diff --git a/teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts b/teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts index b591e77..760e8a7 100644 --- a/teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts +++ b/teressa-copeland-homes/src/app/api/documents/[id]/file/route.ts @@ -21,8 +21,9 @@ export async function GET( }); if (!doc || !doc.filePath) return new Response('Not found', { status: 404 }); - // Serve the original unsigned PDF only — see LEGAL-03 - const relativePath = doc.filePath; + // Serve signed PDF to agent when available (LEGAL-03 applies to client-facing endpoints only) + // Fall back to original if not yet signed + const relativePath = doc.signedFilePath ?? doc.filePath; const filePath = path.join(UPLOADS_BASE, relativePath); // Path traversal guard — critical security check