Protected files flagged via file blueprint

[devmount]

Hi everyone,

I want to implement file protection depending on authenticated users. I know about the Protecting files recipe which is based on files located at a special route (downloads). For my project I need the protection for files at any location, but flagged as protected via file blueprint. Is there a way to serve flagged images or files for authenticated users? And 403 for others?

Here is my code:

site/blueprints/files/default.yml:

title: File

fields:
  alt:
    label: Alt Text
    type: text
  protected:
    label: Protected file
    type: toggle

content/1_home/my-image.png.txt:

Alt: 

----

Protected: true

----

Uuid: qzistvufo5dkmr9e

----

Template: blocks/image

site/plugins/protected-files/index.php:

use Kirby\Cms\App as Kirby;

Kirby::plugin('devmount/protected-files', [
  'components' => [
    'file::url' => function ($kirby, $file) {
      dump('Debug: ' . ($file->protected()->toBool() ? '1' : '0')); // <- This is always 0
      if ($file->protected()->toBool() === true) {
        return '';
      }
      return $file->mediaUrl();
    },
    'file::version' => function ($kirby, $file, array $options = []) {

      static $original;

      // if the file is protected, return the original file
      if ($file->protected()->toBool() === true) {
        return $file;
      }
      // if static $original is null, get the original component
      if ($original === null) {
          $original = $kirby->nativeComponent('file::version');
      }

      // and return it with the given options
      return $original($kirby, $file, $options);
    }
  ],
]);

I seem to cannot access the blueprint fields in the callback functions like this. The dump statement above is 0 for every single image, no matter if protected was toggled on or off.

I’m grateful for any hints or tipps on this.

[texnixe]

@devmount

// $file->protected()->toBool() === true

That line of code by itself is pretty useless, the file::url component needs to return a url and the file::version component a FileVersion object, the above components don’t do anything.

[devmount]

Haha yes, sorry for explaining badly. That code is obviously useless, I just wanted to give an example of me trying to access the blueprint field protected in those callback functions. I edited the code example above, but I get the feeling I’m on the wrong path here

I just want Kirby to deny access to images / files included on various pages, that are flagged as protected.

[texnixe]

Well, the code should work, but with uncomplete code it’s hard to pinpoint what is going wrong and where.

[devmount]

Fair point. I edited the original post again, now with a working code example. You saying that the code should work is already helping a lot. It means there might be something wrong at another place. Thanks!

[texnixe]

I put the above plugin into a fresh 5.2.1 Starterkit.

In /site/blueprints/files/image.yml, I added the protected field:

In the Panel, I opened photography/sky/coconut-milkyway.jpg and set the toggle to true.

Now the image doesn’t appear anywhere anymore, neither in the Panel nor in the frontend:

[devmount]

Thanks so much Sonja for taking the time and confirming this is the correct way. I’ll investigate on my end why this is not working. I’ll come back if I found something.

Thanks again!