~NAXC~

File Content: `FileController.php`

<?php

namespace App\Http\Controllers;

use App\Models\File;
use Exception;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Facades\URL;

class FileController extends Controller
{
    /**
     * @OA\Get(
     *  path="/api/secure-file/{file_id}",
     *  summary="Download any private file directly",
     *  tags={"Files"},
     *  @OA\Parameter(name="role", in="header", required=true, @OA\Schema(type="string")),
     *  @OA\Parameter(name="file_id", in="path", required=true, @OA\Schema(type="integer")),
     *  @OA\Response(response="200", description="File download"),
     *  @OA\Response(response="403", description="Access denied"),
     *  @OA\Response(response="404", description="File not found")
     * )
     */
    public function secureFileAccess(Request $request, $fileId)
    {
        try {
            // role from header or query param
            $role = $request->header('role') ?? $request->get('role');
            // event admin
            if ($role != 'event_admin')
                return response([
                    'status' => false,
                    'message' => 'Access denied'
                ], 403);

            // Rate limiting for security
            $key = 'file_access:' . $request->ip();
            $attempts = cache()->get($key, 0);
            
            if ($attempts >= 100) { // 100 requests per hour
                return response([
                    'status' => false,
                    'message' => 'Too many requests'
                ], 429);
            }
            
            cache()->put($key, $attempts + 1, 3600); // 1 hour

            $file = File::find($fileId);
            if (!$file) abort(404);

            // Direct file download
            $filePath = $file->filepath . $file->save_name;
            return Storage::download($filePath, $file->filename);
            
        } catch (Exception $e) {
            return response()->json(['status' => false, 'message' => 'Server error'], 500);
        }
    }


}
File Content: FileController.php

File Content: `FileController.php`
