import { promises as fs } from "fs";
import db from "./inc/sql.mjs";
import lib from "./inc/lib.mjs";
import cfg from "./inc/config.mjs";
import { applyWordFilter } from "./inc/wordfilter.mjs";
import queue from "./inc/queue.mjs";
import path from "path";
import https from "https";
import { getManualApproval, getMinTags, getTrustedUploads, getBypassDuplicateCheck, getEnablePdf, getEnableItemSlugs } from "./inc/settings.mjs";
import { parseMultipart, collectBody } from "./inc/multipart.mjs";
import f0cklib from "./inc/routeinc/f0cklib.mjs";
import { calculateExpiresAt } from "./inc/routes/apiv2/upload.mjs";


// Derive archive MIME types from cfg.mimes — any application/* that isn't swf or pdf.
// Adding a new archive type to config.json is sufficient; no code change needed.
const ARCHIVE_MIMES = new Set(
    Object.entries(cfg.mimes)
        .filter(([mime, ext]) => mime.startsWith('application/') && !['swf', 'pdf'].includes(ext))
        .map(([mime]) => mime)
);
const isArchiveMime = (mime) => ARCHIVE_MIMES.has(mime);

const autoTagsFromUrl = (urlString) => {
    const tags = [];
    try {
        const { hostname } = new URL(urlString);
        const host = hostname.replace(/:\d+$/, '').toLowerCase();
        const parts = host.split('.');
        const shortSlds = new Set(['co', 'com', 'net', 'org', 'gov', 'edu', 'ac', 'or', 'ne']);
        let domain;
        if (parts.length >= 3 && shortSlds.has(parts[parts.length - 2])) {
            domain = parts.slice(-3).join('.');
        } else {
            domain = parts.slice(-2).join('.');
        }
        if (/(?:youtube\.com|youtu\.be)$/i.test(domain) || /(?:youtube\.com|youtu\.be)$/i.test(host)) {
            tags.push('youtube');
        }
    } catch (e) {}
    return [...new Set(tags)];
};

// Helper for JSON response
const sendJson = (res, data, code = 200) => {
    res.writeHead(code, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify(data));
};

// One-time migration: add original_filename column if it doesn't exist
db`ALTER TABLE items ADD COLUMN IF NOT EXISTS original_filename text`.catch(() => {});

// One-time migration: restore title column for backwards compatibility with old databases
db`ALTER TABLE items ADD COLUMN IF NOT EXISTS title text`.catch(() => {});

// One-time migration: add width/height columns for image and video dimension storage
db`ALTER TABLE items ADD COLUMN IF NOT EXISTS width integer`.catch(() => {});
db`ALTER TABLE items ADD COLUMN IF NOT EXISTS height integer`.catch(() => {});
db`ALTER TABLE items ADD COLUMN IF NOT EXISTS expires_at bigint DEFAULT NULL`.catch(() => {});


// One-time migration: widen checksum column to varchar(255) for SHA-256 + bypass suffix support
// (old schema had varchar(40), sized for SHA-1 — SHA-256 is 64 chars and bypass suffix adds more)
db`ALTER TABLE items ALTER COLUMN checksum TYPE character varying(255)`.catch(() => {});

// One-time migration: widen dest column to varchar(60) — UUID (32) + dot + extension can exceed 40 chars
db`ALTER TABLE items ALTER COLUMN dest TYPE character varying(60)`.catch(() => {});
db`ALTER TABLE comment_files ALTER COLUMN dest TYPE character varying(60)`.catch(() => {});

// One-time migration: fix NULL visibility values and ensure NOT NULL default going forward
db`UPDATE items SET visibility = 0 WHERE visibility IS NULL`.catch(() => {});
db`ALTER TABLE items ALTER COLUMN visibility SET DEFAULT 0`.catch(() => {});

export const handleUpload = async (req, res, self) => {
    // Manual session lookup is required here because this handler is called from a 
    // bypass middleware that runs in parallel with the main session middleware.
    if (req.cookies?.session) {
        try {
            const user = await db`
                select "user".id, "user".login, "user".user, "user".admin, "user".is_moderator, "user_sessions".id as sess_id, "user_sessions".csrf_token, "user_options".*
                from "user_sessions"
                left join "user" on "user".id = "user_sessions".user_id
                left join "user_options" on "user_options".user_id = "user_sessions".user_id
                where "user_sessions".session = ${lib.sha256(req.cookies.session)}
                limit 1
            `;
            if (user.length > 0) {
                req.session = user[0];
            }
        } catch (err) {
        }
    }

    // Fallback: authenticate via X-Api-Key header (upload-only; no CSRF required)
    if (!req.session && req.headers['x-api-key'] && cfg.websrv.enable_user_api_keys !== false) {
        const key = req.headers['x-api-key'];
        try {
            const rows = await db`
                SELECT u.id, u.user, u.login, u.admin, u.is_moderator, u.banned,
                       uo.*
                FROM user_api_keys k
                JOIN "user" u ON u.id = k.user_id
                LEFT JOIN user_options uo ON uo.user_id = u.id
                WHERE k.api_key = ${key}
                LIMIT 1
            `;
            if (rows.length > 0) {
                if (rows[0].banned) {
                    return sendJson(res, { success: false, msg: 'Account banned' }, 403);
                }
                req.session = { ...rows[0], api_key_auth: true };
            }
        } catch (err) {
            console.error('[UPLOAD] API key lookup error:', err);
        }
    }

    if (!req.session) {
        return sendJson(res, { success: false, msg: 'Unauthorized' }, 401);
    }

    // CSRF validation — required for browser sessions, skipped for API key auth.
    if (!req.session.api_key_auth) {
        const csrfToken = req.headers['x-csrf-token'];
        if (!req.session.csrf_token || !csrfToken || csrfToken !== req.session.csrf_token) {
            return sendJson(res, { success: false, msg: 'Invalid CSRF token' }, 403);
        }
    }

    try {
        const contentType = req.headers['content-type'] || '';
        let parts = {};

