From cfb725144a2784ad0dca67bab638a52bcf963cf9 Mon Sep 17 00:00:00 2001
From: "Troll (Hermes Agent)" <ai@hallsworth.ca>
Date: Sat, 1 Aug 2026 20:36:25 +0000
Subject: [PATCH] Preserve original filenames on upload with A/B version prefix
 and sanitized names

---
 app.py | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/app.py b/app.py
index aa2c461..603da3c 100644
--- a/app.py
+++ b/app.py
@@ -95,7 +95,8 @@ def upload_path(request_id):
 
 def save_upload(request_id, file_obj, version):
     """
-    Save an uploaded MP3 file for a request.
+    Save an uploaded MP3 file for a request, preserving the original filename
+    with a version prefix (e.g. A - MySong.mp3 / B - MySong.mp3).
     :param request_id: database ID of the request
     :param file_obj: Flask FileStorage from request.files
     :param version: 'a' or 'b'
@@ -106,10 +107,16 @@ def save_upload(request_id, file_obj, version):
     if not allowed_file(file_obj.filename):
         flash('Only MP3 files are allowed.', 'error')
         return None
+
+    # Use Werkzeug's secure_filename to strip unsafe characters.
+    original = secure_filename(file_obj.filename)
+    # Prefix with A or B so the operator knows which version it is.
+    filename = f"{version.upper()} - {original}"
+
     p = upload_path(request_id)
-    filename = f'song_{version}.mp3'
-    file_obj.save(p / filename)
-    return str(p / filename)
+    dest = p / filename
+    file_obj.save(dest)
+    return str(dest)
 
 
 def send_email(to, subject, body, attachments=None):
@@ -366,9 +373,11 @@ def admin_request(rid):
 
                 attachments = []
                 if req['customer_approved'] in ('a', 'both') and req['song_a_path']:
-                    attachments.append((req['song_a_path'], 'song_a.mp3'))
+                    a_name = Path(req['song_a_path']).name
+                    attachments.append((req['song_a_path'], a_name))
                 if req['customer_approved'] in ('b', 'both') and req['song_b_path']:
-                    attachments.append((req['song_b_path'], 'song_b.mp3'))
+                    b_name = Path(req['song_b_path']).name
+                    attachments.append((req['song_b_path'], b_name))
 
                 player_link = f"{current_app.config['PUBLIC_BASE_URL']}/play/{req['player_token']}"
                 body = f"Hi {req['name']},\n\nThanks for your payment! Your approved song is attached to this email.\n\nIf you selected both versions, you'll find two MP3 files.\n\nYou can also keep streaming them here: {player_link}\n\nEnjoy!\n\n— {current_app.config['BOOTH_NAME']}"