// POST /cms/admin/media — upload an image (author+). Two ways in, since the
// platform fix (F-026):
//   1. JSON:      { name, content_type, data_base64 }
//   2. RAW BINARY: Content-Type: image/png, body = the bytes, ?name=file.png
//      (the platform hands a non-JSON binary body to the script as base64).
// SVG is rejected (it can carry scripts -> stored XSS).
import "auth" as auth;
let g = auth::guard(ctx, ["admin", "author"]);
if !g.ok { return g.response; }

let allowed = ["image/png", "image/jpeg", "image/gif", "image/webp"];
let name = ();
let content_type = ();
let bytes = ();

let b = ctx.request.body;
if type_of(b) == "map" {
    // (1) JSON path
    if b.data_base64 == () || b.name == () || b.content_type == () {
        return #{ statusCode: 400, body: #{ error: "name, content_type, data_base64 required" } };
    }
    name = b.name;
    content_type = b.content_type;
    bytes = base64::decode(b.data_base64);
} else if type_of(b) == "string" {
    // (2) raw binary path — body is the platform's base64 of the raw bytes
    let ct = ctx.request.headers["content-type"];
    if ct == () { return #{ statusCode: 400, body: #{ error: "content-type header required" } }; }
    content_type = ct;
    name = ctx.request.query["name"];
    if name == () { name = "upload"; }
    bytes = base64::decode(b);
} else {
    return #{ statusCode: 400, body: #{ error: "empty body" } };
}

if !allowed.contains(content_type) {
    return #{ statusCode: 415, body: #{ error: "unsupported content_type (images only, no svg)" } };
}

let media = files::collection("media");
let id = media.create(#{ name: name, content_type: content_type, data: bytes });
#{ statusCode: 201, body: #{ id: id, name: name, content_type: content_type, size: bytes.len() } }