first

apps/attachments/views.py

@@ -0,0 +1,30 @@
+import mimetypes
+from django.conf import settings
+from django.core.exceptions import PermissionDenied
+from django.http import FileResponse
+from django.shortcuts import get_object_or_404
+from apps.tickets.policies import TicketPolicy
+from apps.accounts.magic_access import get_ticket_magic_access
+from .delivery import signed_media_redirect
+from .models import Attachment
+def _authorized_attachment(request,public_id):
+    attachment=get_object_or_404(Attachment.objects.select_related("message__ticket"),public_id=public_id); ticket=attachment.message.ticket
+    magic_link = None if request.user.is_authenticated else get_ticket_magic_access(request,ticket)
+    if not TicketPolicy.can_view(request.user,ticket) and not magic_link: raise PermissionDenied
+    if attachment.message.is_internal and (magic_link or getattr(request.user,"account_type",None)=="CUSTOMER"): raise PermissionDenied
+    if attachment.message.deleted_at and not request.user.has_perm("messaging.view_deleted_message_content"): raise PermissionDenied
+    return attachment
+def view(request,public_id):
+    attachment=_authorized_attachment(request,public_id)
+    if settings.USE_NGINX_MEDIA:
+        return signed_media_redirect(attachment.relative_path)
+    content_type=attachment.mime_type or mimetypes.guess_type(attachment.original_name)[0] or "application/octet-stream"
+    response=FileResponse(attachment.file.open("rb"),content_type=content_type)
+    response["Content-Disposition"]=f'inline; filename="{attachment.original_name}"'
+    response["X-Content-Type-Options"]="nosniff"
+    return response
+def download(request,public_id):
+    attachment=_authorized_attachment(request,public_id)
+    if settings.USE_NGINX_MEDIA:
+        return signed_media_redirect(attachment.relative_path, download=True)
+    return FileResponse(attachment.file.open("rb"),as_attachment=True,filename=attachment.original_name)