Media: uploads stripped of metadata, attachments both ways, a remote media proxy

- /api/v1/media and /api/v2/media (and GET/PUT /api/v1/media/:id):
  images go through libvips (NetVips, its native build bundled):
  autorotated, every kind of metadata dropped (EXIF, GPS, XMP, IPTC,
  comments), capped at 4096 px, with a 640 px preview and a blurhash
  (own encoder, the reference algorithm); animated GIFs are re-encoded;
  video and audio are remuxed by ffmpeg with -map_metadata -1, never
  re-encoded, and a video gets a still preview. Files get random names
  under /var/lib/privapub/media, outside the web root deploys replace, and
  are served at /media/files with nosniff and a sandbox CSP.
- media_ids on create and edit (four at most, the persona's own, each used
  once); notes carry them as Document attachments with alt text, blurhash,
  focalPoint and size; inbound attachments were already kept.
- avatar and header uploads in update_credentials, cropped to 400x400 and
  1500x500, federated with Update{Person}.
- Remote media reaches clients only through /media/proxy/{hmac}/{url},
  fetched by the guarded client (no SVG, 40 MB cap) and cached outside the
  served root, trimmed to 5 GB; foreign avatars and headers use it too, so
  a client never contacts another server.
- MediaJanitor deletes uploads left unattached for a day.
- nginx accepts 100 MB bodies on the upload endpoints only (applied on Max).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -5,6 +5,7 @@ using MongoDB.Entities;
 using PrivaPub.Api.Mastodon.Entities;
 using PrivaPub.Api.Mastodon.Infrastructure;
 using PrivaPub.Api.Mastodon.Mappers;
+using PrivaPub.Domain.Media;
 using PrivaPub.Domain.Privacy;
 using PrivaPub.Domain.Relationships;
 using PrivaPub.Domain.Social;
@@ -45,10 +46,19 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpGet("/api/v1/accounts/verify_credentials"), Scope("read:accounts")]
 		public async Task<IActionResult> VerifyCredentials(CancellationToken token) => Json(await _mapper.Local(Me, withSource: true, token));
 
-		[HttpPatch("/api/v1/accounts/update_credentials"), Scope("write:accounts")]
-		public async Task<IActionResult> UpdateCredentials(CancellationToken token)
+		[HttpPatch("/api/v1/accounts/update_credentials"), Scope("write:accounts"), RequestSizeLimit(20 * 1024 * 1024),
+			RequestFormLimits(MultipartBodyLengthLimit = 20 * 1024 * 1024)]
+		public async Task<IActionResult> UpdateCredentials([FromServices] IMediaService media, CancellationToken token)
 		{
 			var avatar = await _dbEntities.Avatars.MatchID(Me.Id).ExecuteFirstAsync(token);
+			if (Request.HasFormContentType)
+			{
+				var form = await Request.ReadFormAsync(token);
+				if (form.Files["avatar"] is { } picture && await media.ProfileImage(picture, 400, 400, token) is { } pictureUrl)
+					avatar.PictureURL = pictureUrl;
+				if (form.Files["header"] is { } header && await media.ProfileImage(header, 1500, 500, token) is { } headerUrl)
+					avatar.ThumbnailURL = headerUrl;
+			}
 			if (Params.Has("display_name"))
 				avatar.Name = Params.Get("display_name")?.Trim();
 			if (Params.Has("note"))

