const MIME_TYPES: Record<string, string> = {
  txt: "text/plain",
  html: "text/html",
  css: "text/css",
  js: "application/javascript",
  json: "application/json",
  png: "image/png",
  jpg: "image/jpeg",
  jpeg: "image/jpeg",
  gif: "image/gif",
  webp: "image/webp",
  ico: "image/x-icon",
  svg: "image/svg+xml",
  pdf: "application/pdf",
  mp4: "video/mp4",
};

app.use(async (ctx) => {
  const { req, url, config } = ctx;

  // Decode URI component to handle spaces in file paths
  let pathname = decodeURIComponent(url.pathname);
  
  // Normalize base path if configured
  if (config.basePath) {
    pathname = pathname !== config.basePath
      ? pathname.slice(config.basePath.length)
      : "/";
  }

  // 安全校验：防止路径遍历攻击（避免访问上级目录文件）Resolve to static directory
  pathname = `/static/${pathname}`;

  // Security: Prevent path traversal attacks (e.g., ../../../../)
  const safePath = path.resolve(Deno.cwd(), pathname.slice(1));
  const rootDir = path.resolve(Deno.cwd());

  if (!safePath.startsWith(rootDir)) {
    return new Response("Forbidden", { status: 403 });
  }

  // Check if file exists
  let fileInfo: Deno.FileInfo | undefined;
  try {
    fileInfo = await Deno.stat(safePath);
  } catch (_error) {
    return await ctx.next();
  }
  if (!fileInfo || !fileInfo.isFile) {
    return await ctx.next();
  }

  // Serve the file with proper headers
  try {
    const file = await Deno.open(safePath, { read: true });
    const ext = path.extname(safePath).toLowerCase().replace(".", "");
    const contentType = MIME_TYPES[ext];
    if (!contentType) {
      return await ctx.next();
    }

    const headers = new Headers({
      "Content-Type": contentType,
      "Content-Length": fileInfo.size.toString(),
      "Vary": "If-None-Match",
      "Last-Modified": fileInfo.mtime?.toUTCString() || new Date().toUTCString(),
    });

    return new Response(file.readable, { headers });
  } catch (_error) {
    return await ctx.next();
  }
});