[frankrousseau]

Problem

• Only the working files have a file route: a client cannot store or fetch the content of an output file.
• Nothing records that the file store has the content of a file: a client cannot tell a local file from a synced one without a request for each file.
• An upload over 2 GB fails: size is an Integer on working_file and output_file.
• Any member of the team, client included, can download every working file of the project.

Solution

• Add GET and POST /data/output-files/<id>/file, under the output prefix of the file store.
• Add a nullable uploaded_at column to working_file and output_file, and turn their size into BigInteger (migration). The upload routes set both.
• Upload an output file as a manager of the project or an assignee of the entity, never as a client.
• Download an output file or a working file as a manager or supervisor of the project, or as an artist or vendor with a task on the entity or on a shot the asset is cast in. A client downloads neither.

[NicoPennec]

Two items to address before merging:

1. Permissions: OutputFileFileResource only checks check_project_access. For the POST, I'd reuse the rule of the CRUD update (OutputFileResource.check_update_permissions: project manager, or working on the entity). For the GET, add check_entity_access, like the CRUD read and the working file route.
2. size is an Integer on working_file and output_file: an upload over 2 GB stores the content, then the update fails with "integer out of range" (500, uploaded_at stays empty). Same fix as for the attachments (1caf005): turn both columns into BigInteger in this migration.

Minor follow-up: deleting output files (with their entity or project) leaves their content in the store. Marking ("files", "output", id) deleted in the stored file registry would clean it up.