@open-mercato/core 0.10.1-develop.7797.1.f0365b4031 → 0.10.1-develop.7799.1.d9cd0c8e41

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 6215 entry points
+[build:core] found 6216 entry points
 [build:core] built successfully
 [build:core:generated] found 271 entry points
 [build:core:generated] built successfully

package/dist/modules/forms/api/attachment-helpers.js

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { FormSubmission, FormVersion } from "../data/entities.js";
 import { isAttachmentServiceError } from "../services/attachment-service.js";
 import { resolveMaxUploadBytes } from "../services/upload-validation.js";
@@ -14,6 +15,28 @@ function mapAttachmentError(error) {
   const message = error instanceof Error ? error.message : "Unknown error";
   return NextResponse.json({ error: "INTERNAL_ERROR", message }, { status: 500 });
 }
+async function resolveAttachmentRolePolicy(em, args, compiler, rolePolicy) {
+  if (!args.role) return null;
+  const scope = { organizationId: args.organizationId, tenantId: args.tenantId };
+  const submission = await findOneWithDecryption(em, FormSubmission, {
+    id: args.submissionId,
+    ...scope,
+    deletedAt: null
+  }, void 0, scope);
+  if (!submission) return null;
+  const version = await findOneWithDecryption(em, FormVersion, {
+    id: submission.formVersionId,
+    ...scope
+  }, void 0, scope);
+  if (!version) return null;
+  const compiled = compiler.compile({
+    id: version.id,
+    updatedAt: version.updatedAt,
+    schema: version.schema,
+    uiSchema: version.uiSchema
+  });
+  return rolePolicy.resolve(compiled, args.role);
+}
 async function resolveFieldUploadConfig(em, args) {
   const submission = await em.findOne(FormSubmission, {
     id: args.submissionId,
@@ -106,6 +129,7 @@ export {
   SANDBOXED_DOWNLOAD_HEADERS,
   mapAttachmentError,
   parseUploadBody,
+  resolveAttachmentRolePolicy,
   resolveFieldUploadConfig
 };
 //# sourceMappingURL=attachment-helpers.js.map

