Gate downloads with a last-minute security scan

[catherineluse]

Summary

• add a prepareDownload mutation that runs the existing downloadableFile.downloaded plugin pipeline before releasing a file
• fail closed when the security scanner is missing, fails, or blocks an ordinary download
• preserve creator and authorized moderator access for human review
• return a five-minute signed GCS read URL only after approval and record download analytics afterward
• stop exposing stored clean-file URLs through ordinary authenticated detail queries

This reuses the existing security-attachment-scan VirusTotal integration; no scan-plugin or scan-service changes are required.

Validation

• pnpm run codegen
• pnpm exec tsc --noEmit --pretty false
• node --loader ts-node/esm --test customResolvers/mutations/prepareDownload.test.ts customResolvers/fields/downloadableFileUrl.test.ts customResolvers/mutations/trackDownload.test.ts (21 passing)

Frontend

Coordinated frontend PR: gennit-project/multiforum-nuxt#402.

[codecov]

Codecov Report

❌ Patch coverage is 88.05310% with 27 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
customResolvers/mutations/prepareDownload.ts	87.50%	25 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!