import type { SupabaseClient } from '@supabase/supabase-js'
import { fileTypeFromBuffer } from 'file-type'

export type EvidenceStage = 'report' | 'response' | 'investigation' | 'capa' | 'verification'

const ALLOWED_MIME_TYPES = new Set([
  'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/heic', 'image/avif',
  'video/mp4', 'video/quicktime', 'video/webm', 'video/x-msvideo',
  'application/pdf',
  'application/msword',
  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
  'application/vnd.ms-excel',
  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
])

export async function uploadEvidenceFile(
  supabase: SupabaseClient,
  file: File,
  incidentId: string,
  stage: EvidenceStage,
): Promise<{ path: string; publicUrl: string; hash: string }> {
  const { data, error: authError } = await supabase.auth.getUser()
  if (authError || !data?.user) throw new Error('Not authenticated')
  const user = data.user

  // Server-side size limit before processing
  const isVideo = file.type.startsWith('video/')
  const maxBytes = isVideo ? 200 * 1024 * 1024 : 10 * 1024 * 1024
  if (file.size > maxBytes) {
    throw new Error(`File too large: max ${isVideo ? '200MB' : '10MB'} for this file type`)
  }

  // Magic-byte validation — do not trust client-supplied MIME type
  const buffer = await file.arrayBuffer()
  const detected = await fileTypeFromBuffer(buffer)
  const detectedMime = detected?.mime ?? null
  if (!detectedMime || !ALLOWED_MIME_TYPES.has(detectedMime)) {
    throw new Error(`File type not allowed: ${detectedMime ?? 'unknown'}`)
  }

  const ext = detected?.ext ?? file.name.split('.').pop() ?? 'bin'
  const filename = `${Date.now()}-${Math.random().toString(36).slice(2)}.${ext}`
  const path = `${user.id}/${incidentId}/${stage}/${filename}`

  const hash = await computeHashFromBuffer(buffer)

  const { data: uploadData, error } = await supabase.storage
    .from('evidence')
    .upload(path, buffer, { contentType: detectedMime, upsert: false })

  if (error) throw new Error(error.message)

  // Fix 1: Use createSignedUrl (private bucket) — 10-year URL for DB storage
  const { data: signedData, error: signedError } = await supabase.storage
    .from('evidence')
    .createSignedUrl(uploadData.path, 315360000) // ~10 years
  if (signedError || !signedData) throw new Error(signedError?.message ?? 'Failed to sign URL')

  return { path: uploadData.path, publicUrl: signedData.signedUrl, hash }
}

// Fix 1: getEvidenceUrl is now async, uses 1-hour signed URL
export async function getEvidenceUrl(supabase: SupabaseClient, path: string): Promise<string> {
  const { data, error } = await supabase.storage.from('evidence').createSignedUrl(path, 3600)
  if (error || !data) throw new Error(error?.message ?? 'Failed to sign URL')
  return data.signedUrl
}

async function computeHashFromBuffer(buffer: ArrayBuffer): Promise<string> {
  const hashBuffer = await crypto.subtle.digest('SHA-256', buffer)
  return Array.from(new Uint8Array(hashBuffer))
    .map(b => b.toString(16).padStart(2, '0'))
    .join('')
}