"""Security helper functions shared across route modules."""

import re

from config import ALLOWED_EXTENSIONS
from extensions import get_filter_engine


def is_safe_filterset(filterset):
    """Validate a filterset name against the filter engine's known filtersets
    and a safe-character whitelist. Fails closed if the filter engine has not
    been initialized yet.
    """
    if not filterset or not isinstance(filterset, str):
        return False
    try:
        allowed = set(get_filter_engine().get_available_filtersets())
    except Exception:
        return False
    return filterset in allowed and re.match(r"^[a-zA-Z0-9_-]+$", filterset) is not None


def is_safe_path(path):
    """Validate a relative file path against directory-traversal attempts."""
    if not path or not isinstance(path, str):
        return False
    if ".." in path or path.startswith("/") or "\\" in path:
        return False
    return re.match(r"^[a-zA-Z0-9._/-]+$", path) is not None


def is_allowed_file(filename):
    """Check whether an uploaded filename has an allowed image extension."""
    return (
        "." in filename
        and filename.rsplit(".", 1)[1].lower() in ALLOWED_EXTENSIONS
    )