import { hashAPIPath } from "../../../actions/core/hash";
import { deleteBlobRep } from "../../../actions/azurestorage";
import { respondError, respondSuccess } from "../middleware/apiResponse";
import { getServerSession } from "next-auth/next";
import { authOptions } from "../auth/[...nextauth]";

import nextConnect from "next-connect";
import middleware from "../middleware/middleware";

const ApiProxy = nextConnect();
ApiProxy.use(middleware);

const forbidden = (res) =>
    respondError(res, {
        status: 403,
        code: "FORBIDDEN",
        message: "Request not permitted"
    });

const isValidPathSegment = (value) =>
    typeof value === "string" &&
    value.length > 0 &&
    value.length <= 255 &&
    value === value.trim() &&
    value !== "." &&
    value !== ".." &&
    !/[\\/\u0000-\u001f\u007f]/.test(value);

ApiProxy.get(async (req, res) => {
    const containerName = req.query.container;
    const casefolderID = req.query.casefolderID;
    const repfile = req.query.repfile;
    const checkHash = req.query.hash;

    if (
        typeof containerName === "undefined" ||
        containerName.length === 0 ||
        typeof casefolderID === "undefined" ||
        casefolderID.length === 0 ||
        typeof repfile === "undefined" ||
        repfile.length === 0 ||
        typeof checkHash === "undefined" ||
        checkHash.length === 0
    ) {
        return respondError(res, {
            status: 400,
            code: "MISSING_REQUIRED_QUERY",
            message: "container, casefolderID, repfile and hash are required"
        });
    }

    const casefolderIDTrimmed = casefolderID.trim();
    const repfileTrimmed = repfile.trim();

    if (
        !isValidPathSegment(casefolderIDTrimmed) ||
        !isValidPathSegment(repfileTrimmed)
    ) {
        return respondError(res, {
            status: 400,
            code: "INVALID_REQUEST",
            message: "Invalid request"
        });
    }

    const session = await getServerSession(req, res, authOptions(req, res));
    if (
        typeof session?.user?.id !== "string" ||
        session.user.id.length === 0 ||
        session.user.id !== containerName
    ) {
        return forbidden(res);
    }

    const hashCandidatePaths = [
        "/api/file/deleteblobrep?container=" +
            containerName +
            "&casefolderID=" +
            casefolderIDTrimmed +
            "&repfile=" +
            repfileTrimmed,
        "/api/file/deleteblobrep?container=" +
            containerName +
            "&casefolderID=" +
            encodeURIComponent(casefolderIDTrimmed) +
            "&repfile=" +
            repfileTrimmed,
        "/api/file/deleteblobrep?container=" +
            containerName +
            "&casefolderID=" +
            casefolderIDTrimmed +
            "&repfile=" +
            encodeURIComponent(repfileTrimmed),
        "/api/file/deleteblobrep?container=" +
            containerName +
            "&casefolderID=" +
            encodeURIComponent(casefolderIDTrimmed) +
            "&repfile=" +
            encodeURIComponent(repfileTrimmed)
    ];

    const isHashValid = hashCandidatePaths.some(
        (candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
    );

    if (!isHashValid) {
        return respondError(res, {
            status: 400,
            code: "INVALID_HASH",
            message: "Invalid hash"
        });
    }

    try {
        const normalizedRepPath = casefolderIDTrimmed + "/" + repfileTrimmed;
        const data = await deleteBlobRep(containerName, normalizedRepPath);
        return respondSuccess(res, { data: data });
    } catch (error) {
        return respondError(res, {
            status: 400,
            code: "DELETE_BLOB_REP_FAILED",
            message: "Unable to delete blob representation"
        });
    }
});

export const config = {
    api: {
        bodyParser: false
    }
};

export default ApiProxy;