Method assetHandler

admin/server/assets.go:171–249

assetHandler serves a previously uploaded file asset. If the asset is marked as public, it sets caching headers that allows CDNs and browsers to cache the asset. If the asset is not marked as public, it guarantees that the asset can only be accessed by authenticated users with read access to the ass

(w http.ResponseWriter, r *http.Request)

// If the asset is marked as public, it sets caching headers that allows CDNs and browsers to cache the asset.
// If the asset is not marked as public, it guarantees that the asset can only be accessed by authenticated users with read access to the asset's organization.
func (s *Server) assetHandler(w http.ResponseWriter, r *http.Request) error {
	// Params
	assetID := r.PathValue("asset_id")

	// Find the asset
	asset, err := s.admin.DB.FindAsset(r.Context(), assetID)
	if err != nil {
		return httputil.Error(http.StatusNotFound, err)
	}
	if asset.OrganizationID == nil {
		return httputil.Errorf(http.StatusNotFound, "the requested asset has been soft deleted")
	}

	// Check permissions
	claims := auth.GetClaims(r.Context())
	if !asset.Public && !claims.OrganizationPermissions(r.Context(), *asset.OrganizationID).ReadOrg {
		ok, err := s.admin.DB.CheckOrganizationHasPublicProjects(r.Context(), *asset.OrganizationID)
		if err != nil {
			return err
		}
		if !ok {
			return httputil.Errorf(http.StatusForbidden, "does not have permission to access the asset")
		}
	}

	// Parse the asset's path, which has the form "gs://<bucket>/<path>"
	u, err := url.Parse(asset.Path)
	if err != nil {
		return err
	}

	// Set caching headers if the asset is public
	if asset.Public {
		w.Header().Set("Cache-Control", "public, max-age=31536000")
	} else {
		w.Header().Set("Cache-Control", "no-store")
	}

	// Set the content type header
	found := false
	for _, t := range supportedAssetTypes {
		if strings.HasSuffix(u.Path, t.Extension) { // Using HasSuffix to correctly check multi-part extensions like .tar.gz
			w.Header().Set("Content-Type", t.MIMEType)
			found = true
			break
		}
	}
	if !found { // Fallback content type
		w.Header().Set("Content-Type", "application/octet-stream")
	}

	// Set the content disposition header
	// Using "attachment" as a security measure to prevent browsers from rendering the asset, which is a security vulnerability for e.g. SVGs containing scripts.
	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s", path.Base(u.Path)))

	// Set the status code
	w.WriteHeader(http.StatusOK)