npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (972) hide show

package/dist/esm/files/services/file-upload-grant.backend.service.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"file-upload-grant.backend.service.js","sourceRoot":"","sources":["../../../../../src/files/services/file-upload-grant.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAEL,+BAA+B,EAC/B,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,2BAA2B,EAC3B,SAAS,EACT,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,6BAA6B,EAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EAOf,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,4BAA4B,EAA8B,MAAM,oDAAoD,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AAGvH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAS,wBAAwB,CAAC,GAAW;IAC3C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,0FAA0F;QAC1F,mDAAmD;QACnD,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AA8BM,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIc;IACa;IACG;IACK;IACF;IACY;IACH;IAClB;IAKY;IAflE,QAAQ,CAA+D;IAEjF,YACsD,MAAqB,EACR,YAAwC,EACrC,sBAAqD,EAChD,kBAA+C,EACjD,kBAAoD,EACxC,uBAA8D,EACjE,oBAA+D,EACjF,gBAAyC,EAK7B,gBAA0C;QAZhE,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAChD,uBAAkB,GAAlB,kBAAkB,CAA6B;QACjD,uBAAkB,GAAlB,kBAAkB,CAAkC;QACxC,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,yBAAoB,GAApB,oBAAoB,CAA2C;QACjF,qBAAgB,GAAhB,gBAAgB,CAAyB;QAK7B,qBAAgB,GAAhB,gBAAgB,CAA0B;QAEpH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,yBAAyB,CAA2D,SAAY;QACrG,MAAM,QAAQ,GAAG,qBAAqB,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,KAAK,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,OAAO;YACL,GAAG,SAAS;YACZ,mBAAmB,EAAE;gBACnB,KAAK,EAAE,CAAC,GAAG,aAAa,EAAE,wBAAwB,CAAC,iBAAiB,CAAC;gBACrE,MAAM,EAAE,yBAAyB,CAAC,WAAW;aAC9C;SACG,CAAC;IACT,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,MAAiC;QAC1C,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAE5C,IACE,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB;eAC/E,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,iBAAiB,EACtF,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;gBACzF,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,EAAE,wBAAwB;aACrF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,qCAAqC;gBACzF,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,wBAAwB;aACtH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACtG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;aACnI,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;YACpF,kGAAkG;YAClG,sFAAsF;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;aACtG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7H,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC5F,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,iCAAiC,CAAC;QAEtF,MAAM,kBAAkB,GAAkE;YACxF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3E,CAAC;QAEF,qGAAqG;QACrG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;YAC1D,SAAS,EAAE,wBAAwB,CAAC,iBAAiB;YACrD,eAAe,EAAE,+BAA+B,CAAC,UAAU;YAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;YAClE,cAAc,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;YAC7D,MAAM,EAAE,gBAAgB,CAAC,YAAY,EAAE,MAAM;YAC7C,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAC/C,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YACnD,QAAQ,EAAE,EAAE,GAAG,kBAAkB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;SACjE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;QAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,UAAU,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/F,MAAM,UAAU,GAAG,eAAe,CAAC,gBAAgB,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAE/J,MAAM,KAAK,GAAoB;YAC7B,OAAO;YACP,KAAK,EAAE,oBAAoB,CAAC,OAAO;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,SAAS,EAAE,IAAI;YACf,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBACzC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;aACtC;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,UAAU,CAAC,OAAO;gBAC5B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,EAAE;aACpD;YACD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;YACrD,yFAAyF;YACzF,aAAa,EAAE,gBAAgB,UAAU,KAAK,UAAU,wBAAwB,QAAQ,MAAM,MAAM,CAAC,SAAS,GAAG;YACjH,6GAA6G;YAC7G,uBAAuB,EAAE,oBAAoB,UAAU,KAAK,UAAU,6BAA6B,QAAQ,MAAM,MAAM,CAAC,SAAS,GAAG;YACpI,aAAa;YACb,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,MAAM,EAAE;YACrH,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS;YAC9C,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACpJ,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,uBAAuB,CAC3B,gBAAuC,EACvC,MAA6B,EAC7B,mBAA2B;QAE3B,IAAI,gBAAgB,CAAC,aAAa,KAAK,8BAA8B,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAC;QACzG,MAAM,UAAU,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB;YAAE,OAAO,SAAS,CAAC;QAErF,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,EAAE;YAC5G,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;YACrF,OAAO,EAAE;gBACP,wBAAwB;gBACxB,OAAO,EAAE,KAAK,CAAC,GAAG;gBAClB,MAAM;gBACN,WAAW,EAAE,MAAM;gBACnB,WAAW,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE;aAC9I;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,IAAI,KAAK,CAAC,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI;YAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtJ,mGAAmG;QACnG,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,mGAAmG;QACnG,kGAAkG;QAClG,qDAAqD;QACrD,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,IAAI,YAAY,KAAK,aAAa;YAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE7H,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,wBAAwB,CAAC,QAAiC;QACxD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAC9F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAAoE,EACpE,IAAwD,EACxD,gBAAuC;QAEvC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,iCAAiC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wFAAwF,EAAE;gBACzG,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACrF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,GAAG,EAAE;YACpH,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;gBAC/E,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE,wBAAwB;aAChG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAE1G,IAAI,IAAI,GAAkC,IAAI,CAAC;QAC/C,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACtE,IAAI,QAAQ;gBAAE,IAAI,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;gBAClC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;aACpC;YACD,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,EAAE,EAAE;YAClG,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;YAClD,IAAI;SACL,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,gBAAuC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,CAAC,iBAAiB,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;gBACxE,sBAAsB,EAAE,2BAA2B,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS;eAClD,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAClH,MAAM,YAAY,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACzI,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;gBAC5E,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,wBAAwB;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,GAAG,EAAE;gBACnH,OAAO;gBACP,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC7F,YAAY,EAAE,CAAC,QAAQ,IAAI,YAAY;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAC3C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,gCAAgC,EAAE,CAAC;QAC9F,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAO,eAAe,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,oBAAoB,CAAC,QAAQ,CAAC;QAC3D,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,oBAAoB,CAAC,OAAO,CAAC;QACjF,OAAO,oBAAoB,CAAC,OAAO,CAAC;IACtC,CAAC;IAED,2GAA2G;IACnG,oBAAoB,CAAC,UAAkB;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC5C,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,EAAE,CAAC;QACtF,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnH,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,GAAG,OAAO,GAAG,2BAA2B,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;IACtF,CAAC;IAED;;;;;OAKG;IACK,+BAA+B,CACrC,QAA+C,EAC/C,UAA4D,EAC5D,gBAAuC,EACvC,MAA6B;QAE7B,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;gBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;gBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;aACvL,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;YAClI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;oBACzE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,wBAAwB;iBAC/L,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IAC3E,YAAY,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC;IAC9F,CAAC;IAED,uGAAuG;IAC/F,eAAe,CAAC,SAAiB,EAAE,gBAAsC;QAC/E,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;QAC5F,MAAM,KAAK,GAAG,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAEO,SAAS,CAAC,MAA6B,EAAE,OAAgB;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,MAAM;YAC9D,CAAC,CAAC,qCAAqC,MAAM,CAAC,SAAS,0BAA0B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;YACnI,CAAC,CAAC,qCAAqC,MAAM,CAAC,SAAS,8BAA8B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;QAC5H,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,gFAAgF,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,OAAO,qFAAqF,KAAK,GAAG,MAAM,IAAI;cAC1G,8GAA8G;cAC9G,0EAA0E,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,gBAAuC,EACvC,SAAiC,EACjC,SAAqC,EACrC,SAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBAC1C,MAAM,EAAE,gBAAgB,CAAC,YAAY,EAAE,MAAM;gBAC7C,cAAc,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;gBAC7D,SAAS;gBACT,SAAS;gBACT,SAAS;aACV,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4FAA4F;YAC5F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,SAAS,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;CACF,CAAA;AA7dY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAA;IACpD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAK3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;+CAXuB,0BAA0B;QACb,6BAA6B;QAC5B,2BAA2B;QAC7B,gCAAgC;QACf,qCAAqC;QAC3C,yCAAyC;QAC/D,uBAAuB;GAX9F,6BAA6B,CA6dzC","sourcesContent":["/**\n * File Upload Grant Backend Service\n *\n * The ONE mint function behind both doors — the REST sibling route (`…/files/<field>/grant`) and the\n * MCP derived tool — plus the route-binding check the upload middleware runs, the public status read,\n * revocation, and the post-redemption write-back. Issue #312.