Fix PostgreSQL file visibility queries

src/govoplan_files/backend/storage/files.py

@@ -596,21 +596,31 @@ def _asset_visibility_query_for_user(
         if owner_type == "group" and owner_id:
             query = query.filter(FileAsset.owner_group_id == owner_id)
     if campaign_id:
-        query = query.join(FileShare, FileShare.file_asset_id == FileAsset.id).filter(
+        campaign_share = exists().where(
             FileShare.tenant_id == tenant_id,
+            FileShare.file_asset_id == FileAsset.id,
             FileShare.target_type == "campaign",
             FileShare.target_id == campaign_id,
             effective_file_share_clause(),
         )
+        query = query.filter(campaign_share)
     elif not is_admin and not owner_type:
         group_ids = user_group_ids(session, tenant_id=tenant_id, user_id=user_id)
-        query = query.outerjoin(FileShare, FileShare.file_asset_id == FileAsset.id).filter(
+        active_share = exists().where(
+            FileShare.tenant_id == tenant_id,
+            FileShare.file_asset_id == FileAsset.id,
+            effective_file_share_clause(),
+            or_(
+                (FileShare.target_type == "user") & (FileShare.target_id == user_id),
+                (FileShare.target_type == "group") & (FileShare.target_id.in_(group_ids)),
+                (FileShare.target_type == "tenant") & (FileShare.target_id == tenant_id),
+            )
+        )
+        query = query.filter(
             or_(
                 (FileAsset.owner_type == "user") & (FileAsset.owner_user_id == user_id),
                 (FileAsset.owner_type == "group") & (FileAsset.owner_group_id.in_(group_ids)),
-                effective_file_share_clause() & (FileShare.target_type == "user") & (FileShare.target_id == user_id),
-                effective_file_share_clause() & (FileShare.target_type == "group") & (FileShare.target_id.in_(group_ids)),
-                effective_file_share_clause() & (FileShare.target_type == "tenant") & (FileShare.target_id == tenant_id),
+                active_share,
             )
         )
     if path_prefix:
@@ -639,7 +649,7 @@ def _asset_visibility_query_for_user(
             CampaignAttachmentUse.use_stage == "sent",
         )
         query = query.filter(sent_use_exists if audit_relevant else ~sent_use_exists)
-    return query.distinct()
+    return query
 
 
 def count_assets_for_user(