feat: harden file sharing and integrity

src/govoplan_files/backend/storage/campaign_attachments.py

@@ -13,12 +13,17 @@ from typing import Any, Iterator
 from sqlalchemy.orm import Session
 
 from govoplan_files.backend.db.models import FileAsset, FileBlob, FileShare, FileVersion
-from govoplan_files.backend.storage.backends import StorageBackend, StorageBackendError, get_storage_backend
+from govoplan_files.backend.storage.backends import StorageBackend, get_storage_backend
 from govoplan_files.backend.storage.common import FileStorageError
 from govoplan_files.backend.storage.files import current_versions_and_blobs, get_asset_for_user, list_assets_for_user, share_files
 from govoplan_files.backend.storage.access import ensure_owner_access
 from govoplan_files.backend.storage.paths import normalize_folder, normalize_logical_path, safe_storage_component
 from govoplan_files.backend.storage.provenance import source_provenance_from_metadata, source_revision_from_metadata
+from govoplan_files.backend.storage.share_state import effective_file_share_clause
+from govoplan_files.backend.storage.integrity import (
+    ensure_blob_is_readable,
+    read_verified_blob_bytes,
+)
 
 
 MANAGED_SOURCE_PREFIX = "managed:"
@@ -165,7 +170,7 @@ def _campaign_linked_asset_ids(
                 FileShare.file_asset_id.in_(chunk),
                 FileShare.target_type == "campaign",
                 FileShare.target_id == campaign_id,
-                FileShare.revoked_at.is_(None),
+                effective_file_share_clause(),
             )
             .all()
         )
@@ -301,11 +306,9 @@ def _materialize_managed_asset(
     target = _safe_local_target(local_root, relative_path)
     target.parent.mkdir(parents=True, exist_ok=True)
     version, blob = version_blobs[asset.id]
+    ensure_blob_is_readable(blob)
     if include_bytes:
-        try:
-            data = backend.get_bytes(blob.storage_key) if backend else b""
-        except StorageBackendError as exc:
-            raise FileStorageError(str(exc)) from exc
+        data = read_verified_blob_bytes(blob, backend=backend) if backend else b""
         target.write_bytes(data)
     else:
         target.touch()