fix: add local static file storage fallback

apps/api/internal/httpapi/server.go

@@ -41,6 +41,8 @@ func NewServerWithContext(ctx context.Context, cfg config.Config, db *store.Stor
 	mux.HandleFunc("GET /healthz", server.health)
 	mux.HandleFunc("GET /readyz", server.ready)
 	mux.HandleFunc("GET /static/simulation/{asset}", serveSimulationAsset)
+	mux.HandleFunc("GET /static/generated/{asset}", server.serveGeneratedStaticAsset)
+	mux.HandleFunc("GET /static/uploaded/{asset}", server.serveUploadedStaticAsset)
 
 	mux.Handle("POST /api/v1/auth/register", server.auth.Require(auth.PermissionPublic, http.HandlerFunc(server.register)))
 	mux.Handle("POST /api/v1/auth/login", server.auth.Require(auth.PermissionPublic, http.HandlerFunc(server.login)))

apps/api/internal/httpapi/static_assets.go

@@ -0,0 +1,37 @@
+package httpapi
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/config"
+)
+
+func (s *Server) serveGeneratedStaticAsset(w http.ResponseWriter, r *http.Request) {
+	s.serveLocalStaticAsset(w, r, s.cfg.LocalGeneratedStorageDir, config.DefaultLocalGeneratedStorageDir)
+}
+
+func (s *Server) serveUploadedStaticAsset(w http.ResponseWriter, r *http.Request) {
+	s.serveLocalStaticAsset(w, r, s.cfg.LocalUploadedStorageDir, config.DefaultLocalUploadedStorageDir)
+}
+
+func (s *Server) serveLocalStaticAsset(w http.ResponseWriter, r *http.Request, storageDir string, fallbackStorageDir string) {
+	fileName := filepath.Base(strings.TrimSpace(r.PathValue("asset")))
+	if fileName == "" || fileName == "." || fileName == ".." || fileName == string(filepath.Separator) {
+		http.NotFound(w, r)
+		return
+	}
+	storageDir = strings.TrimSpace(storageDir)
+	if storageDir == "" {
+		storageDir = fallbackStorageDir
+	}
+	filePath := filepath.Join(storageDir, fileName)
+	info, err := os.Stat(filePath)
+	if err != nil || info.IsDir() {
+		http.NotFound(w, r)
+		return
+	}
+	http.ServeFile(w, r, filePath)
+}

apps/api/internal/httpapi/static_assets_test.go

@@ -0,0 +1,65 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/config"
+)
+
+func TestServeGeneratedStaticAsset(t *testing.T) {
+	storageDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(storageDir, "result.png"), []byte("png"), 0o644); err != nil {
+		t.Fatalf("failed to write generated asset fixture: %v", err)
+	}
+	server := &Server{cfg: config.Config{LocalGeneratedStorageDir: storageDir}}
+	request := httptest.NewRequest(http.MethodGet, "/static/generated/result.png", nil)
+	request.SetPathValue("asset", "result.png")
+	response := httptest.NewRecorder()
+
+	server.serveGeneratedStaticAsset(response, request)
+
+	if response.Code != http.StatusOK {
+		t.Fatalf("expected generated asset to be served, got status %d", response.Code)
+	}
+	if response.Body.String() != "png" {
+		t.Fatalf("unexpected generated asset payload: %q", response.Body.String())
+	}
+}
+
+func TestServeUploadedStaticAsset(t *testing.T) {
+	storageDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(storageDir, "upload.pdf"), []byte("pdf"), 0o644); err != nil {
+		t.Fatalf("failed to write uploaded asset fixture: %v", err)
+	}
+	server := &Server{cfg: config.Config{LocalUploadedStorageDir: storageDir}}
+	request := httptest.NewRequest(http.MethodGet, "/static/uploaded/upload.pdf", nil)
+	request.SetPathValue("asset", "upload.pdf")
+	response := httptest.NewRecorder()
+
+	server.serveUploadedStaticAsset(response, request)
+
+	if response.Code != http.StatusOK {
+		t.Fatalf("expected uploaded asset to be served, got status %d", response.Code)
+	}
+	if response.Body.String() != "pdf" {
+		t.Fatalf("unexpected uploaded asset payload: %q", response.Body.String())
+	}
+}
+
+func TestServeLocalStaticAssetRejectsTraversal(t *testing.T) {
+	storageDir := t.TempDir()
+	server := &Server{cfg: config.Config{LocalGeneratedStorageDir: storageDir}}
+	request := httptest.NewRequest(http.MethodGet, "/static/generated/..", nil)
+	request.SetPathValue("asset", "..")
+	response := httptest.NewRecorder()
+
+	server.serveGeneratedStaticAsset(response, request)
+
+	if response.Code != http.StatusNotFound {
+		t.Fatalf("expected traversal-like generated asset name to 404, got status %d", response.Code)
+	}
+}