fix(files,security): S-1 per-source Move authorization, S-2 session-only annotation, S-5 restore guards

S-1 (/files/move, /files/organize action=move):
- organize-guard: authorizeMoveEntities checks every source's media entities
  (declared entity plus entities of registered assets under the source);
  one-time approval still covers the whole request; any source that cannot
  be attributed to an entity only passes with an approval; denial lists every
  unauthorized item; optional non-consuming pre-check
- transfer: entities per source (directory = registered assets beneath it)
- organize: all move groups pre-checked before any group executes; any
  denial -> whole request 403 approval_required
S-2:
- api.ts: GET /files/download and POST /files/trash/purge marked
  auth:"session"; files routes attach requireAdminSession from the registry
  annotation; handler-side purge check removed, download keeps a same-rule
  defense check; permanent delete uses isAdminSession
- DEV key rule written down: equals an admin-scope key for session-only
  endpoints, still admin for Move/delete approval bypass (as authorizeMove)
- api-registry.test: session list updated; new reverse assertion that no
  non-session endpoint answers 403 to an admin-scope bearer
S-5 (trash restore):
- restore-to requires a writable managed library root (isWritableTarget)
- in-place restore rebuilds missing parents level by level without
  following symlinks (mkdirWithin), realpath-checked per level
- cross-volume restore capped by FILES_TRASH_CROSS_MAX_BYTES; cross-volume
  copies (trash in / restore out) go through fsproxy
Tests: multi-entity move 403 + listing, unattributed source, organize foreign
asset 403, download/purge 403 for DEV and admin-scope keys, restore target
not writable, symlinked parent, rebuild parents, cross-volume cap.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/file-manager/transfer.ts

@@ -4,7 +4,7 @@ import type { FilePlanPair, FilesMoveRequest, FilesTransferResult, OrganizationS
 import type { Principal } from "../../http/auth.ts";
 import { ensureTaskRow, markTask } from "../acquisition-organize/services/common.ts";
 import { planImport } from "../acquisition-organize/services/organize.ts";
-import { authorizeMove, PathGuardError, sourceGuard } from "../acquisition-organize/services/organize-guard.ts";
+import { authorizeMoveEntities, PathGuardError, sourceGuard } from "../acquisition-organize/services/organize-guard.ts";
 import type { TransferSpec } from "../acquisition-organize/services/organize-transfer.ts";
 import {
   actorOfP,
@@ -19,7 +19,7 @@ import {
 } from "./common.ts";
 import { audit, filesChanged, loadPlan, retirePlan, savePlan } from "./ledger.ts";
 import { downloadsFor, isWritableTarget, managedDownloads } from "./list.ts";
-import { relocatePreview } from "./records.ts";
+import { entitiesUnder, relocatePreview } from "./records.ts";
 
 // 移动/复制到目录(W5-A2):与整理共用 planImport(原样搬运变体 transfer)、冻结计划存储与 plan_stale 校验。
 // dryRun:冻结源事实(文件 size/mtime/inode;目录递归文件清单指纹)+ planImport 逐文件前后路径 → planId;
@@ -234,16 +234,20 @@ export async function transfer(
         `源属于纳管下载任务(${[...new Set(hnrBlocks.map((h) => h.taskId))].join(", ")}),裸移动会让下载器丢失文件;请用整理入库(Move 会按 H&R 判定并移交)`,
       );
     if (!isAdmin(principal)) {
-      const entity = await d.ctx.db
-        .selectFrom("asset_location as l")
-        .innerJoin("media_asset as a", "a.id", "l.media_asset_id")
-        .select(["a.media_entity_id"])
-        .where("l.library_root_id", "=", sources[0]!.def.libraryRootId ?? "00000000-0000-0000-0000-000000000000")
-        .where("l.relative_path", "=", sources[0]!.rel)
-        .executeTakeFirst();
-      const auth = await authorizeMove(d.ao, principal, request, entity?.media_entity_id ?? null);
+      // 每个源按其(目录则为其下)已登记资产求作品集合,逐一核对授权;任一不覆盖 → 整体拒绝并列出未授权项
+      const perSource: { label: string; entityId: string | null }[] = [];
+      for (const [i, s] of sources.entries()) {
+        const ids = await entitiesUnder(d.ctx.db, s.def.libraryRootId, s.rel, snaps[i]!.isDir);
+        if (ids.length === 0) perSource.push({ label: s.rel, entityId: null });
+        else for (const id of ids) perSource.push({ label: s.rel, entityId: id });
+      }
+      const auth = await authorizeMoveEntities(d.ao, principal, request, perSource);
       if (!auth.allowed) {
-        await audit(d, principal, "move_denied", { reason: auth.reason, planId: plan.id });
+        await audit(d, principal, "move_denied", {
+          reason: auth.reason,
+          planId: plan.id,
+          unauthorized: auth.unauthorized,
+        });
         throw new FilesError("approval_required", auth.reason);
       }
     }