        // Determine max file size early for collectBody
        let effectiveMaxBytes = cfg.main.maxfilesize || (150 * 1024 * 1024);
        if (req.session?.admin) {
            effectiveMaxBytes = Math.floor(effectiveMaxBytes * (cfg.main.adminmultiplier || 10));
        }

        let body;
        try {
            body = await collectBody(req, effectiveMaxBytes);
        } catch (bodyErr) {
            throw bodyErr;
        }

        if (contentType.includes('multipart/form-data')) {
            const boundaryMatch = contentType.match(/boundary=(?:"([^"]+)"|([^;]+))/);
            if (!boundaryMatch) {
                return sendJson(res, { success: false, msg: 'Invalid multipart boundary' }, 400);
            }
            const boundary = boundaryMatch[1] || boundaryMatch[2];
            parts = parseMultipart(body, boundary);
        } else if (contentType.includes('application/json')) {
            try {
                parts = JSON.parse(body.toString());
            } catch (e) {
                return sendJson(res, { success: false, msg: 'Invalid JSON body' }, 400);
            }
        } else if (contentType.includes('application/x-www-form-urlencoded')) {
            const params = new URLSearchParams(body.toString());
            for (const [key, value] of params.entries()) {
                parts[key] = value;
            }
        } else {
            return sendJson(res, { success: false, msg: 'Invalid content type' }, 400);
        }

        // Validate required fields
        let file = (typeof parts.file === 'object' && parts.file !== null && parts.file.data) ? parts.file : null;
        let inputUrl = (typeof parts.url === 'string' && parts.url.trim()) ? parts.url.trim() : null;

        if (!inputUrl && typeof parts.file === 'string' && /^https?:\/\//i.test(parts.file.trim())) {
            inputUrl = parts.file.trim();
        }

        if (inputUrl) {
            file = null;
            try {
                const parsed = new URL(inputUrl);
                if (parsed.searchParams.has('igsh')) {
                    parsed.searchParams.delete('igsh');
                    inputUrl = parsed.toString();
                }
            } catch (e) {}
        }

        const rating = parts.rating;
        const tagsRaw = parts.tags;
        const comment = parts.comment ? String(parts.comment).trim() : '';
        const rawTitle = parts.title ? String(parts.title).trim() : '';
        const title = rawTitle.length > 0 ? rawTitle.substring(0, 500) : null;

        const is_oc = (parts.is_oc === true || parts.is_oc === 'true' || parts.is_oc === '1');
        const is_shitpost = (parts.is_shitpost === true || parts.is_shitpost === 'true' || parts.is_shitpost === '1') || cfg.websrv.shitpost_mode === true;

        if (!file && !inputUrl) {
            return sendJson(res, { success: false, msg: 'No file or URL provided' }, 400);
        }

        if (inputUrl && cfg.websrv.web_url_upload === false) {
            return sendJson(res, { success: false, msg: 'URL uploads are disabled' }, 403);
        }

        // Parse visibility: Header 'X-Upload-Visibility' or body field 'visibility' or user default preference
        let targetVisibility = 0;
        if (cfg.enable_private_uploads !== false) {
            const sysDefault = (typeof cfg.default_upload_visibility === 'number')
                ? cfg.default_upload_visibility
                : (typeof cfg.websrv?.default_upload_visibility === 'number' ? cfg.websrv.default_upload_visibility : 0);

            const allowUserOverride = cfg.allow_user_upload_visibility !== false && cfg.websrv?.allow_user_upload_visibility !== false;

            if (!allowUserOverride) {
                targetVisibility = sysDefault;
            } else {
                const rawVisHeader = req.headers['x-upload-visibility'];
                const rawVisBody = parts.visibility;
                const visVal = (rawVisHeader || rawVisBody || '').toString().trim().toLowerCase();

                if (visVal === 'private' || visVal === '2') {
                    targetVisibility = 2;
                } else if (visVal === 'unlisted' || visVal === '1') {
                    targetVisibility = 1;
                } else if (visVal === 'public' || visVal === '0') {
                    targetVisibility = 0;
                } else {
                    targetVisibility = (req.session?.default_upload_visibility !== undefined && req.session?.default_upload_visibility !== null)
                        ? req.session.default_upload_visibility
                        : sysDefault;
                }
            }
        }

        const rawExpiry = req.headers['x-upload-expiry'] || parts.expiry || parts.expires_at;
        const nowStamp = ~~(Date.now() / 1000);
        const targetExpiresAt = calculateExpiresAt(rawExpiry, nowStamp);

        // Always generate a unique item slug for the database
        const itemSlug = lib.generateSlug(11);

        const maxLen = cfg.main.comment_max_length;
        if (comment && maxLen !== null && maxLen !== undefined && comment.length > maxLen) {
            return sendJson(res, { success: false, msg: `Comment too long (max ${maxLen} characters)` }, 400);
        }

        const effectiveRating = (rating && ['sfw', 'nsfw', 'nsfl'].includes(rating)) ? rating : null;

        if (!is_shitpost && !effectiveRating) {
            return sendJson(res, { success: false, msg: 'Rating (sfw/nsfw/nsfl) is required' }, 400);
        }

        if (is_shitpost && cfg.websrv.shitpost_require_rating === true && !effectiveRating) {
            return sendJson(res, { success: false, msg: 'Rating (sfw/nsfw/nsfl) is required for each item' }, 400);
        }

        if (effectiveRating === 'nsfl' && !cfg.enable_nsfl) {
            return sendJson(res, { success: false, msg: 'NSFL mode is currently disabled' }, 400);
        }

        const userTags = tagsRaw ? String(tagsRaw).split(',').map(t => t.trim()).filter(t => t.length > 0 && !['sfw', 'nsfw', 'nsfl'].includes(t.toLowerCase())) : [];
        const autoTags = (inputUrl && !file) ? autoTagsFromUrl(inputUrl) : [];
        const tags = [...new Set([...userTags, ...autoTags])];

        const minTags = getMinTags();
        const shitpostMinTags = is_shitpost ? (parseInt(cfg.websrv.shitpost_min_tags) || 0) : 0;
        if (!is_shitpost && minTags > 0 && userTags.length < minTags) {
            return sendJson(res, { success: false, msg: `At least ${minTags} tag${minTags !== 1 ? 's' : ''} required` }, 400);
        }
        if (is_shitpost && shitpostMinTags > 0 && userTags.length < shitpostMinTags) {
            return sendJson(res, { success: false, msg: `At least ${shitpostMinTags} tag${shitpostMinTags !== 1 ? 's' : ''} required` }, 400);
        }