\n *\n * ## What a grant is\n *\n * A `SINGLE_USE` consumable token of type `FILE_UPLOAD_GRANT` that lets whoever holds it perform ONE\n * upload into ONE resource file field with the MINTER's authority. Nothing durable is created at mint\n * but the token. The upload goes through the resource's EXISTING file-upload route: the token becomes\n * an ordinary `CONSUMABLE_TOKEN` execution context (typed fields → identity) and the ordinary\n * authorizer decides. This service never decides \"may this principal put a file here\" — the upload\n * middleware does, once, for mint and upload alike, which is what makes mint-authority ≡\n * upload-authority by construction.\n *\n * ## Why the route binding lives in `metadata` and is checked HERE\n *\n * `createExecutionContextFromRequest` turns the token's TYPED fields (`userId`, `organizationId`,\n * `roles`, `resourceIdentifier`, `relatedId`) into identity and deliberately reads nothing from\n * `metadata`. Which field, which operation kind, which concrete upload URL — those are ROUTE facts,\n * and the upload middleware asks this service to check them against the route the token was\n * presented on. Identity and route stay separate concerns.\n */\n\nimport { injectable, inject, optional } from 'inversify';\nimport {\n BackendApiType,\n ConsumableToken_ConsumptionMode,\n CoreAuditableEventType,\n CoreConsumableTokenTypes,\n CORE_APP_ROLES,\n ErrorCustomMessageReference,\n ErrorType,\n ExecutionContext_ExecutionType,\n FILE_UPLOAD_GRANT_DEFAULT_MINUTES,\n FILE_UPLOAD_GRANT_PAGE_PATH,\n FileUploadGrantMetadataSchema,\n FileUploadGrantState,\n ResourceOperationRiskLevel,\n TokenAuthenticationPolicy,\n WildoHeaderKeys,\n type FileUploadGrant,\n type FileUploadGrantMetadata,\n type FileUploadGrantOperation,\n type FileUploadGrantStatus,\n type ResourceConfiguration_Operation,\n type ResourceType,\n CoreResourceType,\n CoreResourceOperation,\n type File,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit, FileGenerationSource } from '@wildo-ai/zod-decorators';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport type { ConsumableToken } from '~wildo-backend-lib/security/consumable-tokens/models/consumable-tokens.shared.schemas';\nimport { FileConstraintResolverChain } from '~wildo-backend-lib/files/constraints/file-constraint-resolver-chain.backend.service';\nimport { FileFieldDetectionBackendService } from '~wildo-backend-lib/files/services/file-field-detection.backend.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { resolveFileUploaderPrincipal, type FileUploaderPrincipal } from '~wildo-backend-lib/files/utils/file-uploader.utils';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\n\n/**\n * Reduce an upload-route URL to the one form the grant's route check compares — its PATH — or\n * `undefined` when it cannot be read as a URL at all.\n *\n * Accepts both shapes the two sides supply: an ABSOLUTE URL (what `metadata.uploadUrl` records, and\n * what a proxy's absolute-form request target produces) and an ORIGIN-RELATIVE path (what Express's\n * `req.originalUrl` normally is). Parsed against a throwaway base so one function handles both.\n *\n * ## What is normalised away, and why each is safe\n *\n * - **Query and fragment.** Mandatory, not cosmetic: GATE 1 accepts the grant in `?consumable_token=`\n * as well as the header, so a redemption legitimately carries a query the mint's URL never had.\n * Comparing with the query attached would refuse the query-token form outright.\n * - **A single trailing slash.** Express routes with `strict: false` by default, so `…/attachment/`\n * reaches the same handler as `…/attachment`. Refusing one of the two would be an artefact of this\n * comparison rather than a fact about the grant. `/` itself is left alone.\n *\n * ## What is deliberately NOT normalised\n *\n * - **The ORIGIN is not compared at all** — only the path is. Both origins come from the same server\n * config (`runtime.endPoints.main_backend_api.publicUrl`, never the client's Host header, which is\n * why the mint reads config in the first place), so an origin comparison is tautological against an\n * attacker and can only ever produce a false refusal: change `publicUrl` and every unredeemed grant\n * — up to an hour of them — stops matching. Nothing is given up, because the origin carries no\n * value a caller could vary.\n * - **Case.** Express matches case-insensitively by default, so `/Files/attachment` would reach the\n * route while comparing unequal. Case-folding was rejected: path segments carry IDs, and folding\n * them would make `/todos/AbC` ≡ `/todos/abc` and quietly weaken the row and parent pins this check\n * exists to add. Folding only the static segments is not available — nothing here can tell a static\n * segment from an id. The cost is that a caller who re-cases the URL is refused; there is no\n * legitimate reason to, since the grant hands back the exact URL to post to.\n * - **Percent-encoding.** Not decoded. Decoding is how path-confusion bugs are born: `%2F` would\n * become `/` and two different routes would compare equal. The raw encoded forms are compared, and\n * the ids that reach these paths are constrained to alphanumerics, `-` and `_` by\n * `validateParameterFormat`, which are encoding-invariant.\n */\nfunction normalizeUploadRoutePath(url: string): string | undefined {\n let path: string;\n try {\n // The base is never used for an absolute input, and for a relative one only its origin is\n // discarded below — so it can be any valid origin.\n path = new URL(url, 'http://upload-route.invalid').pathname;\n } catch {\n return undefined;\n }\n return path.length > 1 && path.endsWith('/') ? path.slice(0, -1) : path;\n}\n\n/** The route facts a grant is bound to, as the upload middleware knows them. */\nexport interface FileUploadGrantTarget {\n resourceType: ResourceType;\n fieldName: string;\n operation: FileUploadGrantOperation;\n resourceId?: string;\n}\n\nexport interface MintFileUploadGrantParams {\n /** The MINTER's context, produced by the upload route's own authorization middleware. */\n executionContext: ExecutionContext<any>;\n target: FileUploadGrantTarget;\n /** Requested lifetime; the engine ceiling is enforced at `createToken`, rejecting never clamping. */\n expiresInMinutes?: number;\n /**\n * What the caller intends to upload (the File Objects proposal's `{name, mimeType, size}`). Checked\n * against the field's constraints HERE so an impossible file is refused before a link exists.\n */\n declared?: { name?: string; mimeType?: string; size?: number };\n /** The concrete, absolute URL of the upload route this grant is for (the request's own URL minus `/grant`). */\n uploadUrl: string;\n /** Absolute API base including the mount prefix (e.g. `https://api.example.com/api/v1`), for the status URL. */\n apiBaseUrl: string;\n /** Request provenance for the audit row; never the token. */\n requestProvenance?: { ipAddress?: string; userAgent?: string };\n}\n\n@injectable()\nexport class FileUploadGrantBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.FileConstraintResolverChain) private readonly constraintResolver: FileConstraintResolverChain,\n @inject(SAAS_SERVICE_TYPES.FileFieldDetectionService) private readonly fileFieldDetection: FileFieldDetectionBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n /**\n * Optional so a harness without the audit stack can construct this service; in production the\n * container always binds it. A missing service is logged at WARN on first use, never silent.\n */\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional() private readonly auditLogsService?: AuditLogsBackendService,\n ) {\n this.logDebug = this.logger.debugByType('FileUploadGrantBackendService');\n this.logger.setDebugTypeLogging('FileUploadGrantBackendService', false);\n }\n\n /**\n * The operation the upload routes hand to the execution-context creator (issue #312, D4).\n *\n * `tokenAuthentication` lives on the OPERATION, so declaring it on the authored CREATE/UPDATE would\n * let a grant perform the whole JSON write. Instead the `…/files/<field>` and `…/files/<field>/grant`\n * routes — and ONLY those — get this derived copy, which accepts the grant type as an ALTERNATIVE\n * credential beside whatever the author declared. The JSON routes keep the authored operation, so a\n * grant presented there is refused by GATE 1 (`CONSUMABLE_TOKEN_NOT_ACCEPTED_FOR_OPERATION`).