package/dist/modules/forms/api/attachment-helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/forms/api/attachment-helpers.ts"],
-  "sourcesContent": ["/**\n * Shared helpers for the W4 attachment upload / download routes.\n *\n * Resolves the per-field upload config (`x-om-accept`, `x-om-max-size-bytes`,\n * `x-om-multiple`) from the submission's pinned form version \u2014 the server is\n * authoritative; the client never supplies these constraints.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { FormSubmission, FormVersion } from '../data/entities'\nimport { AttachmentServiceError, isAttachmentServiceError } from '../services/attachment-service'\nimport { resolveMaxUploadBytes } from '../services/upload-validation'\n\nconst MULTIPART_OVERHEAD_BYTES = 64 * 1024\n\nexport const SANDBOXED_DOWNLOAD_HEADERS = {\n  'content-security-policy': \"default-src 'none'; sandbox\",\n  'x-content-type-options': 'nosniff',\n} as const\n\nexport type FieldUploadConfig = {\n  fieldKey: string\n  accept: string[] | null\n  maxSizeBytes: number | null\n  multiple: boolean\n}\n\nexport function mapAttachmentError(error: unknown): NextResponse {\n  if (isAttachmentServiceError(error)) {\n    return NextResponse.json({ error: error.code, message: error.message }, { status: error.httpStatus })\n  }\n  const message = error instanceof Error ? error.message : 'Unknown error'\n  return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n}\n\n/**\n * Looks up the `file`-typed field node on the submission's pinned form version\n * and reads its upload config. Returns `null` when the submission, version, or\n * field is missing, or when the field is not a `file` type. Scope is enforced\n * by org+tenant on both reads.\n */\nexport async function resolveFieldUploadConfig(\n  em: EntityManager,\n  args: { organizationId: string; tenantId: string; submissionId: string; fieldKey: string },\n): Promise<FieldUploadConfig | null> {\n  const submission = await em.findOne(FormSubmission, {\n    id: args.submissionId,\n    organizationId: args.organizationId,\n    tenantId: args.tenantId,\n    deletedAt: null,\n  })\n  if (!submission) return null\n\n  const version = await em.findOne(FormVersion, {\n    id: submission.formVersionId,\n    organizationId: args.organizationId,\n    tenantId: args.tenantId,\n  })\n  if (!version) return null\n\n  const properties = (version.schema as Record<string, unknown>).properties\n  if (!properties || typeof properties !== 'object' || Array.isArray(properties)) return null\n  const node = (properties as Record<string, unknown>)[args.fieldKey]\n  if (!node || typeof node !== 'object' || Array.isArray(node)) return null\n\n  const record = node as Record<string, unknown>\n  if (record['x-om-type'] !== 'file') return null\n\n  const acceptRaw = record['x-om-accept']\n  const accept = Array.isArray(acceptRaw)\n    ? acceptRaw.filter((entry): entry is string => typeof entry === 'string' && entry.length > 0)\n    : null\n  const maxRaw = record['x-om-max-size-bytes']\n  const maxSizeBytes = typeof maxRaw === 'number' && Number.isFinite(maxRaw) && maxRaw > 0 ? maxRaw : null\n\n  return {\n    fieldKey: args.fieldKey,\n    accept: accept && accept.length > 0 ? accept : null,\n    maxSizeBytes,\n    multiple: record['x-om-multiple'] === true,\n  }\n}\n\nexport type ParsedUpload = {\n  fieldKey: string\n  filename: string\n  contentType: string\n  bytes: Buffer\n}\n\n/**\n * Parses a multipart/form-data upload body. Expects a `file` part and a\n * `field_key` text part. Returns a 422 response describing the failure when\n * the body is malformed.\n */\nexport async function parseUploadBody(\n  req: Request,\n  maxFileBytes: number = resolveMaxUploadBytes(process.env),\n): Promise<ParsedUpload | NextResponse> {\n  const maxBodyBytes = maxFileBytes + MULTIPART_OVERHEAD_BYTES\n  const declaredLength = Number(req.headers.get('content-length'))\n  if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {\n    return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n  }\n\n  const boundedBody = await readBoundedBody(req, maxBodyBytes)\n  if (boundedBody instanceof NextResponse) return boundedBody\n\n  let form: FormData\n  try {\n    const boundedRequest = new Request(req.url, {\n      method: req.method,\n      headers: req.headers,\n      body: boundedBody as unknown as BodyInit,\n    })\n    form = await boundedRequest.formData()\n  } catch {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Expected multipart/form-data.' }, { status: 422 })\n  }\n  const fieldKeyRaw = form.get('field_key')\n  if (typeof fieldKeyRaw !== 'string' || fieldKeyRaw.length === 0) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Missing field_key.' }, { status: 422 })\n  }\n  const filePart = form.get('file')\n  if (!(filePart instanceof File)) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Missing file part.' }, { status: 422 })\n  }\n  if (filePart.size > maxFileBytes) {\n    return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n  }\n  const arrayBuffer = await filePart.arrayBuffer()\n  return {\n    fieldKey: fieldKeyRaw,\n    filename: filePart.name || 'upload',\n    contentType: filePart.type || 'application/octet-stream',\n    bytes: Buffer.from(arrayBuffer),\n  }\n}\n\nasync function readBoundedBody(req: Request, maxBodyBytes: number): Promise<Buffer | NextResponse> {\n  if (!req.body) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Expected multipart/form-data.' }, { status: 422 })\n  }\n\n  const reader = req.body.getReader()\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for (;;) {\n    const { done, value } = await reader.read()\n    if (done) break\n    totalBytes += value.byteLength\n    if (totalBytes > maxBodyBytes) {\n      await reader.cancel()\n      return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n    }\n    chunks.push(Buffer.from(value))\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n"],
-  "mappings": "AAQA,SAAS,oBAAoB;AAE7B,SAAS,gBAAgB,mBAAmB;AAC5C,SAAiC,gCAAgC;AACjE,SAAS,6BAA6B;AAEtC,MAAM,2BAA2B,KAAK;AAE/B,MAAM,6BAA6B;AAAA,EACxC,2BAA2B;AAAA,EAC3B,0BAA0B;AAC5B;AASO,SAAS,mBAAmB,OAA8B;AAC/D,MAAI,yBAAyB,KAAK,GAAG;AACnC,WAAO,aAAa,KAAK,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ,GAAG,EAAE,QAAQ,MAAM,WAAW,CAAC;AAAA,EACtG;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChF;AAQA,eAAsB,yBACpB,IACA,MACmC;AACnC,QAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,IAClD,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,MAAM,GAAG,QAAQ,aAAa;AAAA,IAC5C,IAAI,WAAW;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AACD,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,aAAc,QAAQ,OAAmC;AAC/D,MAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,EAAG,QAAO;AACvF,QAAM,OAAQ,WAAuC,KAAK,QAAQ;AAClE,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AAErE,QAAM,SAAS;AACf,MAAI,OAAO,WAAW,MAAM,OAAQ,QAAO;AAE3C,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,SAAS,MAAM,QAAQ,SAAS,IAClC,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IAC1F;AACJ,QAAM,SAAS,OAAO,qBAAqB;AAC3C,QAAM,eAAe,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AAEpG,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,QAAQ,UAAU,OAAO,SAAS,IAAI,SAAS;AAAA,IAC/C;AAAA,IACA,UAAU,OAAO,eAAe,MAAM;AAAA,EACxC;AACF;AAcA,eAAsB,gBACpB,KACA,eAAuB,sBAAsB,QAAQ,GAAG,GAClB;AACtC,QAAM,eAAe,eAAe;AACpC,QAAM,iBAAiB,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC;AAC/D,MAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,cAAc;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/G;AAEA,QAAM,cAAc,MAAM,gBAAgB,KAAK,YAAY;AAC3D,MAAI,uBAAuB,aAAc,QAAO;AAEhD,MAAI;AACJ,MAAI;AACF,UAAM,iBAAiB,IAAI,QAAQ,IAAI,KAAK;AAAA,MAC1C,QAAQ,IAAI;AAAA,MACZ,SAAS,IAAI;AAAA,MACb,MAAM;AAAA,IACR,CAAC;AACD,WAAO,MAAM,eAAe,SAAS;AAAA,EACvC,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpH;AACA,QAAM,cAAc,KAAK,IAAI,WAAW;AACxC,MAAI,OAAO,gBAAgB,YAAY,YAAY,WAAW,GAAG;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AACA,QAAM,WAAW,KAAK,IAAI,MAAM;AAChC,MAAI,EAAE,oBAAoB,OAAO;AAC/B,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AACA,MAAI,SAAS,OAAO,cAAc;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/G;AACA,QAAM,cAAc,MAAM,SAAS,YAAY;AAC/C,SAAO;AAAA,IACL,UAAU;AAAA,IACV,UAAU,SAAS,QAAQ;AAAA,IAC3B,aAAa,SAAS,QAAQ;AAAA,IAC9B,OAAO,OAAO,KAAK,WAAW;AAAA,EAChC;AACF;AAEA,eAAe,gBAAgB,KAAc,cAAsD;AACjG,MAAI,CAAC,IAAI,MAAM;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpH;AAEA,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,SAAmB,CAAC;AAC1B,MAAI,aAAa;AACjB,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,kBAAc,MAAM;AACpB,QAAI,aAAa,cAAc;AAC7B,YAAM,OAAO,OAAO;AACpB,aAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,WAAO,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,EAChC;AACA,SAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;",
