File attechment submodel

example/apiCollection/Submodel Repository/Submodel File Attachment/Get Submodel Element File Attachment - HandoverDocumentation.bru

@@ -0,0 +1,21 @@
+meta {
+  name: Get Submodel Element File Attachment - HandoverDocumentation
+  type: http
+  seq: 5
+}
+
+get {
+  url: {{DataEngineBaseUrl}}/submodels/:submodelIdentifier/submodel-elements/:idShortPath/attachment
+  body: none
+  auth: inherit
+}
+
+params:path {
+  submodelIdentifier: {{submodelIdentifierHandoverDocumentation-1}}
+  idShortPath: Documents[0].DocumentVersions[0].DigitalFiles[0]
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}

example/apiCollection/Submodel Repository/Submodel File Attachment/folder.bru

@@ -0,0 +1,3 @@
+meta {
+  name: Submodel File Attachment
+}

example/postgres/seed/01_core_asset_tables.sql.inc

@@ -52,7 +52,7 @@ TRUE,
 5,
 '2025-12-24T14:30:00Z',
 '2035-12-24T14:30:00Z',
-('https://docs.google.com/viewer?url=https://raw.githubusercontent.com/AAS-TwinEngine/' ||
+('https://raw.githubusercontent.com/AAS-TwinEngine/' ||
 'AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf')
 ),
 
@@ -98,7 +98,7 @@ FALSE,
 2.2999999999999998,
 '2026-01-15T09:15:00+05:30',
 '2036-01-15T09:15:00+05:31',
-('https://docs.google.com/viewer?url=https://raw.githubusercontent.com/AAS-TwinEngine/' ||
+('https://raw.githubusercontent.com/AAS-TwinEngine/' ||
 'AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf')
 ),
 
@@ -144,7 +144,7 @@ TRUE,
 7.8,
 '2024-07-01T18:45:00-04:00',
 '2034-07-01T18:45:00-04:01',
-('https://docs.google.com/viewer?url=https://raw.githubusercontent.com/AAS-TwinEngine/' ||
+('https://raw.githubusercontent.com/AAS-TwinEngine/' ||
 'AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf')
 );
 

example/postgres/seed/04_handoverdocumentation.sql.inc

@@ -87,7 +87,7 @@ INSERT INTO "DocumentVersion" (
 ) VALUES
 (
     0,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '1',
     '2023-01-01',
@@ -108,7 +108,7 @@ INSERT INTO "DocumentVersion" (
 
 (
     1,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '1.1',
     '2024-05-05',
@@ -129,7 +129,7 @@ INSERT INTO "DocumentVersion" (
 
 (
     0,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '2.1',
     '2026-01-01',
@@ -150,7 +150,7 @@ INSERT INTO "DocumentVersion" (
 
 (
     0,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '2.3',
     '2025-10-10',
@@ -171,7 +171,7 @@ INSERT INTO "DocumentVersion" (
 
 (
     0,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '0.9',
     '2024-01-01',
@@ -192,7 +192,7 @@ INSERT INTO "DocumentVersion" (
 
 (
     0,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '1.2',
     '2024-03-03',
@@ -213,7 +213,7 @@ INSERT INTO "DocumentVersion" (
 
 (
     1,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '1.4',
     '2023-01-01',
@@ -234,7 +234,7 @@ INSERT INTO "DocumentVersion" (
 
 (
     2,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '2',
     '2024-03-03',
@@ -255,7 +255,7 @@ INSERT INTO "DocumentVersion" (
 
 (
     0,
-    'https://docs.google.com/viewer?url=https://raw.githubusercontent.com/'
+    'https://raw.githubusercontent.com/'
     'AAS-TwinEngine/AAS.TwinEngine.DataEngine/refs/heads/main/example/data/dummy_document.pdf',
     '1',
     '2022-02-02',

source/AAS.TwinEngine.DataEngine.ModuleTests/Api/Services/SubmodelRepository/SubmodelRepositoryControllerTests.cs

