leocrm/app/routes/attachments.py

"""Attachment routes — upload (multipart), list, download, delete."""

from __future__ import annotations

import os
import uuid

from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status
from fastapi.responses import FileResponse
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.db import get_db
from app.deps import require_permission
from app.services import attachment_service

router = APIRouter(prefix="/api/v1/attachments", tags=["attachments"])


@router.post("", status_code=status.HTTP_201_CREATED)
async def upload_attachment(
    file: UploadFile = File(...),
    entity_type: str = Form(...),
    entity_id: str = Form(...),
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("attachments:write")),
):
    """Upload a file attachment. Multipart form data."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    user_id = uuid.UUID(current_user["user_id"])


    try:
        eid = uuid.UUID(entity_id)
    except ValueError:
        raise HTTPException(400, detail={"detail": "Invalid entity_id", "code": "invalid_id"}) from None

    file_content = await file.read()
    mime_type = file.content_type or "application/octet-stream"

    return await attachment_service.save_attachment(
        db, tenant_id, user_id, entity_type, eid,
        file.filename or "unknown", file_content, mime_type,
    )


@router.get("")
async def list_attachments(
    entity_type: str,
    entity_id: str,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("attachments:read")),
):
    """List attachments for a specific entity."""
    tenant_id = uuid.UUID(current_user["tenant_id"])

    try:
        eid = uuid.UUID(entity_id)
    except ValueError:
        raise HTTPException(400, detail={"detail": "Invalid entity_id", "code": "invalid_id"}) from None

    return await attachment_service.list_attachments(db, tenant_id, entity_type, eid)


@router.get("/{attachment_id}")
async def download_attachment(
    attachment_id: str,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("attachments:read")),
):
    """Download an attachment file."""
    tenant_id = uuid.UUID(current_user["tenant_id"])

    try:
        aid = uuid.UUID(attachment_id)
    except ValueError:
        raise HTTPException(400, detail={"detail": "Invalid attachment_id", "code": "invalid_id"}) from None

    data = await attachment_service.get_attachment(db, tenant_id, aid)
    if data is None:
        raise HTTPException(404, detail={"detail": "Attachment not found", "code": "not_found"})

    file_path = data["file_path"]
    if not os.path.isfile(file_path):
        raise HTTPException(404, detail={"detail": "File not found on disk", "code": "file_missing"})

    return FileResponse(
        path=file_path,
        filename=data["filename"],
        media_type=data["mime_type"],
    )


@router.delete("/{attachment_id}", status_code=status.HTTP_204_NO_CONTENT)
async def delete_attachment(
    attachment_id: str,
    db: AsyncSession = Depends(get_db),
    current_user: dict = Depends(require_permission("attachments:write")),
):
    """Delete an attachment."""
    tenant_id = uuid.UUID(current_user["tenant_id"])
    user_id = uuid.UUID(current_user["user_id"])


    try:
        aid = uuid.UUID(attachment_id)
    except ValueError:
        raise HTTPException(400, detail={"detail": "Invalid attachment_id", "code": "invalid_id"}) from None

    deleted = await attachment_service.delete_attachment(db, tenant_id, user_id, aid)
    if not deleted:
        raise HTTPException(404, detail={"detail": "Attachment not found", "code": "not_found"})