Class: Livechat::AttachmentsController

Inherits:
ApplicationController show all
Defined in:
app/controllers/livechat/attachments_controller.rb

Overview

Serves message attachments through the engine — never a public Active Storage URL — so every download is gated the same way the rest of the chat is: you get the file only if you can work the inbox, or you are the visitor whose conversation it belongs to. Streamed inline (not redirected to a signed blob URL), so no long-lived link ever escapes the gate.

Instance Method Summary collapse

Instance Method Details

#show ⇒ Object 



10
11
12
13
14
15
16
17
18
19
 
# File 'app/controllers/livechat/attachments_controller.rb', line 10

def show
  attachment = find_attachment
  return head :not_found unless attachment

  message = attachment.record
  return head :forbidden unless message.is_a?(Livechat::Message) &&
                                authorized_for?(message.conversation)

  stream(attachment.blob)
end