Fix submission file preview CORS error via server-side proxy

project.inlang/.gitignore

@@ -1 +1,19 @@
-cache
+# IF GIT SHOWED THAT THIS FILE CHANGED
+#
+# 1. RUN THE FOLLOWING COMMAND
+#
+# ---
+# git rm --cached '**/*.inlang/.gitignore'
+# ---
+#
+# 2. COMMIT THE CHANGE
+#
+# ---
+# git commit -m "fix: remove tracked .gitignore from inlang project"
+# ---
+#
+# Inlang handles the gitignore itself starting with version ^2.5.
+#
+# everything is ignored except settings.json
+*
+!settings.json

src/routes/api/file-proxy/+server.ts

@@ -0,0 +1,44 @@
+import { env } from '$env/dynamic/private';
+import { error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = async ({ url }) => {
+  const fileUrl = url.searchParams.get('url');
+
+  if (!fileUrl) {
+    throw error(400, 'Missing url parameter');
+  }
+
+  const fileStorageUrl = env.FILE_STORAGE_URL;
+
+  if (!fileStorageUrl) {
+    throw error(500, 'File storage URL not configured');
+  }
+
+  if (!fileUrl.startsWith(fileStorageUrl)) {
+    throw error(403, 'URL not allowed');
+  }
+
+  let response: Response;
+  try {
+    response = await fetch(fileUrl);
+  } catch {
+    throw error(502, 'Failed to connect to file storage');
+  }
+
+  if (!response.ok) {
+    throw error(
+      response.status,
+      `Failed to fetch file from storage: ${response.status} ${response.statusText}`
+    );
+  }
+
+  const contentType = response.headers.get('Content-Type') ?? 'application/octet-stream';
+  const body = await response.arrayBuffer();
+
+  return new Response(body, {
+    headers: {
+      'Content-Type': contentType
+    }
+  });
+};

src/routes/dashboard/user/submissions/[submissionId]/+page.svelte

@@ -44,7 +44,8 @@
     let active = true;
     (async () => {
       try {
-        const response = await fetch(url);
+        const proxyUrl = `/api/file-proxy?url=${encodeURIComponent(url)}`;
+        const response = await fetch(proxyUrl);
         if (!response.ok) {
           fileContent = '';
           return;