feat: Add sounds routes for serving audio and thumbnail files

app/routes/sounds.py

@@ -0,0 +1,99 @@
+"""Routes for serving sound files and thumbnails."""
+
+import os
+from flask import Blueprint, send_from_directory, abort
+
+from app.services.decorators import require_auth
+
+bp = Blueprint("sounds", __name__)
+
+
+@bp.route("/<sound_type>/thumbnails/<path:filename>")
+def serve_thumbnail(sound_type, filename):
+    """Serve thumbnail files for sounds."""
+    try:
+        # Map sound type codes to directory names
+        type_mapping = {
+            "str": "stream",
+            "sdb": "soundboard", 
+            "say": "say"
+        }
+        
+        # Security: validate sound type
+        if sound_type not in type_mapping:
+            abort(404)
+        
+        # Basic filename validation (no path traversal)
+        if ".." in filename or "/" in filename or "\\" in filename:
+            abort(404)
+            
+        if not filename or not filename.strip():
+            abort(404)
+        
+        # Get the actual directory name
+        directory_name = type_mapping[sound_type]
+        
+        # Construct the thumbnail directory path
+        sounds_dir = os.path.join(os.getcwd(), "sounds")
+        thumbnail_dir = os.path.join(sounds_dir, directory_name, "thumbnails")
+        
+        # Check if thumbnail directory exists
+        if not os.path.exists(thumbnail_dir):
+            abort(404)
+        
+        # Check if file exists
+        file_path = os.path.join(thumbnail_dir, filename)
+        if not os.path.exists(file_path):
+            abort(404)
+        
+        # Serve the file
+        return send_from_directory(thumbnail_dir, filename)
+        
+    except Exception:
+        abort(404)
+
+
+@bp.route("/<sound_type>/audio/<path:filename>")
+@require_auth
+def serve_audio(sound_type, filename):
+    """Serve audio files for sounds."""
+    try:
+        # Map sound type codes to directory names
+        type_mapping = {
+            "str": "stream",
+            "sdb": "soundboard", 
+            "say": "say"
+        }
+        
+        # Security: validate sound type
+        if sound_type not in type_mapping:
+            abort(404)
+        
+        # Basic filename validation (no path traversal)
+        if ".." in filename or "/" in filename or "\\" in filename:
+            abort(404)
+            
+        if not filename or not filename.strip():
+            abort(404)
+        
+        # Get the actual directory name
+        directory_name = type_mapping[sound_type]
+        
+        # Construct the audio directory path
+        sounds_dir = os.path.join(os.getcwd(), "sounds")
+        audio_dir = os.path.join(sounds_dir, directory_name)
+        
+        # Check if audio directory exists
+        if not os.path.exists(audio_dir):
+            abort(404)
+        
+        # Check if file exists
+        file_path = os.path.join(audio_dir, filename)
+        if not os.path.exists(file_path):
+            abort(404)
+        
+        # Serve the file
+        return send_from_directory(audio_dir, filename)
+        
+    except Exception:
+        abort(404)