From cbbb87cd2eaeefa9766c77e07bdf31bb4b211769 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Thu, 6 Aug 2026 15:43:31 -0400
Subject: [PATCH] fix: uploader fix

---
 index.js | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/index.js b/index.js
index 6a9d85e..243f814 100644
--- a/index.js
+++ b/index.js
@@ -80,8 +80,13 @@ webPush.setVapidDetails(
 async function saveFile(structureId, req, uploadedFile, asset=false) {
   const name = uploadedFile.name;
   const [mime_type, mime_subtype] = uploadedFile.mimetype.split("/");
-  const uploadPath = path.join(__dirname, "public", structureId);
-  const storedPath = path.join(structureId, uploadedFile.name);
+  // structureId may arrive as a number (route.structure_id is an INTEGER) when
+  // called from a sandboxed handler via require('files').saveFile — the workshop
+  // /files route passes a string param, which masked this. path.join demands
+  // strings, so coerce.
+  const sid = String(structureId);
+  const uploadPath = path.join(__dirname, "public", sid);
+  const storedPath = path.join(sid, uploadedFile.name);
 
   fs.mkdirSync(uploadPath, { recursive: true });