From 65c24fe8b3db13afa816527cf6503a1525596859 Mon Sep 17 00:00:00 2001
From: Peuqui <43776522+Peuqui@users.noreply.github.com>
Date: Sat, 14 Feb 2026 13:56:34 +0100
Subject: [PATCH] fix: allow multi-segment paths in userdata API routes

Change aiohttp route parameters from {file} to {file:.*} to allow
paths containing slashes (e.g. workflows/my-workflow.json).

The {file} parameter only matches a single path segment, causing 404
errors when the frontend requests files in subdirectories via
/userdata/workflows/filename.json instead of URL-encoding the slash.

While the frontend uses encodeURIComponent as a workaround, this fix
ensures the routes work correctly with both encoded and unencoded
paths, improving compatibility with external API consumers.

Closes #10151
---
 app/user_manager.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/user_manager.py b/app/user_manager.py
index e2c00dab2..b67c1a2e9 100644
--- a/app/user_manager.py
+++ b/app/user_manager.py
@@ -330,7 +330,7 @@ class UserManager():
 
             return path
 
-        @routes.get("/userdata/{file}")
+        @routes.get("/userdata/{file:.*}")
         async def getuserdata(request):
             path = get_user_data_path(request, check_exists=True)
             if not isinstance(path, str):
@@ -338,7 +338,7 @@ class UserManager():
 
             return web.FileResponse(path)
 
-        @routes.post("/userdata/{file}")
+        @routes.post("/userdata/{file:.*}")
         async def post_userdata(request):
             """
             Upload or update a user data file.
@@ -394,7 +394,7 @@ class UserManager():
 
             return web.json_response(resp)
 
-        @routes.delete("/userdata/{file}")
+        @routes.delete("/userdata/{file:.*}")
         async def delete_userdata(request):
             path = get_user_data_path(request, check_exists=True)
             if not isinstance(path, str):
@@ -404,7 +404,7 @@ class UserManager():
 
             return web.Response(status=204)
 
-        @routes.post("/userdata/{file}/move/{dest}")
+        @routes.post("/userdata/{file:.*}/move/{dest:.*}")
         async def move_userdata(request):
             """
             Move or rename a user data file.