wijtransferen/backend/internal/media/handler.go

package media

import (
	"context"
	"encoding/json"
	"fmt"
	"mime"
	"net/http"
	"path/filepath"
	"strings"
	"time"

	"github.com/example/sndit/backend/internal/auth"
	"github.com/example/sndit/backend/internal/storage"
	"github.com/google/uuid"
)

const (
	maxUploadSize     = int64(10 << 30)
	uploadURLDuration = 24 * time.Hour
)

type ProcessorQueue interface {
	Enqueue(uuid.UUID)
}

type Handler struct {
	repository *Repository
	storage    storage.Storage
	processor  ProcessorQueue
	auth       *auth.Service
}

func NewHandler(repository *Repository, objectStorage storage.Storage, processor ProcessorQueue, authService *auth.Service) *Handler {
	return &Handler{repository: repository, storage: objectStorage, processor: processor, auth: authService}
}

func (h *Handler) RegisterRoutes(mux *http.ServeMux, require func(http.Handler) http.Handler) {
	mux.Handle("GET /api/galleries/{id}/media", require(http.HandlerFunc(h.List)))
	mux.Handle("POST /api/galleries/{id}/uploads", require(http.HandlerFunc(h.CreateUpload)))
	mux.Handle("POST /api/uploads/{id}/complete", require(http.HandlerFunc(h.CompleteUpload)))
	mux.Handle("PATCH /api/media/{id}", require(http.HandlerFunc(h.Update)))
	mux.Handle("POST /api/media/{id}/download", require(http.HandlerFunc(h.Download)))
	mux.Handle("DELETE /api/uploads/{id}", require(http.HandlerFunc(h.Delete)))
	mux.Handle("DELETE /api/media/{id}", require(http.HandlerFunc(h.Delete)))
}

type uploadRequest struct {
	Filename string `json:"filename"`
	MimeType string `json:"mimeType"`
	FileSize int64  `json:"fileSize"`
}

type updateRequest struct {
	SortOrder *int `json:"sortOrder"`
}

func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	galleryID, err := parseID(r.PathValue("id"))
	if err != nil {
		writeError(w, http.StatusBadRequest, "invalid gallery id")
		return
	}
	belongs, err := h.repository.GalleryBelongsToUser(r.Context(), galleryID, user.ID)
	if err != nil || !belongs {
		writeError(w, http.StatusNotFound, "gallery not found")
		return
	}
	items, err := h.repository.ListByGallery(r.Context(), galleryID)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not load media")
		return
	}
	views := make([]Public, 0, len(items))
	for _, item := range items {
		view, err := h.view(r.Context(), item, true)
		if err != nil {
			writeError(w, http.StatusInternalServerError, "could not sign media URLs")
			return
		}
		views = append(views, view)
	}
	writeJSON(w, http.StatusOK, map[string]any{"media": views})
}

func (h *Handler) CreateUpload(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	galleryID, err := parseID(r.PathValue("id"))
	if err != nil {
		writeError(w, http.StatusBadRequest, "invalid gallery id")
		return
	}
	belongs, err := h.repository.GalleryBelongsToUser(r.Context(), galleryID, user.ID)
	if err != nil || !belongs {
		writeError(w, http.StatusNotFound, "gallery not found")
		return
	}
	var request uploadRequest
	if !decodeJSON(w, r, &request) {
		return
	}
	filename := safeFilename(request.Filename)
	mimeType := strings.ToLower(strings.TrimSpace(request.MimeType))
	if mimeType == "" {
		mimeType = mime.TypeByExtension(filepath.Ext(filename))
	}
	if filename == "" || len(filename) > 255 || !allowedMimeType(mimeType) {
		writeError(w, http.StatusBadRequest, "unsupported media file")
		return
	}
	if request.FileSize <= 0 || request.FileSize > maxUploadSize {
		writeError(w, http.StatusBadRequest, "file size must be between 1 byte and 10 GB")
		return
	}
	mediaID := uuid.New()
	storageKey := fmt.Sprintf("galleries/%s/%s/original/%s", galleryID, mediaID, filename)
	item, err := h.repository.Create(r.Context(), galleryID, mediaID, filename, mimeType, request.FileSize, storageKey)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not create upload")
		return
	}
	uploadURL, err := h.storage.CreateUploadURL(r.Context(), storageKey, mimeType, uploadURLDuration)
	if err != nil {
		_, _ = h.repository.Delete(r.Context(), user.ID, mediaID)
		writeError(w, http.StatusInternalServerError, "could not create upload URL")
		return
	}
	writeJSON(w, http.StatusCreated, map[string]any{
		"uploadId":  mediaID.String(),
		"uploadUrl": uploadURL,
		"media":     publicFromRecord(item),
	})
}

func (h *Handler) CompleteUpload(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	mediaID, err := parseID(r.PathValue("id"))
	if err != nil {
		writeError(w, http.StatusBadRequest, "invalid media id")
		return
	}
	item, err := h.repository.GetForUser(r.Context(), user.ID, mediaID)
	if err != nil {
		writeError(w, http.StatusNotFound, "media not found")
		return
	}
	info, err := h.storage.Stat(r.Context(), item.StorageKey)
	if err != nil {
		writeError(w, http.StatusBadRequest, "uploaded object is not available yet")
		return
	}
	item, err = h.repository.Complete(r.Context(), user.ID, mediaID, info.Size)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not complete upload")
		return
	}
	h.processor.Enqueue(item.ID)
	writeJSON(w, http.StatusOK, map[string]any{"media": publicFromRecord(item)})
}

