feat: manage files via manifestattachment with auth and cascade trigger, format API.md method signatures

src/store/manifestattachment/getById.js

@@ -0,0 +1,50 @@
+import { GET_BY_ID } from '../../sql/manifestattachment.js';
+import resolveSelectedCompanyAccess from '../companyuser/resolveSelectedCompanyAccess.js';
+import resolveManifestAccess from './resolveManifestAccess.js';
+import request from '../request.js';
+
+export default function getById(pool) {
+  const access = resolveSelectedCompanyAccess(pool);
+  const manifestAccess = resolveManifestAccess(pool);
+
+  /**
+   * Gets an attachment for a manifest by its attachment ID or file ID, including full file content.
+   *
+   * @param {number} googleAuthId - The id of the Google auth user.
+   * @param {number} manifestId - The manifest ID.
+   * @param {number} id - The attachment ID or file ID.
+   * @returns {Promise<object>} The attachment record with binary content.
+   * @throws {Error} If the manifest or attachment is not found, or user is not authorized.
+   *
+   * @example
+   * const attachment = await store.manifestattachment.getById(42, 1, 5);
+   * // => { id, manifestId, fileId, mimetype, name, content }
+   */
+  return async (googleAuthId, manifestId, id) => {
+    if (!Number.isFinite(id)) {
+      throw new Error('Attachment not found');
+    }
+
+    const { companyId } = await access(googleAuthId);
+    await manifestAccess(companyId, manifestId);
+
+    const res = await request(pool)
+      .input('manifestId', manifestId)
+      .input('id', id)
+      .query(GET_BY_ID);
+
+    const row = res.recordset[0];
+    if (!row) {
+      throw new Error('Attachment not found');
+    }
+
+    return {
+      id: row.id,
+      manifestId: row.manifestId,
+      fileId: row.fileId,
+      mimetype: row.mimetype,
+      name: row.name,
+      content: row.content,
+    };
+  };
+}