Media: uploads stripped of metadata, attachments both ways, a remote media proxy

- /api/v1/media and /api/v2/media (and GET/PUT /api/v1/media/:id):
  images go through libvips (NetVips, its native build bundled):
  autorotated, every kind of metadata dropped (EXIF, GPS, XMP, IPTC,
  comments), capped at 4096 px, with a 640 px preview and a blurhash
  (own encoder, the reference algorithm); animated GIFs are re-encoded;
  video and audio are remuxed by ffmpeg with -map_metadata -1, never
  re-encoded, and a video gets a still preview. Files get random names
  under /var/lib/privapub/media, outside the web root deploys replace, and
  are served at /media/files with nosniff and a sandbox CSP.
- media_ids on create and edit (four at most, the persona's own, each used
  once); notes carry them as Document attachments with alt text, blurhash,
  focalPoint and size; inbound attachments were already kept.
- avatar and header uploads in update_credentials, cropped to 400x400 and
  1500x500, federated with Update{Person}.
- Remote media reaches clients only through /media/proxy/{hmac}/{url},
  fetched by the guarded client (no SVG, 40 MB cap) and cached outside the
  served root, trimmed to 5 GB; foreign avatars and headers use it too, so
  a client never contacts another server.
- MediaJanitor deletes uploads left unattached for a day.
- nginx accepts 100 MB bodies on the upload endpoints only (applied on Max).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub.Tests/Domain/MediaFlowTests.cs

@@ -0,0 +1,102 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Caching.Memory;
+
+using MongoDB.Entities;
+
+using NetVips;
+
+using PrivaPub.Domain.Media;
+using PrivaPub.Domain.Statuses;
+using PrivaPub.Federation.Rendering;
+using PrivaPub.Models.Media;
+using PrivaPub.Tests.Support;
+
+namespace PrivaPub.Tests.Domain
+{
+	[Trait("Category", "Integration")]
+	public sealed class MediaFlowTests : IAsyncLifetime
+	{
+		Harness _harness;
+
+		public async ValueTask InitializeAsync()
+		{
+			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
+			_harness = await Harness.Start();
+		}
+
+		public async ValueTask DisposeAsync()
+		{
+			if (_harness != default)
+				await _harness.DisposeAsync();
+		}
+
+		static byte[] Png(int width, int height)
+		{
+			using var image = (Image.Black(width, height, bands: 3) + new double[] { 10, 120, 200 }).Cast(Enums.BandFormat.Uchar);
+			return image.WriteToBuffer(".png");
+		}
+
+		static IFormFile Upload(byte[] bytes, string contentType) =>
+			new FormFile(new MemoryStream(bytes), 0, bytes.Length, "file", "picture") { Headers = new HeaderDictionary(), ContentType = contentType };
+
+		[Fact]
+		public async Task An_upload_is_attached_once_and_federated_with_its_alt_text()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var (_, alice) = await _harness.Persona("alice");
+			var (_, mallory) = await _harness.Persona("mallory");
+
+			var upload = await _harness.Media.Upload(alice, Upload(Png(300, 200), "image/png"), "a blue square", "0.25,-0.5", token);
+			Assert.True(upload.Ok);
+			Assert.True(File.Exists(Path.Combine(_harness.Media.Root, upload.Attachment.FilePath)));
+
+			var stolen = await _harness.Statuses.Publish(mallory, new StatusDraft { Text = "mine", MediaIds = new[] { upload.Attachment.ID } }, token);
+			Assert.False(stolen.Ok);
+
+			var posted = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "look", MediaIds = new[] { upload.Attachment.ID } }, token);
+			Assert.True(posted.Ok);
+			Assert.Equal(posted.Post.ID, (await DB.Default.Find<MediaAttachment>().OneAsync(upload.Attachment.ID, token)).PostId);
+
+			var note = ActivityPubRenderer.Note(posted.Post, alice, default, default);
+			var attachment = note["attachment"]![0]!;
+			Assert.Equal("a blue square", attachment["name"]!.GetValue<string>());
+			Assert.Equal(300, attachment["width"]!.GetValue<int>());
+			Assert.Equal(-0.5f, attachment["focalPoint"]![1]!.GetValue<float>());
+			Assert.StartsWith("https://privapub.test/media/files/", attachment["url"]!.GetValue<string>());
+
+			var reused = await _harness.Statuses.Publish(alice, new StatusDraft { Text = "again", MediaIds = new[] { upload.Attachment.ID } }, token);
+			Assert.False(reused.Ok);
+		}
+
+		[Fact]
+		public async Task Unsupported_files_are_refused()
+		{
+			var (_, alice) = await _harness.Persona("alice");
+
+			var outcome = await _harness.Media.Upload(alice, Upload(System.Text.Encoding.UTF8.GetBytes("<svg/>"), "image/svg+xml"), default, default, TestContext.Current.CancellationToken);
+
+			Assert.False(outcome.Ok);
+			Assert.Equal(422, outcome.Status);
+		}
+
+		[Fact]
+		public async Task The_proxy_serves_signed_remote_media_and_nothing_else()
+		{
+			var token = TestContext.Current.CancellationToken;
+			var path = $"/files/{Guid.NewGuid():N}.png";
+			_harness.Peer.ServeFile(path, Png(10, 10), "image/png");
+			var proxy = new MediaProxy(_harness.Local, Peer.Http(), _harness.Media, new StaticOptions<MediaOptions>(new MediaOptions()));
+
+			var wrapped = proxy.Wrap(_harness.Peer.A + path);
+			var parts = new Uri(wrapped).AbsolutePath.Split('/');
+			var (file, contentType) = await proxy.Fetch(parts[3], parts[4], token);
+			var (tampered, _) = await proxy.Fetch(parts[3].Replace(parts[3][0], parts[3][0] == 'A' ? 'B' : 'A'), parts[4], token);
+
+			Assert.StartsWith("https://privapub.test/media/proxy/", wrapped);
+			Assert.Equal("image/png", contentType);
+			Assert.True(File.Exists(file));
+			Assert.StartsWith(_harness.Media.ProxyRoot, file);
+			Assert.Null(tampered);
+		}
+	}
+}

