from pathlib import Path

from app.config import settings


def get_project_root() -> Path:
    """Return backend project root."""
    return settings.project_root


def resolve_path(path_value: str | Path) -> Path:
    """Resolve relative paths from backend root."""
    path = Path(path_value)
    return path if path.is_absolute() else get_project_root() / path


def safe_join(base_dir: str | Path, *paths: str) -> Path:
    """Safely join paths and prevent path traversal outside base_dir."""
    base = resolve_path(base_dir).resolve()
    final_path = base.joinpath(*paths).resolve()
    if base != final_path and base not in final_path.parents:
        raise ValueError("Unsafe path detected")
    return final_path