boom

app/controllers/admin/digitals_controller.rb

@@ -0,0 +1,12 @@
+class Admin::DigitalsController < Admin::BaseController
+  
+  resource_controller
+  
+  index.before do
+    @product = Product.find_by_permalink(params[:product_id])
+  end
+  
+  create.wants.html { redirect_to admin_product_digitals_url(@product) }
+  destroy.wants.html { redirect_to admin_product_digitals_url(@product) }
+  
+end

app/controllers/digitals_controller.rb

@@ -0,0 +1,16 @@
+class DigitalsController < Spree::BaseController
+
+  ssl_required :show
+
+  def show
+    link = DigitalLink.find_by_secret(params[:secret])
+    if link.present? and link.digital.attachment.present?
+      attachment = link.digital.attachment
+      if link.authorize! and File.file?(attachment.path)
+        send_file attachment.path :filename => attachment.original_filename, :type => attachment.content_type and return
+      end
+    end
+    render :unauthorized
+  end
+  
+end