func (h *Handler) Update(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	mediaID, err := parseID(r.PathValue("id"))
	if err != nil {
		writeError(w, http.StatusBadRequest, "invalid media id")
		return
	}
	var request updateRequest
	if !decodeJSON(w, r, &request) {
		return
	}
	if request.SortOrder == nil || *request.SortOrder < 0 {
		writeError(w, http.StatusBadRequest, "sort order must be zero or greater")
		return
	}
	if err := h.repository.UpdateSortOrder(r.Context(), user.ID, mediaID, *request.SortOrder); err != nil {
		writeError(w, http.StatusNotFound, "media not found")
		return
	}
	item, _ := h.repository.GetForUser(r.Context(), user.ID, mediaID)
	view, err := h.view(r.Context(), item, true)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "could not sign media URL")
		return
	}
	writeJSON(w, http.StatusOK, map[string]any{"media": view})
}

func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	mediaID, err := parseID(r.PathValue("id"))
	if err != nil {
		writeError(w, http.StatusBadRequest, "invalid media id")
		return
	}
	item, err := h.repository.Delete(r.Context(), user.ID, mediaID)
	if err != nil {
		writeError(w, http.StatusNotFound, "media not found")
		return
	}
	for _, key := range []string{item.StorageKey, item.PreviewKey, item.ThumbnailKey} {
		if key != "" && key != item.ExternalURL {
			_ = h.storage.Delete(r.Context(), key)
		}
	}
	w.WriteHeader(http.StatusNoContent)
}

func (h *Handler) Download(w http.ResponseWriter, r *http.Request) {
	user, ok := auth.UserFromContext(r.Context())
	if !ok {
		writeError(w, http.StatusUnauthorized, "authentication required")
		return
	}
	mediaID, err := parseID(r.PathValue("id"))
	if err != nil {
		writeError(w, http.StatusBadRequest, "invalid media id")
		return
	}
	item, err := h.repository.GetForUser(r.Context(), user.ID, mediaID)
	if err != nil || item.ProcessingStatus != StatusReady {
		writeError(w, http.StatusNotFound, "media not found")
		return
	}
	url := item.ExternalURL
	if url == "" {
		url, err = h.storage.CreateDownloadURL(r.Context(), item.StorageKey, time.Hour)
		if err != nil {
			writeError(w, http.StatusInternalServerError, "could not create download")
			return
		}
	}
	_ = h.repository.RecordDownload(r.Context(), item.GalleryID, &item.ID, user.ID.String())
	writeJSON(w, http.StatusOK, map[string]string{"url": url})
}

func (h *Handler) view(ctx context.Context, item Record, includeOriginal bool) (Public, error) {
	view := publicFromRecord(item)
	if item.ProcessingStatus != StatusReady {
		return view, nil
	}
	if item.ExternalURL != "" {
		view.ThumbnailURL = item.ExternalURL
		view.PreviewURL = item.ExternalURL
		if includeOriginal {
			view.OriginalURL = item.ExternalURL
		}
		return view, nil
	}
	previewKey := item.PreviewKey
	if previewKey == "" {
		previewKey = item.StorageKey
	}
	thumbnailKey := item.ThumbnailKey
	if thumbnailKey == "" {
		thumbnailKey = previewKey
	}
	var err error
	view.ThumbnailURL, err = h.storage.CreateDownloadURL(ctx, thumbnailKey, time.Hour)
	if err != nil {
		return Public{}, err
	}
	view.PreviewURL, err = h.storage.CreateDownloadURL(ctx, previewKey, time.Hour)
	if err != nil {
		return Public{}, err
	}
	if includeOriginal {
		view.OriginalURL, err = h.storage.CreateDownloadURL(ctx, item.StorageKey, time.Hour)
		if err != nil {
			return Public{}, err
		}
	}
	return view, nil
}

func publicFromRecord(item Record) Public {
	return Public{
		ID:               item.ID,
		OriginalFilename: item.OriginalFilename,
		MimeType:         item.MimeType,
		FileSize:         item.FileSize,
		ProcessingStatus: item.ProcessingStatus,
		Width:            item.Width,
		Height:           item.Height,
		DurationSeconds:  item.DurationSeconds,
		SortOrder:        item.SortOrder,
	}
}

func allowedMimeType(value string) bool {
	switch value {
	case "image/jpeg", "image/png", "image/webp", "image/heic", "image/heif", "video/mp4", "video/quicktime", "video/webm":
		return true
	default:
		return false
	}
}

func safeFilename(value string) string {
	value = strings.ReplaceAll(value, "\\", "/")
	value = filepath.Base(value)
	if value == "." || value == ".." {
		return ""
	}
	return strings.TrimSpace(value)
}

func parseID(value string) (uuid.UUID, error) {
	return uuid.Parse(value)
}

func decodeJSON(w http.ResponseWriter, r *http.Request, target any) bool {
	if !strings.HasPrefix(r.Header.Get("Content-Type"), "application/json") {
		writeError(w, http.StatusUnsupportedMediaType, "content type must be application/json")
		return false
	}
	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(target); err != nil {
		writeError(w, http.StatusBadRequest, "invalid JSON body")
		return false
	}
	return true
}

func writeError(w http.ResponseWriter, status int, message string) {
	writeJSON(w, status, map[string]string{"error": message})
}

func writeJSON(w http.ResponseWriter, status int, value any) {
	w.Header().Set("Content-Type", "application/json; charset=utf-8")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(value)
}