feat(admin): serve response media from standalone API

apps/api/src/domains/admin/repository.ts

@@ -131,6 +131,7 @@ export interface AdminRepository {
   }>>;
   users(principal: AdminPrincipal, userId?: string): Promise<Record<string, unknown>[]>;
   authorizeMedia(principal: AdminPrincipal, mediaId: string): Promise<void>;
+  responseMedia(principal: AdminPrincipal, responseId: string): Promise<{ storageKey: string; mimeType: string }>;
   decryptMessage(principal: AdminPrincipal, messageId: string): Promise<{ content: string | null }>;
   decryptMedia(principal: AdminPrincipal, messageId: string): Promise<{ bytes: Buffer; mimeType: string }>;
   close(): Promise<void>;
@@ -287,6 +288,25 @@ export class PostgresAdminRepository implements AdminRepository {
     if (!result.rows[0]) throw new AdminError('media_not_found', 'Media not found', 404);
   }
 
+  async responseMedia(principal: AdminPrincipal, responseId: string): Promise<{ storageKey: string; mimeType: string }> {
+    requirePermission(principal, 'view_responses');
+    const result = await this.pool.query<{ storage_key: string; mime_type: string }>(
+      `select mo.storage_key,mo.mime_type
+         from responses r
+         join media_objects mo
+           on r.response_data->>'media_path'='media:'||mo.id::text
+          and mo.kind='response'
+          and mo.owner_id=r.user_id
+          and mo.couple_id=r.couple_id
+          and (mo.question_id is null or mo.question_id=r.question_id)
+        where r.id=$1 and mo.deleted_at is null and (mo.expires_at is null or mo.expires_at>now())`,
+      [responseId],
+    );
+    const row = result.rows[0];
+    if (!row) throw new AdminError('response_media_not_found', 'Response media not found', 404);
+    return { storageKey: row.storage_key, mimeType: row.mime_type };
+  }
+
   private async messageForDecryption(messageId: string) {
     const result = await this.pool.query<{
       content: string | null; encrypted_content: string | null; encryption_iv: string | null;

apps/api/src/domains/admin/routes.ts

@@ -97,6 +97,26 @@ export function registerAdminRoutes(app: App, repository: AdminRepository, auth?
     return result.ok ? c.json(result.value, 200, { 'cache-control': 'private, no-store' }) : c.json(failure(result.cause.code, result.cause.message), result.cause.status);
   });
 
+  app.get('/v1/admin/responses/:responseId/media', async (c) => {
+    const parsed = z.string().uuid().safeParse(c.req.param('responseId'));
+    if (!parsed.success) return c.json(failure('invalid_response_id', 'A valid response ID is required'), 400);
+    if (!mediaStorage) return c.json(failure('media_unavailable', 'Media storage is unavailable'), 503);
+    const result = await execute(async () => {
+      const media = await repository.responseMedia(await repository.principal(c.get('identity').id), parsed.data);
+      const bytes = await mediaStorage.read(media.storageKey).catch(() => {
+        throw new AdminError('response_media_not_found', 'Response media not found', 404);
+      });
+      return { ...media, bytes };
+    });
+    if (!result.ok) return c.json(failure(result.cause.code, result.cause.message), result.cause.status);
+    return c.body(new Uint8Array(result.value.bytes), 200, {
+      'content-type': result.value.mimeType,
+      'content-length': String(result.value.bytes.byteLength),
+      'cache-control': 'private, no-store',
+      'x-content-type-options': 'nosniff',
+    });
+  });
+
   app.post('/v1/admin/users/:userId/gift-premium', async (c) => {
     const parsed = z.object({ days: z.number().int().min(1).max(3650).nullable(), reason: z.string().trim().max(500).optional() }).strict()
       .safeParse(await c.req.json().catch(() => ({})));

apps/api/test/admin.integration.test.ts

@@ -15,6 +15,12 @@ describe.skipIf(!databaseUrl || !isLocal)('admin repository authorization + audi
   const superUser = '22222222-2222-4222-8222-222222222222';
   const ordinaryUser = '33333333-3333-4333-8333-333333333333';
   const moderatorUser = '44444444-4444-4444-8444-444444444444';
+  const responseCouple = '55555555-5555-4555-8555-555555555555';
+  const responseCategory = '66666666-6666-4666-8666-666666666666';
+  const responsePack = '77777777-7777-4777-8777-777777777777';
+  const responseQuestion = '88888888-8888-4888-8888-888888888888';
+  const responseId = '99999999-9999-4999-8999-999999999999';
+  const responseMediaId = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa';
   let pool: Pool; let repository: PostgresAdminRepository;
 
   beforeAll(async () => {
@@ -123,6 +129,38 @@ describe.skipIf(!databaseUrl || !isLocal)('admin repository authorization + audi
     await expect(repository.authorizeMedia(moderator, randomUUID())).rejects.toMatchObject({ code: 'media_not_found' });
   });
 
