From b6f12c2a56b3d20fa02ebda00b5f2485cf853f7d Mon Sep 17 00:00:00 2001
From: markov <markov@uix.su>
Date: Thu, 26 Feb 2026 15:16:42 +0100
Subject: [PATCH] Fix #17: Add comment explaining token query param in
 download_attachment

---
 src/tracker/api/attachments.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tracker/api/attachments.py b/src/tracker/api/attachments.py
index d906fc0..2e36e19 100644
--- a/src/tracker/api/attachments.py
+++ b/src/tracker/api/attachments.py
@@ -63,7 +63,7 @@ async def upload_file(
 @router.get("/attachments/{attachment_id}/download")
 async def download_attachment(
     attachment_id: str,
-    token: str | None = None,
+    token: str | None = None,  # Auth handled by middleware (query param for img src)
     db: AsyncSession = Depends(get_db),
 ):
     """Download an attachment by ID."""