feat(08-05): decompose documents API monolith into documents/ package — CODE-02 CODE-08

- upload.py: request_upload_url, upload_document, confirm_upload (3 routes)
- crud.py: list_documents, get_document, patch_document, delete_document, classify_document (5 routes)
- content.py: stream_document_content + _parse_range (1 route)
- shared.py: _CLOUD_PROVIDERS, UploadUrlRequest, DocumentPatch (single definitions)
- __init__.py: router aggregator prefix=/api/documents, 9 routes total
- documents.py monolith deleted; all URL paths unchanged
- list_documents registered on parent router to avoid FastAPI empty-path/prefix check
- get_storage_backend_for_document re-exported for test monkeypatching compatibility

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/documents/content.py

@@ -0,0 +1,145 @@
+"""Document content streaming endpoint.
+
+Endpoints:
+  GET /{doc_id}/content — stream document bytes from any backend (MinIO or cloud)
+
+Sub-router carries NO prefix — prefix="/api/documents" lives in __init__.py (D-04).
+
+Security:
+  T-04-05-01: uses get_regular_user — admin role → 403 (critical security invariant).
+  T-04-05-02: bytes fetched via get_object() ONLY — presigned_get_url() never called.
+  T-04-05-03: Range header validated via _parse_range(); invalid range → 416.
+  T-04-05-04: access gated on ownership OR active Share.recipient_id.
+  DOC-04 / SEC-04: ownership assertion before serving bytes.
+"""
+from __future__ import annotations
+
+import urllib.parse
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from fastapi.responses import StreamingResponse
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from db.models import Document, Share, User
+from deps.auth import get_regular_user
+from deps.db import get_db
+from services.rate_limiting import account_limiter
+from storage.exceptions import CloudConnectionError
+
+router = APIRouter()
+
+
+# ── Range header parsing helper ───────────────────────────────────────────────
+
+def _parse_range(range_header: str, file_size: int) -> tuple:
+    """Parse a 'bytes=X-Y' Range header and return (start, end).
+
+    Returns (start, end) where both are inclusive byte offsets.
+    Raises HTTP 416 on any invalid or out-of-bounds range.
+
+    T-04-05-03: validates start <= end, start >= 0, end < file_size.
+    """
+    try:
+        h = range_header.replace("bytes=", "").split("-")
+        start = int(h[0]) if h[0] != "" else 0
+        end = int(h[1]) if h[1] != "" else file_size - 1
+    except (ValueError, IndexError):
+        raise HTTPException(status.HTTP_416_RANGE_NOT_SATISFIABLE)
+    if start > end or start < 0 or end >= file_size:
+        raise HTTPException(status.HTTP_416_RANGE_NOT_SATISFIABLE)
+    return start, end
+
+
+# ── GET /api/documents/{doc_id}/content ──────────────────────────────────────
+
+@router.get("/{doc_id}/content")
+@account_limiter.limit("100/minute")
+async def stream_document_content(
+    doc_id: str,
+    request: Request,
+    session: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_regular_user),
+):
+    """Stream document bytes directly from MinIO (DOC-02).
+
+    T-04-05-01: uses get_regular_user — admin role → 403 (critical security invariant).
+    T-04-05-02: bytes fetched via get_object() ONLY — presigned_get_url() never called.
+    T-04-05-03: Range header validated via _parse_range(); invalid range → 416.
+    T-04-05-04: access gated on ownership OR active Share.recipient_id.
+
+    Returns 200 (or 206 for Range requests) with:
+      Content-Type: doc.content_type
+      Content-Disposition: inline; filename="<filename>"
+      Accept-Ranges: bytes
+      Content-Length: <size>
+    """
+    request.state.current_user = current_user
+    try:
+        uid = uuid.UUID(doc_id)
+    except ValueError:
+        raise HTTPException(status_code=404, detail="Document not found")
+
+    doc = await session.get(Document, uid)
+    if doc is None:
+        raise HTTPException(status_code=404, detail="Document not found")
+
+    # Access control: owner OR share recipient (T-04-05-04)
+    if doc.user_id != current_user.id:
+        result = await session.execute(
+            select(Share).where(
+                Share.document_id == doc.id,
+                Share.recipient_id == current_user.id,
+            )
+        )
+        share = result.scalar_one_or_none()
+        if share is None:
+            raise HTTPException(status_code=404, detail="Document not found")
+
+    # Fetch bytes from the correct backend — get_storage_backend_for_document handles
+    # all backends (MinIO, Google Drive, OneDrive, Nextcloud, WebDAV) transparently
+    # (D-15, T-04-05-02). NEVER via presigned URL for cloud backends (D-14).
+    try:
+        import api.documents as _doc_pkg  # late import allows test monkeypatching via api.documents
+        storage_backend = await _doc_pkg.get_storage_backend_for_document(doc, current_user, session)
+        file_bytes = await storage_backend.get_object(doc.object_key)
+    except CloudConnectionError as exc:
+        raise HTTPException(
+            status_code=503,
+            detail="Cloud connection requires re-authentication. Please reconnect in Settings.",
+        ) from exc
+    except HTTPException:
+        raise
+    except Exception as exc:
+        raise HTTPException(
+            status_code=502,
+            detail="Cloud backend unreachable. Please try again or reconnect in Settings.",
+        ) from exc
+    file_size = len(file_bytes)
+
+    safe_name = urllib.parse.quote(doc.filename, safe='')
+    headers = {
+        "content-type": doc.content_type,
+        "content-disposition": f"inline; filename*=UTF-8''{safe_name}",
+        "accept-ranges": "bytes",
+        "content-length": str(file_size),
+    }
+
+    range_header = request.headers.get("range")
+    if range_header:
+        start, end = _parse_range(range_header, file_size)
+        chunk = file_bytes[start : end + 1]
+        headers["content-range"] = f"bytes {start}-{end}/{file_size}"
+        headers["content-length"] = str(len(chunk))
+        return StreamingResponse(
+            iter([chunk]),
+            status_code=206,
+            headers=headers,
+        )
+
+    return StreamingResponse(
+        iter([file_bytes]),
+        status_code=200,
+        headers=headers,
+    )