启动与授权-初步优化

backend/app/api/v1/attachments.py

@@ -1,6 +1,7 @@
 import os
 import uuid
 from pathlib import Path
+from urllib.parse import quote
 
 import aiofiles
 from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status, Request
@@ -23,6 +24,12 @@ global_router = APIRouter()
 UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
 
 
+def _content_disposition(filename: str, disposition: str = "inline") -> str:
+    fallback = "".join((ch if ord(ch) < 128 else "_") for ch in filename) or "download"
+    quoted = quote(filename, safe="")
+    return f"{disposition}; filename=\"{fallback}\"; filename*=UTF-8''{quoted}"
+
+
 async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     study = await study_crud.get(db, study_id)
     if not study:
@@ -79,6 +86,7 @@ async def upload_attachment(
         id=attachment.id,
         filename=attachment.filename,
         file_size=attachment.file_size,
+        content_type=attachment.content_type,
         uploaded_by=UserDisplay.model_validate(current_user) if current_user else None,
         uploaded_by_id=attachment.uploaded_by,
         uploaded_at=attachment.uploaded_at,
@@ -108,6 +116,7 @@ async def list_attachments(
                 id=a.id,
                 filename=a.filename,
                 file_size=a.file_size,
+                content_type=a.content_type,
                 uploaded_by=UserDisplay.model_validate(user) if user else None,
                 uploaded_by_id=a.uploaded_by,
                 uploaded_at=a.uploaded_at,
@@ -137,7 +146,32 @@ async def download_attachment(
         path=attachment.file_path,
         filename=attachment.filename,
         media_type=attachment.content_type or "application/octet-stream",
-        headers={"Content-Disposition": f'inline; filename="{attachment.filename}"'},
+        headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="attachment")},
+    )
+
+
+@router.get(
+    "/{attachment_id}/preview",
+    dependencies=[Depends(require_study_member())],
+)
+async def preview_attachment(
+    study_id: uuid.UUID,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    attachment_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+) -> FileResponse:
+    await _ensure_study_exists(db, study_id)
+    attachment = await attachment_crud.get_attachment(db, attachment_id)
+    if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
+    if not os.path.exists(attachment.file_path):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
+    return FileResponse(
+        path=attachment.file_path,
+        filename=attachment.filename,
+        media_type=attachment.content_type or "application/octet-stream",
+        headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="inline")},
     )
 
 
@@ -182,7 +216,31 @@ async def global_download_attachment(
         path=attachment.file_path,
         filename=attachment.filename,
         media_type=attachment.content_type or "application/octet-stream",
-        headers={"Content-Disposition": f'inline; filename="{attachment.filename}"'},
+        headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="attachment")},
+    )
+
+
+@global_router.get(
+    "/{attachment_id}/preview",
+    response_class=FileResponse,
+)
+async def global_preview_attachment(
+    attachment_id: uuid.UUID,
+    request: Request,
+    db: AsyncSession = Depends(get_db_session),
+):
+    attachment = await attachment_crud.get_attachment(db, attachment_id)
+    if not attachment:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
+    await _ensure_study_exists(db, attachment.study_id)
+    await _authorize_global(request, db, attachment.study_id)
+    if not os.path.exists(attachment.file_path):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
+    return FileResponse(
+        path=attachment.file_path,
+        filename=attachment.filename,
+        media_type=attachment.content_type or "application/octet-stream",
+        headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="inline")},
     )