transfer from private server/git server

web/routes/fichiers.py

@@ -0,0 +1,59 @@
+"""routes/fichiers.py — API upload/download du module Fichiers (EXF-05 à EXF-08)."""
+
+from flask import Blueprint, current_app, jsonify, request, send_file
+
+from services import fichier_service
+from services.auth_service import client_ip, current_user, is_admin, require_login
+
+bp = Blueprint("fichiers", __name__, url_prefix="/api/fichiers")
+
+
+def _db():
+    return current_app.config["DB"]
+
+
+@bp.route("", methods=["GET"])
+@require_login
+def list_fichiers():
+    return jsonify(fichier_service.list_fichiers(_db()))
+
+
+@bp.route("/upload", methods=["POST"])
+@require_login
+def upload():
+    user = current_user()
+    try:
+        fichier_id = fichier_service.handle_upload(
+            _db(), request.files.get("file"), user["sub"], client_ip()
+        )
+    except fichier_service.FileValidationError as exc:
+        return jsonify({"error": str(exc)}), 400
+    return jsonify({"id": fichier_id}), 201
+
+
+@bp.route("/<int:fichier_id>/download", methods=["GET"])
+@require_login
+def download(fichier_id):
+    user = current_user()
+    try:
+        path, original_name = fichier_service.prepare_download(
+            _db(), fichier_id, user["sub"], is_admin(user), client_ip()
+        )
+    except FileNotFoundError:
+        return jsonify({"error": "not found"}), 404
+    except PermissionError:
+        return jsonify({"error": "forbidden"}), 403
+    return send_file(path, as_attachment=True, download_name=original_name)
+
+
+@bp.route("/<int:fichier_id>", methods=["DELETE"])
+@require_login
+def delete(fichier_id):
+    user = current_user()
+    try:
+        fichier_service.delete_fichier(_db(), fichier_id, user["sub"], is_admin(user), client_ip())
+    except FileNotFoundError:
+        return jsonify({"error": "not found"}), 404
+    except PermissionError:
+        return jsonify({"error": "forbidden"}), 403
+    return jsonify({"status": "deleted"})