        // Validate MIME type for attached file
        const allowedCats = Array.isArray(cfg.allowedMimes)
            ? cfg.allowedMimes.map(c => c.toLowerCase())
            : null;
        const allowedMimes = allowedCats
            ? Object.keys(cfg.mimes).filter(m =>
                allowedCats.some(cat =>
                    cat.includes('/') ? m === cat : m.startsWith(`${cat}/`)
                )
              )
            : Object.keys(cfg.mimes);

        if (file && !inputUrl) {
            let mime = file.contentType;
            if ((mime === 'application/octet-stream' || !mime || mime === 'application/x-www-form-urlencoded') &&
                file.filename && file.filename.toLowerCase().endsWith('.swf')) {
                mime = 'application/x-shockwave-flash';
            }
            if (!allowedMimes.includes(mime)) {
                return sendJson(res, { success: false, msg: `Invalid file type: ${mime}` }, 400);
            }
        }

        let manualApproval = getManualApproval();
        const trustedThreshold = getTrustedUploads();
        if (trustedThreshold > 0 && !req.session.admin && !req.session.is_moderator) {
            try {
                const totalUploads = await db`
                    SELECT count(*) as count 
                    FROM items 
                    WHERE username = ${req.session.user} 
                    AND is_deleted = false
                `;
                if (parseInt(totalUploads[0].count) < trustedThreshold) {
                    manualApproval = true;
                }
            } catch (err) {
                manualApproval = true; 
            }
        }

        if (!manualApproval && !req.session.admin && !req.session.is_moderator) {
            const twelveHoursAgo = ~~(Date.now() / 1000) - (12 * 3600);
            const uploadCount = await db`
                SELECT count(*) as count 
                FROM items 
                WHERE username = ${req.session.user} 
                AND stamp > ${twelveHoursAgo} 
                AND is_deleted = false
            `;
            const uploadLimit = cfg.main.upload_limit ?? 69;
            if (parseInt(uploadCount[0].count) >= uploadLimit) {
                return sendJson(res, {
                    success: false,
                    msg: `Rate limit exceeded. You can only upload ${uploadLimit} files every 12 hours.`
                }, 429);
            }
        }

        // Check for YouTube Embeds when url is provided without a file attachment
        const ytRegex = /(?:youtube\.com\/\S*(?:(?:\/e(?:mbed))?\/|watch\/?\?(?:\S*?&?v\=))|youtu\.be\/)([a-zA-Z0-9_-]{6,11})/i;
        const ytMatch = (!file && inputUrl) ? inputUrl.match(ytRegex) : null;

        if (ytMatch && cfg.websrv.enable_youtube_upload !== false) {
            const videoId = ytMatch[1];
            const ytUrl = `https://www.youtube.com/watch?v=${videoId}`;
            const filename = `yt:${videoId}`;

            const [{ id: itemid }] = await db`
                insert into items ${db({
                    src: ytUrl,
                    dest: filename,
                    mime: 'video/youtube',
                    size: 0,
                    checksum: `yt_${videoId}_${Date.now()}`,
                    phash: null,
                    username: req.session.user,
                    userchannel: 'web',
                    usernetwork: 'web',
                    stamp: nowStamp,
                    active: !manualApproval,
                    is_oc: !!is_oc,
                    title: title,
                    visibility: targetVisibility,
                    slug: itemSlug,
                    expires_at: targetExpiresAt
                }, 'src', 'dest', 'mime', 'size', 'checksum', 'phash', 'username', 'userchannel', 'usernetwork', 'stamp', 'active', 'is_oc', 'title', 'visibility', 'slug', 'expires_at')}
                RETURNING id
            `;

            try {
                await db`INSERT INTO comment_subscriptions (user_id, item_id) VALUES (${req.session.id}, ${itemid}) ON CONFLICT DO NOTHING`;
            } catch (err) {}

            try {
                await queue.genThumbnail(filename, 'video/youtube', itemid, ytUrl, manualApproval);
            } catch (err) {
                const tDir = manualApproval ? path.join(cfg.paths.pending, 't') : cfg.paths.t;
                await queue.spawn('magick', ['-size', '128x128', 'xc:#1a1a1a', '-gravity', 'center', '-fill', '#666', '-pointsize', '20', '-annotate', '0', 'YouTube', path.join(tDir, `${itemid}.webp`)]).catch(() => {});
            }

            if (effectiveRating) {
                const ratingTagId = effectiveRating === 'sfw' ? 1 : (effectiveRating === 'nsfw' ? 2 : (cfg.nsfl_tag_id || 3));
                await db`insert into tags_assign ${db({ item_id: itemid, tag_id: ratingTagId, user_id: req.session.id })} on conflict do nothing`;
                await queue.genBlurredThumbnail(itemid, manualApproval).catch(() => {});
            }

            for (const tagName of tags) {
                let tagRow = await db`select id from tags where normalized = slugify(${tagName}) limit 1`;
                if (tagRow.length === 0) {
                    await db`insert into tags ${db({ tag: tagName }, 'tag')}`;
                    tagRow = await db`select id from tags where normalized = slugify(${tagName}) limit 1`;
                }
                await db`insert into tags_assign ${db({ item_id: itemid, tag_id: tagRow[0].id, user_id: req.session.id })} on conflict do nothing`;
            }

            if (comment && comment.length > 0) {
                try {
                    const filteredComment = await applyWordFilter(comment);
                    await db`INSERT INTO comments ${db({ item_id: itemid, user_id: req.session.id, content: filteredComment })}`;
                } catch (err) {}
            }

            if (is_oc) {
                const ocTags = ['oc', 'original content'];
                for (const ocName of ocTags) {
                    let tagRow = await db`select id from tags where normalized = slugify(${ocName}) limit 1`;
                    if (tagRow.length === 0) {
                        await db`insert into tags ${db({ tag: ocName }, 'tag')}`;
                        tagRow = await db`select id from tags where normalized = slugify(${ocName}) limit 1`;
                    }
                    await db`insert into tags_assign ${db({ item_id: itemid, tag_id: tagRow[0].id, user_id: req.session.id })} on conflict do nothing`;
                }
            }

