import { NextRequest, NextResponse } from 'next/server';
import { db } from '@/lib/db';

// Public delivery route: TikTok (and other social platforms) pull media from
// these URLs, so GET must stay unauthenticated. IDs are unguessable cuids.

export async function GET(
  _request: NextRequest,
  { params }: { params: { id: string } }
) {
  const id = String(params?.id || '').trim();
  if (!id) {
    return NextResponse.json({ error: 'Asset id is required.' }, { status: 400 });
  }

  try {
    const asset = await db.socialAsset.findUnique({ where: { id } });
    if (!asset) {
      return NextResponse.json({ error: 'Not found' }, { status: 404 });
    }

    return new NextResponse(new Uint8Array(asset.data), {
      status: 200,
      headers: {
        'Content-Type': asset.mimeType,
        'Content-Length': String(asset.data.length),
        'Cache-Control': 'public, max-age=31536000, immutable',
        'Content-Disposition': `inline; filename="${asset.filename.replace(/[^\w.\-]/g, '_')}"`,
      },
    });
  } catch (err) {
    const message = err instanceof Error ? err.message : 'Unknown error';
    return NextResponse.json({ error: message }, { status: 500 });
  }
}

export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const adminKey = process.env.SOCIAL_ASSET_ADMIN_KEY || process.env.TIKTOK_ADMIN_KEY;
  const provided =
    request.headers.get('x-admin-key') || request.nextUrl.searchParams.get('key');
  if (!adminKey || provided !== adminKey) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  const id = String(params?.id || '').trim();
  if (!id) {
    return NextResponse.json({ error: 'Asset id is required.' }, { status: 400 });
  }

  try {
    await db.socialAsset.delete({ where: { id } });
    return NextResponse.json({ deleted: id });
  } catch {
    return NextResponse.json({ error: 'Not found' }, { status: 404 });
  }
}