\n *\n * An authored ADDITIVE policy is NOT preserved as ADDITIVE here: the upload route's own authorizer\n * decides on the resulting context either way, and an additive token on a multipart upload is not a\n * case any resource declares today. If one appears, this is the seam to widen — do not widen the\n * authored operation.\n */\n static withUploadGrantAcceptance<T extends ResourceConfiguration_Operation<any, any, any>>(operation: T): T {\n const authored = 'tokenAuthentication' in operation ? operation.tokenAuthentication : undefined;\n const authoredTypes = authored?.policy === TokenAuthenticationPolicy.ALTERNATIVE ? (authored.types ?? []) : [];\n return {\n ...operation,\n tokenAuthentication: {\n types: [...authoredTypes, CoreConsumableTokenTypes.FILE_UPLOAD_GRANT],\n policy: TokenAuthenticationPolicy.ALTERNATIVE,\n },\n } as T;\n }\n\n /**\n * Mint a grant for the target the caller has JUST been authorized on.\n *\n * Refuses two minter kinds: a `CONSUMABLE_TOKEN` context (a grant may not mint a grant — no\n * delegation chains) and an `ANONYMOUS_SESSION` (no stable subject to attribute the file to, no\n * roles worth snapshotting). `USER_REQUEST` and both machine principals mint.\n */\n async mint(params: MintFileUploadGrantParams): Promise<FileUploadGrant> {\n const { executionContext, target } = params;\n\n if (\n executionContext.executionType === ExecutionContext_ExecutionType.CONSUMABLE_TOKEN\n || executionContext.executionType === ExecutionContext_ExecutionType.ANONYMOUS_SESSION\n ) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_MINTER_NOT_ELIGIBLE,\n context: { executionType: executionContext.executionType }, // diagnostic (log-only)\n });\n }\n\n const minter = resolveFileUploaderPrincipal(executionContext);\n if (!minter) {\n // A principal the uploader resolver cannot name cannot be the file's owner either.\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_MINTER_NOT_ELIGIBLE,\n context: { executionType: executionContext.executionType, reason: 'no uploader principal' }, // diagnostic (log-only)\n });\n }\n\n const fieldMeta = this.fileFieldDetection.getFileFieldMetadata(target.resourceType, target.fieldName);\n if (!fieldMeta) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'Not a file field', resourceType: target.resourceType, fieldName: target.fieldName }, // diagnostic (log-only)\n });\n }\n if (fieldMeta.fileMetadata.generation?.source === FileGenerationSource.PDF_TEMPLATE) {\n // Same refusal the upload handler makes, made EARLY: a grant for a field that can never receive a\n // user upload would be a link that fails on redemption for a reason knowable at mint.\n throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {\n customMessageReference: ErrorCustomMessageReference.FILE_GENERATED_FIELD_NOT_WRITABLE,\n context: { resourceType: target.resourceType, fieldName: target.fieldName }, // diagnostic (log-only)\n });\n }\n\n const constraint = await this.constraintResolver.resolve({ resourceType: target.resourceType, fieldName: target.fieldName });\n this.assertDeclarationFitsConstraint(params.declared, constraint, executionContext, target);\n const expiresInMinutes = params.expiresInMinutes ?? FILE_UPLOAD_GRANT_DEFAULT_MINUTES;\n\n const metadataWithoutUrl: Omit<FileUploadGrantMetadata, 'uploadUrl' | 'producedFileId'> = {\n fieldName: target.fieldName,\n operation: target.operation,\n minter: { entityType: minter.uploadedByEntityType, id: minter.uploadedBy },\n };\n\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a principal delegates ONE upload, into\n // ONE field, under its own authority, to whoever holds the grant. The ceiling and SINGLE_USE are\n // enforced inside createToken; the audit row below is what makes the delegation accountable.\n const token = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.FILE_UPLOAD_GRANT,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: expiresInMinutes, unit: DurationUnit.MINUTES },\n organizationId: executionContext.initiatorIds?.organizationId,\n userId: executionContext.initiatorIds?.userId,\n resourceIdentifier: String(target.resourceType),\n relatedId: target.resourceId,\n roles: [...(executionContext.initiatorRoles ?? [])],\n metadata: { ...metadataWithoutUrl, uploadUrl: params.uploadUrl },\n });\n\n const grantId = token._id;\n const tokenValue = token.token;\n const uploadPageUrl = this.resolveUploadPageUrl(tokenValue);\n const statusUrl = `${params.apiBaseUrl}/files/upload-grants/${encodeURIComponent(tokenValue)}`;\n const headerName = WildoHeaderKeys.CONSUMABLE_TOKEN;\n const fileHint = params.declared?.name?.trim() ? this.safeFileName(params.declared.name) : this.suggestFileName(target.fieldName, constraint.allowedMimeTypes);\n\n const grant: FileUploadGrant = {\n grantId,\n state: FileUploadGrantState.PENDING,\n expiresAt: token.expiresAt.toISOString(),\n singleUse: true,\n target: {\n resourceType: String(target.resourceType),\n fieldName: target.fieldName,\n operation: target.operation,\n resourceId: target.resourceId ?? null,\n },\n constraints: {\n maxBytes: constraint.maxSize,\n allowedMimeTypes: constraint.allowedMimeTypes ?? [],\n },\n uploadUrl: params.uploadUrl,\n uploadHeader: { name: headerName, value: tokenValue },\n // No `-f`: on a refusal the JSON error body is the only thing that tells the caller why.\n uploadCommand: `curl -sS -H \"${headerName}: ${tokenValue}\" -F \"file=@/path/to/${fileHint}\" \"${params.uploadUrl}\"`,\n // In PowerShell `curl` aliases Invoke-WebRequest, which does not understand -F; the real binary is curl.exe.\n uploadCommandPowerShell: `curl.exe -sS -H \"${headerName}: ${tokenValue}\" -F \"file=@C:\\\\path\\\\to\\\\${fileHint}\" \"${params.uploadUrl}\"`,\n uploadPageUrl,\n statusUrl,\n note: this.buildNote(target, uploadPageUrl !== null),\n };\n\n await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_ISSUED, ResourceOperationRiskLevel.MEDIUM, {\n grantId,\n resourceType: String(target.resourceType),\n fieldName: target.fieldName,\n operation: target.operation,\n resourceId: target.resourceId ?? null,\n expiresAt: grant.expiresAt,\n minter: metadataWithoutUrl.minter,\n ipAddress: params.requestProvenance?.ipAddress,\n userAgent: params.requestProvenance?.userAgent,\n });\n\n this.logDebug('File upload grant minted', { grantId, resourceType: target.resourceType, fieldName: target.fieldName, operation: target.operation });\n return grant;\n }\n\n /**\n * The upload middleware's question: is the token this context was built from a grant for THIS route?\n *\n * Returns `undefined` when the context is not a grant context at all — a JWT/API-key upload, or an\n * authored non-grant ALTERNATIVE token, which keeps behaving as it did. Throws\n * `FILE_UPLOAD_GRANT_TARGET_MISMATCH` when it IS a grant minted for a different resource, field,\n * operation kind or row. Mirrors `validateFileToken` on the download twin: type pinned AND target\n * pinned; a grant with no binding unlocks nothing.\n *\n * For UPDATE the creator has already coherence-checked `relatedId` against the URL id; the check is\n * repeated here because CREATE has no id, so this is the one place both kinds are decided.\n *\n * ## The fifth check: the concrete ROUTE, added 2026-09-08\n *\n * `presentedRequestUrl` is the request's own `originalUrl`, and its path must equal the path of the\n * `uploadUrl` the grant recorded at mint. The other four checks pin the resource, the field, the\n * write kind and (for UPDATE) the row — they do NOT pin which of a resource's several upload ROUTES\n * was used. A resource whose operation declares more than one `initiatorInfo` registers one upload\n * route per parent path, and `validateParameterCoherence` only pins the `{param}`s the TOKEN itself\n * supplies (`organizationId`, `userId`, and the resource's own id via `relatedId`); every other\n * segment — an intermediate parent id, a nested FK — comes from the URL alone and matched nothing.\n * So a grant minted under one parent could be redeemed under another, and the minter's snapshotted\n * roles would be re-decided there. This closes that: the grant unlocks the ONE route its mint was\n * authorized on, which is the same route it publishes in `uploadUrl` / `uploadCommand` /\n * `uploadPageUrl` and re-emits from the status read.\n *\n * It does NOT close anything the authorizer would refuse anyway (roles are still re-evaluated on the\n * presented route), replay (SINGLE_USE consumption does that), or a leaked token being redeemed on\n * the recorded route by whoever holds it — the token IS the credential, by design.\n *\n * Note this middleware also fronts the MINT route (`…/files/<field>/grant`), whose path differs from\n * the recorded one by that last segment. A grant presented THERE is now refused here rather than two\n * steps later by mint's own \"a grant may not mint a grant\" rule. Both refusals stay.\n */\n async assertGrantMatchesRoute(\n executionContext: ExecutionContext<any>,\n target: FileUploadGrantTarget,\n presentedRequestUrl: string,\n ): Promise<{ token: ConsumableToken; metadata: FileUploadGrantMetadata } | undefined> {\n if (executionContext.executionType !