files
Served avatars, uploaded files, and solution files.
Get an avatar file
Serves an avatar image from private storage, inline. Any signed-in user may fetch one (avatars are shown throughout the app). The filename is rejected if it contains a path-traversal sequence.
Get a problem file
Serves a problem's attached file, inline. **Course staff (faculty/TA) or a system admin only**: a problem file is the autograder's answer/solution key, so a student must never receive it (same sensitivity as a solution file). The download is audited, and traversal filenames are rejected.
Get a solution file
Serves a problem's solution file, the most sensitive protected material, so access is limited to course staff (faculty or TAs) or a system admin, and every successful serve is audited (both inline and `?download=1`). Traversal filenames are rejected.
Get a submission file
Serves a submission's uploaded file as a download. Restricted to the submitting student, course staff (faculty or TAs), or a system admin. The download is audited, and traversal filenames are rejected.