SubmissionFileDelivery

Corex\Config\Submissions\SubmissionFileDelivery · class · Config layer

The address a file uploaded with a submission is opened at (spec 081, FR-009). The link names the submission and the field, not the attachment, because the rule is the submission’s: whoever the inbox lets read that submission may open its file, and nobody else. {@see AttachmentDelivery} asks WordPress whether the person may read a private attachment, which editors and administrators may and a role that was only given the inbox may not. That person would have been shown a link that refused them. The rule is asked on every request, of {@see SubmissionQueryService}. This class reads the request and gives the answer its status; the file itself leaves through AttachmentDelivery, with the headers decided there.

Public API

__construct(SubmissionQueryService $submissions, AttachmentDelivery $delivery)

url(int $submissionId, string $field): string

The address of the file one submission holds as its answer to one field. It is for the person signed in when it is made: it stops working when their session ends, and within a day in any case, as a WordPress nonce does.

serve(): void