From b424de8436c37850b3b2f77ddb31c7341d3bb695 Mon Sep 17 00:00:00 2001
From: Marshal <marshal@example.com>
Date: Sun, 28 Jun 2026 08:01:00 +0000
Subject: [PATCH] Add Public decorator to file streaming endpoint for direct
 browser access

---
 apps/edr-freight-api/src/modules/files/files.controller.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/apps/edr-freight-api/src/modules/files/files.controller.ts b/apps/edr-freight-api/src/modules/files/files.controller.ts
index 4ee48c867..e0d876176 100644
--- a/apps/edr-freight-api/src/modules/files/files.controller.ts
+++ b/apps/edr-freight-api/src/modules/files/files.controller.ts
@@ -7,6 +7,7 @@ import {
   Res,
 } from "@nestjs/common";
 import { ApiOperation, ApiQuery, ApiTags } from "@nestjs/swagger";
+import { Public } from "@edr/api-common";
 import { Response } from "express";
 
 import { FilesService } from "./files.service";
@@ -17,6 +18,10 @@ export class FilesController {
   constructor(private readonly filesService: FilesService) {}
 
   @Get(":fileId")
+  // Public so the browser can load the bytes directly via <img>/<iframe>/<a> —
+  // those requests can't carry the Bearer token the axios client injects, so a
+  // guarded route 401s. File UUIDs are unguessable; same tradeoff as webhooks.
+  @Public()
   @ApiOperation({
     summary: "Stream a file by ID",
     description: