import { NextRequest, NextResponse } from 'next/server'
import { getSessionUser, unauthorized, forbidden } from '@/lib/sessionUser'
import { writeFile, mkdir } from 'fs/promises'
import { join, extname } from 'path'

const MAX_SIZE = 20 * 1024 * 1024 // 20 MB

export async function POST(req: NextRequest) {
  const u = await getSessionUser()
  if (!u) return unauthorized()
  if (!u.canEdit) return forbidden()

  const formData = await req.formData()
  const file = formData.get('file') as File | null
  if (!file) return NextResponse.json({ error: 'No se recibió archivo' }, { status: 400 })
  if (file.size > MAX_SIZE) return NextResponse.json({ error: 'Archivo demasiado grande (máx 20 MB)' }, { status: 400 })

  const bytes = await file.arrayBuffer()
  const buffer = Buffer.from(bytes)

  const ext = extname(file.name).toLowerCase()
  const safeName = `${Date.now()}-${Math.random().toString(36).slice(2)}${ext}`
  const uploadDir = join(process.cwd(), 'public', 'uploads')

  await mkdir(uploadDir, { recursive: true })
  await writeFile(join(uploadDir, safeName), buffer)

  return NextResponse.json({ url: `/uploads/${safeName}`, name: file.name, size: file.size })
}