Add setup-flow

internal/file/model.go

@@ -7,6 +7,7 @@ import (
 type FileRecord struct {
 	ID                  string    `gorm:"primaryKey" json:"id"`
 	DeletionID          string    `json:"deletion_id"`
+	ViewID              string    `json:"view_id"`
 	Filename            string    `json:"filename"`
 	Path                string    `json:"-"` // file path on disk (not exposed via JSON)
 	ExpiresAt           time.Time `json:"expires_at"`

internal/file/service.go

@@ -3,6 +3,7 @@ package file
 import (
 	"io"
 	"os"
+	"path/filepath"
 	"time"
 
 	"github.com/google/uuid"
@@ -29,7 +30,8 @@ func (s *Service) UploadFile(filename string, data io.Reader, deleteAfterDownloa
 		return nil, err
 	}
 
-	path := folderPath + "/" + filename
+	safeName := uuid.NewString() + filepath.Ext(filename)
+	path := filepath.Join(folderPath, safeName)
 
 	out, err := os.Create(path)
 	if err != nil {