            if (!manualApproval) {
                f0cklib.clearCountCache();
                try {
                    await db`SELECT pg_notify('new_item', ${JSON.stringify({
                        id: itemid,
                        dest: filename,
                        mime: 'video/youtube',
                        username: req.session.user,
                        display_name: req.session.display_name || null,
                        tag_id: effectiveRating ? (effectiveRating === 'sfw' ? 1 : (effectiveRating === 'nsfw' ? 2 : (cfg.nsfl_tag_id || 3))) : 0,
                        is_oc: !!is_oc,
                        slug: itemSlug,
                        visibility: targetVisibility
                    })})`;
                } catch (err) {
                    console.error('[UPLOAD] YouTube new_item notify failed:', err);
                }
            }

            const itemRoute = itemSlug ? `/${itemSlug}` : `/${itemid}`;
            const successMsg = manualApproval ? 'Upload successful! Your upload is pending admin approval.' : 'Upload successful! Your upload is now live.';
            return sendJson(res, {
                success: true,
                msg: successMsg,
                itemid: itemid,
                slug: itemSlug,
                visibility: targetVisibility,
                manual_approval: manualApproval,
                redirect: !manualApproval ? itemRoute : null,
                url: !manualApproval ? `${cfg.main.url.full}${itemRoute}` : `${cfg.main.url.full}/`,
                file_url: null,
                dest: filename,
                mime: 'video/youtube',
                tag_id: effectiveRating ? (effectiveRating === 'sfw' ? 1 : (effectiveRating === 'nsfw' ? 2 : (cfg.nsfl_tag_id || 3))) : 0,
                is_oc: !!is_oc,
                display_name: req.session.display_name || null,
                username: req.session.user
            });
        }

        // Check repost link if uploading via URL (non-YouTube)
        if (!file && inputUrl && !getBypassDuplicateCheck()) {
            const repostLink = await queue.checkrepostlink(inputUrl);
            if (repostLink) {
                return sendJson(res, { success: false, msg: 'This URL has already been uploaded', repost: repostLink }, 409);
            }
        }

        // Generate UUID & Base Paths
        const uuid = await queue.genuuid();
        const tmpPath = path.join(cfg.paths.tmp, `${uuid}.tmp`);

        // Ensure directories exist
        await fs.mkdir(cfg.paths.tmp, { recursive: true });
        await fs.mkdir(path.join(cfg.paths.pending, 'b'), { recursive: true });
        await fs.mkdir(path.join(cfg.paths.pending, 't'), { recursive: true });
        await fs.mkdir(path.join(cfg.paths.pending, 'ca'), { recursive: true });

        if (file && file.data) {
            await fs.writeFile(tmpPath, file.data);
        } else if (inputUrl) {
            const proxyArgs = (cfg.main.socks && cfg.main.socks !== 'undefined') ? ['--proxy', cfg.main.socks] : [];
            const ytdlpArgs = ['--js-runtimes', 'node', '--geo-bypass', '--extractor-args', 'youtube:player-client=ios,web', '--newline', '--no-colors'];
            const isInstagram = /instagram\.com/i.test(inputUrl);
            let downloadedFile = null;

            try {
                const { stdout } = await queue.spawn('yt-dlp', [
                    ...proxyArgs, ...ytdlpArgs,
                    '-f', 'bv*[height<=1080]+ba/b[height<=1080] / wv*+ba/w',
                    inputUrl,
                    '--max-filesize', `${effectiveMaxBytes / 1024}k`,
                    '--postprocessor-args', 'ffmpeg:-bitexact',
                    '-o', path.join(cfg.paths.tmp, `${uuid}.%(ext)s`),
                    '--print', 'after_move:filepath',
                    '--merge-output-format', 'mp4'
                ], { quiet: true });
                downloadedFile = stdout.trim().split('\n').map(l => l.trim()).filter(l => l.length > 0).pop();
            } catch (err1) {
                if (isInstagram) {
                    return sendJson(res, { success: false, msg: 'Failed to download Instagram URL' }, 400);
                }
                try {
                    const { stdout } = await queue.spawn('yt-dlp', [
                        ...proxyArgs, ...ytdlpArgs,
                        inputUrl,
                        '--max-filesize', `${effectiveMaxBytes / 1024}k`,
                        '-o', path.join(cfg.paths.tmp, `${uuid}.%(ext)s`),
                        '--print', 'after_move:filepath'
                    ], { quiet: true });
                    downloadedFile = stdout.trim().split('\n').map(l => l.trim()).filter(l => l.length > 0).pop();
                } catch (err2) {
                    const fallbackTmp = path.join(cfg.paths.tmp, `${uuid}.curl_tmp`);
                    let referer = inputUrl;
                    try {
                        const parsedUrl = new URL(inputUrl);
                        let host = parsedUrl.hostname;
                        if (host.includes('imgur.com')) host = 'imgur.com';
                        referer = `${parsedUrl.protocol}//${host}/`;
                    } catch (e) {}

                    const curlArgs = [
                        '-s', '-S', '-f', '-L', inputUrl, '-o', fallbackTmp,
                        '--max-filesize', `${effectiveMaxBytes}`,
                        '--connect-timeout', '30',
                        '--max-time', '300',
                        '--user-agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
                        '--referer', referer,
                        '-H', 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8',
                        '-H', 'Accept-Language: en-US,en;q=0.9'
                    ];
                    if (cfg.main.socks && cfg.main.socks !== 'undefined' && cfg.main.socks !== '') {
                        const proxyHost = cfg.main.socks.includes('://') ? cfg.main.socks.split('://')[1] : cfg.main.socks;
                        curlArgs.push('--socks5-hostname', proxyHost);
                    }
                    try {
                        await queue.spawn('curl', curlArgs);
                        downloadedFile = fallbackTmp;
                    } catch (curlErr) {
                        return sendJson(res, { success: false, msg: 'Failed to download file from URL' }, 400);
                    }
                }
            }

            let exists = false;
            if (downloadedFile) {
                try {
                    await fs.access(downloadedFile);
                    exists = true;
                } catch (e) {}
            }
            if (!exists) {
                return sendJson(res, { success: false, msg: 'Failed to download file from URL' }, 400);
            }

            if (downloadedFile !== tmpPath) {
                await fs.rename(downloadedFile, tmpPath);
            }
        }

