import { generateFileToken } from '~~/server/utils/file-token';

const FILE_PREFIX = '/api/files/';

// Uploaded avatars are served to signed in people only, and whoever opens an
// invite is not signed in yet. A short-lived signed URL lets them see it.
const publicImage = (image: string | null): string | null => {
    const secret = process.env.BETTER_AUTH_SECRET;

    if (!image || !image.startsWith(FILE_PREFIX) || !secret) return image;

    const { exp, sig } = generateFileToken(image.slice(FILE_PREFIX.length), secret);

    return `${image}?exp=${exp}&sig=${sig}`;
};

/**
 * Tells the register page whether an invite link still works and who it is
 * from. Public on purpose, the person opening the link has no account yet.
 */
export default defineEventHandler(async (event) => {
    const invite = await findUsableInvite(getRouterParam(event, 'token')!);

    if (!invite) {
        return { valid: false as const };
    }

    return {
        valid: true as const,
        expiresAt: invite.expiresAt,
        singleUse: invite.maxUses === 1,
        inviter: {
            id: invite.inviterId,
            name: invite.inviterName,
            image: publicImage(invite.inviterImage),
        },
    };
});