"""Asset and static-file route registration."""

import logging
import os

from flask import abort, current_app, send_from_directory

from security import is_safe_path

logger = logging.getLogger(__name__)


def register_asset_routes(app):
    """Register asset routes while preserving legacy endpoint names."""

    @app.route("/themes/<path:filename>")
    def serve_theme(filename):
        """Serve theme files (CSS, JS)."""
        if not is_safe_path(filename) or ".." in filename:
            logger.warning(f"Unsafe theme file requested: {filename}")
            abort(404)
        return send_from_directory("themes", filename)

    @app.route("/logo.png")
    def serve_logo():
        """Serve configurable logo."""
        logo_path = current_app.config["LOGO_PATH"]
        if "/" not in logo_path:
            return send_from_directory(".", logo_path)

        directory = os.path.dirname(logo_path)
        filename = os.path.basename(logo_path)
        return send_from_directory(directory, filename)

    @app.route("/static/<path:filename>")
    def serve_static(filename):
        """Serve static files (avatars, etc.)."""
        if not is_safe_path(filename) or ".." in filename:
            logger.warning(f"Unsafe static file requested: {filename}")
            abort(404)
        return send_from_directory("static", filename)