Lars
b752883392
All checks were successful
Deploy Development / deploy (push) Successful in 41s
Test Suite / pytest-backend (push) Successful in 23s
Test Suite / lint-backend (push) Successful in 0s
Test Suite / build-frontend (push) Successful in 7s
Test Suite / playwright-tests (push) Successful in 25s
- Updated PostgreSQL binding in docker-compose to restrict access to localhost only. - Implemented a new API endpoint for secure media file delivery, requiring authentication via token. - Enhanced governance checks for exercise media access, ensuring only authorized users can retrieve files. - Updated frontend components to utilize the new media file access method, improving user experience while maintaining security. - Documented changes in production readiness audit and access layer endpoint audit for clarity on security enhancements.
20 lines
829 B
JavaScript
20 lines
829 B
JavaScript
/** URL für Übungs-Mediendateien: API mit Token (Legacy /media/ ohne Auth ist abgeschaltet). */
|
|
|
|
const API_BASE = (import.meta.env.VITE_API_URL || '').replace(/\/$/, '')
|
|
|
|
/**
|
|
* @param {number|string} exerciseId
|
|
* @param {object} media — exercise_media Zeile mit id, file_path
|
|
* @returns {string|null}
|
|
*/
|
|
export function resolveExerciseMediaFileUrl(exerciseId, media) {
|
|
if (!media?.file_path) return null
|
|
const fp = String(media.file_path)
|
|
if (fp.startsWith('http://') || fp.startsWith('https://')) return fp
|
|
const token = typeof localStorage !== 'undefined' ? localStorage.getItem('authToken') : ''
|
|
const q = token ? `?ssetoken=${encodeURIComponent(token)}` : ''
|
|
const id = media.id
|
|
if (id == null || exerciseId == null) return null
|
|
return `${API_BASE}/api/exercises/${exerciseId}/media/${id}/file${q}`
|
|
}
|