import fs from 'fs'
import path from 'path'

function uniqueCandidates(candidates) {
  return [...new Set(candidates.filter(Boolean))]
}

function hasServerDataDir(root) {
  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
  // root candidates come only from APP_ROOT/cwd/parent and are used only for existence checks.
  return fs.existsSync(path.join(root, 'server', 'data'))
}

export function resolveProjectRoot() {
  const envRoot = process.env.APP_ROOT ? process.env.APP_ROOT.trim() : ''
  const cwd = process.cwd()
  const parent = path.resolve(cwd, '..')

  const candidates = uniqueCandidates([envRoot, cwd, parent])
  for (const root of candidates) {
    if (hasServerDataDir(root)) return root
  }

  return cwd
}

export function getProjectPath(...segments) {
  return path.join(resolveProjectRoot(), ...segments)
}

export function getServerDataPath(...segments) {
  return getProjectPath('server', 'data', ...segments)
}