if att.mime_type == "text/html":
            text = sanitize_preview(text)
        return {"previewable": True, "kind": "text", "content": text[:20000]}
    return {"previewable": False, "reason": "unsupported_kind"}


@router.post("/{att_id}/delete")
async def delete_attachment(att_id: int, db: AsyncSession = Depends(get_db),
                            user: User = Depends(get_current_user),
                            _: None = Depends(require_csrf)):
    att = await _get_own(db, user, att_id)
    att_name = att.name
    if att.stored_path:
        await asyncio.get_event_loop().run_in_executor(
            None, att_svc.delete_attachment_file, att)
    await db.delete(att)
    await db.commit()
    await log_audit(db, user.id, "attachment.delete", "attachment", att_id,
                    {"name": att_name})