Antylogic
DemoApp login

399 operational guides

Docs sections
DocsDocumentation
Device

Get Authenticated Docs Asset

Confirm that an authenticated app user can load a Docs media file through `/api/app/docs/assets/{path}` after app authentication, path cleaning, and asset-root checks.

In this article

Use this guide when a support, documentation, or QA operator needs to verify that a Docs article image or direct asset path is available for Harbor Demo User in the GB demo context.

The action is read-only. A successful request returns stored media bytes, not JSON, and the route does not upload, resize, convert, or check organisation-level permissions after app authentication.

Before you start

  • The backend is running with app routes registered and token validation enabled.
  • Harbor Demo User has an active app session or access token for Harbor Demo Group.
  • The account is active and not pending deletion.
  • `DOCS_ASSETS_PATH`, or the docs content `assets` fallback, points to the generated docs media root.
  • The file `iphone/light/en/calendars-view-reservations/reservations-calendar.png` exists under the docs asset root.

Instructions

  1. 1.

    Start From An Authenticated Session

    Sign in through the app before requesting the asset. The route accepts `Authorization: Bearer ...` or an `access_token` cookie, and blocks missing, invalid, or pending-deletion accounts before asset lookup.

  2. 2.

    Use The File Path As The Lookup Key

    Request the real path inside the asset root. Direct asset serving does not look up `asset_id`, `capture_id`, locale, platform, device, theme, or query text.

  3. 3.

    Request The Asset

    Open `GET /api/app/docs/assets/iphone/light/en/calendars-view-reservations/reservations-calendar.png` from the authenticated context. The asset handler serves the file directly and does not load `articles.json` for direct asset requests.

  4. 4.

    Confirm The File Response

    A successful GET renders the reservations calendar PNG. Recognised extensions set `Content-Type`, configured asset caching sets `Cache-Control`, and HEAD follows the same validation path without returning the body.

  5. 5.

    Verify The Article Consumer Path

    Open `antylogic://docs/reservations/en-calendars-view-reservations` in the authenticated app. The article detail response rewrites Docs media to `/api/app/docs/assets/{path}` before the Documentation screen renders the image URI.

  6. 6.

    Interpret Failures

    Use status codes to isolate the problem: 401 for authentication, 403 for pending deletion, 400 for invalid cleaned paths, 404 for missing files or directories, 405 for unsupported methods, and 503 for unconfigured Docs content.

Validations and limits

  • Authenticate the app request before route dispatch.
  • Block pending-deletion accounts except the explicit `/me` recovery allowlist, which does not include Docs assets.
  • Allow only GET and HEAD for Docs routes.
  • Require at least one path segment after `assets/`.
  • Clean the path with `path.Clean` and reject empty, dot, and parent-traversal forms.
  • Verify the resolved file path stays inside the configured docs asset root.
  • Reject missing files and directories.
  • Treat successful responses as media bytes; JSON is used for error responses.

Expected result

The operator can confirm that authenticated Docs asset serving works for the GB reservations calendar image and that the same media renders from the app Documentation article path.

Related articles