== ExecutionContext_ExecutionType.CONSUMABLE_TOKEN) return undefined;\n const tokenValue = executionContext.consumableTokenValue;\n if (!tokenValue) return undefined;\n\n const token = await this.consumableTokenService.validateToken(tokenValue);\n if (token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) return undefined;\n\n const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n const mismatch = (reason: string) => this.errorBuilder.buildError(ErrorType.AUTHENTICATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_TARGET_MISMATCH,\n context: {\n // diagnostic (log-only)\n grantId: token._id,\n reason,\n routeTarget: target,\n grantTarget: { resourceIdentifier: token.resourceIdentifier, relatedId: token.relatedId, metadata: parsed.success ? parsed.data : undefined },\n },\n });\n\n if (!parsed.success) throw mismatch('unparseable grant metadata');\n const metadata = parsed.data;\n if (token.resourceIdentifier !== String(target.resourceType)) throw mismatch('resource');\n if (metadata.fieldName !== target.fieldName) throw mismatch('field');\n if (metadata.operation !== target.operation) throw mismatch('operation');\n if (target.operation === CoreResourceOperation.UPDATE ? token.relatedId !== target.resourceId : token.relatedId != null) throw mismatch('resourceId');\n\n // The two `undefined` clauses are REDUNDANT today and kept deliberately, which is worth stating so\n // nobody \"simplifies\" them back out. An unreadable side already loses the inequality against a\n // readable one, and `metadata.uploadUrl` is `z.string().url()` so the recorded side cannot be\n // unreadable at all — the parse above refuses first. What they guard is the ONE case where the\n // inequality would ADMIT: both sides unreadable, `undefined === undefined`. Reaching it needs that\n // schema to loosen, so it cannot be pinned from a test; the pin covers the outcome (an unreadable\n // request target is refused) rather than the clause.\n const recordedPath = normalizeUploadRoutePath(metadata.uploadUrl);\n const presentedPath = normalizeUploadRoutePath(presentedRequestUrl);\n if (recordedPath === undefined || presentedPath === undefined || recordedPath !== presentedPath) throw mismatch('uploadUrl');\n\n return { token, metadata };\n }\n\n /**\n * The uploader the redeemed file is attributed to: the MINTER, from the grant, never the grant itself.\n *\n * No cast: `metadata.minter.entityType` is the `FileUploaderEntityType` enum because the metadata\n * schema says so, and the metadata reached here through `safeParse`. It carried\n * `as FileUploaderPrincipal['uploadedByEntityType']` until 2026-09-08 — a cast that told the type\n * system a closed union had been checked when nothing had checked it. The runtime was not actually\n * open (`validateUploadedByEntityType` re-checks membership in the upload handler and again in\n * `createFile`), so this was a lie to the compiler rather than a hole to the database; what it cost\n * was the refusal landing three layers downstream, as a VALIDATION error mid-upload, at a parameter\n * typed `unknown`, instead of at the boundary that parses the grant.\n */\n resolveUploaderFromGrant(metadata: FileUploadGrantMetadata): FileUploaderPrincipal {\n return { uploadedBy: metadata.minter.id, uploadedByEntityType: metadata.minter.entityType };\n }\n\n /**\n * After the one upload landed: write the produced fileId back and audit the redemption. Best-effort\n * by contract — the upload has succeeded; a failure here is logged and the status read degrades to\n * \"REDEEMED, file unknown\".\n */\n async recordRedemption(\n grant: { token: ConsumableToken; metadata: FileUploadGrantMetadata },\n file: { fileId: string; mimeType: string; size: number },\n executionContext: ExecutionContext<any>,\n ): Promise<void> {\n try {\n await this.consumableTokenService.recordFileUploadGrantProducedFile(grant.token._id, file.fileId);\n } catch (error) {\n this.logger.warn('File upload grant: produced-file write-back failed; status read will not name the file', {\n grantId: grant.token._id, fileId: file.fileId, ...projectCaughtErrorLogFields(error),\n });\n }\n await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_REDEEMED, ResourceOperationRiskLevel.LOW, {\n grantId: grant.token._id,\n fileId: file.fileId,\n mimeType: file.mimeType,\n size: file.size,\n minter: grant.metadata.minter,\n });\n }\n\n /**\n * Public status read: the token IS the credential, so anyone holding it learns the grant's state,\n * the target and constraints (what the drop page renders), and — after redemption — the `fileId`\n * and file status (what the agent needs). Never the file's name.\n */\n async readStatus(tokenValue: string): Promise<FileUploadGrantStatus> {\n const token = await this.consumableTokenService.findTokenByValue(tokenValue);\n if (!token || token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n });\n }\n const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n if (!parsed.success) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n context: { grantId: token._id, reason: 'unparseable grant metadata' }, // diagnostic (log-only)\n });\n }\n const metadata = parsed.data;\n const resourceType = token.resourceIdentifier as ResourceType;\n const constraint = await this.constraintResolver.resolve({ resourceType, fieldName: metadata.fieldName });\n\n let file: FileUploadGrantStatus['file'] = null;\n if (metadata.producedFileId) {\n const produced = await this.readProducedFile(metadata.producedFileId);\n if (produced) file = { fileId: produced.fileId, status: produced.status };\n }\n\n return {\n grantId: token._id,\n state: this.deriveState(token),\n expiresAt: token.expiresAt.toISOString(),\n target: {\n resourceType: String(resourceType),\n fieldName: metadata.fieldName,\n operation: metadata.operation,\n resourceId: token.relatedId ?? null,\n },\n constraints: { maxBytes: constraint.maxSize, allowedMimeTypes: constraint.allowedMimeTypes ?? [] },\n uploadUrl: metadata.uploadUrl,\n uploadHeaderName: WildoHeaderKeys.CONSUMABLE_TOKEN,\n file,\n };\n }\n\n /**\n * Revoke an unredeemed grant — by ID, never by value, and AUTHENTICATED: the minter, or a platform\n * super-administrator. Revoke-by-value on a public route was rejected: anyone holding the link could\n * burn it (harmless) while learning that it existed (not).\n */\n async revoke(grantId: string, executionContext: ExecutionContext<any>): Promise<boolean> {\n const token = await this.consumableTokenService.findTokenById(grantId);\n if (!token || token.tokenType !== CoreConsumableTokenTypes.FILE_UPLOAD_GRANT) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n customMessageReference: ErrorCustomMessageReference.FILE_UPLOAD_GRANT_NOT_FOUND,\n });\n }\n const parsed = FileUploadGrantMetadataSchema.safeParse(token.metadata);\n const caller = resolveFileUploaderPrincipal(executionContext);\n const isMinter = parsed.success && caller !== undefined\n && caller.uploadedBy === parsed.data.minter.id && caller.uploadedByEntityType === parsed.data.minter.entityType;\n const isSuperAdmin = (executionContext.initiatorRoles ?? []).some((entry) => entry.roles.includes(CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN));\n if (!isMinter && !isSuperAdmin) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED,\n context: { grantId }, // diagnostic (log-only)\n });\n }\n const revoked = await this.consumableTokenService.revokeToken(grantId);\n if (revoked) {\n await this.audit(executionContext, CoreAuditableEventType.FILE_UPLOAD_GRANT_REVOKED, ResourceOperationRiskLevel.LOW, {\n grantId,\n revokedBy: caller ? { entityType: caller.uploadedByEntityType, id: caller.uploadedBy } : null,\n asSuperAdmin: !isMinter && isSuperAdmin,\n });\n }\n return revoked;\n }\n\n // ── helpers ────────────────────────────────────────────────────────────────\n\n /**\n * Read the produced FILES row with no caller context — the status route is public and the token is\n * the credential. Same mechanism as the file controller's token-access download path (an internal\n * system context against the FILES repository, keyed on `_id`); only `fileId` and `status` leave here.\n */\n private async readProducedFile(fileId: string): Promise<Pick<File, 'fileId' | 'status'> | null> {\n const internalContext = await this.executionContextCreator.createForInternalSystemOperation();\n const filesRepository = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.FILES, internalContext);\n const file = await filesRepository.read<File>(internalContext, { _id: fileId });\n return file ? { fileId: file.fileId, status: file.status } : null;\n }\n\n private deriveState(token: ConsumableToken): FileUploadGrantState {\n if (token.revokedAt) return FileUploadGrantState.REVOKED;\n if (token.isConsumed) return FileUploadGrantState.REDEEMED;\n if (token.expiresAt.getTime() <= Date.now()) return FileUploadGrantState.EXPIRED;\n return FileUploadGrantState.PENDING;\n }\n\n /** `null` for a headless application (no frontend service declared) — there is no page to hand a human. */\n private resolveUploadPageUrl(tokenValue: string): string | null {\n const config = this.appConfigService.config;\n const frontendServiceName = this.appConfigService.resolveDefaultFrontendServiceName();\n const base = frontendServiceName ? AuthControllerUtils.lookupFrontendPublicUrl(config, frontendServiceName) : null;\n if (!base) return null;\n const trimmed = base.endsWith('/') ? base.slice(0, -1) : base;\n return `${trimmed}${FILE_UPLOAD_GRANT_PAGE_PATH}/${encodeURIComponent(tokenValue)}`;\n }\n\n /**\n * Refuse, at MINT, a declared file the field could never accept — the early half of the check the\n * upload route performs on receipt. Only what was declared is checked; an undeclared fact is checked\n * on the bytes. `allowedMimeTypes` empty means every type is accepted; a `type/*` entry matches its\n * whole family, as the upload validator reads it.