feat(authz): check permission on read handlers + check create permission on folder

src/application/ports/file_ports.rs

@@ -11,6 +11,7 @@ use crate::application::services::file_management_service::FileManagementService
 use crate::application::services::file_retrieval_service::FileRetrievalService;
 use crate::application::services::file_upload_service::FileUploadService;
 use crate::common::errors::DomainError;
+use crate::domain::services::authorization::Permission;
 
 // ─────────────────────────────────────────────────────
 // Upload port
@@ -119,7 +120,7 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     ///
     /// Returns `NotFound` if the file does not exist **or** belongs to
     /// another user.  All user-facing handlers should use this method.
-    async fn get_file_owned(&self, id: &str, caller_id: Uuid) -> Result<FileDto, DomainError>;
+    async fn get_file_with_perms(&self, id: &str, caller_id: Uuid) -> Result<FileDto, DomainError>;
 
     /// Gets a file by its path (for WebDAV)
     async fn get_file_by_path(&self, path: &str) -> Result<FileDto, DomainError>;
@@ -131,7 +132,7 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     ///
     /// Uses SQL-level `AND user_id` filtering — no in-memory post-filter.
     /// All user-facing list handlers should use this method.
-    async fn list_files_owned(
+    async fn list_files_with_perms(
         &self,
         folder_id: Option<&str>,
         owner_id: Uuid,
@@ -144,7 +145,7 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     ) -> Result<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>, DomainError>;
 
     /// Gets file content as a stream, enforcing that `caller_id` is the owner.
-    async fn get_file_stream_owned(
+    async fn get_file_stream_with_perms(
         &self,
         id: &str,
         caller_id: Uuid,
@@ -166,7 +167,7 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     ///
     /// Verifies `caller_id` owns the file before returning content.
     /// All user-facing download handlers should use this.
-    async fn get_file_optimized_owned(
+    async fn get_file_optimized_with_perms(
         &self,
         id: &str,
         caller_id: Uuid,
@@ -198,7 +199,7 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     ) -> Result<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>, DomainError>;
 
     /// Ownership-scoped range stream — verifies caller owns the file first.
-    async fn get_file_range_stream_owned(
+    async fn get_file_range_stream_with_perms(
         &self,
         id: &str,
         caller_id: Uuid,
@@ -238,7 +239,7 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     ///
     /// Used by streaming WebDAV PROPFIND so that each user only sees their
     /// own files, even in shared folder_id namespaces.
-    async fn list_files_batch_for_owner(
+    async fn list_files_batch_with_perms(
         &self,
         folder_id: Option<&str>,
         owner_id: Uuid,
@@ -256,6 +257,13 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
 
 /// Primary port for file management operations
 pub trait FileManagementUseCase: Send + Sync + 'static {
+    async fn has_permission(
+        &self,
+        caller_id: Uuid,
+        permission: Permission,
+        file_id: &str,
+    ) -> Result<(), DomainError>;
+
     /// Moves a file, enforcing that `caller_id` is the owner.
     async fn move_file_with_perms(
         &self,