PrivaPub.Tests/Domain/MediaProcessingTests.cs

@@ -0,0 +1,72 @@
+using NetVips;
+
+using PrivaPub.Domain.Media;
+
+namespace PrivaPub.Tests.Domain
+{
+	public class MediaProcessingTests
+	{
+		static byte[] JpegWithMetadata(int width, int height)
+		{
+			using var image = (Image.Black(width, height, bands: 3) + new double[] { 200, 40, 90 }).Cast(Enums.BandFormat.Uchar);
+			using var tagged = image.Mutate(m =>
+			{
+				m.Set(GValue.GStrType, "exif-ifd0-ImageDescription", "where I live");
+				m.Set(GValue.GStrType, "exif-ifd0-Artist", "Alice Smith");
+				m.Set(GValue.GStrType, "exif-ifd2-UserComment", "at home");
+				m.Set(GValue.BlobType, "xmp-data", System.Text.Encoding.UTF8.GetBytes("<x:xmpmeta xmlns:x='adobe:ns:meta/'><secret/></x:xmpmeta>"));
+			});
+			return tagged.WriteToBuffer(".jpg");
+		}
+
+		[Fact]
+		public void Uploaded_images_lose_every_kind_of_metadata()
+		{
+			var input = JpegWithMetadata(800, 600);
+			using (var original = Image.NewFromBuffer(input))
+				Assert.Contains("exif-data", original.GetFields());
+
+			var processed = MediaService.ProcessImage(input, 4096, 640, animated: false);
+
+			using var output = Image.NewFromBuffer(processed.Bytes);
+			var fields = output.GetFields();
+			Assert.DoesNotContain("exif-data", fields);
+			Assert.DoesNotContain("xmp-data", fields);
+			Assert.DoesNotContain("iptc-data", fields);
+			Assert.DoesNotContain(fields, f => f.StartsWith("exif-ifd"));
+			Assert.Equal((800, 600), (processed.Width, processed.Height));
+			Assert.Equal("image/jpeg", processed.ContentType);
+			using var preview = Image.NewFromBuffer(processed.Preview);
+			Assert.Equal(640, Math.Max(preview.Width, preview.Height));
+			Assert.DoesNotContain("exif-data", preview.GetFields());
+		}
+
+		[Fact]
+		public void Large_images_are_capped()
+		{
+			var processed = MediaService.ProcessImage(JpegWithMetadata(5000, 2500), 4096, 640, animated: false);
+
+			Assert.Equal((4096, 2048), (processed.Width, processed.Height));
+		}
+
+		[Fact]
+		public void A_blurhash_is_well_formed()
+		{
+			var processed = MediaService.ProcessImage(JpegWithMetadata(64, 64), 4096, 640, animated: false);
+
+			Assert.Equal(28, processed.Blurhash.Length);
+			Assert.Equal('L', processed.Blurhash[0]);
+		}
+
+		[Fact]
+		public void A_white_image_encodes_white_as_its_average()
+		{
+			var pixels = Enumerable.Range(0, 16 * 16).SelectMany(_ => new byte[] { 255, 255, 255 }).ToArray();
+
+			var hash = Blurhash.Encode(pixels, 16, 16);
+
+			Assert.Equal(28, hash.Length);
+			Assert.Equal("TSUA", hash[2..6]);
+		}
+	}
+}