\n */\n private assertDeclarationFitsConstraint(\n declared: MintFileUploadGrantParams['declared'],\n constraint: { maxSize: number; allowedMimeTypes?: string[] },\n executionContext: ExecutionContext<any>,\n target: FileUploadGrantTarget,\n ): void {\n if (!declared) return;\n if (declared.size !== undefined && declared.size > constraint.maxSize) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'Declared file size exceeds the field maximum', declaredSize: declared.size, maxBytes: constraint.maxSize, fieldName: target.fieldName }, // diagnostic (log-only)\n });\n }\n const allowed = constraint.allowedMimeTypes ?? [];\n if (declared.mimeType && allowed.length > 0) {\n const mime = declared.mimeType.toLowerCase();\n const fits = allowed.some((a) => a.toLowerCase() === mime || (a.endsWith('/*') && mime.startsWith(a.slice(0, -1).toLowerCase())));\n if (!fits) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { message: 'Declared MIME type is not accepted by the field', declaredMimeType: declared.mimeType, allowedMimeTypes: allowed, fieldName: target.fieldName }, // diagnostic (log-only)\n });\n }\n }\n }\n\n /** A declared file name reduced to what is safe inside a quoted shell argument. */\n private safeFileName(name: string): string {\n return name.replace(/[^\\w.\\- ]+/g, '_').replace(/\\s+/g, ' ').trim().slice(0, 120) || 'file';\n }\n\n /** A plausible file name for the curl example, from the field name and the first allowed MIME type. */\n private suggestFileName(fieldName: string, allowedMimeTypes: string[] | undefined): string {\n const stem = fieldName.replace(/[^\\w.-]+/g, '_').replace(/\\./g, '-').slice(0, 40) || 'file';\n const first = allowedMimeTypes?.find((m) => !m.endsWith('/*'));\n const ext = first ? first.split('/')[1]?.replace(/^x-/, '').replace(/\\+.*$/, '') : undefined;\n return ext && /^[a-z0-9]{2,5}$/i.test(ext) ? `${stem}.${ext}` : stem;\n }\n\n private buildNote(target: FileUploadGrantTarget, hasPage: boolean): string {\n const attach = target.operation === CoreResourceOperation.UPDATE\n ? `then pass the returned fileId as \"${target.fieldName}.fileId\" when updating ${String(target.resourceType)} ${target.resourceId}`\n : `then pass the returned fileId as \"${target.fieldName}.fileId\" when creating the ${String(target.resourceType)} record`;\n const human = hasPage ? 'or show uploadPageUrl to the user so they can drop the file in their browser, ' : '';\n return `Run uploadCommand if you can execute commands and the file is on your filesystem, ${human}${attach}. `\n + 'The link is single-use and bound to this one field: if it expires or the upload is refused, mint a new one. '\n + 'The header value is not your credential — it unlocks exactly one upload.';\n }\n\n private async audit(\n executionContext: ExecutionContext<any>,\n eventType: CoreAuditableEventType,\n riskLevel: ResourceOperationRiskLevel,\n eventData: Record<string, unknown>,\n ): Promise<void> {\n if (!this.auditLogsService) {\n this.logger.warn('File upload grant: audit service unbound; event not recorded', { eventType });\n return;\n }\n try {\n await this.auditLogsService.logGenericEvent({\n userId: executionContext.initiatorIds?.userId,\n organizationId: executionContext.initiatorIds?.organizationId,\n riskLevel,\n eventType,\n eventData,\n }, executionContext);\n } catch (error) {\n // An audit failure never fails the operation it observes; it is logged so it is not silent.\n this.logger.warn('File upload grant: audit emission failed', { eventType, ...projectCaughtErrorLogFields(error) });\n }\n }\n}\n"]}

package/dist/esm/files/services/files.backend.service.d.ts CHANGED Viewed

@@ -82,6 +82,29 @@ export declare class FilesBackendService {
         next?: NextFunction;
         variant?: FileServeVariant;
     }): Promise<void>;
+    /**
+     * Does the DECLARING field permit derived renditions of this file?
+     *
+     * Reads `imageConstraints.generateThumbnails` off the file field's own schema metadata,
+     * resolved from the file's recorded `linkedResourceType` + `linkedFieldName`. Until #478 the
+     * flag was declared, set on the framework's own user-avatar field, and read by nothing — every
+     * eligible raster image got a rendition whether or not its author had asked for one, and an
+     * author who set it `false` for cost or privacy got thumbnails and no error. It degraded in the
+     * PERMISSIVE direction, which is why it was worth wiring rather than deleting.
+     *
+     * ## Absence means PERMIT, at three different levels, and each is deliberate
+     *
+     * A file with no `linkedResourceType`/`linkedFieldName` (a standalone upload), a field the
+     * registry cannot resolve, a field with no `imageConstraints`, or `imageConstraints` with no
+     * `generateThumbnails` — all permit. Only an EXPLICIT `false` suppresses. The flag is opt-OUT:
+     * nobody has declared it today except to say `true`, and a resolution failure must not become a
+     * silent refusal on a preview surface that works now.
+     *
+     * The `{ sizes: [...] }` form counts as permission. Its sizes are not honoured — the derivation
+     * has one fixed longest-edge — so it is truthy-permits here and nothing more; an author reading
+     * this should not expect their sizes to reach the renderer.
+     */
+    private fieldPermitsDerivedRenditions;
     /**
      * Serve a downscaled `webp` thumbnail of a raster image — the `?variant=thumbnail`
      * path of {@link streamFileToResponse}.
@@ -184,6 +207,51 @@ export declare class FilesBackendService {
      * @returns Array of file metadata
      */
     batchGetFiles(fileIds: string[], executionContext: ExecutionContext<any>, options?: RepositoryOptions): Promise<File[]>;
+    /**
+     * Read a file's BYTES for a system-initiated outbound send — today, an email attachment (#429).
+     *
+     * ## Why this lives here and not in the caller
+     *
+     * Everything it has to get right is file knowledge: which statuses may be served, how a file is
+     * authorized against a scope, and which storage provider holds the bytes. A caller that assembled
+     * those itself would be a second, drifting copy of three decisions this service owns — and the
+     * one most dangerous to copy is the status gate, because getting it wrong means attaching an
+     * INFECTED file to an outbound email.
+     *
+     * ## It REFUSES rather than skipping, and that is the whole point
+     *
+     * The defect this closes is a SILENT drop: `attachmentFileIds` was declared and read by nothing,
+     * so a caller supplying an attachment got a successful send and an attachment-less email. A
+     * resolution that quietly omitted a file it could not serve would be the same defect wearing
+     * error handling, so every rejection throws and names the file.
+     *
+     * ## Authorization: the `authoritativeScopeOverride` this reuses was built for exactly this shape
+     *
+     * A system send carries no user principal, and an identity-less execution context derives no
+     * owner — `authorizeFileAccess` records that trap in its own JSDoc, where an empty context would
+     * have denied the subject's own file during erasure teardown. So the caller's scope is passed
+     * explicitly, the same way the teardown path passes the owner it already resolved. The scope is
+     * NOT optional: without it there is no tenancy confinement, and an attachment path that reads any
+     * file by id is a read-anything primitive wearing an email envelope.
+     *
+     * @param fileIds - The file ids to resolve, in the order the caller supplied them.
+     * @param scope - The AUTHORITATIVE owner every file is authorized against. An organization-scoped
+     *   send passes its `organizationId`; an application-scoped one passes `applicationId` only, and
+     *   then only application-scoped files resolve.
+     * @returns One entry per requested id, in the requested order, carrying the bytes.
+     * @throws When a file is unknown, is in a status that is not servable, is outside the scope, or
+     *   cannot be read from its storage provider.
+     */
+    readFilesForOutboundAttachment(fileIds: readonly string[], scope: {
+        applicationId?: string;
+        organizationId?: string;
+        userId?: string;
+    }): Promise<Array<{
+        fileId: string;
+        filename: string;
+        mimeType: string;
+        bytes: Buffer;
+    }>>;
     /**
      * Update file status (e.g., PENDING -> UPLOADED, UPLOADED -> LINKED).
      *
@@ -346,6 +414,25 @@ export declare class FilesBackendService {
      * @param executionContext - Execution context
      * @returns Access scope information with all identifiers
      */
+    /**
+     * Does the caller hold ORGANIZATION-WIDE membership of this exact organization?
+     *
+     * Answered only from `initiatorRoles`, the one input a request cannot author for itself.
