From 1a31a29680860df5418a6c6770d6502fba07018c Mon Sep 17 00:00:00 2001
From: Methapon Metanipat <methapon@frappet.com>
Date: Fri, 1 Nov 2024 17:34:36 +0700
Subject: [PATCH] feat: add security to endpoint

---
 src/controllers/05-payment-controller.ts   | 1 -
 src/controllers/05-quotation-controller.ts | 3 ++-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/controllers/05-payment-controller.ts b/src/controllers/05-payment-controller.ts
index 63d7bd7..622ce10 100644
--- a/src/controllers/05-payment-controller.ts
+++ b/src/controllers/05-payment-controller.ts
@@ -231,7 +231,6 @@ export class PaymentFileController extends Controller {
   }
 
   @Get("{name}")
-  @Security("keycloak")
   async getAttachment(
     @Request() req: RequestWithUser,
     @Path() paymentId: string,
diff --git a/src/controllers/05-quotation-controller.ts b/src/controllers/05-quotation-controller.ts
index 052a558..c3e2d26 100644
--- a/src/controllers/05-quotation-controller.ts
+++ b/src/controllers/05-quotation-controller.ts
@@ -842,13 +842,14 @@ export class QuotationFileController extends Controller {
   }
 
   @Get("{name}")
+  @Security("keycloak")
   async getAttachment(
     @Request() req: RequestWithUser,
     @Path() quotationId: string,
     @Path() name: string,
   ) {
     await this.checkPermission(req.user, quotationId);
-    return req.res?.redirect(await getFile(fileLocation.quotation.attachment(quotationId, name)));
+    return await getFile(fileLocation.quotation.attachment(quotationId, name));
   }
 
   @Put("{name}")