jimmy/nas-tools
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Fix file download authentication with public router #55

Merged
jimmy merged 1 commits from dev into main 2026-04-21 22:14:49 +08:00
Conversation 0 Commits 1 Files Changed 2
+5 -2
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit e35319f881 - Show all commits
dashboard/backend/main.py
+3 -1
View File
@@ -279,8 +279,10 @@ app.include_router(
gitea.router, prefix="/api/gitea", dependencies=[Depends(_inject_user), Depends(require_page("gitea"))] gitea.router, prefix="/api/gitea", dependencies=[Depends(_inject_user), Depends(require_page("gitea"))]
) )
app.include_router( app.include_router(
files.router, prefix="/api/files" files.router, prefix="/api/files", dependencies=[Depends(_inject_user)]
) )
# Public file download endpoint (no auth required for token-based downloads)
app.include_router(files.public_router, prefix="/api/files")
app.include_router( app.include_router(
system.router, prefix="/api/system", dependencies=[Depends(_inject_user), Depends(require_page("dashboard"))] system.router, prefix="/api/system", dependencies=[Depends(_inject_user), Depends(require_page("dashboard"))]
) )
dashboard/backend/routers/files.py
+2 -1
View File
@@ -13,6 +13,7 @@ from config import VOLUME_ROOT
from rbac import require_admin from rbac import require_admin
router = APIRouter() router = APIRouter()
public_router = APIRouter() # For endpoints that don't require auth
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)
BASE = Path(VOLUME_ROOT) BASE = Path(VOLUME_ROOT)
@@ -117,7 +118,7 @@ def create_download_token(path: str):
raise HTTPException(status_code=403, detail="Access denied") raise HTTPException(status_code=403, detail="Access denied")
@router.get("/download") @public_router.get("/download")
def download(path: str = None, token: str = Query(None)): def download(path: str = None, token: str = Query(None)):
"""Download a file. Supports both authenticated access (path param) and token-based access (token param).""" """Download a file. Supports both authenticated access (path param) and token-based access (token param)."""
try: try: