feat(m10): file sharing with upload, lightbox, permission, tests, e2e

- FileRepository (CRUD, soft-delete, pagination, project isolation) +
  FileStorageService (local FS save data/uploads/<projectId>/<uuid>.<ext>,
  MIME allowlist, filename sanitize, unique uuid name, member permission,
  file_shared notification to other members, file_uploaded activity log,
  SSE file.uploaded, uploader/admin delete + FS unlink)
- APIs: files list/upload(multipart), download (membership), delete
- Screens: files page + Uploader(multipart) + FileList(image Lightbox,
  PDF link, delete), ProjectNav ファイル link
- Unit tests (FileRepository, FileStorageService) + e2e file-sharing

tests/e2e/file-sharing.spec.ts

@@ -0,0 +1,68 @@
+import { test, expect } from '@playwright/test';
+
+function unique(prefix: string): string {
+  return `${prefix}-${Date.now()}-${Math.floor(Math.random() * 1_000_000)}`;
+}
+
+// 1x1 透明PNG
+const PNG_BUFFER = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=',
+  'base64'
+);
+
+async function setupOwner(page: import('@playwright/test').Page) {
+  const email = unique('owner') + '@example.com';
+  await page.goto('/login');
+  await page.getByRole('button', { name: '新規登録はこちら' }).click();
+  await page.getByLabel('表示名').fill('Owner');
+  await page.getByLabel('メールアドレス').fill(email);
+  await page.getByLabel('パスワード').fill('password123');
+  await page.getByRole('button', { name: '登録する' }).click();
+  await expect(page).toHaveURL(/\/dashboard/);
+  await page.getByLabel('プロジェクト名').fill(unique('Proj'));
+  await page.getByRole('button', { name: '新規プロジェクト' }).click();
+  await expect(page).toHaveURL(/\/projects\/\d+$/);
+  return Number(page.url().match(/\/projects\/(\d+)/)![1]);
+}
+
+test.describe('file sharing', () => {
+  test('upload, view in lightbox, and delete a file', async ({ page }) => {
+    const projectId = await setupOwner(page);
+
+    // アップロード(multipart)
+    const uploadRes = await page.request.post(
+      `/api/projects/${projectId}/files`,
+      {
+        multipart: {
+          file: {
+            name: 'tiny.png',
+            mimeType: 'image/png',
+            buffer: PNG_BUFFER,
+          },
+        },
+      }
+    );
+    expect(uploadRes.ok()).toBeTruthy();
+    const { file } = (await uploadRes.json()) as { file: { id: number } };
+
+    // ファイル一覧に表示
+    await page.goto(`/projects/${projectId}/files`);
+    await expect(page.getByTestId(`file-item-${file.id}`)).toBeVisible();
+
+    // 画像をクリック → Lightbox
+    await page
+      .getByTestId(`file-item-${file.id}`)
+      .getByRole('button')
+      .first()
+      .click();
+    await expect(page.getByTestId('lightbox')).toBeVisible();
+    // Lightboxを閉じる(リロードで確実に解除)
+    await page.reload();
+
+    // 削除(API)
+    const delRes = await page.request.delete(`/api/files/${file.id}`);
+    expect(delRes.ok()).toBeTruthy();
+    await page.reload();
+    await expect(page.getByTestId(`file-item-${file.id}`)).toHaveCount(0);
+  });
+});

