images working, featured still broken

plugins/media/routes.py

@@ -232,15 +232,6 @@ def serve(plugin, filename):
     return send_from_directory(disk_dir, filename)
 
 
-@bp.route("/files/<path:filename>")
-def media_file(filename):
-    base = current_app.config["UPLOAD_FOLDER"]
-    full = os.path.normpath(os.path.join(base, filename))
-    if not full.startswith(os.path.abspath(base)):
-        abort(404)
-    return send_from_directory(base, filename)
-
-
 @bp.route("/<filename>")
 def media_public(filename):
     base = current_app.config["UPLOAD_FOLDER"]
@@ -286,32 +277,64 @@ def add_media(plant_uuid):
     return redirect(request.referrer or url_for("plant.edit", uuid_val=plant_uuid))
 
 
-@bp.route("/feature/<string:context>/<int:context_id>/<int:media_id>", methods=["POST"])
-@login_required
-def set_featured_image(context, context_id, media_id):
-    media = Media.query.get_or_404(media_id)
-    if media.uploader_id != current_user.id and current_user.role != "admin":
-        return jsonify({"error": "Not authorized"}), 403
+@bp.route("/<context>/<int:context_id>/<filename>")
+def media_file(context, context_id, filename):
+    # your existing serve_context_media logic here
+    # (unchanged)
+    from flask import current_app, send_from_directory
+    import os
+    valid = {"user", "plant", "growlog", "vendor"}
+    if context in valid:
+        plugin = context
+    elif context.endswith("s") and context[:-1] in valid:
+        plugin = context[:-1]
+    else:
+        abort(404)
 
+    media = Media.query.filter_by(
+        plugin=plugin,
+        related_id=context_id,
+        filename=filename
+    ).first_or_404()
+
+    base = current_app.config["UPLOAD_FOLDER"]
+    directory = os.path.join(base, plugin, str(context_id))
+    return send_from_directory(directory, filename)
+
+@bp.route('/featured/<context>/<int:context_id>/<int:media_id>', methods=['POST'])
+def set_featured_image(context, context_id, media_id):
+    """
+    Single‐select “featured” toggle for any plugin (plants, grow_logs, etc).
+    """
+    # normalize to plural
+    plugin_ctx = context if context.endswith('s') else context + 's'
+    if plugin_ctx not in ('plants', 'grow_logs', 'users', 'vendors'):
+        abort(404)
+
+    # must own that media row
+    media = Media.query.filter_by(
+        plugin=plugin_ctx,
+        related_id=context_id,
+        id=media_id
+    ).first_or_404()
+
+    # clear out any existing
     FeaturedImage.query.filter_by(
-        context=context,
+        context=plugin_ctx,
         context_id=context_id
     ).delete()
 
-    feat = FeaturedImage(
+    # insert new featured row
+    fi = FeaturedImage(
         media_id=media.id,
-        context=context,
+        context=plugin_ctx,
         context_id=context_id,
         is_featured=True
     )
-    db.session.add(feat)
-
-    if context == "plant":
-        plant = Plant.query.get_or_404(context_id)
-        plant.featured_media_id = media.id
-
+    db.session.add(fi)
     db.session.commit()
-    return jsonify({"status": "success", "media_id": media.id})
+
+    return jsonify({"media_id": media.id})
 
 
 @bp.route("/delete/<int:media_id>", methods=["POST"])