feat: harden file sharing and integrity

src/govoplan_files/backend/capabilities.py

@@ -22,6 +22,7 @@ from govoplan_files.backend.storage.campaign_attachments import (
 from govoplan_files.backend.storage.campaign_usage import record_campaign_attachment_uses_for_jobs
 from govoplan_files.backend.storage.files import current_version_and_blob
 from govoplan_files.backend.storage.paths import normalize_folder
+from govoplan_files.backend.storage.share_state import effective_file_share_clause
 
 
 VIRTUAL_FOLDER_RESOURCE_PREFIX = "virtual-folder:v1"
@@ -96,7 +97,7 @@ class FilesAccessService(FileAccessProvider):
             .filter(
                 FileShare.tenant_id == asset.tenant_id,
                 FileShare.file_asset_id == asset.id,
-                FileShare.revoked_at.is_(None),
+                effective_file_share_clause(),
                 FileShare.permission.in_(sorted(permission_values)),
                 or_(
                     (FileShare.target_type == "user") & (FileShare.target_id == principal.membership_id),