@@ -1,4 +1,5 @@
 using System.Net;
+using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using System.Text;
 using System.Text.Json.Nodes;
@@ -7,6 +8,7 @@
 using AAS.TwinEngine.DataEngine.ApplicationLogic.Services.AasEnvironment.Providers;
 using AAS.TwinEngine.DataEngine.ApplicationLogic.Services.Plugin;
 using AAS.TwinEngine.DataEngine.ApplicationLogic.Services.Plugin.Providers;
+using AAS.TwinEngine.DataEngine.ApplicationLogic.Services.SubmodelRepository.Providers;
 using AAS.TwinEngine.DataEngine.Infrastructure.Http.Clients;
 using AAS.TwinEngine.DataEngine.ModuleTests.Common;
 
@@ -18,6 +20,7 @@
 
 using AAS.TwinEngine.DataEngine.ServiceConfiguration.Config;
 using AAS.TwinEngine.DataEngine.DomainModel.SubmodelRepository;
+using AAS.TwinEngine.DataEngine.DomainModel.Shared;
 
 namespace AAS.TwinEngine.DataEngine.ModuleTests.Api.Services.SubmodelRepository;
 
@@ -27,20 +30,23 @@ public abstract class SubmodelRepositoryControllerTests : IDisposable
     private readonly ITemplateProvider _mockTemplateProvider;
     private readonly HttpClient _client;
     private readonly ICreateClient _httpClientFactory;
+    private readonly IFileContentProvider _fileContentProvider;
 
     protected SubmodelRepositoryControllerTests(string configDir)
     {
         _mockTemplateProvider = Substitute.For<ITemplateProvider>();
         var mockPluginManifestProvider = Substitute.For<IPluginManifestProvider>();
         var mockPluginManifestConflictHandler = Substitute.For<IPluginManifestConflictHandler>();
         _httpClientFactory = Substitute.For<ICreateClient>();
+        _fileContentProvider = Substitute.For<IFileContentProvider>();
 
         _factory = new ConfigTestFactory(configDir, services =>
         {
             _ = services.AddSingleton(_httpClientFactory);
             _ = services.AddSingleton(_mockTemplateProvider);
             _ = services.AddSingleton(mockPluginManifestProvider);
             _ = services.AddSingleton(mockPluginManifestConflictHandler);
+            _ = services.AddSingleton(_fileContentProvider);
         });
 
         _client = _factory.CreateClient();
@@ -180,6 +186,72 @@ public async Task GetSubmodelElementAsync_WithNotFound_Returns404Async()
         Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
     }
 
