import path from "path";

export function getUploadDir(): string {
  return process.env.UPLOAD_DIR || path.join(process.cwd(), "uploads");
}

export function isSafeFilename(filename: string): boolean {
  if (!filename) return false;
  if (filename.includes("..")) return false;
  if (filename.includes("/") || filename.includes("\\")) return false;
  return true;
}

export function resolveUploadPath(filename: string): string {
  const uploadDir = getUploadDir();
  const filePath = path.resolve(uploadDir, filename);
  const normalizedUploadDir = path.resolve(uploadDir) + path.sep;
  if (!filePath.startsWith(normalizedUploadDir)) {
    throw new Error("Invalid filename");
  }
  return filePath;
}
