Serve every media file privately at /media/<id>

There is no public media any more. `/media/public/<id>` served a media
row with no session at all, so anyone with the id could read a file.
The public/private split is gone: the path is `/media/<id>` (and
`/media/<id>/thumbnail`), every request is signed in first, and
`grabUserMedia` decides whether the user may see it: their own upload,
a bot's or workspace's picture or file they reach, or a file on a task
they reach. Anything else is a 404 before a path is built.

The `media.is_private` column and the two per-user directories went
with it: uploads live in `media/<user_id>/` and there is nothing to
pick between. The files browser's media volume is now the viewer's
own folder whatever their role.

Bots also say which of the two things they mean. A `[file:ID]` ref is a
saved file and its chip opens the bytes; a folder is a new
`[folder:volume:owner:path]` ref (`src/utils/folder-ref.ts`) whose chip
opens the files browser there and downloads nothing. The old `[path:...]`
ref and the extension sniffing that guessed file from folder are gone,
so `import_file` names the folder holding a file it copied rather than
the file itself.

The prompts say what the Assistant got wrong: list before importing or
saving, one copy per artifact, never split a file into parts unless
asked, never claim the store is empty without a fresh list, and never
invent a size cap. A re-import now says the path already existed
instead of silently overwriting and reporting a fresh copy.

src/functions/server/media/handle-media-server.ts

@@ -1,12 +1,8 @@
-import BunSQLite from "@moduletrace/bun-sqlite";
-import type { BUN_SQLITE_COBBLE_MEDIA, BunSQLiteTables } from "@/db/types/db";
 import grabDirNames from "@/src/utils/grab-dir-names";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import userAuth from "../../backend/auth/user-auth";
-import grabSharedPictureMedia from "@/src/functions/backend/db/access/grab-shared-picture-media";
-import grabBotFileMedia from "@/src/functions/backend/db/bot-files/grab-bot-file-media";
-import grabTaskMediaFile from "@/src/functions/backend/db/tasks/grab-task-media-file";
+import grabUserMedia from "../../backend/db/media/grab-user-media";
 
 const { DATA_DIR } = grabDirNames();
 
@@ -14,70 +10,37 @@ type Params = {
     req: Request;
 };
 
+/**
+ * Serves a media file's bytes: `/media/<id>`, and `/media/<id>/thumbnail`
+ * for an image's smaller copy.
+ *
+ * There is no public media. Every URL is private, so the request has to be
+ * signed in and the user has to reach the file (`grabUserMedia` decides
+ * that: their own upload, a bot's or workspace's file or picture they can
+ * chat with, a file on one of their tasks). Anything else is answered with
+ * a 404, never with the file.
+ */
 export default async function handleMediaServer({
     req,
 }: Params): Promise<Response> {
     const url = new URL(req.url);
 
-    const [root, privacy, media_id, thumbnail] = url.pathname
+    const [_root, media_id, thumbnail] = url.pathname
         .split("/")
         .filter((p) => p.match(/./));
 
-    if (!privacy) {
-        throw new Error(`No media privacy params passed`);
+    if (!media_id) {
+        throw new Error(`No media id passed`);
     }
 
-    let media: BUN_SQLITE_COBBLE_MEDIA | undefined = undefined;
+    const { user } = await userAuth({ req });
 
-    if (privacy == "private") {
-        const { user, user_types } = await userAuth({ req });
-
-        if (!user?.logged_in_status) {
-            throw new Error(`Not logged in`);
-        }
-
-        const media_res = await BunSQLite.select<
-            BUN_SQLITE_COBBLE_MEDIA,
-            (typeof BunSQLiteTables)[number]
-        >({
-            table: "media",
-            query: {
-                query: {
-                    user_id: {
-                        value: user.id,
-                    },
-                },
-            },
-            targetId: media_id,
-        });
-
-        media =
-            media_res.singleRes ||
-            (media_id ? await grabSharedPictureMedia({ media_id, user_id: user.id! }) : null) ||
-            (media_id ? await grabBotFileMedia({ media_id, user_id: user.id! }) : null) ||
-            (media_id ? await grabTaskMediaFile({ media_id, user_id: user.id! }) : null) ||
-            undefined;
-    } else {
-        const media_res = await BunSQLite.select<
-            BUN_SQLITE_COBBLE_MEDIA,
-            (typeof BunSQLiteTables)[number]
-        >({
-            table: "media",
-            targetId: media_id,
-        });
-
-        media = media_res.singleRes || undefined;
-
-        /**
-         * A private file is only served through `/media/private`, to its
-         * owner (or, for a bot's or workspace's picture, to whoever sees
-         * it).
-         */
-        if (media?.is_private) {
-            media = undefined;
-        }
+    if (!user?.logged_in_status) {
+        throw new Error(`Not logged in`);
     }
 
+    const media = await grabUserMedia({ media_id, user_id: user.id! });
+
     if (!media?.id) {
         throw new Error(`Media record not found!`);
     }
@@ -98,12 +61,14 @@ export default async function handleMediaServer({
 
     const file = Bun.file(full_media_location);
     const etag = `"${file.size}-${file.lastModified}"`;
-    const cache_control =
-        privacy == "private" ? "private, no-cache" : "public, no-cache";
 
     const headers = new Headers({
         ETag: etag,
-        "Cache-Control": cache_control,
+        /**
+         * Private: the response depends on who is signed in, so no shared
+         * cache may hold it.
+         */
+        "Cache-Control": "private, no-cache",
     });
 
     if (req.headers.get("if-none-match") === etag) {