Update app.py

app.py

@@ -430,6 +430,34 @@ def upload_reports():
         logger.exception("Upload failed: %s", exc)
         return jsonify({"error": "upload failed", "detail": str(exc)}), 500
 
+@app.route("/<patient_id>/<filename>")
+def serve_report(patient_id, filename):
+    """
+    Serve a specific uploaded PDF (or other allowed file) for a patient.
+    URL format: /<patient_id>/<filename>
+    Example:   /p14562/report1.pdf
+    """
+    try:
+        patient_folder = REPORTS_ROOT / str(patient_id)
+
+        if not patient_folder.exists():
+            abort(404, description=f"Patient folder not found: {patient_id}")
+
+        # security check: only allow files with allowed extensions
+        ext = filename.rsplit(".", 1)[-1].lower() if "." in filename else ""
+        if ext not in ALLOWED_EXTENSIONS:
+            abort(403, description=f"Extension '{ext}' not allowed")
+
+        return send_from_directory(
+            directory=str(patient_folder),
+            path=filename,
+            as_attachment=False  # set True if you want download instead of inline view
+        )
+
+    except Exception as e:
+        logger.exception("Failed to serve file %s/%s: %s", patient_id, filename, e)
+        abort(500, description=f"Failed to serve file: {e}")
+
 
 @app.route("/ping", methods=["GET"])
 def ping():