feat: expose immutable postbox file references

src/govoplan_files/backend/routes/assets.py

@@ -16,6 +16,7 @@ from govoplan_files.backend.storage.common import FileStorageError
 from govoplan_files.backend.storage.files import (
     get_asset_for_user,
     read_asset_bytes,
+    read_asset_version_bytes,
     soft_delete_assets,
 )
 
@@ -85,6 +86,46 @@ def download_file(
     )
 
 
+@router.get("/{file_id}/versions/{version_id}/download")
+def download_file_version(
+    file_id: str,
+    version_id: str,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_scope("files:file:download")),
+):
+    try:
+        asset = get_asset_for_user(
+            session,
+            tenant_id=principal.tenant_id,
+            user_id=principal.user.id,
+            asset_id=file_id,
+            is_admin=_is_admin(principal),
+        )
+        data, version, blob = read_asset_version_bytes(session, asset, version_id)
+        _audit_connector_event(
+            session,
+            principal,
+            action="files.connector.accessed",
+            asset=asset,
+            version=version,
+            blob=blob,
+            operation="download-version",
+            commit=True,
+        )
+    except FileStorageError as exc:
+        raise _http_error(exc, not_found=True) from exc
+    headers = {
+        "Content-Disposition": _attachment_disposition(
+            version.filename_at_upload or asset.filename
+        )
+    }
+    return StreamingResponse(
+        BytesIO(data),
+        media_type=blob.content_type or "application/octet-stream",
+        headers=headers,
+    )
+
+
 @router.delete("/{file_id}", response_model=BulkDeleteResponse)
 def delete_file(
     file_id: str,