+     *
+     * **A unit-scoped entry does not count, and that is a decision rather than an oversight.**
+     * `ExecutionContext_RoleInfo.organizationUnitId` marks a grant that is live authority inside ONE unit,
+     * and its own schema is explicit that reading such an entry as tenant-wide is "a privilege escalation,
+     * not a convenience". Membership of the tenant is arguably implied either way — a unit member is a
+     * member — but this route serves a file scoped to the WHOLE organization, so the narrower reading is
+     * the safe one and {@link isOrganizationWideRoleInfo} is the single definition of it. If a unit-scoped
+     * caller should reach an organization-scoped file, argue it and change it here, once.
+     *
+     * A platform administrator who is not a member gets nothing from this, which is also deliberate: the
+     * cross-tenant admission model is per-operation-variant (`admitsCrossTenantPlatformAdministration` plus
+     * a usable platform-access grant), these controller routes are not resource operations, and granting
+     * reach by position in the request path is exactly the ambient privilege that model removed.
+     */
+    private callerHoldsOrganizationWideMembership;
     protected deriveAccessScope(executionContext: ExecutionContext<any>): {
         applicationId?: string;
         organizationId?: string;

package/dist/esm/files/services/files.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"files.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/files.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAA2C,YAAY,EAA0C,sBAAsB,EAAE,KAAK,qBAAqB,~~EAAwI~~,MAAM,uBAAuB,CAAC;~~AAChU~~,OAAO,EAAE,IAAI,EAAE,UAAU,~~EAA2B~~,oBAAoB,EAAkB,gBAAgB,EAAgC,MAAM,uBAAuB,CAAC;~~AACxK~~,OAAO,EAA4B,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAE5I,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;~~AAKxG~~,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8DAA8D,CAAC;AAC9H,OAAO,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAEtJ,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AA+CnH,qBACa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAGjC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAQ/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAGzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAhCjC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,iBAAiB,EAAE,+BAA+B,EAElD,oBAAoB,EAAE,yCAAyC,EAE/D,uBAAuB,EAAE,qCAAqC,EAE9D,uBAAuB,EAAE,qCAAqC,EAE9D,iBAAiB,EAAE,+BAA+B,EAElD,gBAAgB,EAAE,uBAAuB,EAGzC,6BAA6B,CAAC,EAAE,2CAA2C,EAQ3E,uBAAuB,CAAC,EAAE,qCAAqC,EAG/D,aAAa,CAAC,EAAE,2BAA2B;IAQ9D;;;OAGG;IACH,OAAO,KAAK,eAAe,GAE1B;IAED,OAAO,CAAC,yBAAyB;IAI1B,yBAAyB,CAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,GAAG,YAAY,CAAC,EAC7D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,oBAAoB;IA2BvB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,oBAAoB,CAC/B,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,QAAQ,EACb,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,EACnD,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,YAAY,CAAC;QAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;KAAE,GACnG,OAAO,CAAC,IAAI,CAAC;~~IAuIhB~~;;;;;;;;;;;;;;;;;;OAkBG;YACW,mBAAmB;IA2EjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,8BAA8B;IAqB5C;;;;;;;;;;;OAWG;IACG,UAAU,CACd,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,qEAAqE;QACrE,eAAe,CAAC,EAAE,mBAAmB,CAAC;QAGtC,KAAK,CAAC,EAAE,oBAAoB,CAAC;QAG7B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,qBAAqB,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAwNhB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IAuBrB;;;;;;OAMG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+CvB;;;;;;OAMG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EAAE,EACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;IAoElB;;;;;;;OAOG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,mBAAmB,GACrC,OAAO,CAAC,IAAI,CAAC;IAkFhB;;;;;;;;OAQG;YACW,gCAAgC;IAwB9C;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;~~IAuIhB~~;;;;;;;;;;;OAWG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;OAOG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;OAIG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;;;OAQG;IACG,oBAAoB,CACxB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;IAyGlB;;;;;;;;;;;;;OAaG;IACG,mBAAmB,CACvB,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IACvC;;;;;;;;;OASG;IACH,0BAA0B,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAChG,OAAO,CAAC,OAAO,CAAC;~~IAuEnB~~;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,iBAAiB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;KAC/C;IAyBD;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG;QACpE,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAiBD;;;OAGG;IACH,SAAS,CAAC,0BAA0B,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAyB7G,SAAS,CAAC,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IA4B9F;;;;;;;;;;;;;;;;;OAiBG;YACW,qCAAqC;IAgCnD;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,6BAA6B,CACrC,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IACvC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1C,oBAAoB;IA4HvB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAOzB"}
1	+ {"version":3,"file":"files.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/files/services/files.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAA2C,YAAY,EAA0C,sBAAsB,EAAE,KAAK,qBAAqB,EAAoK,MAAM,uBAAuB,CAAC;AAC5V,OAAO,EAAE,IAAI,EAAE,UAAU,EAA+E,oBAAoB,EAAkB,gBAAgB,EAAgC,MAAM,uBAAuB,CAAC;AAC5N,OAAO,EAA4B,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,qCAAqC,EAAE,MAAM,qFAAqF,CAAC;AAE5I,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,iBAAiB,EAAE,MAAM,qEAAqE,CAAC;AAMxG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,8DAA8D,CAAC;AAC9H,OAAO,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAEtJ,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AA+CnH,qBACa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAExC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAGjC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAQ/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAGzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAhCjC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAI9D,MAAM,EAAE,aAAa,EAErB,YAAY,EAAE,0BAA0B,EAExC,iBAAiB,EAAE,+BAA+B,EAElD,oBAAoB,EAAE,yCAAyC,EAE/D,uBAAuB,EAAE,qCAAqC,EAE9D,uBAAuB,EAAE,qCAAqC,EAE9D,iBAAiB,EAAE,+BAA+B,EAElD,gBAAgB,EAAE,uBAAuB,EAGzC,6BAA6B,CAAC,EAAE,2CAA2C,EAQ3E,uBAAuB,CAAC,EAAE,qCAAqC,EAG/D,aAAa,CAAC,EAAE,2BAA2B;IAQ9D;;;OAGG;IACH,OAAO,KAAK,eAAe,GAE1B;IAED,OAAO,CAAC,yBAAyB;IAI1B,yBAAyB,CAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,GAAG,YAAY,CAAC,EAC7D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,oBAAoB;IA2BvB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,oBAAoB,CAC/B,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,QAAQ,EACb,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,EACnD,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,YAAY,CAAC;QAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;KAAE,GACnG,OAAO,CAAC,IAAI,CAAC;IAmKhB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,6BAA6B;IA+BrC;;;;;;;;;;;;;;;;;;OAkBG;YACW,mBAAmB;IA2EjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,8BAA8B;IAqB5C;;;;;;;;;;;OAWG;IACG,UAAU,CACd,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,qEAAqE;QACrE,eAAe,CAAC,EAAE,mBAAmB,CAAC;QAGtC,KAAK,CAAC,EAAE,oBAAoB,CAAC;QAG7B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,qBAAqB,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAwNhB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IAuBrB;;;;;;OAMG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IA+CvB;;;;;;OAMG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EAAE,EACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;IAoElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,8BAA8B,CAClC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1E,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA4ExF;;;;;;;OAOG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,mBAAmB,GACrC,OAAO,CAAC,IAAI,CAAC;IAkFhB;;;;;;;;OAQG;YACW,gCAAgC;IAwB9C;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA4IhB;;;;;;;;;;;OAWG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;OAOG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;OAIG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;;;OAQG;IACG,oBAAoB,CACxB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;IAyGlB;;;;;;;;;;;;;OAaG;IACG,mBAAmB,CACvB,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IACvC;;;;;;;;;OASG;IACH,0BAA0B,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAChG,OAAO,CAAC,OAAO,CAAC;IAgGnB;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,iBAAiB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,IAAI,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;KAC/C;IAyBD;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,qCAAqC;IAoB7C,SAAS,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG;QACpE,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAiBD;;;OAGG;IACH,SAAS,CAAC,0BAA0B,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAyB7G,SAAS,CAAC,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IA4B9F;;;;;;;;;;;;;;;;;OAiBG;YACW,qCAAqC;IAgCnD;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,6BAA6B,CACrC,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC;IACvC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1C,oBAAoB;IA4HvB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAOzB"}

package/dist/esm/files/services/files.backend.service.js CHANGED Viewed

@@ -24,8 +24,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject, optional } from 'inversify';
-import { CoreResourceOperation, CoreResourceType, ErrorType, ErrorCustomMessageReference, ResourcePrimaryScope, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, CORE_APP_ROLES, Resources_SharedUtils, isWildoBackendError, WildoHeaderKeys } from '@wildo-ai/saas-models';
-import { FileStatus, FILE_STATUS_TRANSITIONS, FileScopeUtils, FileServeVariant, ERASED_FILE_NAME_PLACEHOLDER } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, CoreResourceType, ErrorType, ErrorCustomMessageReference, ResourcePrimaryScope, PRIMARY_SCOPE_TO_FIELD_IDENTIFIER, CORE_APP_ROLES, Resources_SharedUtils, isOrganizationWideRoleInfo, isWildoBackendError, WildoHeaderKeys } from '@wildo-ai/saas-models';
+import { FileStatus, FILE_STATUS_TRANSITIONS, FILE_LINKABLE_STATUSES, FILE_DOWNLOADABLE_STATUSES, FileScopeUtils, FileServeVariant, ERASED_FILE_NAME_PLACEHOLDER } from '@wildo-ai/saas-models';
 import { resolveFileDisplayNature } from '@wildo-ai/zod-decorators';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
 import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service.js';
@@ -38,6 +38,7 @@ import { validateFileId, validateResourceId, validateResourceType, validateField
 import { setContentDispositionHeader } from '../../files/utils/file-upload.utils.js';
 import { resolveFileUploaderPrincipal } from '../../files/utils/file-uploader.utils.js';
 import { generateImageThumbnail, collectStreamToBuffer, isThumbnailableImage, THUMBNAIL_SOURCE_MAX_BYTES } from '../../files/utils/image-thumbnail.backend.utils.js';
+import { getFileFieldSchemaMetadataByPath } from '../../files/utils/file-field-schema-path.backend.utils.js';
 import { AppConfigurationService } from '../../config/services/app-configuration.backend.service.js';
 import { FileStorageRouterBackendService } from '../../files/storage/file-storage-router.backend.service.js';
 import { ResourcePersistenceUnitOfWorkBackendService } from '../../databases/services/resource-persistence-unit-of-work.backend.service.js';
@@ -174,10 +175,33 @@ let FilesBackendService = class FilesBackendService {
         const next = options?.next;
         const variant = options?.variant ?? FileServeVariant.ORIGINAL;
         // ── THUMBNAIL VARIANT — a preview surface asked for a downscaled rendition.
