"""Storage-backed document delivery, called only after document ACL checks."""

from django.conf import settings

from eusrr_backend.protected_media import protected_file_response


def document_file_response(attachment, *, filename: str, as_attachment: bool = True):
    """Stream locally via an internal nginx location, after caller checks ACL.

    Resolve symlinks and reject paths outside the document storage root. Never
    forward an arbitrary filesystem path to nginx. Remote storage and local
    development keep the regular storage-backed FileResponse fallback.
    """
    return protected_file_response(
        attachment,
        filename=filename,
        as_attachment=as_attachment,
        storage_directory="documents",
        internal_prefix=settings.DOCUMENTS_X_ACCEL_REDIRECT_PREFIX,
        use_x_accel=getattr(settings, "DOCUMENTS_USE_X_ACCEL_REDIRECT", False),
    )