from pathlib import Path

from django.conf import settings
from django.http import FileResponse, Http404
from django.views.decorators.http import require_safe


@require_safe
def protected_media(request, path):
    """Download company uploads through the application authentication gate.

    The invited pilot has one company per deployment. MEDIA_ROOT must contain
    uploads only; operational databases and credentials live outside this root.
    """
    root = Path(settings.MEDIA_ROOT).resolve()
    try:
        target = (root / path).resolve()
        if not target.is_relative_to(root) or not target.is_file():
            raise Http404
        file = target.open('rb')
    except (OSError, RuntimeError, ValueError) as exc:
        raise Http404 from exc
    return FileResponse(file, as_attachment=True, filename=target.name)