NextChair/src/lib/media/media-storage.ts

import { randomUUID } from "node:crypto";
import { mkdir, unlink, writeFile } from "node:fs/promises";
import path from "node:path";

/**
 * Local-disk storage for the Media Manager (see src/services/media) —
 * files live under public/media/<category>/..., served for free by
 * Next's own static file handling for public/ (no custom GET route
 * needed). A deliberate v1 choice for this app's single-container Docker
 * deployment model, not a cloud object-storage integration — see
 * docker-compose.local.yaml's media volume for why this survives a
 * container restart. Swapping to S3-compatible storage later only means
 * changing this one file; every caller only ever sees a public URL.
 *
 * SVG is deliberately not in the allow-list — an uploaded SVG can embed
 * <script>, making it a stored-XSS vector if ever served inline.
 */
const ALLOWED_MIME_EXTENSIONS: Record<string, string> = {
  "image/png": "png",
  "image/jpeg": "jpg",
  "image/webp": "webp",
  "image/gif": "gif",
};

export const MEDIA_MAX_UPLOAD_BYTES = Number(process.env.MEDIA_MAX_UPLOAD_BYTES ?? 5_000_000);

const MEDIA_ROOT = path.join(process.cwd(), "public", "media");
const MEDIA_URL_PREFIX = "/media/";

export function isAllowedMediaMimeType(mimeType: string): boolean {
  return mimeType in ALLOWED_MIME_EXTENSIONS;
}

export interface StoredMediaFile {
  /** Public path — what gets saved on MediaAsset.url and rendered directly. */
  url: string;
}

function sanitizeCategory(category: string): string {
  return category.replace(/[^a-z0-9_-]/gi, "").toLowerCase() || "other";
}

export async function storeMediaFile(params: {
  buffer: Buffer;
  mimeType: string;
  category: string;
}): Promise<StoredMediaFile> {
  const extension = ALLOWED_MIME_EXTENSIONS[params.mimeType];
  if (!extension) throw new Error(`Unsupported media type: ${params.mimeType}`);

  const safeCategory = sanitizeCategory(params.category);
  const filename = `${randomUUID()}.${extension}`;
  const dir = path.join(MEDIA_ROOT, safeCategory);
  await mkdir(dir, { recursive: true });
  await writeFile(path.join(dir, filename), params.buffer);

  return { url: `${MEDIA_URL_PREFIX}${safeCategory}/${filename}` };
}

/** Best-effort — a missing file (already deleted, or a URL that was never ours) never blocks removing the DB row. */
export async function deleteMediaFile(url: string): Promise<void> {
  if (!url.startsWith(MEDIA_URL_PREFIX)) return;
  const relative = url.slice(MEDIA_URL_PREFIX.length);
  const absolutePath = path.join(MEDIA_ROOT, relative);
  // Path-traversal guard — a corrupted/crafted url should never resolve outside MEDIA_ROOT.
  if (!absolutePath.startsWith(MEDIA_ROOT + path.sep)) return;
  await unlink(absolutePath).catch(() => {});
}