        // Verify actual MIME (second check after file-command detection)
        let actualMime = (await queue.spawn('file', ['--mime-type', '-b', tmpPath])).stdout.trim();
        if (!allowedMimes.includes(actualMime)) {
            await fs.unlink(tmpPath).catch(() => { });
            return sendJson(res, { success: false, msg: `Invalid file type detected: ${actualMime}` }, 400);
        }

        if (actualMime === 'application/pdf' && !getEnablePdf()) {
            await fs.unlink(tmpPath).catch(() => { });
            return sendJson(res, { success: false, msg: 'PDF uploads are currently disabled.' }, 403);
        }

        if (isArchiveMime(actualMime) && cfg.websrv.enable_archive === false) {
            await fs.unlink(tmpPath).catch(() => { });
            return sendJson(res, { success: false, msg: 'Archive uploads are currently disabled.' }, 403);
        }

        // ── Phase A: parallel analysis of tmpPath ─────────────────────────────
        // sha256sum, PHash, and dimension probing all just read the file —
        // none depends on the other, so run them concurrently.
        const needsPHash    = !isArchiveMime(actualMime);
        const needsDims     = !isArchiveMime(actualMime);
        const needsAudioMP4 = (actualMime === 'video/mp4' || actualMime === 'video/quicktime');

        const [
            checksumResult,
            phashResult,
            dimResult,
            audioMp4Result
        ] = await Promise.all([
            // 1. SHA-256 checksum
            queue.spawn('sha256sum', [tmpPath]).then(r => r.stdout.trim().split(' ')[0]),

            // 2. Perceptual hash (skip for archives)
            needsPHash
                ? queue.generatePHash(tmpPath).catch(e => { console.error('[UPLOAD] PHash error:', e); return null; })
                : Promise.resolve(null),

            // 3. Pixel dimensions (skip for archives)
            needsDims
                ? (async () => {
                    try {
                        if (actualMime.startsWith('image/')) {
                            const { stdout: magickOut } = await queue.spawn('magick', [
                                'identify', '-format', '%wx%h\n', tmpPath + '[0]'
                            ], { quiet: true, ignoreExitCode: true });
                            const line = magickOut.trim().split('\n')[0];
                            const match = line.match(/^(\d+)x(\d+)$/);
                            if (match) return { width: parseInt(match[1], 10), height: parseInt(match[2], 10) };
                        } else if (actualMime.startsWith('video/') && actualMime !== 'video/youtube') {
                            const { stdout: probeOut } = await queue.spawn('ffprobe', [
                                '-v', 'error',
                                '-select_streams', 'v:0',
                                '-show_entries', 'stream=width,height',
                                '-of', 'csv=p=0',
                                tmpPath
                            ], { quiet: true, ignoreExitCode: true });
                            const dimParts = probeOut.trim().split(',');
                            if (dimParts.length >= 2) {
                                const w = parseInt(dimParts[0], 10);
                                const h = parseInt(dimParts[1], 10);
                                if (!isNaN(w) && !isNaN(h) && w > 0 && h > 0) return { width: w, height: h };
                            }
                        }
                    } catch (dimErr) {
                        console.warn(`[UPLOAD] Dimension probe failed for ${actualMime} (non-fatal):`, dimErr.message);
                    }
                    return null;
                })()
                : Promise.resolve(null),

            // 4. Audio-only MP4 reclassification probe (only when needed)
            needsAudioMP4
                ? (async () => {
                    const origExt = file?.filename ? file.filename.split('.').pop().toLowerCase() : (inputUrl ? inputUrl.split('?')[0].split('.').pop().toLowerCase() : '');
                    if (['m4a', 'aac'].includes(origExt)) {
                        return 'audio/mp4'; // Extension-based reclassification
                    }
                    try {
                        const probeResult = await queue.spawn('ffprobe', [
                            '-v', 'error', '-select_streams', 'v:0',
                            '-show_entries', 'stream=codec_type',
                            '-of', 'csv=p=0', tmpPath
                        ]);
                        if (!probeResult.stdout.trim()) return 'audio/mp4';
                    } catch (err) { /* ffprobe unavailable, keep original */ }
                    return null; // No reclassification needed
                })()
                : Promise.resolve(null),
        ]);

        const checksum = checksumResult;
        let phash = phashResult;
        const itemWidth  = dimResult?.width  ?? null;
        const itemHeight = dimResult?.height ?? null;

        // Apply audio/MP4 reclassification if detected
        if (audioMp4Result) {
            actualMime = audioMp4Result;
            console.log(`[UPLOAD] Reclassified to ${audioMp4Result}`);
        }

        // Resolve final filename now that actualMime is settled
        const ext = cfg.mimes[actualMime] || 'bin';
        const filename = `${uuid}.${ext}`;
        const destPath = path.join(cfg.paths.pending, 'b', filename);

        // ── Phase B: parallel duplicate checks ────────────────────────────────
        // Both are read-only DB queries — run them together.
        if (!getBypassDuplicateCheck()) {
            const [repostBySum, repostByPhash] = await Promise.all([
                queue.checkrepostsum(checksum),
                (phash ? queue.checkrepostphash(phash) : Promise.resolve(null)),
            ]);

            if (repostBySum) {
                await fs.unlink(tmpPath).catch(() => {});
                return sendJson(res, { success: false, msg: 'This file already exists', repost: repostBySum }, 409);
            }
            if (repostByPhash) {
                await fs.unlink(tmpPath).catch(() => {});
                return sendJson(res, { success: false, msg: 'This file is a visual duplicate', repost: repostByPhash }, 409);
            }
        }

