Refactor backend and frontend cleanup paths

backend/api/documents/content.py

@@ -15,14 +15,12 @@ Security:
 from __future__ import annotations
 
 import urllib.parse
-import uuid
-
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 from fastapi.responses import StreamingResponse
-from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from db.models import Document, Share, User
+from db.models import User
+from api.documents.shared import get_accessible_document
 from deps.auth import get_regular_user
 from deps.db import get_db
 from services.rate_limiting import account_limiter
@@ -31,15 +29,12 @@ from storage.exceptions import CloudConnectionError
 router = APIRouter()
 
 
-# ── Range header parsing helper ───────────────────────────────────────────────
-
 def _parse_range(range_header: str, file_size: int) -> tuple:
     """Parse a 'bytes=X-Y' Range header and return (start, end).
 
     Returns (start, end) where both are inclusive byte offsets.
     Raises HTTP 416 on any invalid or out-of-bounds range.
 
-    T-04-05-03: validates start <= end, start >= 0, end < file_size.
     """
     try:
         h = range_header.replace("bytes=", "").split("-")
@@ -52,8 +47,6 @@ def _parse_range(range_header: str, file_size: int) -> tuple:
     return start, end
 
 
-# ── GET /api/documents/{doc_id}/content ──────────────────────────────────────
-
 @router.get("/{doc_id}/content")
 @account_limiter.limit("100/minute")
 async def stream_document_content(
@@ -63,26 +56,7 @@ async def stream_document_content(
     current_user: User = Depends(get_regular_user),
 ):
     request.state.current_user = current_user
-    try:
-        uid = uuid.UUID(doc_id)
-    except ValueError:
-        raise HTTPException(status_code=404, detail="Document not found")
-
-    doc = await session.get(Document, uid)
-    if doc is None:
-        raise HTTPException(status_code=404, detail="Document not found")
-
-    # Access control: owner OR share recipient (T-04-05-04)
-    if doc.user_id != current_user.id:
-        result = await session.execute(
-            select(Share).where(
-                Share.document_id == doc.id,
-                Share.recipient_id == current_user.id,
-            )
-        )
-        share = result.scalar_one_or_none()
-        if share is None:
-            raise HTTPException(status_code=404, detail="Document not found")
+    doc, _is_recipient = await get_accessible_document(session, doc_id, current_user.id)
 
     try:
         import api.documents as _doc_pkg  # late import allows test monkeypatching via api.documents