package api

import (
	"net/http"

	"github.com/go-chi/chi/v5"

	"palette/internal/store"
)

// burnViewerWindow returns the admin-tunable per-viewer dedupe window
// (#40), falling back to the 15-minute default from #49.
func (a *apiServer) burnViewerWindow() int {
	if a.settings != nil {
		if m := a.settings.get().BurnViewerWindowMinutes; m > 0 {
			return m
		}
	}
	return 15
}

// handleRedeemDeletion lets a holder of the deletion token hard-delete immediately.
// DELETE /api/pastes/{id}/redeem with the token in the Authorization header
// (#143: the ?token= query path was removed so the secret stays out of
// access logs and browser history).
func (a *apiServer) handleRedeemDeletion(w http.ResponseWriter, r *http.Request) {
	id := chi.URLParam(r, "id")
	token := deletionAuthorization(r)
	if token == "" {
		writeErr(w, 400, "token required")
		return
	}
	row, err := a.store.GetPaste(id)
	if err != nil || row == nil {
		writeErr(w, 404, "paste not found")
		return
	}
	if row.DeletionToken.String == "" || !store.DeletionTokenEqual(row.DeletionToken.String, token) {
		writeErr(w, 403, "invalid token")
		return
	}
	// hard delete: pastes table row goes away entirely
	a.store.HardDelete(row.ID)
	writeJSON(w, 200, map[string]string{"status": "deleted"})
}