Merge branch 'main' into policy-results

api/evidence.py

@@ -3,6 +3,7 @@ import json
 from flask import Blueprint, request, jsonify, send_file, current_app
 from flask_jwt_extended import get_jwt_identity
 from werkzeug.utils import secure_filename
+from sqlalchemy import func
 from models import Attestation, UploadSession, User, Webhook, webhook_type_attestation_finalized
 from app import db
 from auth import jwt_required_with_logging, get_current_user_safe
@@ -195,7 +196,7 @@ def list_evidence():
         
         # Apply filters from AllContext data
         for key, value in data.items():
-            if key == 'product_key':
+            if key == 'name' or key == 'product_key':
                 query = query.filter(Attestation.product_key == value)
             elif key == 'product_version':
                 query = query.filter(Attestation.product_version == value)
@@ -213,7 +214,12 @@ def list_evidence():
                 # Filter by labels in context
                 for label in value:
                     query = query.filter(Attestation.context['labels'].astext.contains(label))
-        
+            elif value is not None and value is not '' and value is not False:
+                if db.engine.dialect.name == 'sqlite':
+                    query = query.filter(func.json_extract(Attestation.context, f'$.{key}') == str(value))
+                else: # PostgreSQL
+                    query = query.filter(Attestation.context[key].astext == str(value))
+
         # Get all matching results
         attestations = query.all()
         
@@ -409,6 +415,55 @@ def upload_file(file_id):
         )
         return jsonify({'error': str(e)}), 500
 
+@evidence_bp.route('/evidence/download/<path:storage_path>', methods=['GET'])
+def evidence_download(storage_path):
+    """Direct file download for local storage - API access to attestation files
+    This endpoint is public (no auth required) similar to a pre-signed URL"""
+    try:
+        config = current_app.config.get('STORAGE_CONFIG')
+        
+        if config.STORAGE_TYPE != 'FILE_MOUNT':
+            # For non-local storage, redirect to presigned URL
+            storage = get_storage_backend()
+            download_url = storage.generate_download_url(storage_path)
+            return jsonify({'download_url': download_url}), 302
+        
+        # For local storage, serve the file directly
+        file_path = os.path.join(config.FILE_STORAGE_PATH, storage_path)
+        
+        if not os.path.exists(file_path):
+            return jsonify({'error': 'File not found'}), 404
+        
+        log_event(
+            severity=6,
+            message=f"API file downloaded: {storage_path}",
+            event_type="api_file_downloaded"
+        )
+
+        # Determine content type based on file extension
+        content_type = None
+        if file_path.endswith(".json"):
+            content_type = "application/json"
+        elif file_path.endswith(".bin"):
+            # Try to infer from path or default to octet-stream
+            content_type = "application/octet-stream"
+        
+        # Serve the file directly
+        return send_file(
+            file_path, 
+            mimetype=content_type, 
+            as_attachment=True,
+            download_name=os.path.basename(file_path)
+        )
+        
+    except Exception as e:
+        log_event(
+            severity=3,
+            message=f"API download error: {str(e)}",
+            event_type="api_download_error"
+        )
+        return jsonify({'error': str(e)}), 500
+
 @evidence_bp.route('/evidence/finish', methods=['POST'])
 @jwt_required_with_logging
 def finish_attestation():

storage.py

@@ -55,7 +55,9 @@ class FileStorageBackend(StorageBackend):
     
     def generate_download_url(self, storage_path):
         """Generate download URL for local files"""
-        return urljoin(self.base_url, storage_path)
+        # For API access, prepend 'evidence/download/' to the storage path
+        api_path = f"evidence/download/{storage_path}"
+        return urljoin(self.base_url, api_path)
     
     def delete_file(self, storage_path):
         """Delete local file"""