some changes

static/js/note-files.js

@@ -11,7 +11,7 @@ import { api, uploadWithProgress } from "@rustpad/api";
 import { copyText } from "@rustpad/clipboard";
 import { prepareImageFile } from "@rustpad/image-upload";
 import { askConfirm } from "@rustpad/modal";
-import { safeAppUrl } from "@rustpad/security";
+import { safeAppUrl, safePublicUrl } from "@rustpad/security";
 import { createUploadToast } from "@rustpad/toast";
 
 function escapeHtml(value) {
@@ -40,6 +40,13 @@ function markdownCode(url, label, mimeType) {
   return String(mimeType || "").startsWith("image/") ? `![${label}](${url})` : `[${label}](${url})`;
 }
 
+function safeAttachmentUrl(value) {
+  const raw = String(value || "").trim();
+  return raw.startsWith("/")
+    ? safeAppUrl(raw)
+    : safePublicUrl(raw, { allowMailto: false });
+}
+
 export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, canUpload, toast, onFilesChanged = () => {} }) {
   const dialog = document.querySelector("#files-dialog");
   const list = document.querySelector("#files-list");
@@ -143,13 +150,13 @@ export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, ca
     if (showButton) {
       const panel = showButton.closest(".file-row").querySelector(".file-code");
       const output = panel.querySelector("textarea");
-      const absolute = new URL(safeAppUrl(showButton.dataset.url), location.origin).href;
+      const safeUrl = safeAttachmentUrl(showButton.dataset.url);
+      const absolute = new URL(safeUrl, location.origin).href;
       let text = absolute;
       if (showButton.dataset.showFileCode === "alias") {
         text = aliasCode(showButton.dataset.name, showButton.dataset.name, showButton.dataset.mime);
       } else if (showButton.dataset.showFileCode === "markdown") {
-        const relative = safeAppUrl(showButton.dataset.url);
-        text = markdownCode(relative, showButton.dataset.name, showButton.dataset.mime);
+        text = markdownCode(safeUrl, showButton.dataset.name, showButton.dataset.mime);
       }
       output.value = text; panel.hidden = false; output.focus(); output.select(); return;
     }