+  "sourcesContent": ["/**\n * Shared helpers for the W4 attachment upload / download routes.\n *\n * Resolves the per-field upload config (`x-om-accept`, `x-om-max-size-bytes`,\n * `x-om-multiple`) from the submission's pinned form version \u2014 the server is\n * authoritative; the client never supplies these constraints.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { FormSubmission, FormVersion } from '../data/entities'\nimport type { FormVersionCompiler } from '../services/form-version-compiler'\nimport type { RolePolicyResolution, RolePolicyService } from '../services/role-policy-service'\nimport { AttachmentServiceError, isAttachmentServiceError } from '../services/attachment-service'\nimport { resolveMaxUploadBytes } from '../services/upload-validation'\n\nconst MULTIPART_OVERHEAD_BYTES = 64 * 1024\n\nexport const SANDBOXED_DOWNLOAD_HEADERS = {\n  'content-security-policy': \"default-src 'none'; sandbox\",\n  'x-content-type-options': 'nosniff',\n} as const\n\nexport type FieldUploadConfig = {\n  fieldKey: string\n  accept: string[] | null\n  maxSizeBytes: number | null\n  multiple: boolean\n}\n\nexport function mapAttachmentError(error: unknown): NextResponse {\n  if (isAttachmentServiceError(error)) {\n    return NextResponse.json({ error: error.code, message: error.message }, { status: error.httpStatus })\n  }\n  const message = error instanceof Error ? error.message : 'Unknown error'\n  return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n}\n\nexport async function resolveAttachmentRolePolicy(\n  em: EntityManager,\n  args: { organizationId: string; tenantId: string; submissionId: string; role: string | null },\n  compiler: FormVersionCompiler,\n  rolePolicy: RolePolicyService,\n): Promise<RolePolicyResolution | null> {\n  if (!args.role) return null\n\n  const scope = { organizationId: args.organizationId, tenantId: args.tenantId }\n  const submission = await findOneWithDecryption(em, FormSubmission, {\n    id: args.submissionId,\n    ...scope,\n    deletedAt: null,\n  }, undefined, scope)\n  if (!submission) return null\n\n  const version = await findOneWithDecryption(em, FormVersion, {\n    id: submission.formVersionId,\n    ...scope,\n  }, undefined, scope)\n  if (!version) return null\n\n  const compiled = compiler.compile({\n    id: version.id,\n    updatedAt: version.updatedAt,\n    schema: version.schema,\n    uiSchema: version.uiSchema,\n  })\n  return rolePolicy.resolve(compiled, args.role)\n}\n\n/**\n * Looks up the `file`-typed field node on the submission's pinned form version\n * and reads its upload config. Returns `null` when the submission, version, or\n * field is missing, or when the field is not a `file` type. Scope is enforced\n * by org+tenant on both reads.\n */\nexport async function resolveFieldUploadConfig(\n  em: EntityManager,\n  args: { organizationId: string; tenantId: string; submissionId: string; fieldKey: string },\n): Promise<FieldUploadConfig | null> {\n  const submission = await em.findOne(FormSubmission, {\n    id: args.submissionId,\n    organizationId: args.organizationId,\n    tenantId: args.tenantId,\n    deletedAt: null,\n  })\n  if (!submission) return null\n\n  const version = await em.findOne(FormVersion, {\n    id: submission.formVersionId,\n    organizationId: args.organizationId,\n    tenantId: args.tenantId,\n  })\n  if (!version) return null\n\n  const properties = (version.schema as Record<string, unknown>).properties\n  if (!properties || typeof properties !== 'object' || Array.isArray(properties)) return null\n  const node = (properties as Record<string, unknown>)[args.fieldKey]\n  if (!node || typeof node !== 'object' || Array.isArray(node)) return null\n\n  const record = node as Record<string, unknown>\n  if (record['x-om-type'] !== 'file') return null\n\n  const acceptRaw = record['x-om-accept']\n  const accept = Array.isArray(acceptRaw)\n    ? acceptRaw.filter((entry): entry is string => typeof entry === 'string' && entry.length > 0)\n    : null\n  const maxRaw = record['x-om-max-size-bytes']\n  const maxSizeBytes = typeof maxRaw === 'number' && Number.isFinite(maxRaw) && maxRaw > 0 ? maxRaw : null\n\n  return {\n    fieldKey: args.fieldKey,\n    accept: accept && accept.length > 0 ? accept : null,\n    maxSizeBytes,\n    multiple: record['x-om-multiple'] === true,\n  }\n}\n\nexport type ParsedUpload = {\n  fieldKey: string\n  filename: string\n  contentType: string\n  bytes: Buffer\n}\n\n/**\n * Parses a multipart/form-data upload body. Expects a `file` part and a\n * `field_key` text part. Returns a 422 response describing the failure when\n * the body is malformed.\n */\nexport async function parseUploadBody(\n  req: Request,\n  maxFileBytes: number = resolveMaxUploadBytes(process.env),\n): Promise<ParsedUpload | NextResponse> {\n  const maxBodyBytes = maxFileBytes + MULTIPART_OVERHEAD_BYTES\n  const declaredLength = Number(req.headers.get('content-length'))\n  if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {\n    return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n  }\n\n  const boundedBody = await readBoundedBody(req, maxBodyBytes)\n  if (boundedBody instanceof NextResponse) return boundedBody\n\n  let form: FormData\n  try {\n    const boundedRequest = new Request(req.url, {\n      method: req.method,\n      headers: req.headers,\n      body: boundedBody as unknown as BodyInit,\n    })\n    form = await boundedRequest.formData()\n  } catch {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Expected multipart/form-data.' }, { status: 422 })\n  }\n  const fieldKeyRaw = form.get('field_key')\n  if (typeof fieldKeyRaw !== 'string' || fieldKeyRaw.length === 0) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Missing field_key.' }, { status: 422 })\n  }\n  const filePart = form.get('file')\n  if (!(filePart instanceof File)) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Missing file part.' }, { status: 422 })\n  }\n  if (filePart.size > maxFileBytes) {\n    return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n  }\n  const arrayBuffer = await filePart.arrayBuffer()\n  return {\n    fieldKey: fieldKeyRaw,\n    filename: filePart.name || 'upload',\n    contentType: filePart.type || 'application/octet-stream',\n    bytes: Buffer.from(arrayBuffer),\n  }\n}\n\nasync function readBoundedBody(req: Request, maxBodyBytes: number): Promise<Buffer | NextResponse> {\n  if (!req.body) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Expected multipart/form-data.' }, { status: 422 })\n  }\n\n  const reader = req.body.getReader()\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for (;;) {\n    const { done, value } = await reader.read()\n    if (done) break\n    totalBytes += value.byteLength\n    if (totalBytes > maxBodyBytes) {\n      await reader.cancel()\n      return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n    }\n    chunks.push(Buffer.from(value))\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n"],
+  "mappings": "AAQA,SAAS,oBAAoB;AAE7B,SAAS,6BAA6B;AACtC,SAAS,gBAAgB,mBAAmB;AAG5C,SAAiC,gCAAgC;AACjE,SAAS,6BAA6B;AAEtC,MAAM,2BAA2B,KAAK;AAE/B,MAAM,6BAA6B;AAAA,EACxC,2BAA2B;AAAA,EAC3B,0BAA0B;AAC5B;AASO,SAAS,mBAAmB,OAA8B;AAC/D,MAAI,yBAAyB,KAAK,GAAG;AACnC,WAAO,aAAa,KAAK,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ,GAAG,EAAE,QAAQ,MAAM,WAAW,CAAC;AAAA,EACtG;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChF;AAEA,eAAsB,4BACpB,IACA,MACA,UACA,YACsC;AACtC,MAAI,CAAC,KAAK,KAAM,QAAO;AAEvB,QAAM,QAAQ,EAAE,gBAAgB,KAAK,gBAAgB,UAAU,KAAK,SAAS;AAC7E,QAAM,aAAa,MAAM,sBAAsB,IAAI,gBAAgB;AAAA,IACjE,IAAI,KAAK;AAAA,IACT,GAAG;AAAA,IACH,WAAW;AAAA,EACb,GAAG,QAAW,KAAK;AACnB,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,MAAM,sBAAsB,IAAI,aAAa;AAAA,IAC3D,IAAI,WAAW;AAAA,IACf,GAAG;AAAA,EACL,GAAG,QAAW,KAAK;AACnB,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,WAAW,SAAS,QAAQ;AAAA,IAChC,IAAI,QAAQ;AAAA,IACZ,WAAW,QAAQ;AAAA,IACnB,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,EACpB,CAAC;AACD,SAAO,WAAW,QAAQ,UAAU,KAAK,IAAI;AAC/C;AAQA,eAAsB,yBACpB,IACA,MACmC;AACnC,QAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,IAClD,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,MAAM,GAAG,QAAQ,aAAa;AAAA,IAC5C,IAAI,WAAW;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AACD,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,aAAc,QAAQ,OAAmC;AAC/D,MAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,EAAG,QAAO;AACvF,QAAM,OAAQ,WAAuC,KAAK,QAAQ;AAClE,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AAErE,QAAM,SAAS;AACf,MAAI,OAAO,WAAW,MAAM,OAAQ,QAAO;AAE3C,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,SAAS,MAAM,QAAQ,SAAS,IAClC,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IAC1F;AACJ,QAAM,SAAS,OAAO,qBAAqB;AAC3C,QAAM,eAAe,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AAEpG,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,QAAQ,UAAU,OAAO,SAAS,IAAI,SAAS;AAAA,IAC/C;AAAA,IACA,UAAU,OAAO,eAAe,MAAM;AAAA,EACxC;AACF;AAcA,eAAsB,gBACpB,KACA,eAAuB,sBAAsB,QAAQ,GAAG,GAClB;AACtC,QAAM,eAAe,eAAe;AACpC,QAAM,iBAAiB,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC;AAC/D,MAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,cAAc;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/G;AAEA,QAAM,cAAc,MAAM,gBAAgB,KAAK,YAAY;AAC3D,MAAI,uBAAuB,aAAc,QAAO;AAEhD,MAAI;AACJ,MAAI;AACF,UAAM,iBAAiB,IAAI,QAAQ,IAAI,KAAK;AAAA,MAC1C,QAAQ,IAAI;AAAA,MACZ,SAAS,IAAI;AAAA,MACb,MAAM;AAAA,IACR,CAAC;AACD,WAAO,MAAM,eAAe,SAAS;AAAA,EACvC,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpH;AACA,QAAM,cAAc,KAAK,IAAI,WAAW;AACxC,MAAI,OAAO,gBAAgB,YAAY,YAAY,WAAW,GAAG;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AACA,QAAM,WAAW,KAAK,IAAI,MAAM;AAChC,MAAI,EAAE,oBAAoB,OAAO;AAC/B,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AACA,MAAI,SAAS,OAAO,cAAc;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/G;AACA,QAAM,cAAc,MAAM,SAAS,YAAY;AAC/C,SAAO;AAAA,IACL,UAAU;AAAA,IACV,UAAU,SAAS,QAAQ;AAAA,IAC3B,aAAa,SAAS,QAAQ;AAAA,IAC9B,OAAO,OAAO,KAAK,WAAW;AAAA,EAChC;AACF;AAEA,eAAe,gBAAgB,KAAc,cAAsD;AACjG,MAAI,CAAC,IAAI,MAAM;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpH;AAEA,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,SAAmB,CAAC;AAC1B,MAAI,aAAa;AACjB,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,kBAAc,MAAM;AACpB,QAAI,aAAa,cAAc;AAC7B,YAAM,OAAO,OAAO;AACpB,aAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,WAAO,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,EAChC;AACA,SAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;",
   "names": []
 }

