package modules

import (
	"bytes"
	"path"
	"strings"
)

// maxPreviewSize bounds how large an image the blob view will render inline.
// Past it the view keeps the download link but drops the preview, so a large
// file is not pulled over the wire twice (once as the page's subresource,
// once as the bytes the reader actually wanted). The /raw/ route itself is
// not capped here: a direct request is an explicit request for the bytes,
// and MaxGit still bounds every git read.
const maxPreviewSize = 2 << 20 // 2 MiB

// imageContentType returns the MIME type to serve at p when its leading
// bytes are that format and the extension agrees, and "" otherwise.
//
// SECURITY: this is the one place /raw/ is allowed to declare a non-text
// Content-Type, so the rules are deliberately narrow:
//   - only raster formats are recognised. SVG is an XML document that can
//     carry <script>, so it is never in this list and keeps the text/plain
//     fallback; the danger is top-level navigation to an image/svg+xml
//     response on this origin, not <img>, where scripts do not run.
//   - the extension and the magic bytes must BOTH match, so an .png whose
//     contents are really HTML is not relabelled as an image. Relaxing the
//     current attachment rule for attacker-influenced bytes is only safe
//     because a mislabelled file fails here and keeps the download.
//   - the caller still sends X-Content-Type-Options: nosniff and the
//     sandbox CSP, so even a polyglot declared image/* cannot be re-sniffed
//     as a document.
func imageContentType(p string, data []byte) string {
	switch strings.ToLower(path.Ext(p)) {
	case ".png":
		if bytes.HasPrefix(data, []byte("\x89PNG\r\n\x1a\n")) {
			return "image/png"
		}
	case ".jpg", ".jpeg":
		if bytes.HasPrefix(data, []byte("\xff\xd8\xff")) {
			return "image/jpeg"
		}
	case ".gif":
		if bytes.HasPrefix(data, []byte("GIF87a")) || bytes.HasPrefix(data, []byte("GIF89a")) {
			return "image/gif"
		}
	case ".webp":
		if len(data) >= 12 && bytes.Equal(data[:4], []byte("RIFF")) &&
			bytes.Equal(data[8:12], []byte("WEBP")) {
			return "image/webp"
		}
	case ".bmp":
		if bytes.HasPrefix(data, []byte("BM")) {
			return "image/bmp"
		}
	case ".ico":
		if bytes.HasPrefix(data, []byte("\x00\x00\x01\x00")) {
			return "image/x-icon"
		}
	case ".avif":
		// ISO-BMFF: "ftyp" at offset 4, major brand avif/avis at 8. A file
		// with a compatible-but-not-major avif brand is left unlabelled
		// rather than guessed at.
		if len(data) >= 12 && bytes.Equal(data[4:8], []byte("ftyp")) &&
			(bytes.Equal(data[8:12], []byte("avif")) || bytes.Equal(data[8:12], []byte("avis"))) {
			return "image/avif"
		}
	}
	return ""
}