feat: add content asset security scanning

apps/api/src/features/video/routes.ts

@@ -17,6 +17,7 @@ import {
   assertCdnAccessAllowed,
   signedAssetFingerprint,
 } from '../storage/asset-access.js';
+import { assertAssetSecurityScanPassed } from '../tenant-content/assets.js';
 
 interface QuestionVideoRow {
   questionId: string;
@@ -60,6 +61,7 @@ interface VideoPlaybackRow {
   assetType: string | null;
   assetVisibility: string | null;
   assetUploadStatus: string | null;
+  assetSecurityScanStatus: string | null;
   assetAccessRules: Record<string, unknown> | null;
   assetMetadata: Record<string, unknown> | null;
 }
@@ -163,6 +165,11 @@ async function signVideoPlayback(tenantId: string, video: VideoPlaybackRow) {
     if (video.objectKey && video.assetUploadStatus !== 'verified') {
       throw new HttpError(409, 'Video asset upload has not been verified', 'VIDEO_ASSET_UPLOAD_NOT_VERIFIED');
     }
+    assertAssetSecurityScanPassed({
+      provider: video.storageProvider as StorageProviderName,
+      objectKey: video.objectKey,
+      securityScanStatus: video.assetSecurityScanStatus,
+    });
     assertCdnAccessAllowed({
       assetId: video.assetId,
       visibility: video.assetVisibility || 'svip',
@@ -307,6 +314,7 @@ export async function videoPlaybackRoute(ctx: RequestContext) {
            a.title as "assetTitle", a.status as "assetStatus",
            a.asset_type as "assetType", a.visibility as "assetVisibility",
            a.upload_status as "assetUploadStatus",
+           a.security_scan_status as "assetSecurityScanStatus",
            a.access_rules as "assetAccessRules", a.metadata as "assetMetadata"
     from public.video_explanations v
     left join public.content_assets a on a.tenant_id = v.tenant_id and a.id = v.asset_id