-        // Only raster images within the memory-safe size ceiling are transformed; every
-        // other case (non-image, oversized, or a resize failure inside
-        // `serveImageThumbnail`) serves the ORIGINAL bytes via the streaming path below.
-        // Gated on the RECORDED `mimeType`/`size` so the decision costs no storage round-trip.
+        //
+        // TWO refusals, and they are deliberately NOT the same shape (#478):
+        //
+        //  1. The field SUPPRESSED derived renditions (`imageConstraints.generateThumbnails: false`).
+        //     This is a declared intent — cost, or privacy on a sensitive image — so it REFUSES.
+        //     Falling through to the original bytes, which is what every other ineligible case does,
+        //     would serve the FULL-SIZE image to a caller who asked for a small one: the exact
+        //     outcome an author suppressing thumbnails is trying to prevent. A control that degrades
+        //     into serving more data than was asked for is worse than no control.
+        //
+        //  2. The file cannot be thumbnailed (non-image, zero-size, oversized, or a resize failure
+        //     inside `serveImageThumbnail`). Nothing was declared about it, so the original bytes are
+        //     the honest answer and a preview request never hard-fails.
+        //
+        // Both gates read RECORDED state — the field's declared metadata and the file's own
+        // `mimeType`/`size` — so neither costs a storage round-trip.
+        if (variant === FileServeVariant.THUMBNAIL && !this.fieldPermitsDerivedRenditions(file)) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                context: {
+                    message: 'This file field suppresses derived renditions; request the original variant instead.',
+                    fileId: file.fileId,
+                    linkedResourceType: file.linkedResourceType,
+                    linkedFieldName: file.linkedFieldName,
+                },
+            });
+        }
         const canThumbnail = variant === FileServeVariant.THUMBNAIL &&
             isThumbnailableImage(file.mimeType) &&
             (file.size ?? 0) > 0 &&
@@ -290,6 +314,56 @@ let FilesBackendService = class FilesBackendService {
             throw error;
         }
     }
+    /**
+     * Does the DECLARING field permit derived renditions of this file?
+     *
+     * Reads `imageConstraints.generateThumbnails` off the file field's own schema metadata,
+     * resolved from the file's recorded `linkedResourceType` + `linkedFieldName`. Until #478 the
+     * flag was declared, set on the framework's own user-avatar field, and read by nothing — every
+     * eligible raster image got a rendition whether or not its author had asked for one, and an
+     * author who set it `false` for cost or privacy got thumbnails and no error. It degraded in the
+     * PERMISSIVE direction, which is why it was worth wiring rather than deleting.
+     *
+     * ## Absence means PERMIT, at three different levels, and each is deliberate
+     *
+     * A file with no `linkedResourceType`/`linkedFieldName` (a standalone upload), a field the
+     * registry cannot resolve, a field with no `imageConstraints`, or `imageConstraints` with no
+     * `generateThumbnails` — all permit. Only an EXPLICIT `false` suppresses. The flag is opt-OUT:
+     * nobody has declared it today except to say `true`, and a resolution failure must not become a
+     * silent refusal on a preview surface that works now.
+     *
+     * The `{ sizes: [...] }` form counts as permission. Its sizes are not honoured — the derivation
+     * has one fixed longest-edge — so it is truthy-permits here and nothing more; an author reading
+     * this should not expect their sizes to reach the renderer.
+     */
+    fieldPermitsDerivedRenditions(file) {
+        const resourceType = file.linkedResourceType;
+        const fieldName = file.linkedFieldName;
+        if (!resourceType || !fieldName) {
+            return true;
+        }
+        const resourceConfig = this.resourcesRegistry.getResourceConfiguration(resourceType);
+        if (!resourceConfig?.mainSchema) {
+            return true;
+        }
+        let resolved;
+        try {
+            resolved = getFileFieldSchemaMetadataByPath(resourceConfig.mainSchema, fieldName);
+        }
+        catch (error) {
+            // The walker throws on schema shapes it refuses to descend (plain unions, dynamic
+            // containers). That is a question about the SCHEMA, not about this file's permission —
+            // serving a preview is the safe answer, and the walker's own consumers report the shape.
+            this.logDebug('Could not resolve file field metadata for the rendition gate; permitting', {
+                fileId: file.fileId,
+                resourceType,
+                fieldName,
+                ...projectCaughtErrorLogFields(error),
+            });
+            return true;
+        }
+        return resolved?.fileMetadata.imageConstraints?.generateThumbnails !== false;
+    }
     /**
      * Serve a downscaled `webp` thumbnail of a raster image — the `?variant=thumbnail`
      * path of {@link streamFileToResponse}.
@@ -703,6 +777,102 @@ let FilesBackendService = class FilesBackendService {
         this.logDebug('Batch get completed', { requested: fileIds.length, found: files.length, authorized: authorizedFiles.length });
         return authorizedFiles;
     }
+    /**
+     * Read a file's BYTES for a system-initiated outbound send — today, an email attachment (#429).
+     *
+     * ## Why this lives here and not in the caller
+     *
+     * Everything it has to get right is file knowledge: which statuses may be served, how a file is
+     * authorized against a scope, and which storage provider holds the bytes. A caller that assembled
+     * those itself would be a second, drifting copy of three decisions this service owns — and the
+     * one most dangerous to copy is the status gate, because getting it wrong means attaching an
+     * INFECTED file to an outbound email.
+     *
+     * ## It REFUSES rather than skipping, and that is the whole point
+     *
+     * The defect this closes is a SILENT drop: `attachmentFileIds` was declared and read by nothing,
+     * so a caller supplying an attachment got a successful send and an attachment-less email. A
+     * resolution that quietly omitted a file it could not serve would be the same defect wearing
+     * error handling, so every rejection throws and names the file.
+     *
+     * ## Authorization: the `authoritativeScopeOverride` this reuses was built for exactly this shape
+     *
+     * A system send carries no user principal, and an identity-less execution context derives no
+     * owner — `authorizeFileAccess` records that trap in its own JSDoc, where an empty context would
+     * have denied the subject's own file during erasure teardown. So the caller's scope is passed
+     * explicitly, the same way the teardown path passes the owner it already resolved. The scope is
+     * NOT optional: without it there is no tenancy confinement, and an attachment path that reads any
+     * file by id is a read-anything primitive wearing an email envelope.
+     *
+     * @param fileIds - The file ids to resolve, in the order the caller supplied them.
+     * @param scope - The AUTHORITATIVE owner every file is authorized against. An organization-scoped
+     *   send passes its `organizationId`; an application-scoped one passes `applicationId` only, and
+     *   then only application-scoped files resolve.
+     * @returns One entry per requested id, in the requested order, carrying the bytes.
+     * @throws When a file is unknown, is in a status that is not servable, is outside the scope, or
+     *   cannot be read from its storage provider.