PrivaPub.Tests/Support/Harness.cs

@@ -5,6 +5,7 @@ using Microsoft.Extensions.Logging.Abstractions;
 using MongoDB.Entities;
 
 using PrivaPub.Domain.Content;
+using PrivaPub.Domain.Media;
 using PrivaPub.Domain.Relationships;
 using PrivaPub.Domain.Social;
 using PrivaPub.Domain.Statuses;
@@ -58,7 +59,9 @@ namespace PrivaPub.Tests.Support
 			Follows = new FollowService(Db, Local, Remote, Delivery, new KeyLocalizer<GenericRes>(), NullLogger<FollowService>.Instance);
 			Content = new ContentRenderer(Local, Remote);
 			Outbox = new OutboxPublisher(Db, Local, Delivery);
-			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout);
+			Media = new MediaService(new StaticOptions<MediaOptions>(new MediaOptions { Root = Path.Combine(Path.GetTempPath(), $"privapub-media-{Guid.NewGuid():N}") }),
+				Local, default, NullLogger<MediaService>.Instance);
+			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, Media);
 			Posts = new PostsService(Db, Local, Statuses, new KeyLocalizer<GenericRes>(), NullLogger<PostsService>.Instance);
 			Timelines = new TimelineService(Db, new KeyLocalizer<GenericRes>());
 			Relationships = new RelationshipService(Db, Follows, Delivery);
@@ -78,6 +81,7 @@ namespace PrivaPub.Tests.Support
 		public OutboxPublisher Outbox { get; }
 		public PostsService Posts { get; }
 		public StatusService Statuses { get; }
+		public MediaService Media { get; }
 		public Fanout Fanout { get; }
 		public RemotePosts RemotePosts { get; }
 		public TimelineService Timelines { get; }

PrivaPub.Tests/Support/Peer.cs

@@ -19,6 +19,7 @@ namespace PrivaPub.Tests.Support
 		readonly WebApplication _app;
 		readonly ConcurrentDictionary<string, string> _documents = new();
 		readonly ConcurrentDictionary<string, (int Status, TimeSpan Delay)> _answers = new();
+		readonly ConcurrentDictionary<string, (byte[] Bytes, string ContentType)> _files = new();
 
 		public int Port { get; }
 		public string A => $"http://127.0.0.1:{Port}";
@@ -41,6 +42,12 @@ namespace PrivaPub.Tests.Support
 			{
 				peer.Requests.Enqueue(new(context.Request.Method, context.Request.Path, context.Request.Headers["Signature"].ToString()));
 				var key = context.Request.Path.Value;
+				if (peer._files.TryGetValue(key, out var file))
+				{
+					context.Response.ContentType = file.ContentType;
+					await context.Response.Body.WriteAsync(file.Bytes);
+					return;
+				}
 				if (peer._answers.TryGetValue(key, out var answer))
 				{
 					if (answer.Delay > TimeSpan.Zero)
@@ -63,6 +70,8 @@ namespace PrivaPub.Tests.Support
 
 		public void Serve(string path, string json) => _documents[path] = json;
 
+		public void ServeFile(string path, byte[] bytes, string contentType) => _files[path] = (bytes, contentType);
+
 		public void Answer(string path, int status, TimeSpan delay = default) => _answers[path] = (status, delay);
 
 		public static FederationHttp Http(IMemoryCache cache = default, IDomainBlocks blocks = default)