import express from 'express';
import passport from 'passport';
import { wrapAsync } from '@/api/http/request';
import * as file from '@/api/controllers/file.controller';

const router = express.Router();

// Authentication required (Workstream 3 §3.5 / WS5): downloads serve files by
// path, so an unauthenticated endpoint would leak private files. Download also
// enforces a per-file tenant/ownership check in the controller (a user may only
// fetch a file owned by their own organization unless they have global access).
router.get(
  '/download',
  passport.authenticate('jwt', { session: false }),
  wrapAsync(file.download),
);

router.post(
  '/upload/:table/:field',
  passport.authenticate('jwt', { session: false }),
  file.upload,
);

export default router;