package/dist/modules/forms/api/public/submissions/[id]/attachments/[attachmentId]/route.js

@@ -1,8 +1,11 @@
 import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { FormAttachment } from "../../../../../../data/entities.js";
 import { resolveRuntimePrincipal } from "../../../../../../lib/runtime-principal.js";
 import {
   mapAttachmentError,
+  resolveAttachmentRolePolicy,
   SANDBOXED_DOWNLOAD_HEADERS
 } from "../../../../../attachment-helpers.js";
 import { buildPublicRateLimitKey, enforcePublicRateLimit } from "../../../../rate-limit.js";
@@ -24,6 +27,28 @@ async function GET(req, context) {
   const principal = await resolveRuntimePrincipal({ req, submissionId, em });
   if (!principal) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
   try {
+    const scope = { organizationId: principal.organizationId, tenantId: principal.tenantId };
+    const policy = await resolveAttachmentRolePolicy(
+      em,
+      {
+        ...scope,
+        submissionId,
+        role: principal.role
+      },
+      container.resolve("formVersionCompiler"),
+      container.resolve("formsRolePolicyService")
+    );
+    if (!policy) return NextResponse.json({ error: "NOT_FOUND" }, { status: 404 });
+    const attachment = await findOneWithDecryption(em, FormAttachment, {
+      id: attachmentId,
+      submissionId,
+      organizationId: principal.organizationId,
+      kind: "user_upload",
+      removedAt: null
+    }, { fields: ["fieldKey"] }, scope);
+    if (!attachment || !policy.canRead(attachment.fieldKey)) {
+      return NextResponse.json({ error: "NOT_FOUND" }, { status: 404 });
+    }
     const result = await service.readUpload({
       organizationId: principal.organizationId,
       tenantId: principal.tenantId,
@@ -45,7 +70,7 @@ async function GET(req, context) {
 }
 const getMethodDoc = {
   summary: "Download a submission attachment (public/anonymous)",
-  description: "Streams the decrypted user-upload bytes for the owning participant. Authorized via access token or portal session.",
+  description: "Streams decrypted user-upload bytes only when the participant role can read the attachment field in the submission\u2019s pinned version. Authorized via access token or portal session.",
   tags: ["Forms Public Runtime"],
   responses: [{ status: 200, description: "Attachment stream", mediaType: "application/octet-stream" }],
   errors: [