        // ─────────────────────────────────────────────────────────────────────

        // When bypass is active, symlink to the existing file if one already exists on disk.
        // We write the symlink straight into cfg.paths.b so we can skip the pending flow entirely.
        let linkedToExisting = false;
        if (getBypassDuplicateCheck()) {
            console.error(`[UPLOAD] bypass: looking up existing file for checksum ${checksum}`);
            const existing = await db`
                SELECT dest, checksum FROM items
                WHERE checksum = ${checksum} OR checksum LIKE ${checksum + '_bypass_%'}
                ORDER BY id DESC
                LIMIT 1
            `;
            console.error(`[UPLOAD] bypass: DB lookup found ${existing.length} row(s)`, existing.length ? existing[0].checksum : '');
            if (existing.length > 0) {
                const existingFile = existing[0].dest;
                const existingAbsPath = path.join(cfg.paths.b, existingFile);
                try {
                    // Resolve to the real file to avoid symlink chains
                    const realTargetAbsPath = await fs.realpath(existingAbsPath);
                    
                    // Determine where the symlink will live
                    // If manual approval is enabled, it lives in pending/b. Otherwise directly in public/b.
                    const symlinkPath = manualApproval ? destPath : path.join(cfg.paths.b, filename);
                    const symlinkDir = path.dirname(symlinkPath);
                    
                    // Calculate relative path for the symlink target
                    const relativeTarget = path.relative(symlinkDir, realTargetAbsPath);
                    
                    await fs.symlink(relativeTarget, symlinkPath);
                    linkedToExisting = true;
                    console.error(`[UPLOAD] bypass: symlinked ${symlinkPath} → ${relativeTarget}`);
                } catch (e) {
                    console.error(`[UPLOAD ERROR] bypass symlink failed:`, e);
                }
            } else {
                console.error(`[UPLOAD] bypass: no existing file found for ${checksum}`);
            }
        }

        if (!linkedToExisting) {
            // Normal path: copy tmp to pending/b, to be moved to public later
            await fs.copyFile(tmpPath, destPath);
        }
        await fs.unlink(tmpPath).catch(() => { });

        // When bypass is active the real checksum may already exist in the DB (unique constraint).
        // Suffix it so the INSERT can proceed — the file is genuinely a new item entry.
        const insertChecksum = getBypassDuplicateCheck() ? `${checksum}_bypass_${Date.now()}` : checksum;


        // Insert
        const size = file?.data ? file.data.length : (await fs.stat(destPath).then(s => s.size).catch(() => 0));
        let originalFilename = file ? (file.filename || null) : null;
        if (!originalFilename && inputUrl) {
            try {
                const parsedName = path.basename(new URL(inputUrl).pathname);
                if (parsedName && parsedName !== '/') originalFilename = parsedName;
            } catch (e) {}
        }

        await db`
          insert into items ${db({
            src: inputUrl || '',
            dest: filename,
            mime: actualMime,
            size: size,
            checksum: insertChecksum,
            phash: phash,
            username: req.session.user,
            userchannel: 'web',
            usernetwork: 'web',
            stamp: nowStamp,
            active: !manualApproval,
            is_oc: is_oc,
            original_filename: originalFilename,
            title: title,
            width: itemWidth,
            height: itemHeight,
            visibility: targetVisibility,
            slug: itemSlug,
            expires_at: targetExpiresAt
        }, 'src', 'dest', 'mime', 'size', 'checksum', 'phash', 'username', 'userchannel', 'usernetwork', 'stamp', 'active', 'is_oc', 'original_filename', 'title', 'width', 'height', 'visibility', 'slug', 'expires_at')}
        `;

        const itemid = await queue.getItemID(filename);

        // Automatically subscribe uploader to comment thread
        try {
            await db`
                INSERT INTO comment_subscriptions (user_id, item_id)
                VALUES (${req.session.id}, ${itemid})
                ON CONFLICT DO NOTHING
            `;
        } catch (err) {
            console.error('[UPLOAD HANDLER] Failed to auto-subscribe uploader:', err);
        }

        // Thumbnail & Coverart
        const isPending = linkedToExisting ? manualApproval : true;
        let thumbProcessed = false;

        // Custom Thumbnail for Flash
        const dynThumbSize = 512;
        if (actualMime === 'application/x-shockwave-flash' || actualMime === 'application/vnd.adobe.flash.movie') {
            if (parts.thumbnail && parts.thumbnail.data && parts.thumbnail.data.length > 0) {
                try {
                    const thumbTmp = path.join(cfg.paths.tmp, `${itemid}_custom_thumb.tmp`);
                    await fs.writeFile(thumbTmp, parts.thumbnail.data);
                    
                    const tDir = isPending ? path.join(cfg.paths.pending, 't') : cfg.paths.t;
                    const thumbDest = path.join(tDir, `${itemid}.webp`);
                    
                    await queue.spawn('magick', [thumbTmp, '-resize', `${dynThumbSize}x${dynThumbSize}^`, '-gravity', 'center', '-crop', `${dynThumbSize}x${dynThumbSize}+0+0`, '+repage', thumbDest]);
                    await fs.unlink(thumbTmp).catch(() => {});
                    thumbProcessed = true;
                    console.log(`[UPLOAD] Custom thumbnail processed for Flash item ${itemid}`);
                } catch (thumbErr) {
                    console.error(`[UPLOAD] Custom thumbnail processing failed for item ${itemid}:`, thumbErr);
                }
            }
        }

        try {
            if (!thumbProcessed) {
            await queue.genThumbnail(filename, actualMime, itemid, '', isPending, dynThumbSize);
            }
            
            if (actualMime.startsWith('audio/') && queue._lastCoverExtracted) {
                await db`UPDATE items SET has_coverart = TRUE WHERE id = ${itemid}`;
            }
        } catch (err) {
            console.warn(`[UPLOAD WARNING] genThumbnail failed for item ${itemid} (falling back to placeholder):`, err.message);
            // Fallback to placeholder for thumbnail ONLY if it hasn't been processed yet
            if (!thumbProcessed) {
                const tPath = !isPending
                    ? path.join(cfg.paths.t, itemid + '.webp')
                    : path.join(cfg.paths.pending, 't', itemid + '.webp');
                await queue.spawn('magick', ['-size', `${dynThumbSize}x${dynThumbSize}`, 'xc:#1a1a1a', tPath]).catch(() => {});
            }
        }