tests/unit/repositories/FileRepository.test.ts

@@ -0,0 +1,88 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { createMigratedTestDb } from '@/tests/helpers/db';
+import type { SqliteDatabase } from '@/lib/db/sqlite';
+import { UserRepository } from '@/repositories/UserRepository';
+import { ProjectRepository } from '@/repositories/ProjectRepository';
+import { ProjectMemberRepository } from '@/repositories/ProjectMemberRepository';
+import { FileRepository } from '@/repositories/FileRepository';
+
+describe('FileRepository', () => {
+  let db: SqliteDatabase;
+  let repo: FileRepository;
+  let projectId: number;
+  let userId: number;
+
+  beforeEach(() => {
+    db = createMigratedTestDb();
+    repo = new FileRepository(db);
+    userId = new UserRepository(db).create({
+      name: 'U',
+      email: 'u@example.com',
+      passwordHash: 'h',
+    }).id;
+    projectId = new ProjectRepository(db).create({
+      name: 'P',
+      ownerId: userId,
+    }).id;
+    new ProjectMemberRepository(db).add(projectId, userId, 'admin');
+  });
+
+  afterEach(() => db.close());
+
+  function createFile(name: string) {
+    return repo.create({
+      projectId,
+      uploaderId: userId,
+      filename: `${name}.bin`,
+      originalName: name,
+      mimeType: 'application/octet-stream',
+      size: 10,
+      path: `/tmp/${name}.bin`,
+    });
+  }
+
+  it('creates and finds a file', () => {
+    const f = createFile('test');
+    expect(repo.findFileById(f.id)?.originalName).toBe('test');
+  });
+
+  it('lists files newest first with total', () => {
+    createFile('a');
+    createFile('b');
+    const { items, total } = repo.findFilesByProject(projectId);
+    expect(total).toBe(2);
+    expect(items[0].originalName).toBe('b');
+  });
+
+  it('excludes soft-deleted files', () => {
+    const f = createFile('a');
+    repo.delete(f.id);
+    expect(repo.findFileById(f.id)).toBeNull();
+    expect(repo.findFilesByProject(projectId).total).toBe(0);
+  });
+
+  it('isolates files by project', () => {
+    createFile('mine');
+    const p2 = new ProjectRepository(db).create({
+      name: 'P2',
+      ownerId: userId,
+    }).id;
+    repo.create({
+      projectId: p2,
+      uploaderId: userId,
+      filename: 'x.bin',
+      originalName: 'theirs',
+      mimeType: 'application/octet-stream',
+      size: 1,
+      path: '/tmp/x.bin',
+    });
+    expect(repo.findFilesByProject(projectId).total).toBe(1);
+    expect(repo.findFilesByProject(p2).total).toBe(1);
+  });
+
+  it('paginates files', () => {
+    for (let i = 0; i < 5; i++) createFile(`f${i}`);
+    expect(repo.findFilesByProject(projectId, 1, 2).items).toHaveLength(2);
+    expect(repo.findFilesByProject(projectId, 1, 2).total).toBe(5);
+  });
+});

