Initial commit

2026-05-26 22:46:00 +02:00
commit 7e2c2ff89c
256 changed files with 51523 additions and 0 deletions
@@ -0,0 +1,45 @@
+import { NextRequest } from "next/server";
+import path from "node:path";
+import fs from "node:fs/promises";
+import crypto from "node:crypto";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const COVER_ROOT = path.join(process.cwd(), "data", "collection-covers");
+const IMAGE_MIME: Record<string, string> = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+};
+
+export async function GET(_req: NextRequest, ctx: { params: Promise<{ file: string }> }) {
+  const { file } = await ctx.params;
+  const name = decodeURIComponent(file);
+  if (name.includes("/") || name.includes("\\") || name.includes("..")) {
+    return new Response("not found", { status: 404 });
+  }
+  const abs = path.join(COVER_ROOT, name);
+  try {
+    const buf = await fs.readFile(abs);
+    const ext = path.extname(abs).toLowerCase();
+    const etag = `"${crypto.createHash("sha256").update(buf).digest("hex")}"`;
+    return new Response(new Uint8Array(buf), {
+      headers: {
+        "Content-Type": IMAGE_MIME[ext] ?? "application/octet-stream",
+        "Content-Disposition": rfc5987Disposition(name),
+        "Cache-Control": "public, max-age=0, must-revalidate",
+        ETag: etag,
+      },
+    });
+  } catch {
+    return new Response("not found", { status: 404 });
+  }
+}
+
+function rfc5987Disposition(filename: string): string {
+  const ascii = filename.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_");
+  const utf8 = encodeURIComponent(filename);
+  return `inline; filename="${ascii}"; filename*=UTF-8''${utf8}`;
+}