Reuse recent pre-download security scans

[catherineluse]

Summary

• reuse persisted CLEAN pre-download scan verdicts for a bounded freshness window
• deduplicate simultaneous scan requests for the same file within a backend instance
• keep URL signing, authorization, and download analytics independent per requester
• document DOWNLOAD_SCAN_CACHE_TTL_MS (15-minute default; 0 disables reuse)

Only clean verdicts are reusable. Failed, suspicious, infected, invalid, expired, and future-dated results continue through the scanner.

Verification

• pnpm run codegen
• pnpm exec tsc --noEmit --pretty false
• pnpm exec eslint customResolvers/mutations/prepareDownload.ts customResolvers/mutations/prepareDownload.test.ts
• node --loader ts-node/esm --test customResolvers/mutations/prepareDownload.test.ts customResolvers/fields/downloadableFileUrl.test.ts customResolvers/mutations/trackDownload.test.ts (25 passing)

[codecov]

Codecov Report

❌ Patch coverage is 97.36842% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
customResolvers/mutations/prepareDownload.ts	97.36%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!