const express = require('express');
const path = require('path');
const fs = require('fs');
const { getRow } = require('../db');
const { authenticate } = require('../middleware/auth');
const { UPLOAD_DIR } = require('../middleware/upload');

const router = express.Router();

router.get('/:storedName', authenticate, async (req, res) => {
  const att = await getRow('SELECT * FROM attachments WHERE stored_name = ?', [req.params.storedName]);
  if (!att) return res.status(404).json({ error: '文件不存在' });
  const ticket = await getRow('SELECT * FROM tickets WHERE id = ?', [att.ticket_id]);
  if (req.user.role === 'player' && ticket?.user_id !== req.user.id) return res.status(403).json({ error: '无权限' });
  const filePath = path.join(UPLOAD_DIR, att.stored_name);
  if (!fs.existsSync(filePath)) return res.status(404).json({ error: '文件不存在' });
  res.setHeader('Content-Type', att.mime_type);
  res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(att.original_name)}"`);
  res.setHeader('Cache-Control', 'private, max-age=86400');
  fs.createReadStream(filePath).pipe(res);
});

module.exports = router;