/* ---------------------------------------------------------------------------
 * Event photo uploads.
 *
 * Files are written outside the build output (so they survive redeploys) and
 * served back through the /uploads/[file] route. Path defaults to
 * <cwd>/data/uploads; override with BIFROST_UPLOAD_DIR on the VPS.
 *
 * Scope: admin-only event photos (see SPEC §8 exception). Participants cannot
 * upload.
 * ------------------------------------------------------------------------- */

import { join } from 'node:path';

export const UPLOAD_DIR =
  process.env.BIFROST_UPLOAD_DIR ?? join(process.cwd(), 'data', 'uploads');

/** Accepted MIME types → file extension. */
export const ALLOWED_IMAGE_TYPES = new Map<string, string>([
  ['image/png', 'png'],
  ['image/jpeg', 'jpg'],
]);

export const MAX_UPLOAD_BYTES = 5 * 1024 * 1024; // 5 MB

/** Guards the served filename against path traversal. */
export function isSafeUploadName(name: string): boolean {
  return /^[a-z0-9][a-z0-9._-]*$/i.test(name) && !name.includes('..');
}

/** Content-type for a stored upload, by extension. */
export const UPLOAD_CONTENT_TYPES: Record<string, string> = {
  '.png': 'image/png',
  '.jpg': 'image/jpeg',
  '.jpeg': 'image/jpeg',
};
