internal/api/routes/files.go

@@ -4,6 +4,7 @@ import (
 	"encoding/base64"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -63,7 +64,17 @@ func RegisterFileRoutes(cfg *types.StereoConfig, api *gin.RouterGroup) {
 
 	api.GET("/:name", func(c *gin.Context) {
 		name := c.Param("name")
-		path := filepath.Join(cfg.ImagePath, name)
+		parts := strings.SplitN(name, "_", 2)
+		if len(parts) != 2 {
+			c.JSON(400, gin.H{"error": "invalid file name"})
+			return
+		}
+		uid, filename := parts[0], parts[1]
+		path := filepath.Join(cfg.ImagePath, uid, filename)
+		if _, err := os.Stat(path); err != nil {
+			c.JSON(404, gin.H{"error": "file not found"})
+			return
+		}
 		c.File(path)
 	})