Function previewAttachment

internal/server/http/attachments.go:97–126

(db *sql.DB, store *storage.AttachmentStore, table string)

}

func previewAttachment(db *sql.DB, store *storage.AttachmentStore, table string) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		eventUUID := r.PathValue("eventUuid")
		uuid := r.PathValue("uuid")

		var name, path, mime string
		var storedEventUUID string
		err := db.QueryRowContext(r.Context(),
			"SELECT event_uuid, name, path, mime FROM "+table+" WHERE uuid = ?", uuid,
		).Scan(&storedEventUUID, &name, &path, &mime)
		if err != nil {
			http.Error(w, "attachment not found", 404)
			return
		}

		if storedEventUUID != eventUUID {
			http.Error(w, "forbidden", 403)
			return
		}

		data, err := store.Get(path)
		if err != nil {
			http.Error(w, "file not found", 404)
			return
		}

		w.Header().Set("Content-Type", mime)
		w.Write(data)
	}
}