fix(files): scope conversation file access

[sriaradhyula]

Description

Make conversation-scoped file routes use the stored conversation as the source of truth.

• Load and authorize the requested conversation before proxying file operations.
• Require read access for listing and downloading.
• Require write access for deletion.
• Derive the agent ID from the conversation participant record.
• Remove the requirement to trust a client-provided agent ID.

Type of Change

• Bugfix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (please describe)

Pre-release Helm Charts (Optional)

No chart changes.

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (where applicable)
• I have verified this change is not present in other open pull requests

Validation

• 10 route authorization tests passed
• Read and write denials verify the backend proxy is never called
• ESLint passed
• Next.js production compilation passed; the repository current route-export type errors remain in the type phase

[github-actions]

✅ No proprietary content detected. This PR is clear for review!

[github-actions]

🧪 CAIPE UI Test Results

✅ All tests passed

🟡 Overall Coverage: 61%

📊 Detailed Coverage

Metric	Covered	Total	Percentage
Lines	35530	53663	66.20%
Statements	37943	59228	64.06%
Functions	6524	10947	59.59%
Branches	23507	43726	53.75%

✅ Test Suites

• ✅ auth-guard.test.tsx - Route protection & authorization
• ✅ token-expiry-guard.test.tsx - Token expiry handling
• ✅ dynamic-agent-client.test.ts - Dynamic Agents streaming client
• ✅ auth-utils.test.ts - Authentication utilities (100% coverage)
• ✅ auth-config.test.ts - OIDC configuration

📈 Coverage Thresholds

Threshold	Target	Current	Status
Minimum	40%	61%	✅ Pass
Good	60%	61%	✅ Pass
Excellent	80%	61%	⚠️ Below target

⚠️ Areas Needing Tests

High Priority:

• lib/streaming/* - Core stream event handling
• store/chat-store.ts - Chat state management
• store/agent-skills-store.ts - Agent skills
• lib/api-client.ts - API communication
• lib/storage-mode.ts - MongoDB/localStorage switching

Medium Priority:

• components/chat/ChatPanel.tsx - Main chat interface
• components/agent-builder/* - Agent builder UI
• lib/mongodb.ts - MongoDB integration

---

💡 Run locally: make caipe-ui-tests
📦 Full report: Check workflow artifacts

[github-actions]

ℹ️ Branch is behind main (advisory, non-blocking)

Commit: 7ffa69e4

This branch does not yet contain the latest main. This does not fail the version-bump check — version files are bumped once the branch is updated, and GitHub branch protection still requires the branch to be up to date before merge. Use the Update branch button on this PR, or run:

git fetch origin main
git checkout prebuild/fix/conversation-file-authorization
git merge FETCH_HEAD
git push

This is a prebuild/* branch, so Helm prebuild publishing will still run so you can test the chart changes while the branch is being updated.