23 lines
895 B
Python
23 lines
895 B
Python
"""Storage-backed document delivery, called only after document ACL checks."""
|
|
|
|
from django.conf import settings
|
|
|
|
from eusrr_backend.protected_media import protected_file_response
|
|
|
|
|
|
def document_file_response(attachment, *, filename: str, as_attachment: bool = True):
|
|
"""Stream locally via an internal nginx location, after caller checks ACL.
|
|
|
|
Resolve symlinks and reject paths outside the document storage root. Never
|
|
forward an arbitrary filesystem path to nginx. Remote storage and local
|
|
development keep the regular storage-backed FileResponse fallback.
|
|
"""
|
|
return protected_file_response(
|
|
attachment,
|
|
filename=filename,
|
|
as_attachment=as_attachment,
|
|
storage_directory="documents",
|
|
internal_prefix=settings.DOCUMENTS_X_ACCEL_REDIRECT_PREFIX,
|
|
use_x_accel=getattr(settings, "DOCUMENTS_USE_X_ACCEL_REDIRECT", False),
|
|
)
|