feat: manage files via manifestattachment with auth and cascade trigger, format API.md method signatures

src/store/manifestattachment/listByManifestId.js

@@ -0,0 +1,43 @@
+import { LIST_BY_MANIFEST } from '../../sql/manifestattachment.js';
+import resolveSelectedCompanyAccess from '../companyuser/resolveSelectedCompanyAccess.js';
+import resolveManifestAccess from './resolveManifestAccess.js';
+import request from '../request.js';
+
+function shape(row) {
+  return {
+    id: row.id,
+    manifestId: row.manifestId,
+    fileId: row.fileId,
+    mimetype: row.mimetype,
+    name: row.name,
+    size: row.size,
+  };
+}
+
+export default function listByManifestId(pool) {
+  const access = resolveSelectedCompanyAccess(pool);
+  const manifestAccess = resolveManifestAccess(pool);
+
+  /**
+   * Lists all attachments for a given manifest, without loading their full binary content.
+   *
+   * @param {number} googleAuthId - The id of the Google auth user.
+   * @param {number} manifestId - The manifest ID.
+   * @returns {Promise<Array<object>>} A list of attachment metadata objects.
+   * @throws {Error} If the manifest is not found or the user is not authorized.
+   *
+   * @example
+   * const attachments = await store.manifestattachment.listByManifestId(42, 1);
+   * // => [{ id, manifestId, fileId, mimetype, name, size }]
+   */
+  return async (googleAuthId, manifestId) => {
+    const { companyId } = await access(googleAuthId);
+    await manifestAccess(companyId, manifestId);
+
+    const res = await request(pool)
+      .input('manifestId', manifestId)
+      .query(LIST_BY_MANIFEST);
+
+    return res.recordset.map(shape);
+  };
+}