fix(server): preserve company-scoped read privacy

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/issue-attachment-routes.test.ts

@@ -445,7 +445,8 @@ describe("issue attachment routes", () => {
     const res = await request(app)
       .get("/api/issues/11111111-1111-4111-8111-111111111111/attachments/archive");
 
-    expect(res.status).toBe(403);
+    expect(res.status).toBe(404);
+    expect(res.body).toEqual({ error: "Issue not found" });
     expect(mockIssueService.listAttachments).not.toHaveBeenCalled();
     expect(storage.getObject).not.toHaveBeenCalled();
   });

server/src/routes/issues.ts

@@ -12629,12 +12629,8 @@ export function issueRoutes(
 
   router.get("/issues/:id/attachments/archive", async (req, res, next) => {
     const issueId = req.params.id as string;
-    const issue = await svc.getById(issueId);
-    if (!issue) {
-      res.status(404).json({ error: "Issue not found" });
-      return;
-    }
-    assertCompanyAccess(req, issue.companyId);
+    const issue = await getAccessibleResource(req, res, svc.getById(issueId), "Issue not found");
+    if (!issue) return;
     if (!(await assertIssueReadAllowed(req, res, issue))) return;
 
     const [attachments, issueDocuments] = await Promise.all([