<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use Illuminate\Support\Facades\Storage;
use Symfony\Component\HttpFoundation\BinaryFileResponse;

class MediaController extends Controller
{
    public function avatar(string $filename): BinaryFileResponse
    {
        abort_unless(
            $filename === basename($filename)
            && preg_match('/^[A-Za-z0-9_-]+\.(?:jpe?g|png|webp)$/i', $filename),
            404,
        );

        $path = "avatars/{$filename}";
        abort_unless(Storage::disk('public')->exists($path), 404);

        return response()->file(Storage::disk('public')->path($path), [
            'Cache-Control' => 'public, max-age=86400, immutable',
            'X-Content-Type-Options' => 'nosniff',
        ]);
    }
}