uploads.py

import os
from flask import Blueprint, current_app, send_from_directory, abort


def _send_upload_file(filename: str):
    upload_dir = current_app.config.get("UPLOAD_DIR", "./uploads")
    if ".." in filename or filename.startswith("/"):
        abort(400)
    if not os.path.exists(os.path.join(upload_dir, filename)):
        abort(404)
    return send_from_directory(upload_dir, filename)


# /uploads/... — keep for backwards compatibility and direct nginx rules
bp = Blueprint("uploads", __name__, url_prefix="/uploads")


@bp.get("/<path:filename>")
def get_upload(filename: str):
    return _send_upload_file(filename)


# /api/uploads/... — same files; works when only /api/ is proxied to Flask (common)
bp_api = Blueprint("uploads_api", __name__, url_prefix="/api/uploads")


@bp_api.get("/<path:filename>")
def get_upload_via_api(filename: str):
    return _send_upload_file(filename)