product custom fields

app/Http/Controllers/Checkout/CustomFieldFileController.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Controllers\Checkout;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+/**
+ * Serves a file answer to a product custom field (a cart/order line's
+ * meta.custom_fields, see CartController::customFieldsMeta()) from its private
+ * disk. Only reachable through a temporary signed URL — generated per render
+ * by checkout::partials.line-custom-fields — so disk and path in the query
+ * can't be tampered with, and a link stops working once it expires.
+ */
+class CustomFieldFileController extends Controller
+{
+    public function __invoke(string $locale, Request $request): StreamedResponse
+    {
+        $disk = Storage::disk((string) $request->query('disk'));
+        $path = (string) $request->query('path');
+
+        abort_unless($disk->exists($path), 404);
+
+        return $disk->response($path, null, ['Cache-Control' => 'private, max-age=3600']);
+    }
+}