using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace Distribution.Features.Expense;

[ApiController]
public class ExpenseAttachmentController(ExpenseAttachmentService service) : ControllerBase
{
    [HttpPost("api/expenses/{expenseId:guid}/attachments")]
    [Authorize("expense.create")]
    [RequestSizeLimit(10 * 1024 * 1024)]
    public async Task<IActionResult> Upload(Guid expenseId, IFormFile file, CancellationToken ct)
    {
        try
        {
            var result = await service.UploadAsync(expenseId, file, ct);
            return result is null ? NotFound() : Ok(result);
        }
        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
    }

    [HttpGet("api/expense-attachments/{id:guid}/download")]
    [Authorize("expense.view")]
    public async Task<IActionResult> Download(Guid id, CancellationToken ct)
    {
        var result = await service.DownloadAsync(id, ct);
        if (result is null) return NotFound();
        return File(result.Value.Stream, result.Value.ContentType, result.Value.FileName);
    }

    [HttpDelete("api/expense-attachments/{id:guid}")]
    [Authorize("expense.create")]
    public async Task<IActionResult> Delete(Guid id, CancellationToken ct) =>
        await service.DeleteAsync(id, ct) ? NoContent() : NotFound();
}