fix: serve uploaded images via API route (public/ is read-only in production)

Next.js bakes public/ at build time — dynamically uploaded files were
never served in Docker standalone mode. Store uploads in data/uploads/
and serve via /api/uploads/ with a rewrite for backward compatibility.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

memento-note/app/api/chat/route.ts

@@ -49,7 +49,7 @@ export async function POST(req: Request) {
 
   // 2. Parse request body — messages arrive as UIMessage[] from DefaultChatTransport
   const body = await req.json()
-  console.log('[Chat] body keys:', Object.keys(body), 'noteContext?', !!body.noteContext, 'images?', body.noteContext?.images?.length)
+
   const { messages: rawMessages, conversationId, notebookId, language, webSearch, noteContext } = body as {
     messages: UIMessage[]
     conversationId?: string
@@ -331,22 +331,16 @@ Tu as accès à ces outils pour des recherches approfondies :
   // Load note images as base64 for vision-capable models
   let imageContextParts: Array<{ type: 'image'; image: string }> = []
   if (noteContext?.images && noteContext.images.length > 0) {
-    console.log('[Chat] noteContext.images:', noteContext.images)
     for (const imgPath of noteContext.images.slice(0, 4)) {
       try {
-        const fullPath = path.join(process.cwd(), 'public', imgPath)
-        console.log('[Chat] reading image:', fullPath)
+        const fullPath = path.join(process.cwd(), 'data', imgPath)
         const buffer = await readFile(fullPath)
         const ext = path.extname(imgPath).toLowerCase()
         const mime = ext === '.png' ? 'image/png' : ext === '.gif' ? 'image/gif' : ext === '.webp' ? 'image/webp' : 'image/jpeg'
         const base64 = `data:${mime};base64,${buffer.toString('base64')}`
         imageContextParts.push({ type: 'image', image: base64 })
-        console.log('[Chat] image loaded, size:', buffer.length, 'bytes')
-      } catch (err) {
-        console.error('[Chat] failed to read image:', imgPath, err)
-      }
+      } catch {}
     }
-    console.log('[Chat] total image parts:', imageContextParts.length)
   }
 
   let copilotContext = ''

memento-note/app/api/upload/route.ts

@@ -46,8 +46,8 @@ export async function POST(request: NextRequest) {
     }
     const filename = `${randomUUID()}${ext}`
     
-    // Ensure directory exists
-    const uploadDir = path.join(process.cwd(), 'public/uploads/notes')
+    // Ensure directory exists (data/uploads is outside public/, served via API route)
+    const uploadDir = path.join(process.cwd(), 'data/uploads/notes')
     await mkdir(uploadDir, { recursive: true })
     
     const filePath = path.join(uploadDir, filename)

memento-note/app/api/uploads/[...path]/route.ts

@@ -0,0 +1,58 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { readFile, stat } from 'fs/promises'
+import path from 'path'
+import { auth } from '@/auth'
+
+const UPLOAD_DIR = path.join(process.cwd(), 'data', 'uploads')
+
+const MIME_MAP: Record<string, string> = {
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.png': 'image/png',
+  '.gif': 'image/gif',
+  '.webp': 'image/webp',
+}
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ path: string[] }> }
+) {
+  const { path: segments } = await params
+
+  // Only serve from uploads/notes/ subdirectory
+  if (segments[0] !== 'notes') {
+    return new NextResponse('Not found', { status: 404 })
+  }
+
+  const filename = segments[segments.length - 1]
+  const ext = path.extname(filename).toLowerCase()
+  const contentType = MIME_MAP[ext]
+  if (!contentType) {
+    return new NextResponse('Unsupported file type', { status: 400 })
+  }
+
+  // Prevent path traversal
+  const safePath = path.join(UPLOAD_DIR, ...segments)
+  if (!safePath.startsWith(UPLOAD_DIR)) {
+    return new NextResponse('Forbidden', { status: 403 })
+  }
+
+  try {
+    const fileStats = await stat(safePath)
+    if (!fileStats.isFile()) {
+      return new NextResponse('Not found', { status: 404 })
+    }
+
+    const buffer = await readFile(safePath)
+
+    return new NextResponse(buffer, {
+      headers: {
+        'Content-Type': contentType,
+        'Cache-Control': 'public, max-age=31536000, immutable',
+        'Content-Length': String(buffer.length),
+      },
+    })
+  } catch {
+    return new NextResponse('Not found', { status: 404 })
+  }
+}