<?php

declare(strict_types=1);

/**
 * SPDX-FileCopyrightText: 2026 HtmlViewer / patch by Hermes Agent
 * SPDX-License-Identifier: AGPL-3.0-or-later
 *
 * Streams the raw HTML file for the DirectEditing sandbox iframe.
 * Authenticated via the user session (direct editing keeps a session).
 */

namespace OCA\HtmlViewer\Controller;

use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
use OCP\AppFramework\Http\DataDisplayResponse;
use OCP\AppFramework\Http\NotFoundResponse;
use OCP\Files\File;
use OCP\Files\IRootFolder;
use OCP\IRequest;
use OCP\IUserSession;

class DirectController extends Controller {

	public function __construct(
		string $appName,
		IRequest $request,
		private IRootFolder $rootFolder,
		private IUserSession $userSession,
	) {
		parent::__construct($appName, $request);
	}

	#[NoAdminRequired]
	#[NoCSRFRequired]
	public function content(int $fileId) {
		$user = $this->userSession->getUser();
		if ($user === null) {
			return new NotFoundResponse();
		}

		$userFolder = $this->rootFolder->getUserFolder($user->getUID());
		$nodes = $userFolder->getById($fileId);
		if (empty($nodes)) {
			return new NotFoundResponse();
		}
		$file = array_shift($nodes);
		if (!$file instanceof File) {
			return new NotFoundResponse();
		}

		$response = new DataDisplayResponse($file->getContent());
		$response->addHeader('Content-Type', 'text/html; charset=utf-8');
		return $response;
	}
}