PrivaPub/Api/Mastodon/Controllers/MediaController.cs

@@ -0,0 +1,91 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+using MongoDB.Entities;
+
+using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Domain.Media;
+using PrivaPub.Models.Media;
+
+using System.Globalization;
+
+namespace PrivaPub.Api.Mastodon.Controllers
+{
+	public class MediaController : MastodonController
+	{
+		const long UploadLimit = 100L * 1024 * 1024;
+
+		readonly IMediaService _media;
+		readonly IMediaProxy _proxy;
+
+		public MediaController(IMediaService media, IMediaProxy proxy)
+		{
+			_media = media;
+			_proxy = proxy;
+		}
+
+		[HttpPost("/api/v1/media"), HttpPost("/api/v2/media"), Scope("write:media"), RequestSizeLimit(UploadLimit),
+			RequestFormLimits(MultipartBodyLengthLimit = UploadLimit)]
+		public async Task<IActionResult> Upload(CancellationToken token)
+		{
+			if (!Request.HasFormContentType)
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: File can't be blank");
+			var form = await Request.ReadFormAsync(token);
+			var outcome = await _media.Upload(Me, form.Files["file"], form["description"], form["focus"], token);
+			return outcome.Ok ? Json(View(outcome.Attachment)) : Error(outcome.Status, outcome.Error);
+		}
+
+		[HttpGet("/api/v1/media/{id}"), Scope("write:media")]
+		public async Task<IActionResult> Get(string id, CancellationToken token)
+		{
+			var attachment = await DB.Default.Find<MediaAttachment>().Match(m => m.ID == id && m.OwnerAvatarId == MyId).ExecuteFirstAsync(token);
+			return attachment == default ? NotFoundError() : Json(View(attachment));
+		}
+
+		[HttpPut("/api/v1/media/{id}"), Scope("write:media")]
+		public async Task<IActionResult> Update(string id, CancellationToken token)
+		{
+			var attachment = await DB.Default.Find<MediaAttachment>().Match(m => m.ID == id && m.OwnerAvatarId == MyId).ExecuteFirstAsync(token);
+			if (attachment == default)
+				return NotFoundError();
+			if (Params.Has("description"))
+				attachment.Description = Params.Get("description")?.Trim() is { Length: > 0 } description ? description[..Math.Min(description.Length, 1500)] : default;
+			if (Params.Get("focus")?.Split(',') is [var x, var y]
+				&& float.TryParse(x, NumberStyles.Float, CultureInfo.InvariantCulture, out var fx) && float.TryParse(y, NumberStyles.Float, CultureInfo.InvariantCulture, out var fy))
+				attachment.Focus = new[] { Math.Clamp(fx, -1, 1), Math.Clamp(fy, -1, 1) };
+			await DB.Default.SaveAsync(attachment, token);
+			return Json(View(attachment));
+		}
+
+		[HttpGet("/media/proxy/{signature}/{encoded}"), AllowAnonymous, ApiExplorerSettings(IgnoreApi = true)]
+		public async Task<IActionResult> Proxy(string signature, string encoded, CancellationToken token)
+		{
+			var (path, contentType) = await _proxy.Fetch(signature, encoded, token);
+			if (path == default)
+				return NotFound();
+			Response.Headers["X-Content-Type-Options"] = "nosniff";
+			Response.Headers["Content-Security-Policy"] = "default-src 'none'; sandbox";
+			Response.Headers["Cache-Control"] = "public, max-age=604800";
+			return PhysicalFile(path, contentType);
+		}
+
+		object View(MediaAttachment attachment) => new
+		{
+			id = attachment.ID,
+			type = attachment.Kind,
+			url = _media.Url(attachment.FilePath),
+			preview_url = _media.Url(attachment.PreviewPath ?? attachment.FilePath),
+			remote_url = default(string),
+			text_url = default(string),
+			meta = new
+			{
+				original = attachment.Width.HasValue && attachment.Height > 0
+					? new { width = attachment.Width, height = attachment.Height, size = $"{attachment.Width}x{attachment.Height}", aspect = (double)attachment.Width / attachment.Height.Value }
+					: default,
+				focus = attachment.Focus is { Length: 2 } ? new { x = attachment.Focus[0], y = attachment.Focus[1] } : default
+			},
+			description = attachment.Description,
+			blurhash = attachment.Blurhash
+		};
+	}
+}

PrivaPub/Api/Mastodon/Controllers/StatusesController.cs

@@ -44,8 +44,6 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				if (existing != default)
 					return Json(await _mapper.Status(existing, MyId, token));
 			}
-			if (Params.List("media_ids").Count > 0)
-				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Media attachments are not supported yet");
 			if (Params.Has("poll[options]"))
 				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Polls are not supported yet");
 
@@ -57,7 +55,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				Sensitive = Params.Bool("sensitive") ?? Me.Settings.DefaultSensitive,
 				Visibility = Visibility(Params.Get("visibility") ?? Me.Settings.DefaultVisibility),
 				InReplyTo = Params.Get("in_reply_to_id"),
-				Language = Params.Get("language") ?? Me.Settings.DefaultLanguage
+				Language = Params.Get("language") ?? Me.Settings.DefaultLanguage,
+				MediaIds = Params.List("media_ids")
 			}, token);
 			if (!outcome.Ok)
 				return Error(outcome.Status, outcome.Error);
@@ -88,15 +87,14 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpPut("/api/v1/statuses/{id}"), Scope("write:statuses")]
 		public async Task<IActionResult> Edit(string id, CancellationToken token)
 		{
-			if (Params.List("media_ids").Count > 0)
-				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Media attachments are not supported yet");
 			var outcome = await _statuses.Edit(Me, id, new StatusDraft
 			{
 				Text = Params.Get("status"),
 				PlainText = true,
 				SpoilerText = Params.Get("spoiler_text"),
 				Sensitive = Params.Bool("sensitive") ?? false,
-				Language = Params.Get("language")
+				Language = Params.Get("language"),
+				MediaIds = Params.Has("media_ids") ? Params.List("media_ids") : default
 			}, token);
 			return outcome.Ok ? Json(await _mapper.Status(outcome.Post, MyId, token)) : Error(outcome.Status, outcome.Error);
 		}

