Add folder type checks in viewer handlers to prevent folder viewing

go_cloud/internal/http/routes.go

@@ -626,6 +626,12 @@ func viewerHandler(w http.ResponseWriter, r *http.Request, db *database.DB, jwtM
 		return
 	}
 
+	// Check if it's a folder - cannot view folders
+	if file.Type == "folder" {
+		errors.WriteError(w, errors.CodeInvalidArgument, "Cannot view folders", http.StatusBadRequest)
+		return
+	}
+
 	// Log activity
 	db.LogActivity(r.Context(), userID, orgID, &fileId, "view_file", map[string]interface{}{})
 
@@ -729,6 +735,12 @@ func userViewerHandler(w http.ResponseWriter, r *http.Request, db *database.DB,
 		return
 	}
 
+	// Check if it's a folder - cannot view folders
+	if file.Type == "folder" {
+		errors.WriteError(w, errors.CodeInvalidArgument, "Cannot view folders", http.StatusBadRequest)
+		return
+	}
+
 	// Optionally log activity without org id
 	db.LogActivity(r.Context(), userID, uuid.Nil, &fileId, "view_user_file", map[string]interface{}{})