Serving Files

The local provider has dedicated URL logic so the UI can ask for an openable file URL without knowing whether the file lives on disk, object storage, or a signed endpoint.

Actual route shape

The local server route handler is built around a catch-all route such as:

/api/drive/files/:id?variant=main&disposition=inline

The implementation parses variant and disposition, looks up the node, checks asset visibility, and redirects to the resolved storage URL.

Things to decide in your app

• whether files are public or signed
• whether previews use transformed URLs
• how long temporary URLs stay valid
• whether access checks happen on every open request

Security note

Private assets are not just hidden in the UI. The route handler checks for a session before redirecting to a private file URL. Keep that check on the server boundary even if your screen is already permission-gated.