There are a number of cases in Launchpad where we want to upload a file to the librarian and then be able to read it back again within the one request. There are two methods of uploading a file to the librarian, and both are problematic at present.
The first method is with addFile(), where the metadata about the file is created on the client side and then the data is sent to the librarian along with the database IDs of the metadata for storage. This is useful because the metadata is usable within the request's transaction. However, the content can not be read back from the librarian until the request's transaction is committed.
The second method is with remoteAddFile(), where the metadata is written to the database on the librarian side. The content can be read from the librarian immediately, but the metadata in the database is unavailable within the request's transaction, due to transactional isolation.
The proposed solution to this problem is to add another method usable from the backend librarian port (which is not exposed to the internet) to download the content for a given content ID, without the librarian checking for its presence in the database. This would make it possible to fetch the content for a file uploaded with addFile() from the request/transaction where it was uploaded. The librarian would not have access to the mime type or file alias when servicing one of these requests.
As this feature would only be available from the backend port, it should not have any security concerns. The client library would need to be responsible for any additional checks that the librarian does, such as checking the deleted flag.
This solution sounds good to me. +1