"""/notes/{rel_path} — authenticated note-media file serving.

Port of v1 serve_note (main.py:8243-8250). The path strings stored in
``field_notes.audio_path`` / ``photo_paths`` (``YYYY-MM/<uuid>.<ext>``) are
served verbatim under /notes/, so migrated rows keep working.

Auth: /notes/ is NOT on the public allowlist, so the default-deny
AuthMiddleware requires a valid grant before this handler runs — same
posture as every /api route (v1 checked its session cookie here).

Safety: services/media.safe_note_path is the single traversal gate —
absolute paths, ``..`` segments and normalization escapes all resolve to
None → 404.
"""
from __future__ import annotations

from fastapi import APIRouter
from fastapi.responses import FileResponse

from ..errors import AppError
from ..services.media import MEDIA_NOT_FOUND, safe_note_path

router = APIRouter(tags=["media"])


@router.get("/notes/{rel_path:path}")
def serve_note_media(rel_path: str) -> FileResponse:
    abs_path = safe_note_path(rel_path)
    if not abs_path:
        raise AppError(MEDIA_NOT_FOUND, "not found", 404)
    return FileResponse(abs_path)