refactor: move business logic out of presentation — ReadAssetFile, checksum, auth checks, MetadataValue conversions

crates/application/tests/catalog/queries/get_asset.rs

@@ -16,12 +16,13 @@ async fn returns_asset_with_resolved_metadata() {
         relative_path: "photos/img.jpg".into(),
         checksum: Checksum::new("a".repeat(64)).unwrap(),
     };
+    let owner = SystemId::new();
     let asset = Asset::new(
         source,
         AssetType::Image,
         "image/jpeg",
         1024,
-        SystemId::new(),
+        owner,
     );
     asset_repo.save(&asset).await.unwrap();
 
@@ -42,6 +43,7 @@ async fn returns_asset_with_resolved_metadata() {
     let (returned, resolved) = handler
         .execute(GetAssetQuery {
             asset_id: asset.asset_id,
+            user_id: owner,
         })
         .await
         .unwrap();
@@ -62,8 +64,35 @@ async fn rejects_nonexistent() {
     let result = handler
         .execute(GetAssetQuery {
             asset_id: SystemId::new(),
+            user_id: SystemId::new(),
         })
         .await;
 
     assert!(matches!(result, Err(DomainError::NotFound(_))));
 }
+
+#[tokio::test]
+async fn rejects_forbidden_access() {
+    let asset_repo = Arc::new(InMemoryAssetRepository::new());
+    let meta_repo = Arc::new(InMemoryAssetMetadataRepository::new());
+
+    let source = SourceReference {
+        volume_id: SystemId::new(),
+        relative_path: "photos/img.jpg".into(),
+        checksum: Checksum::new("a".repeat(64)).unwrap(),
+    };
+    let owner = SystemId::new();
+    let asset = Asset::new(source, AssetType::Image, "image/jpeg", 1024, owner);
+    asset_repo.save(&asset).await.unwrap();
+
+    let handler = GetAssetHandler::new(asset_repo, meta_repo);
+    let other_user = SystemId::new();
+    let result = handler
+        .execute(GetAssetQuery {
+            asset_id: asset.asset_id,
+            user_id: other_user,
+        })
+        .await;
+
+    assert!(matches!(result, Err(DomainError::Forbidden(_))));
+}

crates/application/tests/catalog/queries/mod.rs

@@ -1,2 +1,3 @@
 mod get_asset;
 mod get_timeline;
+mod read_asset_file;

crates/application/tests/catalog/queries/read_asset_file.rs

@@ -0,0 +1,55 @@
+use application::catalog::{ReadAssetFileHandler, ReadAssetFileQuery};
+use application::testing::{InMemoryAssetRepository, InMemoryFileStorage};
+use bytes::Bytes;
+use domain::catalog::entities::{Asset, AssetType, SourceReference};
+use domain::errors::DomainError;
+use domain::ports::{AssetRepository, FileStoragePort};
+use domain::value_objects::{Checksum, SystemId};
+use std::sync::Arc;
+
+#[tokio::test]
+async fn reads_file_successfully() {
+    let asset_repo = Arc::new(InMemoryAssetRepository::new());
+    let file_storage = Arc::new(InMemoryFileStorage::new());
+
+    let source = SourceReference {
+        volume_id: SystemId::new(),
+        relative_path: "photos/inbox/cat.jpg".into(),
+        checksum: Checksum::new("a".repeat(64)).unwrap(),
+    };
+    let asset = Asset::new(source, AssetType::Image, "image/jpeg", 512, SystemId::new());
+    asset_repo.save(&asset).await.unwrap();
+
+    let file_data = Bytes::from(vec![0xFFu8; 512]);
+    file_storage
+        .store_file("photos/inbox/cat.jpg", file_data.clone())
+        .await
+        .unwrap();
+
+    let handler = ReadAssetFileHandler::new(asset_repo, file_storage);
+    let result = handler
+        .execute(ReadAssetFileQuery {
+            asset_id: asset.asset_id,
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(result.data, file_data);
+    assert_eq!(result.mime_type, "image/jpeg");
+    assert_eq!(result.filename, "cat.jpg");
+}
+
+#[tokio::test]
+async fn rejects_nonexistent_asset() {
+    let asset_repo = Arc::new(InMemoryAssetRepository::new());
+    let file_storage = Arc::new(InMemoryFileStorage::new());
+
+    let handler = ReadAssetFileHandler::new(asset_repo, file_storage);
+    let result = handler
+        .execute(ReadAssetFileQuery {
+            asset_id: SystemId::new(),
+        })
+        .await;
+
+    assert!(matches!(result, Err(DomainError::NotFound(_))));
+}