feat: harden file sharing and integrity

src/govoplan_files/backend/storage/share_state.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from sqlalchemy import and_, or_
+
+from govoplan_files.backend.db.models import FileShare
+from govoplan_files.backend.storage.common import utcnow
+
+
+def effective_file_share_clause(*, at: datetime | None = None):
+    checked_at = at or utcnow()
+    return and_(
+        FileShare.revoked_at.is_(None),
+        or_(FileShare.expires_at.is_(None), FileShare.expires_at > checked_at),
+    )
+
+
+def file_share_is_active(share: FileShare, *, at: datetime | None = None) -> bool:
+    if share.revoked_at is not None:
+        return False
+    if share.expires_at is None:
+        return True
+    checked_at = _aware_utc(at or utcnow())
+    return _aware_utc(share.expires_at) > checked_at
+
+
+def _aware_utc(value: datetime) -> datetime:
+    if value.tzinfo is None:
+        return value.replace(tzinfo=timezone.utc)
+    return value.astimezone(timezone.utc)
+
+
+__all__ = ["effective_file_share_clause", "file_share_is_active"]