Fixed media upload

src/public.rs

@@ -276,6 +276,7 @@ async fn client_portal(
             .iter()
             .filter(|m| {
                 m.status == "active"
+                    && m.client_id.primary_key().unwrap() == client_id
                     && m.visit_id
                         .as_ref()
                         .map(|fk| fk.primary_key().unwrap() == vid)
@@ -393,7 +394,7 @@ async fn portal_media(
         }
     }
 
-    match tokio::fs::read(&media.file_path).await {
+    match crate::uploads::read_db_file(&media.file_path).await {
         Ok(data) => {
             let content_type = match media.file_path.rsplit('.').next().unwrap_or("") {
                 "jpg" | "jpeg" => "image/jpeg",
@@ -413,7 +414,17 @@ async fn portal_media(
                 .insert("content-type", content_type.parse().unwrap());
             Ok(resp)
         }
-        Err(_) => Html::new("404").into_response(),
+        Err(err) => {
+            tracing::warn!(
+                target: "uploads",
+                media_id,
+                db_path = %media.file_path,
+                resolved_path = %crate::uploads::resolved_display_path(&media.file_path),
+                error = %err,
+                "portal media file is missing or unreadable"
+            );
+            Html::new("404").into_response()
+        }
     }
 }
 
@@ -430,7 +441,7 @@ async fn serve_testimonial_image(
         Some(p) => p.clone(),
         None => return Html::new("404").into_response(),
     };
-    match tokio::fs::read(&path).await {
+    match crate::uploads::read_db_file(&path).await {
         Ok(data) => {
             let content_type = match path.rsplit('.').next().unwrap_or("") {
                 "jpg" | "jpeg" => "image/jpeg",
@@ -447,7 +458,17 @@ async fn serve_testimonial_image(
                 .insert("cache-control", "public, max-age=86400".parse().unwrap());
             Ok(resp)
         }
-        Err(_) => Html::new("404").into_response(),
+        Err(err) => {
+            tracing::warn!(
+                target: "uploads",
+                testimonial_id = id,
+                db_path = %path,
+                resolved_path = %crate::uploads::resolved_display_path(&path),
+                error = %err,
+                "testimonial image is missing or unreadable"
+            );
+            Html::new("404").into_response()
+        }
     }
 }