Adriano Dal Pastro
fd571c479e
- setup: validate roles against users.VALID_ROLES (Supervisor was missing) - files: fix path traversal prefix-match edge case (is_relative_to), dedupe path validation into resolve_upload_path(), use logging not print - measurements: extract shared _build_measurement_filters() helper - client app: prevent open redirect via Referer on /set-language - maker: guard resp.json() in parse-technical-sheet proxy - measure/maker: extract shared file proxy into services/file_proxy.py - measure: localize supervisor validation error messages - annotation-editor: remove global keydown listener in destroy() Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
26 lines
843 B
Python
26 lines
843 B
Python
"""Shared file proxy: relay uploads from the FastAPI server to the browser.
|
|
|
|
The browser can't send the X-API-Key header directly, so blueprints expose
|
|
a proxy route and delegate here.
|
|
"""
|
|
import requests as http_requests
|
|
from flask import Response, session
|
|
|
|
from config import Config
|
|
|
|
|
|
def proxy_file(file_path: str) -> Response:
|
|
"""Fetch a file from the API server and relay it with its content type."""
|
|
base_url = Config.API_SERVER_URL.rstrip("/")
|
|
resp = http_requests.get(
|
|
f"{base_url}/api/files/{file_path}",
|
|
headers={"X-API-Key": session.get("api_key", "")},
|
|
timeout=30,
|
|
)
|
|
if resp.status_code != 200:
|
|
return Response(resp.text, status=resp.status_code)
|
|
return Response(
|
|
resp.content,
|
|
content_type=resp.headers.get("content-type", "application/octet-stream"),
|
|
)
|