feat(attachments): provenance payload attachments + download route

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_api_attachments.py

@@ -0,0 +1,47 @@
+import pytest
+
+from backend.app import create_app
+from backend.app.models import Artist, PostAttachment
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture
+async def app():
+    return create_app()
+
+
+@pytest.fixture
+async def client(app):
+    async with app.test_client() as c:
+        yield c
+
+
+@pytest.mark.asyncio
+async def test_download_streams_with_disposition(client, db, tmp_path):
+    blob = tmp_path / "pack.zip"
+    blob.write_bytes(b"PK\x03\x04binarypayload")
+    a = Artist(name="Q", slug="q")
+    db.add(a)
+    await db.flush()
+    att = PostAttachment(
+        post_id=None, artist_id=a.id, sha256="q" + "0" * 63,
+        path=str(blob), original_filename="pack.zip", ext=".zip",
+        mime="application/zip", size_bytes=blob.stat().st_size,
+    )
+    db.add(att)
+    await db.flush()
+    await db.commit()
+
+    resp = await client.get(f"/api/attachments/{att.id}/download")
+    assert resp.status_code == 200
+    disp = resp.headers.get("Content-Disposition", "")
+    assert "attachment" in disp
+    assert "pack.zip" in disp
+    assert (await resp.get_data()) == b"PK\x03\x04binarypayload"
+
+
+@pytest.mark.asyncio
+async def test_download_404(client):
+    resp = await client.get("/api/attachments/999999/download")
+    assert resp.status_code == 404

tests/test_provenance_service.py

@@ -7,6 +7,7 @@ from backend.app.models import (
     ImageProvenance,
     ImageRecord,
     Post,
+    PostAttachment,
     Source,
 )
 from backend.app.services.provenance_service import ProvenanceService
@@ -153,3 +154,25 @@ async def test_for_post_returns_post_source_artist(db):
                                  "url": source.url}
     assert payload["artist"] == {"id": artist.id, "name": "Carol",
                                  "slug": "carol"}
+
+
+@pytest.mark.asyncio
+async def test_for_post_includes_attachments(db):
+    artist, source, post = await _seed_post(
+        db, artist_name="Att", slug="att", platform="patreon",
+        ext_id="55",
+    )
+    db.add(PostAttachment(
+        post_id=post.id, artist_id=artist.id, sha256="t" + "0" * 63,
+        path="/images/attachments/t00/t.zip", original_filename="t.zip",
+        ext=".zip", mime="application/zip", size_bytes=9,
+    ))
+    await db.flush()
+    svc = ProvenanceService(db)
+    payload = await svc.for_post(post.id)
+    assert len(payload["attachments"]) == 1
+    att = payload["attachments"][0]
+    assert att["original_filename"] == "t.zip"
+    assert att["download_url"].endswith(
+        f"/api/attachments/{att['id']}/download"
+    )