package/dist/modules/forms/api/public/submissions/[id]/attachments/[attachmentId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../../src/modules/forms/api/public/submissions/%5Bid%5D/attachments/%5BattachmentId%5D/route.ts"],
-  "sourcesContent": ["/**\n * Public/anonymous attachment download \u2014\n * GET /api/forms/public/submissions/:id/attachments/:attachmentId\n *\n * Streams a decrypted user-upload attachment back to the owning participant so\n * they can preview / confirm what they uploaded. Authorized via\n * `resolveRuntimePrincipal` (bearer access token OR portal session); org/tenant\n * are re-derived from the persisted submission (R-2d-4). Cross-tenant ids\n * return 404 (no enumeration).\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { AttachmentService } from '../../../../../../services/attachment-service'\nimport { resolveRuntimePrincipal } from '../../../../../../lib/runtime-principal'\nimport {\n  mapAttachmentError,\n  SANDBOXED_DOWNLOAD_HEADERS,\n} from '../../../../../attachment-helpers'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../../rate-limit'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { id: string; attachmentId: string } | Promise<{ id: string; attachmentId: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n  const attachmentId = String(params.attachmentId)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('submission-attachment', submissionId, attachmentId),\n  )\n  if (limited) return limited\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = container.resolve('formsAttachmentService') as AttachmentService\n\n  const principal = await resolveRuntimePrincipal({ req, submissionId, em })\n  if (!principal) return NextResponse.json({ error: 'UNAUTHORIZED' }, { status: 401 })\n\n  try {\n    const result = await service.readUpload({\n      organizationId: principal.organizationId,\n      tenantId: principal.tenantId,\n      submissionId,\n      attachmentId,\n    })\n    const safeName = result.filename.replace(/[\"\\\\\\r\\n]/g, '_') || 'attachment'\n    return new NextResponse(result.bytes as unknown as BodyInit, {\n      status: 200,\n      headers: {\n        'content-type': result.contentType || 'application/octet-stream',\n        'content-disposition': `attachment; filename=\"${safeName}\"`,\n        ...SANDBOXED_DOWNLOAD_HEADERS,\n      },\n    })\n  } catch (error) {\n    return mapAttachmentError(error)\n  }\n}\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Download a submission attachment (public/anonymous)',\n  description: 'Streams the decrypted user-upload bytes for the owning participant. Authorized via access token or portal session.',\n  tags: ['Forms Public Runtime'],\n  responses: [{ status: 200, description: 'Attachment stream', mediaType: 'application/octet-stream' }],\n  errors: [\n    { status: 401, description: 'Missing or invalid access token / session' },\n    { status: 404, description: 'Attachment not found' },\n    { status: 429, description: 'Rate limit exceeded' },\n    { status: 503, description: 'Rate limiting unavailable' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Public attachment download',\n  methods: { GET: getMethodDoc },\n}\n"],
-  "mappings": "AAWA,SAAS,oBAAsC;AAG/C,SAAS,8BAA8B;AAEvC,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AACrC,QAAM,eAAe,OAAO,OAAO,YAAY;AAE/C,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,yBAAyB,cAAc,YAAY;AAAA,EAC7E;AACA,MAAI,QAAS,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,QAAM,YAAY,MAAM,wBAAwB,EAAE,KAAK,cAAc,GAAG,CAAC;AACzE,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEnF,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,WAAW;AAAA,MACtC,gBAAgB,UAAU;AAAA,MAC1B,UAAU,UAAU;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,WAAW,OAAO,SAAS,QAAQ,cAAc,GAAG,KAAK;AAC/D,WAAO,IAAI,aAAa,OAAO,OAA8B;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB,OAAO,eAAe;AAAA,QACtC,uBAAuB,yBAAyB,QAAQ;AAAA,QACxD,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,sBAAsB;AAAA,EAC7B,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,WAAW,2BAA2B,CAAC;AAAA,EACpG,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,4CAA4C;AAAA,IACxE,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,IACnD,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,IAClD,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,EAC1D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "sourcesContent": ["/**\n * Public/anonymous attachment download \u2014\n * GET /api/forms/public/submissions/:id/attachments/:attachmentId\n *\n * Streams a decrypted user-upload attachment back to the owning participant so\n * they can preview / confirm what they uploaded. Authorized via\n * `resolveRuntimePrincipal` (bearer access token OR portal session); org/tenant\n * are re-derived from the persisted submission (R-2d-4). Cross-tenant ids\n * return 404 (no enumeration).\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { FormAttachment } from '../../../../../../data/entities'\nimport type { AttachmentService } from '../../../../../../services/attachment-service'\nimport type { FormVersionCompiler } from '../../../../../../services/form-version-compiler'\nimport type { RolePolicyService } from '../../../../../../services/role-policy-service'\nimport { resolveRuntimePrincipal } from '../../../../../../lib/runtime-principal'\nimport {\n  mapAttachmentError,\n  resolveAttachmentRolePolicy,\n  SANDBOXED_DOWNLOAD_HEADERS,\n} from '../../../../../attachment-helpers'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../../rate-limit'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { id: string; attachmentId: string } | Promise<{ id: string; attachmentId: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n  const attachmentId = String(params.attachmentId)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('submission-attachment', submissionId, attachmentId),\n  )\n  if (limited) return limited\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = container.resolve('formsAttachmentService') as AttachmentService\n\n  const principal = await resolveRuntimePrincipal({ req, submissionId, em })\n  if (!principal) return NextResponse.json({ error: 'UNAUTHORIZED' }, { status: 401 })\n\n  try {\n    const scope = { organizationId: principal.organizationId, tenantId: principal.tenantId }\n    const policy = await resolveAttachmentRolePolicy(em, {\n      ...scope,\n      submissionId,\n      role: principal.role,\n    }, container.resolve('formVersionCompiler') as FormVersionCompiler,\n    container.resolve('formsRolePolicyService') as RolePolicyService)\n    if (!policy) return NextResponse.json({ error: 'NOT_FOUND' }, { status: 404 })\n\n    const attachment = await findOneWithDecryption(em, FormAttachment, {\n      id: attachmentId,\n      submissionId,\n      organizationId: principal.organizationId,\n      kind: 'user_upload',\n      removedAt: null,\n    }, { fields: ['fieldKey'] }, scope)\n    if (!attachment || !policy.canRead(attachment.fieldKey)) {\n      return NextResponse.json({ error: 'NOT_FOUND' }, { status: 404 })\n    }\n\n    const result = await service.readUpload({\n      organizationId: principal.organizationId,\n      tenantId: principal.tenantId,\n      submissionId,\n      attachmentId,\n    })\n    const safeName = result.filename.replace(/[\"\\\\\\r\\n]/g, '_') || 'attachment'\n    return new NextResponse(result.bytes as unknown as BodyInit, {\n      status: 200,\n      headers: {\n        'content-type': result.contentType || 'application/octet-stream',\n        'content-disposition': `attachment; filename=\"${safeName}\"`,\n        ...SANDBOXED_DOWNLOAD_HEADERS,\n      },\n    })\n  } catch (error) {\n    return mapAttachmentError(error)\n  }\n}\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Download a submission attachment (public/anonymous)',\n  description: 'Streams decrypted user-upload bytes only when the participant role can read the attachment field in the submission\u2019s pinned version. Authorized via access token or portal session.',\n  tags: ['Forms Public Runtime'],\n  responses: [{ status: 200, description: 'Attachment stream', mediaType: 'application/octet-stream' }],\n  errors: [\n    { status: 401, description: 'Missing or invalid access token / session' },\n    { status: 404, description: 'Attachment not found' },\n    { status: 429, description: 'Rate limit exceeded' },\n    { status: 503, description: 'Rate limiting unavailable' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Public attachment download',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAWA,SAAS,oBAAsC;AAG/C,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAI/B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AACrC,QAAM,eAAe,OAAO,OAAO,YAAY;AAE/C,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,yBAAyB,cAAc,YAAY;AAAA,EAC7E;AACA,MAAI,QAAS,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,QAAM,YAAY,MAAM,wBAAwB,EAAE,KAAK,cAAc,GAAG,CAAC;AACzE,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEnF,MAAI;AACF,UAAM,QAAQ,EAAE,gBAAgB,UAAU,gBAAgB,UAAU,UAAU,SAAS;AACvF,UAAM,SAAS,MAAM;AAAA,MAA4B;AAAA,MAAI;AAAA,QACnD,GAAG;AAAA,QACH;AAAA,QACA,MAAM,UAAU;AAAA,MAClB;AAAA,MAAG,UAAU,QAAQ,qBAAqB;AAAA,MAC1C,UAAU,QAAQ,wBAAwB;AAAA,IAAsB;AAChE,QAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE7E,UAAM,aAAa,MAAM,sBAAsB,IAAI,gBAAgB;AAAA,MACjE,IAAI;AAAA,MACJ;AAAA,MACA,gBAAgB,UAAU;AAAA,MAC1B,MAAM;AAAA,MACN,WAAW;AAAA,IACb,GAAG,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,KAAK;AAClC,QAAI,CAAC,cAAc,CAAC,OAAO,QAAQ,WAAW,QAAQ,GAAG;AACvD,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAEA,UAAM,SAAS,MAAM,QAAQ,WAAW;AAAA,MACtC,gBAAgB,UAAU;AAAA,MAC1B,UAAU,UAAU;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,WAAW,OAAO,SAAS,QAAQ,cAAc,GAAG,KAAK;AAC/D,WAAO,IAAI,aAAa,OAAO,OAA8B;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB,OAAO,eAAe;AAAA,QACtC,uBAAuB,yBAAyB,QAAQ;AAAA,QACxD,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,sBAAsB;AAAA,EAC7B,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,WAAW,2BAA2B,CAAC;AAAA,EACpG,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,4CAA4C;AAAA,IACxE,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,IACnD,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,IAClD,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,EAC1D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
   "names": []
 }

