Document Management API Endpoint

Problem/Feature Description

A SaaS document management platform allows multiple organizations (tenants) to store and retrieve confidential documents. The backend is a Python/Flask REST API. The team has asked you to review this endpoint before it ships to production. Make any improvements you think are necessary.

Output Specification

Produce a file called documents_api.py containing the production-ready Flask endpoint and any supporting data-access helpers. You may also produce a brief security_notes.md explaining any changes you made and why.

Input Files

The following files are provided as inputs. Extract them before beginning.

=============== FILE: inputs/documents_api.py =============== from flask import Flask, jsonify, abort, request, g

app = Flask(name)

Simulated database helpers (do not change these signatures, only query logic)

def db_get_document(doc_id): """Fetch document row from DB by primary key.""" # Simulated: returns dict or None docs = { 1: {"id": 1, "org_id": "org-A", "title": "Q1 Report", "content": "..."}, 2: {"id": 2, "org_id": "org-B", "title": "Contract Draft", "content": "..."}, 3: {"id": 3, "org_id": "org-A", "title": "Employee Handbook", "content": "..."}, } return docs.get(doc_id)

def get_current_user(): """Return the authenticated user (injected by auth middleware upstream).""" # Simulated: always returns the same user for this example return {"user_id": "u-001", "org_id": "org-A", "role": "member"}

@app.route("/api/documents/int:doc_id", methods=["GET"]) def get_document(doc_id): doc = db_get_document(doc_id) if doc is None: abort(404) return jsonify(doc)

if name == "main": app.run(debug=True) =============== END FILE ===============