        // Generate blurred thumbnail for all posts (SFW, NSFW, NSFL, Untagged)
        await queue.genBlurredThumbnail(itemid, isPending);

        // Insert optional first comment
        if (comment && comment.length > 0) {
            try {
                const filteredComment = await applyWordFilter(comment);
                await db`
                    INSERT INTO comments ${db({
                        item_id: itemid,
                        user_id: req.session.id,
                        content: filteredComment
                    })}
                `;
            } catch (err) {
                console.error('[UPLOAD HANDLER] Failed to insert comment:', err);
            }
        }

        // Tags — rating tag only assigned if a rating was selected
        if (effectiveRating) {
            const ratingTagId = effectiveRating === 'sfw' ? 1 : (effectiveRating === 'nsfw' ? 2 : (cfg.nsfl_tag_id || 3));
            await db`
              insert into tags_assign ${db({ item_id: itemid, tag_id: ratingTagId, user_id: req.session.id })}
            `;
        }

        for (const tagName of tags) {
            let tagRow = await db`
            select id from tags where normalized = slugify(${tagName}) limit 1
          `;

            let tagId;
            if (tagRow.length === 0) {
                await db`
              insert into tags ${db({ tag: tagName }, 'tag')}
            `;
                tagRow = await db`
              select id from tags where normalized = slugify(${tagName}) limit 1
            `;
            }
            tagId = tagRow[0].id;

            await db`
            insert into tags_assign ${db({ item_id: itemid, tag_id: tagId, user_id: req.session.id })}
            on conflict do nothing
          `;
        }

        // Assign OC tags if the uploader ticked the OC checkbox
        if (is_oc) {
            const ocTags = ['oc', 'original content'];
            for (const tagname of ocTags) {
                const normalized = tagname.replace(/\s+/g, '-').toLowerCase();
                let tagRow = await db`SELECT id FROM tags WHERE normalized = slugify(${tagname}) LIMIT 1`;
                if (tagRow.length === 0) {
                    await db`INSERT INTO tags ${db({ tag: tagname }, 'tag')}`;
                    tagRow = await db`SELECT id FROM tags WHERE normalized = slugify(${tagname}) LIMIT 1`;
                }
                await db`
                    INSERT INTO tags_assign ${db({ item_id: itemid, tag_id: tagRow[0].id, user_id: req.session.id })}
                    ON CONFLICT DO NOTHING
                `;
            }
        }

        // Auto-tag SWF uploads with "Flash" and "SWF"
        if (actualMime === 'application/x-shockwave-flash' || actualMime === 'application/vnd.adobe.flash.movie') {
            const swfTags = ['Flash', 'SWF'];
            for (const tagname of swfTags) {
                let tagRow = await db`SELECT id FROM tags WHERE normalized = slugify(${tagname}) LIMIT 1`;
                if (tagRow.length === 0) {
                    await db`INSERT INTO tags ${db({ tag: tagname }, 'tag')}`;
                    tagRow = await db`SELECT id FROM tags WHERE normalized = slugify(${tagname}) LIMIT 1`;
                }
                await db`
                    INSERT INTO tags_assign ${db({ item_id: itemid, tag_id: tagRow[0].id, user_id: req.session.id })}
                    ON CONFLICT DO NOTHING
                `;
            }
        }


        // Action if auto-approved
        if (!manualApproval) {
            // Bust the count cache so page totals update immediately
            f0cklib.clearCountCache();
            if (!linkedToExisting) {
                // Move logic: Handles both real files and symlinks (reposts) correctly
                const moveSafe = async (src, dst) => {
                    try {
                        const lstat = await fs.lstat(src);
                        if (lstat.isSymbolicLink()) {
                            const target = await fs.readlink(src);
                            const absTarget = path.resolve(path.dirname(src), target);
                            const relTarget = path.relative(path.dirname(dst), absTarget);
                            await fs.symlink(relTarget, dst);
                            await fs.unlink(src).catch(() => {});
                        } else {
                            await fs.copyFile(src, dst);
                            await fs.unlink(src).catch(() => {});
                        }
                    } catch (e) {
                        console.error(`[UPLOAD MOVE ERROR] Failed to move ${src} to ${dst}:`, e.message);
                    }
                };

                const itemDest = path.join(cfg.paths.b, filename);
                const thumbDest = path.join(cfg.paths.t, `${itemid}.webp`);
                const blurDest = path.join(cfg.paths.t, `${itemid}_blur.webp`);
                const coverDest = path.join(cfg.paths.ca, `${itemid}.webp`);

                await moveSafe(destPath, itemDest);
                await moveSafe(path.join(cfg.paths.pending, 't', `${itemid}.webp`), thumbDest);

                if (actualMime.startsWith('audio')) {
                    await moveSafe(path.join(cfg.paths.pending, 'ca', `${itemid}.webp`), coverDest);
                }
                if (effectiveRating === 'nsfw' || effectiveRating === 'nsfl') {
                    await moveSafe(path.join(cfg.paths.pending, 't', `${itemid}_blur.webp`), blurDest);
                }
            }
        }

        // --- From here on, we process in the background to return to the user immediately ---
        const backgroundProcess = async () => {
          try {
            // Thumbnail & Coverart is now primarily handled synchronously 
            // for immediate visual feedback in some cases, but we keep this as safety 
            // EXCEPT for custom thumbnails which are already processed.
            const isPending = manualApproval;
            try {
                // If it's Flash, we might have already processed a custom thumbnail.
                // We'll only run genThumbnail if the thumbnail doesn't exist yet.
                const tDir = isPending ? path.join(cfg.paths.pending, 't') : cfg.paths.t;
                const thumbPath = path.join(tDir, `${itemid}.webp`);
                const thumbExists = await fs.access(thumbPath).then(() => true).catch(() => false);

                if (!thumbExists) {
                    await queue.genThumbnail(filename, actualMime, itemid, '', isPending, 512);
                }
                
                if (actualMime.startsWith('audio/') && queue._lastCoverExtracted) {
                    await db`UPDATE items SET has_coverart = TRUE WHERE id = ${itemid}`;
                }
            } catch (err) {
                console.error(`[BACKGROUND ERROR] genThumbnail failed for item ${itemid}:`, err);
            }

            // Ensure blurred thumbnail exists
            const tDir = isPending ? path.join(cfg.paths.pending, 't') : cfg.paths.t;
            const blurPath = path.join(tDir, `${itemid}_blur.webp`);
            const blurExists = await fs.access(blurPath).then(() => true).catch(() => false);
            if (!blurExists) {
                await queue.genBlurredThumbnail(itemid, isPending).catch(err => console.error(`[BACKGROUND ERROR] genBlurredThumbnail failed:`, err));
            }

            // Note: video title metadata is surfaced to the user as a suggestion in the upload form.
            // Auto-tagging from embedded metadata was removed — the user must select suggestions explicitly.