PrivaPub/Api/Mastodon/Mappers/MastodonMapper.cs

@@ -2,6 +2,7 @@ using MongoDB.Entities;
 
 using PrivaPub.Api.Mastodon.Entities;
 using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Domain.Media;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Models.Federation;
@@ -21,13 +22,17 @@ namespace PrivaPub.Api.Mastodon.Mappers
 	{
 		readonly DbEntities _dbEntities;
 		readonly ILocalActorService _localActors;
+		readonly IMediaProxy _proxy;
 
-		public MastodonMapper(DbEntities dbEntities, ILocalActorService localActors)
+		public MastodonMapper(DbEntities dbEntities, ILocalActorService localActors, IMediaProxy proxy = default)
 		{
 			_dbEntities = dbEntities;
 			_localActors = localActors;
+			_proxy = proxy;
 		}
 
+		string Proxied(string url) => _proxy == default ? url : _proxy.Wrap(url);
+
 		string MissingAvatar => $"{_localActors.BaseAddress}/media/missing-avatar.png";
 		string MissingHeader => $"{_localActors.BaseAddress}/media/missing-header.png";
 
@@ -101,10 +106,10 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			Note = foreign.Biography ?? string.Empty,
 			Url = foreign.Url ?? foreign.ActorURI,
 			Uri = foreign.ActorURI,
-			Avatar = foreign.PictureURL ?? MissingAvatar,
-			AvatarStatic = foreign.PictureURL ?? MissingAvatar,
-			Header = foreign.ThumbnailURL ?? MissingHeader,
-			HeaderStatic = foreign.ThumbnailURL ?? MissingHeader
+			Avatar = Proxied(foreign.PictureURL) ?? MissingAvatar,
+			AvatarStatic = Proxied(foreign.PictureURL) ?? MissingAvatar,
+			Header = Proxied(foreign.ThumbnailURL) ?? MissingHeader,
+			HeaderStatic = Proxied(foreign.ThumbnailURL) ?? MissingHeader
 		};
 
 		public async Task<Account> Account(string id, CancellationToken token) =>
@@ -244,9 +249,9 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			return new StatusMention { Id = account.ID, Username = account.UserName, Acct = $"{account.UserName}@{account.Domain}", Url = account.Url ?? account.ActorURI };
 		}
 
-		static MediaAttachment Media(PostMedia media) => new()
+		MediaAttachment Media(PostMedia media) => new()
 		{
-			Id = media.Id.ToString("N"),
+			Id = media.AttachmentId ?? media.Id.ToString("N"),
 			Type = media.ContentType switch
 			{
 				{ } type when type.StartsWith("image/gif") => "gifv",
@@ -255,14 +260,18 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				{ } type when type.StartsWith("audio/") => "audio",
 				_ => "unknown"
 			},
-			Url = media.URL ?? media.RemoteURL,
-			PreviewUrl = media.URL ?? media.RemoteURL,
+			Url = media.URL ?? Proxied(media.RemoteURL),
+			PreviewUrl = media.PreviewURL ?? media.URL ?? Proxied(media.RemoteURL),
 			RemoteUrl = media.RemoteURL,
 			Description = media.Description,
 			Blurhash = media.Blurhash,
-			Meta = media.Width.HasValue && media.Height.HasValue
-				? new { original = new { width = media.Width, height = media.Height, aspect = (double)media.Width / media.Height.Value } }
-				: default
+			Meta = new
+			{
+				original = media.Width.HasValue && media.Height > 0
+					? new { width = media.Width, height = media.Height, size = $"{media.Width}x{media.Height}", aspect = (double)media.Width / media.Height.Value }
+					: default,
+				focus = media.Focus is { Length: 2 } ? new { x = media.Focus[0], y = media.Focus[1] } : default
+			}
 		};
 	}
 }