denuncias

Antifraude.Net/GestionaDenunciasAN/Program.cs

@@ -77,7 +77,7 @@ app.Use(async (context, next) =>
     context.Response.Headers.XContentTypeOptions = "nosniff";
     context.Response.Headers["Referrer-Policy"] = "no-referrer";
     context.Response.Headers.ContentSecurityPolicy =
-        "default-src 'self'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data:; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net";
+        "default-src 'self'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; font-src 'self' data: https://cdn.jsdelivr.net; img-src 'self' data:; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net";
     await next();
 });
 
@@ -403,6 +403,48 @@ api.MapPost("/auth/logout", async (
     return Results.Ok(new { ok = true });
 }).DisableAntiforgery();
 
+api.MapGet("/denuncias/{denunciaId:int}/ficheros/content", async (
+    int denunciaId,
+    string fileName,
+    HttpContext httpContext,
+    IHttpClientFactory httpClientFactory,
+    CancellationToken cancellationToken) =>
+{
+    if (string.IsNullOrWhiteSpace(fileName))
+    {
+        return Results.BadRequest(new ApiError("Nombre de fichero obligatorio."));
+    }
+
+    var token = httpContext.User.FindFirst(ApiDenunciasClient.AccessTokenClaim)?.Value;
+    if (string.IsNullOrWhiteSpace(token))
+    {
+        return Results.Unauthorized();
+    }
+
+    var client = httpClientFactory.CreateClient(ApiDenunciasClient.HttpClientName);
+    var path = $"api/denuncias/{denunciaId}/ficheros/content?fileName={Uri.EscapeDataString(fileName)}";
+    using var request = new HttpRequestMessage(HttpMethod.Get, path);
+    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
+
+    using var response = await client.SendAsync(request, cancellationToken);
+    if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+    {
+        return Results.NotFound();
+    }
+
+    if (!response.IsSuccessStatusCode)
+    {
+        var message = await response.Content.ReadAsStringAsync(cancellationToken);
+        return Results.Problem(message, statusCode: (int)response.StatusCode);
+    }
+
+    var bytes = await response.Content.ReadAsByteArrayAsync(cancellationToken);
+    var contentType = response.Content.Headers.ContentType?.ToString() ?? "application/octet-stream";
+
+    httpContext.Response.Headers.CacheControl = "no-store";
+    return Results.File(bytes, contentType, enableRangeProcessing: true);
+}).RequireAuthorization();
+
 app.MapRazorComponents<App>()
     .AddInteractiveServerRenderMode();