Refactor/e2ee

api/Dockerfile

@@ -24,9 +24,6 @@ RUN apt-get update \
         ca-certificates \
         wget \
         gosu \
-        pandoc \
-        wkhtmltopdf \
-        fonts-noto-cjk \
     && rm -rf /var/lib/apt/lists/*
 
 ENV RUST_LOG=api=info,axum=info,tower_http=info \

api/crates/application/Cargo.toml

@@ -31,6 +31,7 @@ tracing = "0.1"
 urlencoding = "2"
 uuid = { version = "1", features = ["v4", "serde"] }
 yrs = { version = "0.24", features = ["sync"] }
+chacha20poly1305 = "0.10"
 zip = { version = "0.6" }
 
 [dev-dependencies]

api/crates/application/src/core/ports/storage/storage_port.rs

@@ -29,6 +29,41 @@ pub trait StorageResolverPort: Send + Sync {
         original_filename: Option<&str>,
         bytes: &[u8],
     ) -> PortResult<StoredAttachment>;
+
+    // --- Public file storage (for E2EE decrypted files) ---
+
+    /// Store a public (decrypted) file for a published document
+    /// Returns the storage path: public/{workspace_id}/{document_id}/{file_id}
+    async fn store_public_file(
+        &self,
+        workspace_id: Uuid,
+        document_id: Uuid,
+        file_id: Uuid,
+        bytes: &[u8],
+    ) -> PortResult<String>;
+
+    /// Read a public file
+    async fn read_public_file(
+        &self,
+        workspace_id: Uuid,
+        document_id: Uuid,
+        file_id: Uuid,
+    ) -> PortResult<Vec<u8>>;
+
+    /// Delete a public file
+    async fn delete_public_file(
+        &self,
+        workspace_id: Uuid,
+        document_id: Uuid,
+        file_id: Uuid,
+    ) -> PortResult<()>;
+
+    /// Delete all public files for a document
+    async fn delete_public_files_for_document(
+        &self,
+        workspace_id: Uuid,
+        document_id: Uuid,
+    ) -> PortResult<()>;
 }
 
 #[async_trait]

api/crates/application/src/core/services/mod.rs

@@ -8,6 +8,5 @@ pub mod markdown;
 pub mod markdown_render;
 pub mod metrics;
 pub mod storage;
-pub mod tagging;
 pub mod utils;
 pub mod worker;

api/crates/application/src/core/services/storage/ingest/attachments.rs

@@ -27,17 +27,29 @@ impl StorageIngestService {
             }
             Err(err) => return Err(err.into()),
         };
+
+        // E2EE: Validate RME1 format
+        if bytes.len() < 4 || &bytes[0..4] != RME1_MAGIC {
+            warn!(
+                file_id = %file_id,
+                doc_id = %doc_id,
+                repo_path = repo_path,
+                "storage_ingest_attachment_invalid_rme1_format"
+            );
+            return Ok(());
+        }
+
         let size = bytes.len() as i64;
-        let hash = sha256_hex(&bytes);
+        let encrypted_hash = sha256_hex(&bytes);
         self.files_repo
-            .update_hash_and_size(file_id, size, &hash)
+            .update_size_and_hash(file_id, size, &encrypted_hash)
             .await?;
         let mut payload_obj = serde_json::Map::new();
         payload_obj.insert("repo_path".into(), json!(repo_path));
         payload_obj.insert("storage_path".into(), json!(rel_path));
         payload_obj.insert("backend".into(), json!(event.backend.as_str()));
         payload_obj.insert("size".into(), json!(size));
-        payload_obj.insert("content_hash".into(), json!(hash));
+        payload_obj.insert("encrypted_hash".into(), json!(encrypted_hash));
         if let Some(prev) = previous_repo_path {
             payload_obj.insert("previous_path".into(), json!(prev));
         }