using MediaBrowser.Common.Configuration;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;

namespace Jellyfin.Plugin.AutoBackup.Controllers;

[ApiController]
[Authorize(Policy = "RequiresElevation")]
[Route("AutoBackup")]
public class BackupManagementController : ControllerBase
{
    private readonly IApplicationPaths _appPaths;
    private readonly ILogger<BackupManagementController> _logger;

    public BackupManagementController(IApplicationPaths appPaths, ILoggerFactory loggerFactory)
    {
        _appPaths = appPaths;
        _logger   = loggerFactory.CreateLogger<BackupManagementController>();
    }

    [HttpDelete("Backup/{filename}")]
    public IActionResult DeleteBackup([FromRoute] string filename)
    {
        // Only allow jellyfin-backup-*.zip filenames — no path traversal
        if (!System.Text.RegularExpressions.Regex.IsMatch(filename, @"^jellyfin-backup-[\w\-]+\.zip$"))
            return BadRequest("Invalid filename.");

        var path = Path.Combine(_appPaths.DataPath, "backups", filename);
        if (!System.IO.File.Exists(path))
            return NotFound();

        System.IO.File.Delete(path);
        _logger.LogInformation("[AutoBackup] Deleted backup: {File}", path);
        return NoContent();
    }
}