Hoàn thành chức năng collaborative

backend/app/routers/pdfs.py

@@ -30,6 +30,29 @@ def _own_or_404(db: Session, pdf_id: int, user_id: int) -> PDF:
     return pdf
 
 
+def _any_or_404(db: Session, pdf_id: int) -> PDF:
+    """Return PDF if it exists — any authenticated user may read it."""
+    pdf = db.get(PDF, pdf_id)
+    if not pdf:
+        raise HTTPException(status_code=404, detail="PDF not found.")
+    return pdf
+
+
+def _pdf_out(pdf: PDF, db: Session):
+    """Build PDFOut including owner_username."""
+    from ..schemas import PDFOut as _PDFOut
+    owner = db.get(User, pdf.user_id)
+    data = {
+        "id": pdf.id,
+        "user_id": pdf.user_id,
+        "owner_username": owner.username if owner else "unknown",
+        "title": pdf.title,
+        "total_pages": pdf.total_pages,
+        "created_at": pdf.created_at,
+    }
+    return _PDFOut.model_validate(data)
+
+
 # ── GET /api/pdfs ─────────────────────────────────────────────────────────────
 
 @router.get("", response_model=list[PDFOut])
@@ -37,12 +60,8 @@ def list_pdfs(
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db),
 ):
-    return (
-        db.query(PDF)
-        .filter(PDF.user_id == current_user.id)
-        .order_by(PDF.created_at.desc())
-        .all()
-    )
+    pdfs = db.query(PDF).order_by(PDF.created_at.desc()).all()
+    return [_pdf_out(p, db) for p in pdfs]
 
 
 # ── POST /api/pdfs/upload ─────────────────────────────────────────────────────
@@ -90,7 +109,7 @@ async def upload_pdfs(
         db.commit()
         db.refresh(pdf)
 
-        results.append(PDFUploadResult(filename=file.filename or "", success=True, pdf=PDFOut.model_validate(pdf)))
+        results.append(PDFUploadResult(filename=file.filename or "", success=True, pdf=_pdf_out(pdf, db)))
 
     return results
 
@@ -121,8 +140,8 @@ def serve_pdf(
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db),
 ):
-    """Serve the raw PDF bytes — only to the owning user."""
-    pdf = _own_or_404(db, pdf_id, current_user.id)
+    """Serve the raw PDF bytes — any authenticated user may read."""
+    pdf = _any_or_404(db, pdf_id)
     file_path = Path(pdf.file_path)
 
     if not file_path.exists():