File Upload API

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3"
import { getSignedUrl } from "@aws-sdk/s3-request-presigner"

const s3Client = new S3Client({
  region: "auto",
  endpoint: process.env.R2_ENDPOINT as string,
  credentials: {
    accessKeyId: process.env.R2_ACCESS_KEY_ID as string,
    secretAccessKey: process.env.R2_SECRET_ACCESS_KEY as string,
  },
})

export async function POST(request: NextRequest) {
  const body = await request.json()
  const { submissionId, activityName, files, folderName } = body

  if (!submissionId || !activityName || !files || !Array.isArray(files) || !folderName) {
    return Response.json(
      { error: 'Missing submissionId, activityName, files, or folderName' },
      { status: 400 }
    )
  }

  const uploadUrls = []

  for (const file of files) {
    const cleanActivityName = activityName.trim().replace(/\s+/g, '_')
    const bucketPrefix = `${folderName}/`
    const key = `${bucketPrefix}${submissionId}_${cleanActivityName}/${file.name}`

    const command = new PutObjectCommand({
      Bucket: process.env.R2_BUCKET_NAME as string,
      Key: key,
      ContentType: file.type,
    })

    const url = await getSignedUrl(s3Client, command, { expiresIn: 600 })

    uploadUrls.push({ url, key, filename: file.name })
  }

  return Response.json({ uploadUrls })
}

// Uses Next.js Pages Router format
export default async function handler(
  req: NextApiRequest,
  res: NextApiResponse<ResponsePayload>
) {
  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' })
  }

  const { submissionId, eventName, files, directoryName } = req.body

  const cleanEventName = eventName.trim().replace(/\s+/g, '_')
  const bucketPrefix = `${process.env.R2_BUCKET_PREFIX}${directoryName}/`
  const key = `${bucketPrefix}${submissionId}_${cleanEventName}/${file.name}`
  
  // ... rest of implementation similar to community seva endpoint
}

async function uploadFile(uploadUrl, file) {
  const response = await fetch(uploadUrl.url, {
    method: 'PUT',
    body: file,
    headers: {
      'Content-Type': file.type,
    },
  })

  if (!response.ok) {
    throw new Error(`Upload failed: ${response.statusText}`)
  }

  return uploadUrl.key
}

// Usage
const files = document.querySelector('input[type="file"]').files
const fileMetadata = Array.from(files).map(f => ({
  name: f.name,
  type: f.type
}))

// Step 1: Get pre-signed URLs
const response = await fetch('/api/generate-cs-personal-submision-upload-urls', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    submissionId: 'cs-12345',
    activityName: 'Cleanliness Drive',
    folderName: 'community-seva',
    files: fileMetadata
  })
})

const { uploadUrls } = await response.json()

// Step 2: Upload files
for (let i = 0; i < files.length; i++) {
  await uploadFile(uploadUrls[i], files[i])
}

const ALLOWED_DOMAINS = [
  'cdn.njrajatmahotsav.com',
  'imagedelivery.net',
]

const MAX_FILE_SIZE = 10 * 1024 * 1024 // 10MB

function isUrlAllowed(urlString: string): boolean {
  const url = new URL(urlString)
  
  if (url.protocol !== 'https:') return false
  
  const hostname = url.hostname.toLowerCase()
  const isAllowed = ALLOWED_DOMAINS.some(domain =>
    hostname === domain || hostname.endsWith(`.${domain}`)
  )
  
  if (!isAllowed) return false
  
  // Block private IPs
  const privateIpPatterns = [
    /^127\./, /^10\./, /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
    /^192\.168\./, /^localhost$/i, /^::1$/, /^fe80:/i,
  ]
  
  return !privateIpPatterns.some(pattern => pattern.test(hostname))
}

export async function GET(request: NextRequest) {
  const url = request.nextUrl.searchParams.get('url')
  const filename = request.nextUrl.searchParams.get('filename')

  if (!url || !filename) {
    return NextResponse.json({ error: 'Missing parameters' }, { status: 400 })
  }

  if (!isUrlAllowed(url)) {
    return NextResponse.json({ error: 'URL not allowed' }, { status: 403 })
  }

  const sanitizedFilename = filename.replace(/[^a-zA-Z0-9._-]/g, '_')

  const response = await fetch(url, {
    signal: AbortSignal.timeout(10000),
  })

  if (!response.ok) {
    return NextResponse.json({ error: 'Failed to fetch file' }, { status: response.status })
  }

  const contentLength = response.headers.get('content-length')
  if (contentLength && parseInt(contentLength) > MAX_FILE_SIZE) {
    return NextResponse.json({ error: 'File too large' }, { status: 413 })
  }

  const blob = await response.blob()

  if (blob.size > MAX_FILE_SIZE) {
    return NextResponse.json({ error: 'File too large' }, { status: 413 })
  }

  return new NextResponse(blob, {
    headers: {
      'Content-Disposition': `attachment; filename="${sanitizedFilename}"`,
      'Content-Type': response.headers.get('Content-Type') || 'application/octet-stream',
    },
  })
}

{
  "error": "Missing parameters"
}