import express from 'express';
import passport from 'passport';
import { wrapAsync } from '@/api/http/request';
import * as file from '@/api/controllers/file.controller';

const router = express.Router();

// Authentication required: downloads serve files by path, so an unauthenticated
// endpoint would leak private files. Per-file ownership checks were removed by
// customer decision; `assertCanDownloadFile` now enforces JWT-only access.
router.get(
  '/download',
  passport.authenticate('jwt', { session: false }),
  wrapAsync(file.download),
);

router.post(
  '/upload/:table/:field',
  passport.authenticate('jwt', { session: false }),
  file.upload,
);

export default router;
