pub async fn get_for_exercise_and_user(
conn: &mut PgConnection,
exercise_id: Uuid,
user_id: Uuid,
file_upload_ids: &[Uuid],
) -> ModelResult<Vec<AnswerUpload>>Expand description
The requested uploads that belong to this exercise and user, soft-deleted ones included.
Rows bound to another exercise or another user are deliberately not returned: to the caller they must be indistinguishable from ids that were never uploaded, so a foreign id leaks nothing beyond “not yours”.