@method_decorator(login_or_digest_or_basic_or_apikey())
    def get(self, request, domain, case_id=None, attachment_id=None):

        if self.request.couch_user.is_web_user() and not can_view_attachments(self.request):
            return HttpResponseForbidden()

        if not case_id or not attachment_id:
            raise Http404

        img = self.request.GET.get('img', None)
        size = self.request.GET.get('size', OBJECT_ORIGINAL)
        max_width = int(self.request.GET.get('max_image_width', 0))
        max_height = int(self.request.GET.get('max_image_height', 0))
        max_filesize = int(self.request.GET.get('max_size', 0))

        try:
            CaseAccessors(domain).get_case(case_id)
        except CaseNotFound:
            raise Http404

        if img is not None:
            if size == "debug_all":
                url_base = reverse("api_case_attachment", kwargs={
                    "domain": self.request.domain,
                    "case_id": case_id,
                    "attachment_id": attachment_id,
                })

                r = HttpResponse(content_type="text/html")
                r.write('<html><body>')
                r.write('<ul>')
                for fsize in IMAGE_SIZE_ORDERING:
                    meta, stream = fetch_case_image(
                        domain,
                        case_id,
                        attachment_id,
                        filesize_limit=max_filesize,
                        width_limit=max_width,
                        height_limit=max_height,
                        fixed_size=fsize
                    )

                    r.write('<li>')
                    r.write('Size: %s<br>' % fsize)
                    r.write("Limit: max_size: %s" % max_filesize)
                    if max_width > 0:
                        r.write(", max_width: %s" % max_width)
                    if max_height > 0:
                        r.write(", max_height: %s" % max_height)
                    r.write("<br>")
                    if meta is not None:
                        r.write('Resolution: %d x %d<br>' % (meta['width'], meta['height']))
                        r.write('Filesize: %d<br>' % meta['content_length'])

                        url_params = urllib.urlencode({
                            "img": '1',
                            "size": fsize,
                            "max_size": max_filesize,
                            "max_image_width": max_width,
                            "max_image_height": max_height
                        })
                        r.write('<img src="%(attach_url)s?%(params)s">' % {
                                "attach_url": url_base,
                                "params": url_params
                        })
                    else:
                        r.write('Not available')
                    r.write('</li>')
                r.write('</ul></body></html>')
                return r
            else:
                attachment_meta, attachment_stream = fetch_case_image(
                    domain,
                    case_id,
                    attachment_id,
                    filesize_limit=max_filesize,
                    width_limit=max_width,
                    height_limit=max_height,
                    fixed_size=size
                )
        else:
            cached_attachment = get_cached_case_attachment(domain, case_id, attachment_id)
            attachment_meta, attachment_stream = cached_attachment.get()

        if attachment_meta is not None:
            mime_type = attachment_meta['content_type']
        else:
            mime_type = "plain/text"

        return StreamingHttpResponse(streaming_content=attachment_stream, content_type=mime_type)
if we request to view source that exists in the TB all should be fine
dataset/ETHPy150Open dimagi/commcare-hq/corehq/apps/api/object_fetch_api.py/CaseAttachmentAPI.get--crossover with--dataset/ETHPy150Open django-silk/silk/project/tests/test_view_sql_detail.py/TestViewSQLDetail.test_allowed_file_paths_available_source