+  it('requires view_responses and resolves only media linked to the response owner and couple', async () => {
+    await pool.query('insert into couples(id,invite_code) values($1,$2)', [responseCouple, 'ADMINMED']);
+    await pool.query('update profiles set couple_id=$2 where id=$1', [ordinaryUser, responseCouple]);
+    await pool.query("insert into categories(id,name) values($1,'Response media')", [responseCategory]);
+    await pool.query("insert into question_packs(id,name,category_id) values($1,'Response media',$2)", [responsePack, responseCategory]);
+    await pool.query("insert into questions(id,pack_id,text,question_type) values($1,$2,'Share a photo','photo')", [responseQuestion, responsePack]);
+    await pool.query(
+      `insert into media_objects(id,owner_id,couple_id,kind,storage_key,mime_type,byte_size,question_id)
+       values($1,$2,$3,'response','response/test.jpg','image/jpeg',14,$4)`,
+      [responseMediaId, ordinaryUser, responseCouple, responseQuestion],
+    );
+    await pool.query(
+      `insert into responses(id,user_id,question_id,couple_id,answer,response_data)
+       values($1,$2,$3,$4,'yes',$5)`,
+      [responseId, ordinaryUser, responseQuestion, responseCouple, { type: 'photo', media_path: `media:${responseMediaId}` }],
+    );
+
+    const creator = await repository.principal(creatorUser);
+    const moderatorWithoutPermission = await repository.principal(moderatorUser);
+    await expect(repository.responseMedia(creator, responseId)).rejects.toMatchObject({ code: 'forbidden' });
+    await expect(repository.responseMedia(moderatorWithoutPermission, responseId)).rejects.toMatchObject({ code: 'forbidden' });
+
+    await pool.query("update admin_users set permissions=array_append(permissions,'view_responses') where user_id=$1", [moderatorUser]);
+    const responseViewer = await repository.principal(moderatorUser);
+    await expect(repository.responseMedia(responseViewer, responseId)).resolves.toEqual({
+      storageKey: 'response/test.jpg', mimeType: 'image/jpeg',
+    });
+
+    await pool.query('update media_objects set owner_id=$2 where id=$1', [responseMediaId, superUser]);
+    await expect(repository.responseMedia(responseViewer, responseId)).rejects.toMatchObject({ code: 'response_media_not_found' });
+  });
+
   it('creates all legacy admin and dare cutover tables with preserved foreign keys', async () => {
     const tables = await pool.query<{ table_name: string }>(
       `select table_name from information_schema.tables where table_schema=current_schema()

apps/api/test/admin.routes.test.ts

@@ -18,12 +18,15 @@ function setup(denied = false) {
     giftPremium: vi.fn(async () => ({ subscription_id: 'sub', expires_at: 'later' })),
     featureInterestCounts: vi.fn(async () => []), users: vi.fn(async () => []), close: vi.fn(async () => undefined),
     authorizeMedia: vi.fn(async () => undefined),
+    responseMedia: vi.fn(async () => ({ storageKey: 'response/test.jpg', mimeType: 'image/jpeg' })),
     decryptMessage: vi.fn(async () => ({ content: 'plain' })),
     decryptMedia: vi.fn(async () => ({ bytes: Buffer.from('media'), mimeType: 'image/png' })),
   };
   const app = new Hono<{ Variables: { identity: AuthIdentity } }>();
   app.use('/v1/*', async (c, next) => { c.set('identity', identity); await next(); });
-  registerAdminRoutes(app, repository, undefined, new FilesystemMediaStorage('/tmp/admin-route-media', 'test-signing-secret', 'http://localhost:8787'));
+  const mediaStorage = new FilesystemMediaStorage('/tmp/admin-route-media', 'test-signing-secret', 'http://localhost:8787');
+  vi.spyOn(mediaStorage, 'read').mockResolvedValue(Buffer.from('response-media'));
+  registerAdminRoutes(app, repository, undefined, mediaStorage);
   return { app, repository };
 }
 
@@ -79,4 +82,23 @@ describe('admin routes', () => {
     expect(response.status).toBe(201);
     expect(repository.giftPremium).toHaveBeenCalledWith(expect.objectContaining({ userId: identity.id }), identity.id, null, undefined);
   });
+
+  it('streams response media only after response-scoped repository authorization', async () => {
+    const { app, repository } = setup();
+    const responseId = '44444444-4444-4444-8444-444444444444';
+    const response = await app.request(`/v1/admin/responses/${responseId}/media`);
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-type')).toBe('image/jpeg');
+    expect(response.headers.get('cache-control')).toBe('private, no-store');
+    expect(response.headers.get('x-content-type-options')).toBe('nosniff');
+    expect(await response.text()).toBe('response-media');
+    expect(repository.responseMedia).toHaveBeenCalledWith(expect.objectContaining({ userId: identity.id }), responseId);
+  });
+
+  it('rejects malformed response media identifiers before repository access', async () => {
+    const { app, repository } = setup();
+    const response = await app.request('/v1/admin/responses/not-a-uuid/media');
+    expect(response.status).toBe(400);
+    expect(repository.responseMedia).not.toHaveBeenCalled();
+  });
 });