Add access control for media downloads

Introduced IAccesserToDownloadMedia and its implementation to enforce access checks when downloading media files. Updated MediaController to use the new accesser service and improved error handling and validation in upload/download actions. Refactored and moved MediaService to the Medias namespace, registered new services in DI, and added comprehensive tests for access logic. Also fixed GroupMembershipConfiguration to make InvitationId optional and performed minor test and namespace cleanups.

Govor.Application/Services/Medias/AccesserToDownloadMediaService.cs

@@ -0,0 +1,33 @@
+using Govor.Application.Interfaces.Medias;
+using Govor.Core.Models.Messages;
+using Govor.Data;
+using Microsoft.EntityFrameworkCore;
+
+namespace Govor.Application.Services.Medias;
+
+public class AccesserToDownloadMediaService : IAccesserToDownloadMedia
+{
+    private readonly GovorDbContext _dbContext;
+
+    public AccesserToDownloadMediaService(GovorDbContext dbContext)
+    {
+        _dbContext = dbContext;
+    }
+
+    public async Task<bool> HasAccessAsync(Guid mediaFileId, Guid userId)
+    {
+        return await _dbContext.MediaAttachments
+            .Include(ma => ma.Message)
+            .AnyAsync(ma =>
+                ma.MediaFileId == mediaFileId &&
+                (
+                    (ma.Message.RecipientType == RecipientType.User &&
+                     (ma.Message.SenderId == userId || ma.Message.RecipientId == userId))
+                    ||
+                    (ma.Message.RecipientType == RecipientType.Group &&
+                     _dbContext.GroupMemberships.Any(gm =>
+                         gm.GroupId == ma.Message.RecipientId &&
+                         gm.UserId == userId))
+                ));
+    }
+}