@@ -1529,25 +1529,25 @@ async def get_storage_file(
15291529):
15301530 """Get a file from the storage client if it supports direct downloads."""
15311531 from chainlit .data import get_data_layer
1532-
1532+
15331533 data_layer = get_data_layer ()
15341534 if not data_layer or not data_layer .storage_client :
15351535 raise HTTPException (
15361536 status_code = 404 ,
15371537 detail = "Storage not configured" ,
15381538 )
1539-
1539+
15401540 # Validate user authentication
15411541 if not current_user :
15421542 raise HTTPException (status_code = 401 , detail = "Unauthorized" )
1543-
1543+
15441544 # Extract thread_id from object_key to validate thread ownership
15451545 # Object key patterns:
15461546 # 1. threads/{thread_id}/files/{element.id} (chainlit_data_layer)
1547- # 2. {user_id}/{thread_id}/{element.id} (dynamodb)
1547+ # 2. {user_id}/{thread_id}/{element.id} (dynamodb)
15481548 # 3. {user_id}/{element.id}[/{element.name}] (sql_alchemy)
15491549 thread_id = None
1550-
1550+
15511551 # Try to extract thread_id from different patterns
15521552 parts = object_key .split ("/" )
15531553 if len (parts ) >= 3 :
@@ -1565,7 +1565,7 @@ async def get_storage_file(
15651565 except HTTPException :
15661566 # Not a valid thread or user doesn't have access
15671567 pass
1568-
1568+
15691569 # If we found a thread_id, validate thread ownership
15701570 if thread_id :
15711571 await is_thread_author (current_user .identifier , thread_id )
@@ -1576,10 +1576,10 @@ async def get_storage_file(
15761576 user_id_in_path = parts [0 ]
15771577 if user_id_in_path != current_user .identifier :
15781578 raise HTTPException (
1579- status_code = 403 ,
1580- detail = "Access denied: file belongs to different user"
1579+ status_code = 403 ,
1580+ detail = "Access denied: file belongs to different user" ,
15811581 )
1582-
1582+
15831583 # Try to extract element_id and get the original filename from database
15841584 element_id = None
15851585 element_name = None
@@ -1610,7 +1610,7 @@ async def get_storage_file(
16101610 return Response (
16111611 content = content ,
16121612 media_type = mime_type ,
1613- headers = {"Content-Disposition" : f"inline; filename={ filename } " }
1613+ headers = {"Content-Disposition" : f"inline; filename={ filename } " },
16141614 )
16151615
16161616
0 commit comments