feat: verify content asset uploads

supabase/migrations/202606290008_content_asset_upload_verification.sql

@@ -0,0 +1,73 @@
+alter table public.content_assets
+  add column if not exists upload_status text not null default 'not_required',
+  add column if not exists verified_at timestamptz,
+  add column if not exists verified_by uuid references public.platform_users(id) on delete set null,
+  add column if not exists verified_size_bytes bigint,
+  add column if not exists verified_checksum_sha256 text,
+  add column if not exists verification_details jsonb not null default '{}'::jsonb,
+  add column if not exists preview_object_key text,
+  add column if not exists preview_status text not null default 'none',
+  add column if not exists security_flags jsonb not null default '{}'::jsonb;
+
+update public.content_assets
+set upload_status = case
+      when storage_provider in ('local_dev', 'supabase_storage', 'aliyun_oss', 'tencent_cos') and object_key is not null
+        then 'verified'
+      else 'not_required'
+    end,
+    verified_at = case
+      when storage_provider in ('local_dev', 'supabase_storage', 'aliyun_oss', 'tencent_cos') and object_key is not null
+        then coalesce(verified_at, updated_at, created_at, now())
+      else verified_at
+    end,
+    verified_size_bytes = case
+      when storage_provider in ('local_dev', 'supabase_storage', 'aliyun_oss', 'tencent_cos') and object_key is not null
+        then coalesce(verified_size_bytes, file_size_bytes)
+      else verified_size_bytes
+    end,
+    verified_checksum_sha256 = case
+      when storage_provider in ('local_dev', 'supabase_storage', 'aliyun_oss', 'tencent_cos') and object_key is not null
+        then coalesce(verified_checksum_sha256, checksum_sha256)
+      else verified_checksum_sha256
+    end,
+    preview_status = case
+      when preview_url is not null and preview_url <> '' then 'ready'
+      else preview_status
+    end
+where upload_status = 'not_required'
+   or verified_at is null
+   or preview_status = 'none';
+
+do $$
+begin
+  if not exists (select 1 from pg_constraint where conname = 'content_assets_upload_status_check') then
+    alter table public.content_assets
+      add constraint content_assets_upload_status_check
+      check (upload_status in ('not_required', 'pending', 'verified', 'failed'));
+  end if;
+
+  if not exists (select 1 from pg_constraint where conname = 'content_assets_preview_status_check') then
+    alter table public.content_assets
+      add constraint content_assets_preview_status_check
+      check (preview_status in ('none', 'pending', 'ready', 'failed'));
+  end if;
+
+  if not exists (select 1 from pg_constraint where conname = 'content_assets_verified_size_check') then
+    alter table public.content_assets
+      add constraint content_assets_verified_size_check
+      check (verified_size_bytes is null or verified_size_bytes >= 0);
+  end if;
+
+  if not exists (select 1 from pg_constraint where conname = 'content_assets_verified_checksum_check') then
+    alter table public.content_assets
+      add constraint content_assets_verified_checksum_check
+      check (verified_checksum_sha256 is null or verified_checksum_sha256 ~ '^[a-f0-9]{64}$');
+  end if;
+end $$;
+
+create index if not exists idx_content_assets_upload_status
+  on public.content_assets(tenant_id, upload_status, status, updated_at desc);
+
+create index if not exists idx_content_assets_preview
+  on public.content_assets(tenant_id, preview_status)
+  where preview_status <> 'none';