PD-46 — Décomposition en tâches agents¶

export class DownloadResponseDto {
  @ApiProperty({ description: 'Pre-signed URL pour téléchargement direct' })
  downloadUrl: string;

  @ApiProperty({ description: 'Date d\'expiration de l\'URL (UTC)' })
  expiresAt: Date;
}

export enum DownloadErrorCode {
  UNAUTHORIZED = 'ERR-46-001',
  FORBIDDEN = 'ERR-46-002',
  SHARE_REVOKED = 'ERR-46-003',
  TENANT_MISMATCH = 'ERR-46-004',
  INSUFFICIENT_ROLE = 'ERR-46-005',
  NOT_FOUND = 'ERR-46-006',
  S3_ERROR = 'ERR-46-007',
  AUDIT_ERROR = 'ERR-46-008',
}

export class DownloadError extends Error {
  constructor(
    public readonly code: DownloadErrorCode,
    message: string,
    public readonly httpStatus: number,
  ) {
    super(message);
  }
}

async findActiveShare(
  userId: string,
  documentId: string,
): Promise<Share | null> {
  // SELECT * FROM shares
  // WHERE user_id = $1 AND document_id = $2
  //   AND is_active = true
  //   AND (expires_at IS NULL OR expires_at > NOW())
  //   AND revoked_at IS NULL
}

@Injectable()
export class S3PresignService {
  private readonly s3Client: S3Client;
  private readonly bucket: string = 'probatiovault-documents';

  constructor(private readonly configService: ConfigService) {
    // Initialiser S3Client avec credentials OVH (depuis ConfigService)
    // Endpoint: s3.gra.perf.cloud.ovh.net
  }

  async getSignedUrl(
    key: string,
    options: { expiresIn: number } = { expiresIn: 300 },
  ): Promise<string> {
    // Utiliser @aws-sdk/s3-request-presigner
    // getSignedUrl(s3Client, new GetObjectCommand({Bucket, Key}), {expiresIn})
    // IMPORTANT: Ne lit PAS le contenu, génère seulement l'URL
  }
}

@Injectable()
export class AuditDownloadService {
  constructor(private readonly auditService: AuditService) {}

  async logDownloadSuccess(
    userId: string,
    documentId: string,
    tenantId?: string,
  ): Promise<void> {
    // Event: DOWNLOAD_SUCCESS
    // Utiliser auditService.logEvent()
  }

  async logDownloadDenied(
    userId: string,
    documentId: string,
    reason: string,
    tenantId?: string,
  ): Promise<void> {
    // Event: DOWNLOAD_DENIED
    // Utiliser auditService.logEvent()
  }
}

@Injectable()
export class DocumentAccessGuard implements CanActivate {
  constructor(
    private readonly shareRepo: ShareRepository,
    private readonly documentRepo: DocumentRepository,
  ) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    // 1. Extraire userId du JWT (request.user)
    // 2. Extraire documentId des params
    // 3. Vérifier ownership (document.ownerId === userId)
    // 4. Si non owner: vérifier partage actif via shareRepo.findActiveShare()
    // 5. Pour B2B (OIDC): validateTenant + validateRole
    // 6. Throw DownloadError si refusé
  }
}

@Injectable()
export class DownloadService {
  constructor(
    private readonly s3PresignService: S3PresignService,
    private readonly auditService: AuditDownloadService,
    private readonly documentRepo: DocumentRepository,
  ) {}

  async generateDownloadUrl(
    documentId: string,
    user: UserContext,
  ): Promise<{ url: string; expiresAt: Date }> {
    // 1. Récupérer document (s3_key)
    // 2. Appeler s3PresignService.getSignedUrl(key, {expiresIn: 300})
    // 3. Logger via auditService.logDownloadSuccess()
    // 4. Retourner {url, expiresAt: now + 5min}
  }
}

@Controller('documents')
@UseGuards(JwtAuthGuard, DocumentAccessGuard)
export class DownloadController {
  constructor(private readonly downloadService: DownloadService) {}

  @Get(':id/download')
  @HttpCode(HttpStatus.OK)
  async getDownloadUrl(
    @Param('id', ParseUUIDPipe) documentId: string,
    @CurrentUser() user: UserContext,
  ): Promise<DownloadResponseDto> {
    const result = await this.downloadService.generateDownloadUrl(documentId, user);
    return {
      downloadUrl: result.url,
      expiresAt: result.expiresAt,
    };
  }
}