import { NextResponse } from 'next/server';
import { readUpload } from '@/lib/account/uploads';

export const dynamic = 'force-dynamic';

/** Serves member uploads. Avatars and photos of public collections are public; ids are unguessable (100-bit). */
export async function GET(_req: Request, ctx: { params: Promise<{ id: string }> }) {
  const { id } = await ctx.params;
  if (!/^img_[0-9a-z]{20}$/.test(id)) return new NextResponse('Not found', { status: 404 });
  const up = await readUpload(id);
  if (!up) return new NextResponse('Not found', { status: 404 });
  return new NextResponse(new Uint8Array(up.buf), { headers: { 'content-type': up.mime, 'cache-control': 'public, max-age=31536000, immutable', 'x-content-type-options': 'nosniff' } });
}