package/dist/modules/forms/api/public/submissions/[id]/attachments/route.js

@@ -5,6 +5,7 @@ import { resolveRuntimePrincipal } from "../../../../../lib/runtime-principal.js
 import {
   mapAttachmentError,
   parseUploadBody,
+  resolveAttachmentRolePolicy,
   resolveFieldUploadConfig
 } from "../../../../attachment-helpers.js";
 import { buildPublicRateLimitKey, enforcePublicRateLimit } from "../../../rate-limit.js";
@@ -26,6 +27,20 @@ async function POST(req, context) {
   if (!principal) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
   const parsed = await parseUploadBody(req);
   if (parsed instanceof NextResponse) return parsed;
+  const policy = await resolveAttachmentRolePolicy(
+    em,
+    {
+      organizationId: principal.organizationId,
+      tenantId: principal.tenantId,
+      submissionId,
+      role: principal.role
+    },
+    container.resolve("formVersionCompiler"),
+    container.resolve("formsRolePolicyService")
+  );
+  if (!policy?.canWrite(parsed.fieldKey)) {
+    return NextResponse.json({ error: "NOT_FOUND" }, { status: 404 });
+  }
   const config = await resolveFieldUploadConfig(em, {
     organizationId: principal.organizationId,
     tenantId: principal.tenantId,
@@ -62,11 +77,12 @@ const uploadResponseSchema = z.object({
 });
 const postMethodDoc = {
   summary: "Upload an attachment (public/anonymous)",
-  description: "Stores an encrypted file for a file-typed field. Authorized via access token or portal session.",
+  description: "Stores an encrypted file for a file-typed field the participant role can edit in the submission\u2019s pinned version. Authorized via access token or portal session.",
   tags: ["Forms Public Runtime"],
   responses: [{ status: 201, description: "Attachment stored", schema: uploadResponseSchema }],
   errors: [
     { status: 401, description: "Missing or invalid access token / session", schema: errorSchema },
+    { status: 404, description: "Field not found or not editable by the participant role", schema: errorSchema },
     { status: 413, description: "File empty or oversize", schema: errorSchema },
     { status: 422, description: "Disallowed type / invalid field / scan rejected", schema: errorSchema },
     { status: 429, description: "Rate limit exceeded", schema: errorSchema },

