// Groups a mime type into a simple family name we can allow-list against.
// SVG is deliberately NOT counted as a normal image: an SVG file can
// contain scripts, so consumers must opt in to it explicitly.
export function detectMediaType(mimeType: string): string {
  if (mimeType === 'image/svg+xml') return 'svg';
  if (mimeType.startsWith('image/')) return 'image';
  if (mimeType.startsWith('video/')) return 'video';
  if (mimeType === 'application/pdf') return 'pdf';
  if (mimeType.startsWith('application/') || mimeType.startsWith('text/')) {
    return 'document';
  }
  return 'file';
}

// Every real PDF file starts with the bytes "%PDF-".
// Checking the actual file content stops someone renaming another
// file type to ".pdf" and sneaking it past the upload filter.
export function isPdfContent(buffer: Buffer): boolean {
  return buffer.subarray(0, 5).toString('latin1') === '%PDF-';
}