feat: MC Report System - MySQL + Express + Vanilla JS SPA

backend/routes/uploads.js

@@ -0,0 +1,23 @@
+const express = require('express');
+const path = require('path');
+const fs = require('fs');
+const { getRow } = require('../db');
+const { authenticate } = require('../middleware/auth');
+const { UPLOAD_DIR } = require('../middleware/upload');
+
+const router = express.Router();
+
+router.get('/:storedName', authenticate, async (req, res) => {
+  const att = await getRow('SELECT * FROM attachments WHERE stored_name = ?', [req.params.storedName]);
+  if (!att) return res.status(404).json({ error: '文件不存在' });
+  const ticket = await getRow('SELECT * FROM tickets WHERE id = ?', [att.ticket_id]);
+  if (req.user.role === 'player' && ticket?.user_id !== req.user.id) return res.status(403).json({ error: '无权限' });
+  const filePath = path.join(UPLOAD_DIR, att.stored_name);
+  if (!fs.existsSync(filePath)) return res.status(404).json({ error: '文件不存在' });
+  res.setHeader('Content-Type', att.mime_type);
+  res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(att.original_name)}"`);
+  res.setHeader('Cache-Control', 'private, max-age=86400');
+  fs.createReadStream(filePath).pipe(res);
+});
+
+module.exports = router;