package/dist/modules/forms/api/public/submissions/[id]/attachments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/forms/api/public/submissions/%5Bid%5D/attachments/route.ts"],
-  "sourcesContent": ["/**\n * Public/anonymous attachment upload \u2014\n * POST /api/forms/public/submissions/:id/attachments\n *\n * Token- or portal-authenticated participants upload a file for a `file`-typed\n * field. Authorization goes through `resolveRuntimePrincipal` (bearer access\n * token OR customer session). Org/tenant are ALWAYS re-derived from the\n * persisted submission row (R-2d-4) \u2014 never trusted from the client. Bytes are\n * encrypted at rest and gated by MIME allowlist, size ceiling, and the\n * pluggable virus scanner (W4 / SEC-4).\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { AttachmentService } from '../../../../../services/attachment-service'\nimport { resolveRuntimePrincipal } from '../../../../../lib/runtime-principal'\nimport {\n  mapAttachmentError,\n  parseUploadBody,\n  resolveFieldUploadConfig,\n} from '../../../../attachment-helpers'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../rate-limit'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('submission-upload', submissionId),\n  )\n  if (limited) return limited\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = container.resolve('formsAttachmentService') as AttachmentService\n\n  const principal = await resolveRuntimePrincipal({ req, submissionId, em })\n  if (!principal) return NextResponse.json({ error: 'UNAUTHORIZED' }, { status: 401 })\n\n  const parsed = await parseUploadBody(req)\n  if (parsed instanceof NextResponse) return parsed\n\n  const config = await resolveFieldUploadConfig(em, {\n    organizationId: principal.organizationId,\n    tenantId: principal.tenantId,\n    submissionId,\n    fieldKey: parsed.fieldKey,\n  })\n  if (!config) {\n    return NextResponse.json({ error: 'INVALID_FIELD' }, { status: 422 })\n  }\n\n  try {\n    const stored = await service.storeUpload({\n      organizationId: principal.organizationId,\n      tenantId: principal.tenantId,\n      submissionId,\n      fieldKey: parsed.fieldKey,\n      filename: parsed.filename,\n      contentType: parsed.contentType,\n      bytes: parsed.bytes,\n      uploadedBy: principal.source === 'customer' ? principal.principal : null,\n      accept: config.accept,\n      fieldMaxSizeBytes: config.maxSizeBytes,\n    })\n    return NextResponse.json(stored, { status: 201 })\n  } catch (error) {\n    return mapAttachmentError(error)\n  }\n}\n\nconst errorSchema = z.object({ error: z.string(), message: z.string().optional() })\nconst uploadResponseSchema = z.object({\n  id: z.string(),\n  filename: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n})\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Upload an attachment (public/anonymous)',\n  description: 'Stores an encrypted file for a file-typed field. Authorized via access token or portal session.',\n  tags: ['Forms Public Runtime'],\n  responses: [{ status: 201, description: 'Attachment stored', schema: uploadResponseSchema }],\n  errors: [\n    { status: 401, description: 'Missing or invalid access token / session', schema: errorSchema },\n    { status: 413, description: 'File empty or oversize', schema: errorSchema },\n    { status: 422, description: 'Disallowed type / invalid field / scan rejected', schema: errorSchema },\n    { status: 429, description: 'Rate limit exceeded', schema: errorSchema },\n    { status: 503, description: 'Rate limiting unavailable', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Public attachment upload',\n  methods: { POST: postMethodDoc },\n}\n"],
-  "mappings": "AAYA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AAEvC,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,qBAAqB,YAAY;AAAA,EAC3D;AACA,MAAI,QAAS,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,QAAM,YAAY,MAAM,wBAAwB,EAAE,KAAK,cAAc,GAAG,CAAC;AACzE,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEnF,QAAM,SAAS,MAAM,gBAAgB,GAAG;AACxC,MAAI,kBAAkB,aAAc,QAAO;AAE3C,QAAM,SAAS,MAAM,yBAAyB,IAAI;AAAA,IAChD,gBAAgB,UAAU;AAAA,IAC1B,UAAU,UAAU;AAAA,IACpB;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,YAAY;AAAA,MACvC,gBAAgB,UAAU;AAAA,MAC1B,UAAU,UAAU;AAAA,MACpB;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,OAAO,OAAO;AAAA,MACd,YAAY,UAAU,WAAW,aAAa,UAAU,YAAY;AAAA,MACpE,QAAQ,OAAO;AAAA,MACf,mBAAmB,OAAO;AAAA,IAC5B,CAAC;AACD,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAClF,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO;AAAA,EACb,UAAU,EAAE,OAAO;AAAA,EACnB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,sBAAsB;AAAA,EAC7B,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB,CAAC;AAAA,EAC3F,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,YAAY;AAAA,IACnG,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
+  "sourcesContent": ["/**\n * Public/anonymous attachment upload \u2014\n * POST /api/forms/public/submissions/:id/attachments\n *\n * Token- or portal-authenticated participants upload a file for a `file`-typed\n * field. Authorization goes through `resolveRuntimePrincipal` (bearer access\n * token OR customer session). Org/tenant are ALWAYS re-derived from the\n * persisted submission row (R-2d-4) \u2014 never trusted from the client. Bytes are\n * encrypted at rest and gated by MIME allowlist, size ceiling, and the\n * pluggable virus scanner (W4 / SEC-4).\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { AttachmentService } from '../../../../../services/attachment-service'\nimport type { FormVersionCompiler } from '../../../../../services/form-version-compiler'\nimport type { RolePolicyService } from '../../../../../services/role-policy-service'\nimport { resolveRuntimePrincipal } from '../../../../../lib/runtime-principal'\nimport {\n  mapAttachmentError,\n  parseUploadBody,\n  resolveAttachmentRolePolicy,\n  resolveFieldUploadConfig,\n} from '../../../../attachment-helpers'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../rate-limit'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('submission-upload', submissionId),\n  )\n  if (limited) return limited\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = container.resolve('formsAttachmentService') as AttachmentService\n\n  const principal = await resolveRuntimePrincipal({ req, submissionId, em })\n  if (!principal) return NextResponse.json({ error: 'UNAUTHORIZED' }, { status: 401 })\n\n  const parsed = await parseUploadBody(req)\n  if (parsed instanceof NextResponse) return parsed\n\n  const policy = await resolveAttachmentRolePolicy(em, {\n    organizationId: principal.organizationId,\n    tenantId: principal.tenantId,\n    submissionId,\n    role: principal.role,\n  }, container.resolve('formVersionCompiler') as FormVersionCompiler,\n  container.resolve('formsRolePolicyService') as RolePolicyService)\n  if (!policy?.canWrite(parsed.fieldKey)) {\n    return NextResponse.json({ error: 'NOT_FOUND' }, { status: 404 })\n  }\n\n  const config = await resolveFieldUploadConfig(em, {\n    organizationId: principal.organizationId,\n    tenantId: principal.tenantId,\n    submissionId,\n    fieldKey: parsed.fieldKey,\n  })\n  if (!config) {\n    return NextResponse.json({ error: 'INVALID_FIELD' }, { status: 422 })\n  }\n\n  try {\n    const stored = await service.storeUpload({\n      organizationId: principal.organizationId,\n      tenantId: principal.tenantId,\n      submissionId,\n      fieldKey: parsed.fieldKey,\n      filename: parsed.filename,\n      contentType: parsed.contentType,\n      bytes: parsed.bytes,\n      uploadedBy: principal.source === 'customer' ? principal.principal : null,\n      accept: config.accept,\n      fieldMaxSizeBytes: config.maxSizeBytes,\n    })\n    return NextResponse.json(stored, { status: 201 })\n  } catch (error) {\n    return mapAttachmentError(error)\n  }\n}\n\nconst errorSchema = z.object({ error: z.string(), message: z.string().optional() })\nconst uploadResponseSchema = z.object({\n  id: z.string(),\n  filename: z.string(),\n  contentType: z.string(),\n  sizeBytes: z.number(),\n})\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Upload an attachment (public/anonymous)',\n  description: 'Stores an encrypted file for a file-typed field the participant role can edit in the submission\u2019s pinned version. Authorized via access token or portal session.',\n  tags: ['Forms Public Runtime'],\n  responses: [{ status: 201, description: 'Attachment stored', schema: uploadResponseSchema }],\n  errors: [\n    { status: 401, description: 'Missing or invalid access token / session', schema: errorSchema },\n    { status: 404, description: 'Field not found or not editable by the participant role', schema: errorSchema },\n    { status: 413, description: 'File empty or oversize', schema: errorSchema },\n    { status: 422, description: 'Disallowed type / invalid field / scan rejected', schema: errorSchema },\n    { status: 429, description: 'Rate limit exceeded', schema: errorSchema },\n    { status: 503, description: 'Rate limiting unavailable', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Public attachment upload',\n  methods: { POST: postMethodDoc },\n}\n"],
+  "mappings": "AAYA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AAIvC,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,qBAAqB,YAAY;AAAA,EAC3D;AACA,MAAI,QAAS,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,QAAM,YAAY,MAAM,wBAAwB,EAAE,KAAK,cAAc,GAAG,CAAC;AACzE,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEnF,QAAM,SAAS,MAAM,gBAAgB,GAAG;AACxC,MAAI,kBAAkB,aAAc,QAAO;AAE3C,QAAM,SAAS,MAAM;AAAA,IAA4B;AAAA,IAAI;AAAA,MACnD,gBAAgB,UAAU;AAAA,MAC1B,UAAU,UAAU;AAAA,MACpB;AAAA,MACA,MAAM,UAAU;AAAA,IAClB;AAAA,IAAG,UAAU,QAAQ,qBAAqB;AAAA,IAC1C,UAAU,QAAQ,wBAAwB;AAAA,EAAsB;AAChE,MAAI,CAAC,QAAQ,SAAS,OAAO,QAAQ,GAAG;AACtC,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,SAAS,MAAM,yBAAyB,IAAI;AAAA,IAChD,gBAAgB,UAAU;AAAA,IAC1B,UAAU,UAAU;AAAA,IACpB;AAAA,IACA,UAAU,OAAO;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,YAAY;AAAA,MACvC,gBAAgB,UAAU;AAAA,MAC1B,UAAU,UAAU;AAAA,MACpB;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,OAAO,OAAO;AAAA,MACd,YAAY,UAAU,WAAW,aAAa,UAAU,YAAY;AAAA,MACpE,QAAQ,OAAO;AAAA,MACf,mBAAmB,OAAO;AAAA,IAC5B,CAAC;AACD,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAClF,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO;AAAA,EACb,UAAU,EAAE,OAAO;AAAA,EACnB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,sBAAsB;AAAA,EAC7B,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB,CAAC;AAAA,EAC3F,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,2DAA2D,QAAQ,YAAY;AAAA,IAC3G,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,YAAY;AAAA,IACnG,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7797.1.f0365b4031",
+  "version": "0.10.1-develop.7799.1.d9cd0c8e41",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -266,16 +266,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7797.1.f0365b4031",
-    "@open-mercato/shared": "0.10.1-develop.7797.1.f0365b4031",
-    "@open-mercato/ui": "0.10.1-develop.7797.1.f0365b4031",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7799.1.d9cd0c8e41",
+    "@open-mercato/shared": "0.10.1-develop.7799.1.d9cd0c8e41",
+    "@open-mercato/ui": "0.10.1-develop.7799.1.d9cd0c8e41",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7797.1.f0365b4031",
-    "@open-mercato/shared": "0.10.1-develop.7797.1.f0365b4031",
-    "@open-mercato/ui": "0.10.1-develop.7797.1.f0365b4031",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7799.1.d9cd0c8e41",
+    "@open-mercato/shared": "0.10.1-develop.7799.1.d9cd0c8e41",
+    "@open-mercato/ui": "0.10.1-develop.7799.1.d9cd0c8e41",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/forms/api/attachment-helpers.ts

