# workspace_file.dspy - 提供工作空间文件（媒体流 / 下载）

import os
from urllib.parse import quote
from aiohttp.web_fileresponse import FileResponse

file_id = (params_kw or {}).get('id', '').strip()
download = (params_kw or {}).get('download', '').strip()

uid = await get_user()
if not uid:
    uid = 'user-01'

dbname = get_module_dbname('pipeline-sdlc')
workspace_base = '/d/pipeline/workspaces'

async with DBPools().sqlorContext(dbname) as sor:
    recs = await sor.sqlExe(
        "SELECT current_project_id FROM pipeline_agent_settings WHERE user_id=${u}$", {"u": uid})
    pid = getattr(recs[0], 'current_project_id', '') if recs else ''
    ws_dir = ''
    if pid:
        proj = await sor.sqlExe("SELECT name, org_id, workspace_dir FROM sd_projects WHERE id=${p}$", {"p": pid})
        if proj:
            ws = getattr(proj[0], 'workspace_dir', '') or ''
            if ws.startswith('/'):
                ws_dir = ws
            else:
                pname = getattr(proj[0], 'name', '')
                org_id = getattr(proj[0], 'org_id', '0') or '0'
                ws_dir = workspace_base + '/' + org_id + '/' + pname

if not file_id or file_id == '__root__':
    return {"widgettype": "Message", "options": {"title": "错误", "message": "未指定文件"}}

full_path = ws_dir + '/' + file_id if ws_dir else file_id

# 路径穿越校验
real_ws = os.path.realpath(ws_dir)
real_full = os.path.realpath(full_path)
if not real_full.startswith(real_ws + os.sep):
    return {"widgettype": "Message", "options": {"title": "错误", "message": "非法路径"}}

if not os.path.isfile(full_path):
    return {"widgettype": "Message", "options": {"title": "错误", "message": "文件不存在: " + file_id}}

headers = {}
if download:
    filename = os.path.basename(full_path)
    safe_name = quote(filename)
    headers['Content-Disposition'] = 'attachment; filename="%s"; filename*=UTF-8\'\'%s' % (filename, safe_name)

return FileResponse(full_path, headers=headers)