Unauthenticated download hotfix

You should not be able to download files when they are not downloadable (except when authenticated).

This adds a test for that and fixes the current implementation

src/klausurarchiv/database.py

@@ -337,9 +337,12 @@ def upload_document():
 def download_document():
     document_id = request.args.get("id", default=None)
     document = Document.query.get_or_404(document_id)
-    # since document is stored in database, we cannot supply an actual file handle, just the corresponding bytes
-    return send_file(io.BytesIO(document.file), mimetype=document.content_type, as_attachment=True,
-                     download_name=document.filename)
+    if document.downloadable or current_user.is_authenticated:
+        # since document is stored in database, we cannot supply an actual file handle, just the corresponding bytes
+        return send_file(io.BytesIO(document.file), mimetype=document.content_type, as_attachment=True,
+                         download_name=document.filename)
+    else:
+        return {"message": "Not found"}, 404
 
 
 """