mirror of
https://github.com/Tria-plc/edr-platform.git
synced 2026-08-27 00:52:50 +00:00
0114673120
Gates the previously open support-agent, procurement, compliance, facilities, list-users and trade-access controllers, separates customer from staff routes across bookings, contracts, companies, billing, warehouses, files and train scheduling, and moves billing, overview, reports and the settings controllers onto their own keys instead of the blanket admin key. Drops the demo-permissions module and the untested notification test route.
104 lines
3.4 KiB
TypeScript
104 lines
3.4 KiB
TypeScript
import { CurrentUser } from "@edr/api-common";
|
|
import { SUPPORT_ATTACHMENT_RESOURCE } from "@edr/types";
|
|
import {
|
|
Controller,
|
|
ForbiddenException,
|
|
Get,
|
|
NotFoundException,
|
|
Param,
|
|
ParseUUIDPipe,
|
|
Query,
|
|
Res,
|
|
} from "@nestjs/common";
|
|
import {
|
|
ApiBearerAuth,
|
|
ApiOperation,
|
|
ApiQuery,
|
|
ApiTags,
|
|
} from "@nestjs/swagger";
|
|
import { Response } from "express";
|
|
|
|
import { MixedAudience } from "../../common/booking-guards";
|
|
import {
|
|
AuthUserPayload,
|
|
resolveAuthUserId,
|
|
} from "../../common/resolve-auth-user-id";
|
|
import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
|
|
import { FilesService } from "../files/files.service";
|
|
import { SupportChatService } from "./support-chat.service";
|
|
|
|
/**
|
|
* Authenticated download for chat attachments.
|
|
*
|
|
* This exists instead of reusing `GET /files/:fileId` because that route streams
|
|
* any file to any authenticated caller who knows its UUID — fine-ish for a
|
|
* booking document the caller already had a link to, not fine for chat, where
|
|
* one customer guessing another's file id would be a cross-tenant leak. That
|
|
* route now refuses `support_message` files outright and points here.
|
|
*
|
|
* Inline previews still use the short-lived signed URL on the message DTO — a
|
|
* browser `<img>` can't send a Bearer token. This route is for explicit
|
|
* downloads and for clients that would rather stream through the API.
|
|
*/
|
|
@ApiTags("support-chat")
|
|
@ApiBearerAuth()
|
|
@Controller("support/attachments")
|
|
export class SupportAttachmentController {
|
|
constructor(
|
|
private readonly files: FilesService,
|
|
private readonly chat: SupportChatService,
|
|
) {}
|
|
|
|
@Get(":fileId")
|
|
@MixedAudience(FREIGHT_PERMS.support.agentView)
|
|
@ApiOperation({
|
|
summary: "Download a support chat attachment",
|
|
description:
|
|
"Streams the file only if the caller is backoffice staff or belongs to the " +
|
|
"company that owns the thread the attachment was posted in.",
|
|
})
|
|
@ApiQuery({
|
|
name: "download",
|
|
required: false,
|
|
description: "Set to 1/true to force a download instead of inline preview.",
|
|
})
|
|
async download(
|
|
@CurrentUser() user: AuthUserPayload,
|
|
@Param("fileId", ParseUUIDPipe) fileId: string,
|
|
@Query("download") download: string | undefined,
|
|
@Res() res: Response,
|
|
) {
|
|
const record = await this.files.findById(fileId);
|
|
|
|
// Don't let this route become a second general-purpose file endpoint: it can
|
|
// only vouch for chat attachments, so anything else is a 404 (not a 403 —
|
|
// no reason to confirm the id exists).
|
|
if (record.resource !== SUPPORT_ATTACHMENT_RESOURCE) {
|
|
throw new NotFoundException(`File ${fileId} not found`);
|
|
}
|
|
|
|
const allowed = await this.chat.canUserAccessMessage(
|
|
record.resourceId,
|
|
resolveAuthUserId(user),
|
|
);
|
|
if (!allowed) {
|
|
throw new ForbiddenException(
|
|
"This attachment belongs to another company's conversation.",
|
|
);
|
|
}
|
|
|
|
const { stream } = await this.files.streamById(fileId);
|
|
const forceDownload = download === "1" || download === "true";
|
|
|
|
res.setHeader("Content-Type", record.mimeType);
|
|
res.setHeader(
|
|
"Content-Disposition",
|
|
`${forceDownload ? "attachment" : "inline"}; filename="${record.name}"`,
|
|
);
|
|
// Private only — this response is scoped to one caller's authorization, so a
|
|
// shared cache must never reuse it for the next person asking.
|
|
res.setHeader("Cache-Control", "private, max-age=300");
|
|
stream.pipe(res);
|
|
}
|
|
}
|