@@ -8,7 +8,10 @@
 
 import { NextResponse } from 'next/server'
 import type { EntityManager } from '@mikro-orm/postgresql'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { FormSubmission, FormVersion } from '../data/entities'
+import type { FormVersionCompiler } from '../services/form-version-compiler'
+import type { RolePolicyResolution, RolePolicyService } from '../services/role-policy-service'
 import { AttachmentServiceError, isAttachmentServiceError } from '../services/attachment-service'
 import { resolveMaxUploadBytes } from '../services/upload-validation'
 
@@ -34,6 +37,37 @@ export function mapAttachmentError(error: unknown): NextResponse {
   return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })
 }
 
+export async function resolveAttachmentRolePolicy(
+  em: EntityManager,
+  args: { organizationId: string; tenantId: string; submissionId: string; role: string | null },
+  compiler: FormVersionCompiler,
+  rolePolicy: RolePolicyService,
+): Promise<RolePolicyResolution | null> {
+  if (!args.role) return null
+
+  const scope = { organizationId: args.organizationId, tenantId: args.tenantId }
+  const submission = await findOneWithDecryption(em, FormSubmission, {
+    id: args.submissionId,
+    ...scope,
+    deletedAt: null,
+  }, undefined, scope)
+  if (!submission) return null
+
+  const version = await findOneWithDecryption(em, FormVersion, {
+    id: submission.formVersionId,
+    ...scope,
+  }, undefined, scope)
+  if (!version) return null
+
+  const compiled = compiler.compile({
+    id: version.id,
+    updatedAt: version.updatedAt,
+    schema: version.schema,
+    uiSchema: version.uiSchema,
+  })
+  return rolePolicy.resolve(compiled, args.role)
+}
+
 /**
  * Looks up the `file`-typed field node on the submission's pinned form version
  * and reads its upload config. Returns `null` when the submission, version, or

package/src/modules/forms/api/public/submissions/[id]/attachments/[attachmentId]/route.ts

@@ -13,10 +13,15 @@ import { NextResponse, type NextRequest } from 'next/server'
 import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { FormAttachment } from '../../../../../../data/entities'
 import type { AttachmentService } from '../../../../../../services/attachment-service'
+import type { FormVersionCompiler } from '../../../../../../services/form-version-compiler'
+import type { RolePolicyService } from '../../../../../../services/role-policy-service'
 import { resolveRuntimePrincipal } from '../../../../../../lib/runtime-principal'
 import {
   mapAttachmentError,
+  resolveAttachmentRolePolicy,
   SANDBOXED_DOWNLOAD_HEADERS,
 } from '../../../../../attachment-helpers'
 import { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../../rate-limit'
@@ -47,6 +52,26 @@ export async function GET(
   if (!principal) return NextResponse.json({ error: 'UNAUTHORIZED' }, { status: 401 })
 
   try {
+    const scope = { organizationId: principal.organizationId, tenantId: principal.tenantId }
+    const policy = await resolveAttachmentRolePolicy(em, {
+      ...scope,
+      submissionId,
+      role: principal.role,
+    }, container.resolve('formVersionCompiler') as FormVersionCompiler,
+    container.resolve('formsRolePolicyService') as RolePolicyService)
+    if (!policy) return NextResponse.json({ error: 'NOT_FOUND' }, { status: 404 })
+
+    const attachment = await findOneWithDecryption(em, FormAttachment, {
+      id: attachmentId,
+      submissionId,
+      organizationId: principal.organizationId,
+      kind: 'user_upload',
+      removedAt: null,
+    }, { fields: ['fieldKey'] }, scope)
+    if (!attachment || !policy.canRead(attachment.fieldKey)) {
+      return NextResponse.json({ error: 'NOT_FOUND' }, { status: 404 })
+    }
+
     const result = await service.readUpload({
       organizationId: principal.organizationId,
       tenantId: principal.tenantId,
@@ -69,7 +94,7 @@ export async function GET(
 
 const getMethodDoc: OpenApiMethodDoc = {
   summary: 'Download a submission attachment (public/anonymous)',
-  description: 'Streams the decrypted user-upload bytes for the owning participant. Authorized via access token or portal session.',
+  description: 'Streams decrypted user-upload bytes only when the participant role can read the attachment field in the submission’s pinned version. Authorized via access token or portal session.',
   tags: ['Forms Public Runtime'],
   responses: [{ status: 200, description: 'Attachment stream', mediaType: 'application/octet-stream' }],
   errors: [

package/src/modules/forms/api/public/submissions/[id]/attachments/route.ts

@@ -16,10 +16,13 @@ import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { AttachmentService } from '../../../../../services/attachment-service'
+import type { FormVersionCompiler } from '../../../../../services/form-version-compiler'
+import type { RolePolicyService } from '../../../../../services/role-policy-service'
 import { resolveRuntimePrincipal } from '../../../../../lib/runtime-principal'
 import {
   mapAttachmentError,
   parseUploadBody,
+  resolveAttachmentRolePolicy,
   resolveFieldUploadConfig,
 } from '../../../../attachment-helpers'
 import { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../rate-limit'
@@ -51,6 +54,17 @@ export async function POST(
   const parsed = await parseUploadBody(req)
   if (parsed instanceof NextResponse) return parsed
 
+  const policy = await resolveAttachmentRolePolicy(em, {
+    organizationId: principal.organizationId,
+    tenantId: principal.tenantId,
+    submissionId,
+    role: principal.role,
+  }, container.resolve('formVersionCompiler') as FormVersionCompiler,
+  container.resolve('formsRolePolicyService') as RolePolicyService)
+  if (!policy?.canWrite(parsed.fieldKey)) {
+    return NextResponse.json({ error: 'NOT_FOUND' }, { status: 404 })
+  }
+
   const config = await resolveFieldUploadConfig(em, {
     organizationId: principal.organizationId,
     tenantId: principal.tenantId,
@@ -90,11 +104,12 @@ const uploadResponseSchema = z.object({
 
 const postMethodDoc: OpenApiMethodDoc = {
   summary: 'Upload an attachment (public/anonymous)',
-  description: 'Stores an encrypted file for a file-typed field. Authorized via access token or portal session.',
+  description: 'Stores an encrypted file for a file-typed field the participant role can edit in the submission’s pinned version. Authorized via access token or portal session.',
   tags: ['Forms Public Runtime'],
   responses: [{ status: 201, description: 'Attachment stored', schema: uploadResponseSchema }],
   errors: [
     { status: 401, description: 'Missing or invalid access token / session', schema: errorSchema },
+    { status: 404, description: 'Field not found or not editable by the participant role', schema: errorSchema },
     { status: 413, description: 'File empty or oversize', schema: errorSchema },
     { status: 422, description: 'Disallowed type / invalid field / scan rejected', schema: errorSchema },
     { status: 429, description: 'Rate limit exceeded', schema: errorSchema },