+    [Fact]
+    public async Task GetFileAttachmentAsync_WhenElementIsFileWithHttpUrl_StreamsContentAsync()
+    {
+        // Arrange
+        const string SubmodelId = "Q29udGFjdEluZm9ybWF0aW9u";
+        const string IdShortPath = "Thumbnail";
+        const string FileUrl = "https://example.com/logo.png";
+        var fileBytes = Encoding.UTF8.GetBytes("fake-image-bytes");
+
+        using var messageHandler = new FakeHttpMessageHandler((_, _) => Task.FromResult(new HttpResponseMessage
+        {
+            StatusCode = HttpStatusCode.OK,
+            Content = new StringContent(TestData.CreatePluginResponseForFileAttachment())
+        }));
+
+        using var httpClient = new HttpClient(messageHandler);
+        httpClient.BaseAddress = new Uri("https://testendpoint.com");
+
+        const string HttpClientName = $"{HttpClientNames.PluginDataProviderPrefix}TestPlugin1";
+        _ = _httpClientFactory.CreateClient(HttpClientName).Returns(httpClient);
+
+        _ = _mockTemplateProvider.GetFilteredSubmodelTemplateAsync(Arg.Any<string>(), Arg.Any<SubmodelQueryOptions?>(), Arg.Any<CancellationToken>()).Returns(TestData.CreateSubmodel());
+
+        var fileContentResponse = new FileContentResponse(new MemoryStream(fileBytes));
+        _ = _fileContentProvider.GetFileContentAsync(FileUrl, Arg.Any<CancellationToken>()).Returns(fileContentResponse);
+
+        // Act
+        var response = await _client.GetAsync($"/submodels/{SubmodelId}/submodel-elements/{IdShortPath}/attachment");
+
+        // Assert
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.Equal("image/png", response.Content.Headers.ContentType?.MediaType);
+        var body = await response.Content.ReadAsByteArrayAsync();
+        Assert.Equal(fileBytes, body);
+        Assert.Contains("logo.png", response.Content.Headers.ContentDisposition?.ToString(), StringComparison.Ordinal);
+        await _fileContentProvider.Received(1).GetFileContentAsync(FileUrl, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetFileAttachmentAsync_WhenElementIsNotFile_Returns400Async()
+    {
+        // Arrange
+        const string SubmodelId = "Q29udGFjdEluZm9ybWF0aW9u";
+        const string IdShortPath = "ContactName";
+
+        using var messageHandler = new FakeHttpMessageHandler((_, _) => Task.FromResult(new HttpResponseMessage
+        {
+            StatusCode = HttpStatusCode.OK,
+            Content = new StringContent(TestData.CreatePluginResponseForSubmodelElement())
+        }));
+
+        using var httpClient = new HttpClient(messageHandler);
+        httpClient.BaseAddress = new Uri("https://testendpoint.com");
+
+        const string HttpClientName = $"{HttpClientNames.PluginDataProviderPrefix}TestPlugin1";
+        _ = _httpClientFactory.CreateClient(HttpClientName).Returns(httpClient);
+
+        _ = _mockTemplateProvider.GetFilteredSubmodelTemplateAsync(Arg.Any<string>(), Arg.Any<SubmodelQueryOptions?>(), Arg.Any<CancellationToken>()).Returns(TestData.CreateSubmodel());
+
+        // Act
+        var response = await _client.GetAsync($"/submodels/{SubmodelId}/submodel-elements/{IdShortPath}/attachment");
+
+        // Assert
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
     [Fact]
     public async Task GetSubmodelElementAsync_WhenIdentifierIsInValid_Returns400Async()
     {

source/AAS.TwinEngine.DataEngine.ModuleTests/Api/Services/SubmodelRepository/TestData.cs

@@ -144,6 +144,14 @@ public static string CreatePluginResponseForSubmodelElement() => """
     }
     """;
 
+    public static string CreatePluginResponseForFileAttachment() => """
+        {
+        "http://example.com/idta/digital-nameplate/semantic-id": {
+        "http://example.com/idta/digital-nameplate/thumbnail": "https://example.com/logo.png"
+      }
+    }
+    """;
+
     public static string CreatePlugin1ResponseForSubmodel() => """
         {
         "http://example.com/idta/digital-nameplate/semantic-id": {

source/AAS.TwinEngine.DataEngine.UnitTests/Api/SubmodelRepository/Handler/SubmodelRepositoryHandlerTests.cs

@@ -1,10 +1,11 @@
-using System.Text;
+using System.Text;
 
 using AAS.TwinEngine.DataEngine.Api.SubmodelRepository.Handler;
 using AAS.TwinEngine.DataEngine.Api.SubmodelRepository.Requests;
 using AAS.TwinEngine.DataEngine.ApplicationLogic.Exceptions.Application;
 using AAS.TwinEngine.DataEngine.ApplicationLogic.Extensions;
 using AAS.TwinEngine.DataEngine.ApplicationLogic.Services.SubmodelRepository;
+using AAS.TwinEngine.DataEngine.DomainModel.Shared;
 using AAS.TwinEngine.DataEngine.DomainModel.SubmodelRepository;
 
 using AasCore.Aas3_1;
@@ -15,13 +16,17 @@
 using NSubstitute;
 
 namespace AAS.TwinEngine.DataEngine.UnitTests.Api.SubmodelRepository.Handler;
+
 public class SubmodelRepositoryHandlerTests
 {
     private readonly ISubmodelRepositoryService _submodelRepository = Substitute.For<ISubmodelRepositoryService>();
     private readonly ILogger<SubmodelRepositoryHandler> _logger = Substitute.For<ILogger<SubmodelRepositoryHandler>>();
     private readonly SubmodelRepositoryHandler _sut;
 
