feat: resolve authenticated canonical asset inputs

app/services/input_resolver.py

@@ -19,6 +19,8 @@ from app.services.cleanup import CleanupService, RequestWorkspace
 from app.services.downloader import Downloader
 from app.services.validator import MediaValidator
 from app.services.ytdlp_service import YTDLPService
+from app.security.assets import CanonicalAssetNotFoundError, CanonicalAssetService
+from app.security.context import auth_context
 
 
 class InputResolver:
@@ -44,12 +46,14 @@ class InputResolver:
         downloader: Downloader,
         ytdlp: YTDLPService,
         validator: MediaValidator,
+        assets: CanonicalAssetService | None = None,
     ) -> None:
         self.settings = settings
         self.cleanup = cleanup
         self.downloader = downloader
         self.ytdlp = ytdlp
         self.validator = validator
+        self.assets = assets
 
     async def resolve(self, request: Request, *, require_input: bool = True) -> ResolvedRequest:
         request_id = request.state.request_id
@@ -257,6 +261,8 @@ class InputResolver:
         *,
         ytdlp_options: dict[str, Any] | None = None,
     ) -> InputMedia:
+        if "asset_id" in descriptor:
+            return await self._resolve_asset(descriptor, workspace)
         if "temp_path" in descriptor or "path" in descriptor:
             return await self._resolve_local_path(descriptor, workspace)
         if "url" in descriptor:
@@ -323,6 +329,36 @@ class InputResolver:
             raise InputError("Input descriptor must contain a url or Base64 data")
         return await self._decode_base64(data, descriptor, workspace)
 
+    async def _resolve_asset(
+        self, descriptor: dict[str, Any], workspace: RequestWorkspace
+    ) -> InputMedia:
+        asset_id = descriptor.get("asset_id")
+        if not isinstance(asset_id, str) or not asset_id.strip():
+            raise InputError("asset_id must be a non-empty string")
+        context = auth_context.get()
+        if self.assets is None or context is None or not context.workspace_id or not context.user_id:
+            raise InputError("asset_id requires an authenticated workspace")
+        try:
+            record = await self.assets.get_owned_by_id(
+                workspace_id=context.workspace_id,
+                user_id=context.user_id,
+                asset_id=asset_id,
+            )
+            source = self.cleanup.resolve_download(record.request_id, record.filename)
+            await self.assets.verify_file(record, source)
+        except (CanonicalAssetNotFoundError, FileNotFoundError, ValueError) as exc:
+            raise InputError("Media asset was not found or is no longer available") from exc
+        destination = workspace.uploads / f"{uuid4().hex}_{record.filename}"
+        await asyncio.to_thread(source.replace, destination)
+        return InputMedia(
+            source=MediaSource.ASSET,
+            filename=record.filename,
+            mime_type=record.mime_type,
+            temp_path=destination,
+            size=record.file_size,
+            metadata={"asset_id": record.id, "sha256": record.sha256},
+        )
+
     async def _resolve_local_path(
         self, descriptor: dict[str, Any], workspace: RequestWorkspace
     ) -> InputMedia:
@@ -447,22 +483,4 @@ class InputResolver:
         if isinstance(options, dict):
             params.update(options)
         for key, value in payload.items():
-            if key not in self.INPUT_KEYS and not key.startswith("binary.") and key != "options":
-                params[key] = self._parse_field(value)
-        return params
-
-    @staticmethod
-    def _parse_field(value: Any) -> Any:
-        if isinstance(value, list):
-            return [InputResolver._parse_field(item) for item in value]
-        if not isinstance(value, str):
-            return value
-        stripped = value.strip()
-        if stripped.startswith(("{", "[")) or stripped in {"true", "false", "null"}:
-            try:
-                return json.loads(stripped)
-            except json.JSONDecodeError:
-                return value
-        return value
-
-    @staticm
+            if key not in self.INPUT_KEYS and not key.startswith("binary.") and key != "options":