/**
 * GET /api/admin/support/tickets/:id/attachments/:n (support.read): a 5-minute presigned download URL for the thread's
 * nth attachment, served as `Content-Disposition: attachment` + octet-stream (never rendered in the console's origin).
 * Every download is audited (support.attachment.download, with the message id and size; not the file name).
 */
export const GET = adminRoute("support.read", async (_request, ctx, { params }: Context) => {
  const { id: raw, n: index } = await params;
  const id = ticketIdParam(raw);
  if (!/^\d{1,5}$/.test(index)) throw notFound("Attachment");
  const { message, file } = await attachmentAt(id, Number(index));
  const url = await audited(ctx, {
    action: "support.attachment.download", targetType: "ticket", targetId: id,
    after: () => ({ messageId: message.id, n: Number(index), size: file.size, type: file.type }),
  }, () => attachmentDownloadUrl(file.key, file.name, EXPIRES));
  return adminJson({ url, expiresIn: EXPIRES, name: file.name });
});