-    public SubmodelRepositoryHandlerTests() => _sut = new SubmodelRepositoryHandler(_logger, _submodelRepository);
+    public SubmodelRepositoryHandlerTests()
+    {
+        _sut = new SubmodelRepositoryHandler(_logger, _submodelRepository);
+    }
 
     [Fact]
     public async Task HandleSubmodel_ReturnsSubmodel_WhenSubmodelExists()
@@ -344,7 +349,7 @@ await _submodelRepository.Received(1).GetAllSubmodelsAsync(
     [Fact]
     public async Task GetAllSubmodels_WhenNullRequest_ReturnsSuccessfully()
     {
-        var submodelList = new SubmodelList { PagingMetaData = new DomainModel.Shared.PagingMetaData(), Result = [] };
+        var submodelList = new SubmodelList { PagingMetaData = new PagingMetaData(), Result = [] };
         _submodelRepository.GetAllSubmodelsAsync(Arg.Any<SubmodelSearchFilter?>(), Arg.Any<SubmodelQueryOptions?>(), null, null, Arg.Any<CancellationToken>())
             .Returns(submodelList);
 
@@ -452,4 +457,62 @@ await _submodelRepository.Received(1)
             .GetAllSubmodelElementsAsync(SubmodelId, null, null, null, Arg.Any<CancellationToken>());
     }
 
+    [Fact]
+    public async Task GetFileAttachment_CallsService_WhenServiceSucceeds()
+    {
+        const string SubmodelId = "NameplateSubmodel";
+        const string IdShortPath = "Documents.ProductImage";
+        var encodedId = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(SubmodelId));
+        var request = new GetSubmodelElementRequest(encodedId, IdShortPath);
+        var fakeResult = new FileAttachmentResult(Stream.Null, "application/octet-stream", "file.bin", 100 * 1024 * 1024);
+        _submodelRepository
+            .GetFileAttachmentAsync(SubmodelId, IdShortPath, Arg.Any<CancellationToken>())
+            .Returns(fakeResult);
+
+        await _sut.GetFileAttachment(request, CancellationToken.None);
+
+        await _submodelRepository.Received(1)
+            .GetFileAttachmentAsync(SubmodelId, IdShortPath, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task GetFileAttachment_ReturnsServiceResult_WhenServiceSucceeds()
+    {
+        const string SubmodelId = "NameplateSubmodel";
+        const string IdShortPath = "Documents.ProductImage";
+        var encodedId = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(SubmodelId));
+        var request = new GetSubmodelElementRequest(encodedId, IdShortPath);
+
+        var fakeResult = new FileAttachmentResult(Stream.Null, "application/octet-stream", "file.bin", 100 * 1024 * 1024);
+
+        _submodelRepository
+            .GetFileAttachmentAsync(SubmodelId, IdShortPath, Arg.Any<CancellationToken>())
+            .Returns(fakeResult);
+
+        var result = await _sut.GetFileAttachment(request, CancellationToken.None);
+
+        Assert.Equal(fakeResult, result);
+    }
+
+    [Fact]
+    public async Task GetFileAttachment_InvalidBase64SubmodelId_ThrowsInvalidUserInputException()
+    {
+        const string InvalidEncodedId = "!!invalid_base64@@";
+        const string IdShortPath = "Documents.ProductImage";
+        var request = new GetSubmodelElementRequest(InvalidEncodedId, IdShortPath);
+
+        await Assert.ThrowsAsync<InvalidUserInputException>(() => _sut.GetFileAttachment(request, CancellationToken.None));
+    }
+
+    [Theory]
+    [InlineData("../../../etc/passwd")]
+    [InlineData("..\\..\\..\\windows\\system32")]
+    public async Task GetFileAttachment_PathTraversalInIdShortPath_ThrowsInvalidUserInputException(string maliciousPath)
+    {
+        const string SubmodelId = "NameplateSubmodel";
+        var encodedId = SubmodelId.EncodeBase64Url();
+        var request = new GetSubmodelElementRequest(encodedId, maliciousPath);
+
+        await Assert.ThrowsAsync<InvalidUserInputException>(() => _sut.GetFileAttachment(request, CancellationToken.None));
+    }
 }