            // Discord Webhook (only for public uploads)
            if (targetVisibility === 0) {
                try {
                    const discordClient = cfg.clients.find(c => c.type === 'discord');
                    if (discordClient && discordClient.webhook_url) {
                        const message = `${req.session.user} uploaded a new ${actualMime.split('/')[0]}: ${cfg.main.url.full}/${itemid}`;
                        const payload = JSON.stringify({ content: message });
                        const url = new URL(discordClient.webhook_url);
                        const options = {
                            hostname: url.hostname,
                            path: url.pathname + url.search,
                            method: 'POST',
                            headers: {
                                'Content-Type': 'application/json',
                                'Content-Length': Buffer.byteLength(payload)
                            }
                        };
                        const reqDiscord = https.request(options, (resDiscord) => { });
                        reqDiscord.on('error', (err) => console.error('[UPLOAD] Discord Webhook failed:', err));
                        reqDiscord.write(payload);
                        reqDiscord.end();
                    }
                } catch (err) {
                    console.error(`[BACKGROUND ERROR] Discord notification failed:`, err);
                }
            }

            // Broadcast new_item event for live grid updates (only if auto-approved)
            if (!manualApproval) {
                try {
                    await db`SELECT pg_notify('new_item', ${JSON.stringify({
                        id: itemid,
                        dest: filename,
                        mime: actualMime,
                        username: req.session.user,
                        display_name: req.session.display_name || null,
                        tag_id: effectiveRating ? (effectiveRating === 'sfw' ? 1 : (effectiveRating === 'nsfw' ? 2 : (cfg.nsfl_tag_id || 3))) : 0,
                        is_oc: !!is_oc,
                        slug: itemSlug,
                        visibility: targetVisibility
                    })})`;
                } catch (err) {
                    console.error('[UPLOAD] new_item notify failed:', err);
                }
            }

            // Push to Matrix Channel (only if auto-approved and public)
            if (!manualApproval && targetVisibility === 0) {
                try {
                    const matrixCfg = cfg.clients.find(c => c.type === 'matrix');
                    if (matrixCfg?.notification_channel_id && self?.bot?.clients) {
                        const clients = await Promise.all(self.bot.clients);
                        const matrixWrapper = clients.find(c => c.type === 'matrix');
                        if (matrixWrapper?.client) {
                            const message = `${req.session.user} uploaded a new item ${cfg.main.url.full}/${itemid}`;
                            await matrixWrapper.client.send(matrixCfg.notification_channel_id, message);
                            console.log(`[UPLOAD] Matrix notification sent for item ${itemid}`);
                        }
                    }
                } catch (err) {
                    console.error('[UPLOAD] Matrix notification error:', err);
                }
            }

            // Staff Notifications
            if (manualApproval) {
                try {
                    const staff = await db`select id, login from "user" where admin = true or is_moderator = true`;
                    const notifications = staff.map(user => ({
                        user_id: user.id,
                        type: 'admin_pending',
                        reference_id: 0,
                        item_id: itemid
                    }));

                    if (notifications.length > 0) {
                        await db`INSERT INTO notifications ${db(notifications)} ON CONFLICT DO NOTHING`;
                    }
                } catch (err) {
                    console.error('[UPLOAD HANDLER] Failed to notify staff:', err);
                }
            }
            
          } catch (globalErr) {
            console.error(`[CRITICAL BACKGROUND ERROR] Item ${itemid}:`, globalErr);
          }
        };

        // Start background processing without awaiting
        backgroundProcess();

        const successMsg = manualApproval 
            ? 'Upload successful! Your upload is pending admin approval.'
            : 'Upload successful! Your upload is now live.';

        const imagesPath = cfg.websrv.paths?.images || '/b';
        const itemRoute = itemSlug ? `/${itemSlug}` : `/${itemid}`;
        return sendJson(res, {
            success: true,
            msg: successMsg,
            itemid: itemid,
            slug: itemSlug,
            visibility: targetVisibility,
            manual_approval: manualApproval,
            redirect: !manualApproval ? itemRoute : null,
            url: !manualApproval ? `${cfg.main.url.full}${itemRoute}` : `${cfg.main.url.full}/`,
            file_url: !manualApproval ? `${cfg.main.url.full}${imagesPath}/${filename}` : null,
            // Fields for immediate client-side grid injection (avoids SSE race condition)
            dest: filename,
            mime: actualMime,
            tag_id: effectiveRating ? (effectiveRating === 'sfw' ? 1 : (effectiveRating === 'nsfw' ? 2 : (cfg.nsfl_tag_id || 3))) : 0,
            is_oc: !!is_oc,
            display_name: req.session.display_name || null,
            username: req.session.user
        });

    } catch (err) {
        if (err.code === 'BODY_TOO_LARGE') {
            const isBoosted = req.session?.admin || req.session?.is_moderator;
            console.error(`[UPLOAD HANDLER ERROR] [BODY_TOO_LARGE] User: ${req.session?.user || 'unknown'}. Limit: ${lib.formatSize(cfg.main.maxfilesize * (isBoosted ? cfg.main.adminmultiplier : 1))}`);
            return sendJson(res, { success: false, msg: 'File too large' }, 413);
        }
        console.error('[UPLOAD HANDLER ERROR]', err);
        return sendJson(res, { success: false, msg: lib.logError(err, 'Upload failed') }, 500);
    }
};