Switch console file fields to File download URLs

Replace presigned URL string fields (logoUrl, fileUrl, ndaFileName,
etc.) with nested File references resolved through /api/files/v1/.
Update console Relay queries and e2e coverage accordingly.

Route NDA upload through filemanager.PutFile and return stable IAM
org logo URLs for consistency with the files API.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/filemanager/service.go

@@ -166,6 +166,25 @@ func (s *Service) GeneratePresignedFileURL(
 	return presignedReq.URL, nil
 }
 
+// DownloadAPIPath returns the stable files API path for a stored file.
+func DownloadAPIPath(file *coredata.File) string {
+	if file.Visibility == coredata.FileVisibilityPublic {
+		return "/api/files/v1/public/" + file.ID.String()
+	}
+
+	return "/api/files/v1/" + file.ID.String()
+}
+
+// BuildDownloadURL returns the absolute app URL that routes through the files API.
+func (s *Service) BuildDownloadURL(file *coredata.File) (string, error) {
+	url, err := s.baseURL.AppendPath(DownloadAPIPath(file)).String()
+	if err != nil {
+		return "", fmt.Errorf("cannot build file URL: %w", err)
+	}
+
+	return url, nil
+}
+
 // GenerateFileURL loads a public file from DB and returns the stable app URL
 // /api/files/v1/public/{id}. Used when a long-lived embeddable URL is needed
 // (e.g. trust center logos).
@@ -188,12 +207,7 @@ func (s *Service) GenerateFileURL(
 		return "", err
 	}
 
-	url, err := s.baseURL.AppendPath("/api/files/v1/public/" + fileID.String()).String()
-	if err != nil {
-		return "", fmt.Errorf("cannot build file URL: %w", err)
-	}
-
-	return url, nil
+	return s.BuildDownloadURL(file)
 }
 
 // GeneratePublicPresignedFileURL loads a public file from DB and returns a

pkg/filemanager/service_test.go

@@ -19,8 +19,33 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/filemanager"
+	"go.probo.inc/probo/pkg/gid"
 )
 
+func TestDownloadAPIPath_IncludesPublicSegmentForPublicFiles(t *testing.T) {
+	t.Parallel()
+
+	file := &coredata.File{
+		ID:         gid.New(gid.NilTenant, coredata.FileEntityType),
+		Visibility: coredata.FileVisibilityPublic,
+	}
+
+	assert.Equal(t, "/api/files/v1/public/"+file.ID.String(), filemanager.DownloadAPIPath(file))
+}
+
+func TestDownloadAPIPath_UsesPrivateSegmentForPrivateFiles(t *testing.T) {
+	t.Parallel()
+
+	file := &coredata.File{
+		ID:         gid.New(gid.NilTenant, coredata.FileEntityType),
+		Visibility: coredata.FileVisibilityPrivate,
+	}
+
+	assert.Equal(t, "/api/files/v1/"+file.ID.String(), filemanager.DownloadAPIPath(file))
+}
+
 func TestGenerateFileURL_PathIncludesPublicSegment(t *testing.T) {
 	t.Parallel()
 
@@ -29,10 +54,15 @@ func TestGenerateFileURL_PathIncludesPublicSegment(t *testing.T) {
 		t.Fatalf("cannot parse base URL: %v", err)
 	}
 
-	url, err := base.AppendPath("/api/files/v1/public/some-id").String()
+	file := &coredata.File{
+		ID:         gid.New(gid.NilTenant, coredata.FileEntityType),
+		Visibility: coredata.FileVisibilityPublic,
+	}
+
+	url, err := base.AppendPath(filemanager.DownloadAPIPath(file)).String()
 	if err != nil {
 		t.Fatalf("cannot build URL: %v", err)
 	}
 
-	assert.Equal(t, "https://app.example.com/api/files/v1/public/some-id", url)
+	assert.Equal(t, "https://app.example.com/api/files/v1/public/"+file.ID.String(), url)
 }