fix: Validate blob before attaching it to a record (#13115)

Previously, attachments relied only on blob_id, which made it possible
to attach blobs across accounts by enumerating IDs. We now require both
blob_id and blob_key, add cross-account validation to prevent blob
reuse, and centralize the logic in a shared BlobOwnershipValidation
concern.

It also fixes a frontend bug where mixed-type action params (number +
string) were incorrectly dropped, causing attachment uploads to fail.

app/controllers/api/v1/accounts/macros_controller.rb

@@ -1,4 +1,6 @@
 class Api::V1::Accounts::MacrosController < Api::V1::Accounts::BaseController
+  include AttachmentConcern
+
   before_action :fetch_macro, only: [:show, :update, :destroy, :execute]
   before_action :check_authorization, only: [:show, :update, :destroy, :execute]
 
@@ -11,26 +13,32 @@ class Api::V1::Accounts::MacrosController < Api::V1::Accounts::BaseController
   end
 
   def create
+    blobs, actions, error = validate_and_prepare_attachments(params[:actions])
+    return render_could_not_create_error(error) if error
+
     @macro = Current.account.macros.new(macros_with_user.merge(created_by_id: current_user.id))
     @macro.set_visibility(current_user, permitted_params)
-    @macro.actions = params[:actions]
+    @macro.actions = actions
 
-    render json: { error: @macro.errors.messages }, status: :unprocessable_entity and return unless @macro.valid?
+    return render_could_not_create_error(@macro.errors.messages) unless @macro.valid?
 
     @macro.save!
-    process_attachments
-    @macro
+    blobs.each { |blob| @macro.files.attach(blob) }
   end
 
   def update
+    blobs, actions, error = validate_and_prepare_attachments(params[:actions], @macro)
+    return render_could_not_create_error(error) if error
+
     ActiveRecord::Base.transaction do
-      @macro.update!(macros_with_user)
+      @macro.assign_attributes(macros_with_user)
       @macro.set_visibility(current_user, permitted_params)
-      process_attachments
+      @macro.actions = actions if params[:actions]
       @macro.save!
+      blobs.each { |blob| @macro.files.attach(blob) }
     rescue StandardError => e
       Rails.logger.error e
-      render json: { error: @macro.errors.messages }.to_json, status: :unprocessable_entity
+      render_could_not_create_error(@macro.errors.messages)
     end
   end
 
@@ -47,17 +55,6 @@ class Api::V1::Accounts::MacrosController < Api::V1::Accounts::BaseController
 
   private
 
-  def process_attachments
-    actions = @macro.actions.filter_map { |k, _v| k if k['action_name'] == 'send_attachment' }
-    return if actions.blank?
-
-    actions.each do |action|
-      blob_id = action['action_params']
-      blob = ActiveStorage::Blob.find_by(id: blob_id)
-      @macro.files.attach(blob)
-    end
-  end
-
   def permitted_params
     params.permit(
       :name, :visibility,