CAD asset permissions
Public proxy whitelist vs. admin-gated proxy and how to share files with clients.
Overview
CAD files often represent your most valuable IP. Katura's permission model is built so that, by default, no one outside your studio can download a file — and so that the few exceptions (marketing pages, customer proposals) are explicit and auditable.
The three access paths
| Path | Auth | Use case |
|---|---|---|
/api/admin/cad/proxy?path=... | Admin session required (requireKaturaAdmin) | Internal: design file manager, admin previews. |
/api/public-cad/[asset] | None — but slug must be in a server-side whitelist | Marketing: live 3D models on landing pages, hero sections. |
| Signed proposal URL | Time-limited token | Client-facing: send a single piece for review, expires after 14 days. |
Adding a file to the public whitelist
The whitelist lives in src/app/api/public-cad/[asset]/route.ts as a simple object keyed by URL slug. To make a new file publicly downloadable:
const PUBLIC_ASSETS: Record<string, string> = {
homage: "Katura_Homage_Ring_Size_8_Booleaned_STL_21d9ea69.stl",
// add new entries here
}Anything not in the whitelist returns 404. The proxy is also CDN-cached for one hour and 24 hours in the browser, so even high-traffic marketing pages don't hit Supabase on every render.
Warning
Treat the whitelist like a deploy-time decision. Any file you add becomes downloadable by anyone who can guess the slug — pick slugs that are public-information (“homage” ✅) rather than secrets, and never put a one-of-one custom commission on the public list.
Auditing
Every download through the admin proxy and every signed proposal-link visit is logged with the timestamp, the requester (or token id), and the IP. Audit logs are available in /admin/design/audit for 12 months.