Verify private original bytes before evidence registration
Private original intake needs a trusted fingerprint of retained bytes before source registration. This adds an unused server-side helper that authorizes workspace scope before and after reading owner-scoped PDF/CSV keys from the existing context-private bucket. It derives SHA256/size from bytes and rejects empty, oversized, foreign-path, binary-text or implausible PDF containers.
No public endpoint, MCP tool, customer upload, source registration, accepted analysis, rights decision or paid caller is connected. PDF markers and UTF8 text checks are basic plausibility, not parsing or malware/signature validation. Blob size is checked after download; this is not a streaming acquisition limit. Future registration must enforce immutable/version-bound storage and staged-upload/orphan handling.
Validation:18 new fixture tests, including the real storage adapter path, revoked access, exact-byte identity and changed fingerprints; full lint, scoped TypeScript, formatting and diff checks pass. Fixtures do not prove hosted storage permissions or live behavior. Part of app#2116/#2140 original-file intake; no production operations.
Summary by cubic
Adds an unused server-side helper that verifies owner-scoped PDF/CSV originals in the context-private bucket before future evidence registration.
verifyContextOriginal normalizes actor/owner UUIDs, authorizes workspace scope before and after reading, derives SHA-256 and byte size from the actual stored bytes, and rejects empty, oversized, foreign-path, binary-text, or implausible PDF files. Key checks also reject trailing line terminators, path traversal, query tokens, and mismatched extensions before any read.
New original object addresses use a type-independent .original suffix; legacy .pdf and .csv paths stay supported, with neutral paths selecting the bounded PDF/UTF-8 plausibility check. No endpoint, MCP tool, upload, source registration, or rights decision is connected; PDF markers and UTF-8 checks are plausibility only, not parsing or malware validation. Blob size is checked after download, so this is not a streaming acquisition limit. A future registration flow must enforce immutable/version-bound storage and staged-upload/orphan handling; new neutral registrations require Database94's forward-only 20261009230000 migration. Historical objects must not be migrated or reuploaded automatically.
Adds tests covering the real storage adapter path, scope loss before and revocation during the read, exact-byte identity, changed fingerprints, and canonical-key normalization. Fixtures do not prove hosted storage permissions or live behavior. Part of app#2116/#2140 original-file intake; no production operations.