tests/unit/services/FileStorageService.test.ts

@@ -0,0 +1,160 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createMigratedTestDb } from '@/tests/helpers/db';
+import type { SqliteDatabase } from '@/lib/db/sqlite';
+import { UserRepository } from '@/repositories/UserRepository';
+import { ProjectRepository } from '@/repositories/ProjectRepository';
+import { ProjectMemberRepository } from '@/repositories/ProjectMemberRepository';
+import { FileRepository } from '@/repositories/FileRepository';
+import { NotificationRepository } from '@/repositories/NotificationRepository';
+import { ActivityLogRepository } from '@/repositories/ActivityLogRepository';
+import { NotificationService } from '@/services/NotificationService';
+import { ActivityLogService } from '@/services/ActivityLogService';
+import { FileStorageService } from '@/services/FileStorageService';
+import { SseHub } from '@/lib/sse/hub';
+import { ForbiddenError, ValidationError } from '@/lib/errors';
+
+describe('FileStorageService', () => {
+  let db: SqliteDatabase;
+  let service: FileStorageService;
+  let uploadsDir: string;
+  let projectId: number;
+  let authorId: number;
+  let memberId: number;
+  let outsiderId: number;
+
+  beforeEach(() => {
+    db = createMigratedTestDb();
+    uploadsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'uploads-'));
+    const users = new UserRepository(db);
+    authorId = users.create({
+      name: 'A',
+      email: 'a@example.com',
+      passwordHash: 'h',
+    }).id;
+    memberId = users.create({
+      name: 'M',
+      email: 'm@example.com',
+      passwordHash: 'h',
+    }).id;
+    outsiderId = users.create({
+      name: 'O',
+      email: 'o@example.com',
+      passwordHash: 'h',
+    }).id;
+    projectId = new ProjectRepository(db).create({
+      name: 'P',
+      ownerId: authorId,
+    }).id;
+    const members = new ProjectMemberRepository(db);
+    members.add(projectId, authorId, 'admin');
+    members.add(projectId, memberId, 'member');
+    service = new FileStorageService(
+      new FileRepository(db),
+      members,
+      new NotificationService(new NotificationRepository(db)),
+      new ActivityLogService(new ActivityLogRepository(db)),
+      new SseHub(),
+      uploadsDir
+    );
+  });
+
+  afterEach(() => {
+    db.close();
+    fs.rmSync(uploadsDir, { recursive: true, force: true });
+  });
+
+  it('uploads a file: writes to FS, stores metadata, notifies members, logs activity', () => {
+    const file = service.upload(authorId, projectId, {
+      originalName: 'photo.png',
+      mimeType: 'image/png',
+      data: Buffer.from('fake-png-bytes'),
+    });
+
+    expect(file.id).toBeGreaterThan(0);
+    expect(file.originalName).toBe('photo.png');
+    expect(fs.existsSync(file.path)).toBe(true);
+    // メンバー(memberId)へ file_shared 通知
+    expect(new NotificationRepository(db).countUnreadByUser(memberId)).toBe(1);
+    expect(
+      new ActivityLogRepository(db)
+        .findByProject(projectId)
+        .items.some((l) => l.action === 'file_uploaded')
+    ).toBe(true);
+  });
+
+  it('rejects a disallowed MIME type', () => {
+    expect(() =>
+      service.upload(authorId, projectId, {
+        originalName: 'evil.exe',
+        mimeType: 'application/x-msdownload',
+        data: Buffer.from('x'),
+      })
+    ).toThrow(ValidationError);
+  });
+
+  it('rejects an empty file', () => {
+    expect(() =>
+      service.upload(authorId, projectId, {
+        originalName: 'empty.txt',
+        mimeType: 'text/plain',
+        data: Buffer.alloc(0),
+      })
+    ).toThrow(ValidationError);
+  });
+
+  it('forbids a non-member from uploading', () => {
+    expect(() =>
+      service.upload(outsiderId, projectId, {
+        originalName: 'x.png',
+        mimeType: 'image/png',
+        data: Buffer.from('x'),
+      })
+    ).toThrow(ForbiddenError);
+  });
+
+  it('sanitizes the saved filename to a unique uuid-based name', () => {
+    const file = service.upload(authorId, projectId, {
+      originalName: 'photo.png',
+      mimeType: 'image/png',
+      data: Buffer.from('x'),
+    });
+    expect(file.filename).toMatch(/^[0-9a-f-]{36}\.png$/);
+  });
+
+  it('getFileInfo requires membership', () => {
+    const file = service.upload(authorId, projectId, {
+      originalName: 'a.txt',
+      mimeType: 'text/plain',
+      data: Buffer.from('hi'),
+    });
+    expect(service.getFileInfo(authorId, file.id).id).toBe(file.id);
+    expect(() => service.getFileInfo(outsiderId, file.id)).toThrow(
+      ForbiddenError
+    );
+  });
+
+  it('delete: uploader can delete; non-uploader non-admin cannot', () => {
+    const file = service.upload(memberId, projectId, {
+      originalName: 'm.txt',
+      mimeType: 'text/plain',
+      data: Buffer.from('hi'),
+    });
+    expect(() => service.delete(outsiderId, file.id)).toThrow(ForbiddenError);
+    // 作者(member)は削除可
+    service.delete(memberId, file.id);
+    expect(fs.existsSync(file.path)).toBe(false);
+  });
+
+  it('admin can delete another member file', () => {
+    const file = service.upload(memberId, projectId, {
+      originalName: 'm.txt',
+      mimeType: 'text/plain',
+      data: Buffer.from('hi'),
+    });
+    service.delete(authorId, file.id); // authorId is admin
+    expect(() => service.getFileInfo(memberId, file.id)).toThrow();
+  });
+});