import { NextRequest } from "next/server";
import fs from "node:fs";
import path from "node:path";

export async function GET(req: NextRequest) {
  const { searchParams } = new URL(req.url);
  const relPath = searchParams.get("path") || "";

  // Permitir apenas caminhos sob data/images para segurança
  const baseDir = path.join(process.cwd(), "data", "images");
  const resolved = path.join(process.cwd(), relPath);
  if (!resolved.startsWith(baseDir)) {
    return new Response("Forbidden", { status: 403 });
  }

  try {
    const file = await fs.promises.readFile(resolved);
    const ext = path.extname(resolved).toLowerCase();
    const contentType =
      ext === ".gif"
        ? "image/gif"
        : ext === ".png"
        ? "image/png"
        : ext === ".webp"
        ? "image/webp"
        : ext === ".jpg" || ext === ".jpeg"
        ? "image/jpeg"
        : "application/octet-stream";
    return new Response(file, { status: 200, headers: { "Content-Type": contentType } });
  } catch {
    return new Response("Not Found", { status: 404 });
  }
}