gohorsejobs/backend/internal/api/handlers/storage_handler.go

package handlers

import (
	"encoding/json"
	"fmt"
	"net/http"
	"path/filepath"
	"strings"
	"time"

	"github.com/rede5/gohorsejobs/backend/internal/api/middleware"
	"github.com/rede5/gohorsejobs/backend/internal/services"
)

type StorageHandler struct {
	storageService *services.StorageService
}

func NewStorageHandler(s *services.StorageService) *StorageHandler {
	return &StorageHandler{storageService: s}
}

// GetUploadURL returns a pre-signed URL for uploading a file.
// Clients upload directly to this URL.
// Query Params:
// - filename: Original filename
// - contentType: MIME type
// - folder: Optional folder (e.g. 'avatars', 'resumes')
func (h *StorageHandler) GetUploadURL(w http.ResponseWriter, r *http.Request) {
	// Authentication optional (for resumes), but enforced for others
	userIDVal := r.Context().Value(middleware.ContextUserID)
	userID, _ := userIDVal.(string)

	folder := r.URL.Query().Get("folder")
	if folder == "" {
		folder = "uploads"
	}

	// Enforce auth for non-guest folders
	if userID == "" {
		if folder != "resumes" {
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}
		// Generate a guest ID for isolation
		userID = fmt.Sprintf("guest_%d", time.Now().UnixNano())
	}

	filename := r.URL.Query().Get("filename")
	contentType := r.URL.Query().Get("contentType")

	// Validate folder
	validFolders := map[string]bool{"avatars": true, "resumes": true, "logos": true, "uploads": true}
	if !validFolders[folder] {
		http.Error(w, "Invalid folder", http.StatusBadRequest)
		return
	}

	// Generate a unique key
	ext := filepath.Ext(filename)
	if ext == "" {
		// Attempt to guess from contentType if needed, or just allow no ext
	}

	// Key format: {folder}/{userID}/{timestamp}_{random}{ext}
	// Using user ID ensures isolation if needed, or use a UUID.
	key := fmt.Sprintf("%s/%s/%d_%s", folder, userID, time.Now().Unix(), strings.ReplaceAll(filename, " ", "_"))

	url, err := h.storageService.GetPresignedUploadURL(r.Context(), key, contentType)
	if err != nil {
		// If credentials missing, log error and return 500
		// "storage credentials incomplete" might mean admin needs to configure them.
		http.Error(w, "Failed to generate upload URL: "+err.Error(), http.StatusInternalServerError)
		return
	}

	publicURL, err := h.storageService.GetPublicURL(r.Context(), key)
	if err != nil {
		http.Error(w, "Failed to generate public URL: "+err.Error(), http.StatusInternalServerError)
		return
	}

	// Return simple JSON
	resp := map[string]string{
		"url":       url,
		"key":       key,       // Client needs key to save to DB profile
		"publicUrl": publicURL, // Public URL for immediate use
	}

	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(resp)
}

// UploadFile handles direct file uploads via proxy
func (h *StorageHandler) UploadFile(w http.ResponseWriter, r *http.Request) {
	// 1. Parse Multipart Form
	// Max size 5MB
	if err := r.ParseMultipartForm(5 << 20); err != nil {
		http.Error(w, "File too large or invalid form", http.StatusBadRequest)
		return
	}

	file, header, err := r.FormFile("file")
	if err != nil {
		http.Error(w, "File is required", http.StatusBadRequest)
		return
	}
	defer file.Close()

	// 2. Validate Folder/Auth
	userIDVal := r.Context().Value(middleware.ContextUserID)
	userID, _ := userIDVal.(string)

	folder := r.FormValue("folder")
	if folder == "" {
		folder = "uploads"
	}

	validFolders := map[string]bool{"avatars": true, "resumes": true, "logos": true, "uploads": true}
	if !validFolders[folder] {
		http.Error(w, "Invalid folder", http.StatusBadRequest)
		return
	}

	if userID == "" {
		if folder != "resumes" {
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}
		userID = fmt.Sprintf("guest_%d", time.Now().UnixNano())
	}

	// 3. Prepare Upload Path
	filename := header.Filename
	// Clean filename
	filename = strings.ReplaceAll(filename, " ", "_")
	// Use timestamp to avoid collisions
	finalFilename := fmt.Sprintf("%d_%s", time.Now().Unix(), filename)

	// Folder path: folder/userID
	uploadFolder := fmt.Sprintf("%s/%s", folder, userID)

	// Determine Content-Type
	contentType := header.Header.Get("Content-Type")
	if contentType == "" {
		contentType = "application/octet-stream"
	}

	// 4. Upload via Service
	publicURL, err := h.storageService.UploadFile(r.Context(), file, uploadFolder, finalFilename, contentType)
	if err != nil {
		http.Error(w, "Failed to upload file: "+err.Error(), http.StatusInternalServerError)
		return
	}

	// 5. Response
	resp := map[string]string{
		"url":       publicURL, // For proxy, publicURL is the result
		"key":       fmt.Sprintf("%s/%s", uploadFolder, finalFilename),
		"publicUrl": publicURL,
	}

	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(resp)
}