+     */
+    async readFilesForOutboundAttachment(fileIds, scope) {
+        if (fileIds.length === 0) {
+            return [];
+        }
+        const applicationId = scope.applicationId ?? this.appConfigService.applicationId ?? undefined;
+        const executionContext = await this.executionContextCreator.createForInternalRepositoryOperation({
+            resourceType: CoreResourceType.FILES,
+            operationIdentifier: CoreResourceOperation.READ,
+            initiatorIds: {
+                ...(applicationId ? { applicationId } : {}),
+                ...(scope.organizationId ? { organizationId: scope.organizationId } : {}),
+                ...(scope.userId ? { userId: scope.userId } : {}),
+            },
+            initiatorRoles: [
+                {
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,
+                },
+            ],
+        });
+        const files = await this.filesRepository.list(executionContext, { _id: { $in: [...fileIds] } });
+        const filesById = new Map(files.map((file) => [file.fileId, file]));
+        const resolved = [];
+        for (const fileId of fileIds) {
+            const file = filesById.get(fileId);
+            if (!file) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { message: 'Attachment file not found', fileId },
+                });
+            }
+            // The SAME authority the download route uses. INFECTED, SCANNING, PENDING, FAILED and
+            // DELETED are all outside it, so none of them can leave the system as an attachment.
+            if (!FILE_DOWNLOADABLE_STATUSES.has(file.status)) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { message: 'Attachment file is not in a servable status', fileId, status: file.status },
+                });
+            }
+            const authorized = await this.authorizeFileAccess(file, executionContext, scope);
+            if (!authorized) {
+                throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                    customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                    context: { message: 'Attachment file is outside the sending scope', fileId },
+                });
+            }
+            const provider = this.getStorageProviderForFile(file, executionContext);
+            const download = await provider.download({ fileId: file.fileId, storageRef: file.storageRef, storageProvider: file.storageProvider }, executionContext);
+            const chunks = [];
+            for await (const chunk of download.stream) {
+                chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            }
+            resolved.push({
+                fileId: file.fileId,
+                filename: file.filename,
+                mimeType: file.mimeType,
+                bytes: Buffer.concat(chunks),
+            });
+        }
+        return resolved;
+    }
     /**
      * Update file status (e.g., PENDING -> UPLOADED, UPLOADED -> LINKED).
      *
@@ -832,7 +1002,8 @@ let FilesBackendService = class FilesBackendService {
          */
         const updatedFile = await this.filesRepository.update(internalContext, {
             _id: fileId,
-            status: { $in: [FileStatus.UPLOADED, FileStatus.CLEAN] },
+            // The linkable set is the same one the link-time validators consult (issue #320) — one copy.
+            status: { $in: [...FILE_LINKABLE_STATUSES] },
         }, {
             linkedResourceType: resourceType,
             linkedResourceId: resourceId,
@@ -889,14 +1060,18 @@ let FilesBackendService = class FilesBackendService {
                     },
                 });
             }
-            // Wrong status (not UPLOADED)
+            // Not a linkable status. The guarded update above admits exactly FILE_LINKABLE_STATUSES, so
+            // reaching here means the row is outside that set (or moved out of it between read and write).
+            // SCANNING is named on its own: the file is not wrong, only not yet known to be safe — retry.
             throw this.errorBuilder.buildError(ErrorType.BUSINESS_RULE, executionContext, {
-                customMessageReference: ErrorCustomMessageReference.FILE_NOT_IN_UPLOADED_STATUS,
+                customMessageReference: currentFile.status === FileStatus.SCANNING
+                    ? ErrorCustomMessageReference.FILE_SCAN_IN_PROGRESS
+                    : ErrorCustomMessageReference.FILE_NOT_LINKABLE,
                 context: {
                     // diagnostic (log-only)
                     fileId,
                     fileStatus: currentFile.status,
-                    expectedStatus: FileStatus.UPLOADED,
+                    linkableStatuses: [...FILE_LINKABLE_STATUSES],
                     resourceType,
                     resourceId,
                 },
@@ -1285,16 +1460,40 @@ let FilesBackendService = class FilesBackendService {
                     return false;
                 }
                 return true;
-            case ResourcePrimaryScope.ORGANIZATIONS:
-                // ORGANIZATIONS scope: user must belong to the organization
-                if (file.organizationId !== accessScope.organizationId) {
-                    this.logDebug('File access denied: organization mismatch', {
-                        fileOrganizationId: file.organizationId,
-                        requestOrganizationId: accessScope.organizationId,
-                    });
-                    return false;
+            case ResourcePrimaryScope.ORGANIZATIONS: {
+                // The caller is ACTING IN an organization: it must be the file's. Unchanged, and deliberately
+                // not widened — a principal acting in organization A must not reach organization B's file
+                // through this route merely because it also belongs to B. The acting scope is the confinement.
+                if (accessScope.organizationId) {
+                    if (file.organizationId !== accessScope.organizationId) {
+                        this.logDebug('File access denied: organization mismatch', {
+                            fileOrganizationId: file.organizationId,
+                            requestOrganizationId: accessScope.organizationId,
+                        });
+                        return false;
+                    }
+                    return true;
                 }
-                return true;
+                /*
+                 * No acting organization — ask the MEMBERSHIP question instead of denying.
+                 *
+                 * The four global file routes (`/files/:fileId` and friends) build their execution context from
+                 * a URL that carries no parameters, and `extractInitiatorIds` populates `initiatorIds.organizationId`
+                 * only from URL critical params. So the context holds `userId` and nothing else, this comparison
+                 * ran against `undefined`, and every ORGANIZATIONS-scoped file 404'd for its own owner (#68) —
+                 * taking `DisplayFieldFile`'s metadata band with it, since that band loads from this endpoint.
+                 *
+                 * The row already names its organization, so the open question is not WHICH organization but
+                 * whether the caller belongs to it. That is answered from `initiatorRoles`, which the request
+                 * cannot author for itself — `execution-context-creator` builds it from memberships, and only
+                 * from `OrganizationMemberStatus.ACTIVE` ones, so a suspended member contributes no entry here.
+                 *
+                 * A caller-supplied `?organizationId=` is deliberately NOT consulted: that resolution exists only
+                 * on the manual-controller path, and reading a tenant identity off the request is the shape this
+                 * check exists to refuse.
+                 */
+                return this.callerHoldsOrganizationWideMembership(file.organizationId, executionContext);
+            }
             case ResourcePrimaryScope.USER_SELF:
                 // USER_SELF scope: access is granted iff the caller IS the owner. USER_SELF and
                 // ORGANIZATIONS are independent primary-scope axes, so there is NO org check here —
@@ -1353,6 +1552,40 @@ let FilesBackendService = class FilesBackendService {
      * @param executionContext - Execution context
      * @returns Access scope information with all identifiers
      */
+    /**
+     * Does the caller hold ORGANIZATION-WIDE membership of this exact organization?
+     *
+     * Answered only from `initiatorRoles`, the one input a request cannot author for itself.
+     *
+     * **A unit-scoped entry does not count, and that is a decision rather than an oversight.**
+     * `ExecutionContext_RoleInfo.organizationUnitId` marks a grant that is live authority inside ONE unit,
+     * and its own schema is explicit that reading such an entry as tenant-wide is "a privilege escalation,
+     * not a convenience". Membership of the tenant is arguably implied either way — a unit member is a
+     * member — but this route serves a file scoped to the WHOLE organization, so the narrower reading is
+     * the safe one and {@link isOrganizationWideRoleInfo} is the single definition of it. If a unit-scoped
+     * caller should reach an organization-scoped file, argue it and change it here, once.
+     *
+     * A platform administrator who is not a member gets nothing from this, which is also deliberate: the
+     * cross-tenant admission model is per-operation-variant (`admitsCrossTenantPlatformAdministration` plus
+     * a usable platform-access grant), these controller routes are not resource operations, and granting
+     * reach by position in the request path is exactly the ambient privilege that model removed.
+     */
+    callerHoldsOrganizationWideMembership(fileOrganizationId, executionContext) {
+        if (!fileOrganizationId) {
+            this.logDebug('File access denied: organization-scoped file carries no organization owner');
+            return false;
+        }
+        const membership = (executionContext.initiatorRoles ?? []).find((roleInfo) => roleInfo.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS &&
+            isOrganizationWideRoleInfo(roleInfo) &&
+            roleInfo.relatedResourceId === fileOrganizationId);
+        if (!membership) {
+            this.logDebug('File access denied: caller holds no organization-wide membership of the file\'s organization', {
+                fileOrganizationId,
+            });
+            return false;
+        }
+        return true;
+    }
     deriveAccessScope(executionContext) {
         const organizationId = this.resourceOperationHelper.getInitiatorId(executionContext, 'organization');
         const userId = this.resourceOperationHelper.getInitiatorId(executionContext, 'user');