<?php

namespace App\Http\Controllers\Checkout;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;
use Symfony\Component\HttpFoundation\StreamedResponse;

/**
 * Serves a file answer to a product custom field (a cart/order line's
 * meta.custom_fields, see CartController::customFieldsMeta()) from its private
 * disk. Only reachable through a temporary signed URL — generated per render
 * by checkout::partials.line-custom-fields — so disk and path in the query
 * can't be tampered with, and a link stops working once it expires.
 */
class CustomFieldFileController extends Controller
{
    public function __invoke(string $locale, Request $request): StreamedResponse
    {
        $disk = Storage::disk((string) $request->query('disk'));
        $path = (string) $request->query('path');

        abort_unless($disk->exists($path), 404);

        return $disk->response($path, null, ['Cache-Control' => 'private, max-age=3600']);
    }
}