
    ]i                     6   d Z ddlZddlmZ ddlmZmZmZmZ ddl	m
Z
mZ ddlmZ ddlmZ  e       Z ed      j#                         Zej'                  d	d
       ee      fdededefd       Zej'                  dd
       ee      fdedede
fd       Zy)u   Authenticated file serving — replaces the public StaticFiles mount.

All uploads are private. Every request must carry a valid access_token cookie.
Path traversal is blocked by resolving against UPLOAD_DIR and checking the prefix.
    N)Path)	APIRouterDependsHTTPExceptionstatus)FileResponseStreamingResponse)get_current_user)Useruploadsz/files/gdrive/{file_id}F)include_in_schemafile_idcurrent_userreturnc                    K   	 ddl m}  ||       \  }}t        t        j                  |      |      S # t        $ r t        t        j
                  d      w xY ww)zProxy a Google Drive file to the authenticated frontend user.

    Fetches from GDrive using the backend service account and streams back.
    This avoids hotlink 403s that occur when the browser requests GDrive directly.
    r   )gdrive_fetchz$File tidak ditemukan di Google Drivestatus_codedetail)
media_type)	app.utils.gdriver   	Exceptionr   r   HTTP_404_NOT_FOUNDr	   ioBytesIO)r   r   r   contentcontent_types        3/var/www/html/spbu.com/backend/app/routers/files.pyserve_gdrive_filer      s^     
1 ,W 5 RZZ0\JJ  
119
 	

s   A5  A%AAz/files/{file_path:path}	file_pathc                 `  K   t         | z  j                         }t        |      j                  t        t               dz         s$|t         k7  rt	        t
        j                  d      |j                         r|j                         st	        t
        j                  d      t        |      S w)u   Serve an uploaded file. Requires a valid session (access_token cookie).

    Path traversal protection: any path that resolves outside UPLOAD_DIR → 403.
    /zAccess deniedr   zFile tidak ditemukan)
UPLOAD_DIRresolvestr
startswithr   r   HTTP_403_FORBIDDENexistsis_filer   r   )r    r   	full_paths      r   
serve_filer+   +   s      i'002I y>$$S_s%:;	Z@W11"
 	

 Y%6%6%811)
 	

 	""s   B,B.)__doc__r   pathlibr   fastapir   r   r   r   fastapi.responsesr   r	   app.dependenciesr
   app.models.userr   routerr$   r#   getr%   r   r+        r   <module>r6      s    
  = = = -  	 )_$$&
 %? !!12KKK K @K( %? !!12### # @#r5   