feat: add GET /api/files/{filename} route for citation PDF links

Adds a file-serving endpoint that returns uploaded PDFs from data/raw/
with path traversal protection (400) and 404 for missing files.
UPLOAD_DIR defined as a module-level constant for test monkeypatching.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/main.py

@@ -2,8 +2,9 @@ from contextlib import asynccontextmanager
 import time
 from pathlib import Path
 
-from fastapi import FastAPI, Request, Response
+from fastapi import FastAPI, HTTPException, Request, Response
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import FileResponse
 from fastapi.staticfiles import StaticFiles
 
 from server.retriever import get_retriever, get_vectorstore, has_documents
@@ -13,6 +14,9 @@ from server.memory import create_memory
 from server.chain import build_qa_chain
 from server.utils import configure_logging, setup_logger, log_memory_mb
 
+# Module-level constant so tests can monkeypatch it
+UPLOAD_DIR = Path("data/raw")
+
 configure_logging()
 logger = setup_logger(__name__)
 
@@ -82,6 +86,19 @@ app.include_router(workspaces.router, prefix="/api")
 async def health():
     return {"status": "ok", "version": "3.0.0"}
 
+
+@app.get("/api/files/{filename}")
+async def serve_file(filename: str) -> FileResponse:
+    """Serve uploaded files from data/raw/ for citation PDF links."""
+    upload_root = UPLOAD_DIR.resolve()
+    target = (UPLOAD_DIR / filename).resolve()
+    if not str(target).startswith(str(upload_root)):
+        raise HTTPException(status_code=400, detail="Invalid filename")
+    if not target.exists():
+        raise HTTPException(status_code=404, detail="File not found")
+    return FileResponse(str(target))
+
+
 # Serve React frontend build if it exists
 frontend_dist = Path(__file__).resolve().parent.parent / "frontend" / "dist"
 if frontend_dist.exists():

tests/test_file_serving.py

@@ -0,0 +1,45 @@
+import pytest
+from pathlib import Path
+from fastapi.testclient import TestClient
+
+
+def test_serve_existing_file(tmp_path, monkeypatch):
+    """Returns 200 + file content for a file that exists."""
+    fake_raw = tmp_path / "raw"
+    fake_raw.mkdir()
+    pdf = fake_raw / "report.pdf"
+    pdf.write_bytes(b"%PDF-1.4 fake")
+
+    monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)
+
+    from server.main import app
+    client = TestClient(app)
+    resp = client.get("/api/files/report.pdf")
+    assert resp.status_code == 200
+    assert resp.content == b"%PDF-1.4 fake"
+
+
+def test_serve_missing_file(tmp_path, monkeypatch):
+    """Returns 404 for a filename that doesn't exist."""
+    fake_raw = tmp_path / "raw"
+    fake_raw.mkdir()
+
+    monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)
+
+    from server.main import app
+    client = TestClient(app)
+    resp = client.get("/api/files/does_not_exist.pdf")
+    assert resp.status_code == 404
+
+
+def test_serve_blocks_path_traversal(tmp_path, monkeypatch):
+    """Returns 400 for path traversal attempts."""
+    fake_raw = tmp_path / "raw"
+    fake_raw.mkdir()
+
+    monkeypatch.setattr("server.main.UPLOAD_DIR", fake_raw)
+
+    from server.main import app
+    client = TestClient(app)
+    resp = client.get("/api/files/..%2F..%2Fetc%2Fpasswd")
+    assert resp.status_code in (400, 404)