const fs = require('fs'); const path = require('path'); const Errors = { ATTACHMENT_NOT_FOUND: { attachmentNotFound: 'Attachment not found', }, }; module.exports = { inputs: { id: { type: 'string', regex: /^[0-9]+$/, required: true, }, }, exits: { attachmentNotFound: { responseType: 'notFound', }, }, async fn(inputs, exits) { const { currentUser } = this.req; const { attachment, card, project } = await sails.helpers.attachments .getProjectPath(inputs.id) .intercept('pathNotFound', () => Errors.ATTACHMENT_NOT_FOUND); const isBoardMember = await sails.helpers.users.isBoardMember(currentUser.id, card.boardId); if (!isBoardMember) { const isProjectManager = await sails.helpers.users.isProjectManager( currentUser.id, project.id, ); if (!isProjectManager) { throw Errors.ATTACHMENT_NOT_FOUND; // Forbidden } } const filePath = path.join( sails.config.custom.attachmentsPath, attachment.dirname, attachment.filename, ); if (!fs.existsSync(filePath)) { throw Errors.ATTACHMENT_NOT_FOUND; } this.res.type(attachment.filename); if (!attachment.isImage && path.extname(attachment.filename) !== '.pdf') { this.res.set('Content-Disposition', 'attachment'); } this.res.set('Cache-Control', 'private, max-age=900'); // TODO: move to config return exits.success(fs.createReadStream(filePath)); }, };