A file lives exactly as long as something holds it

Deleting a post, editing media out, replacing an avatar or a header, and removing a whole root deleted no file: every
one stayed on disk and publicly served from /media/files with a year-long immutable cache, its row orphaned. Now every
upload is a row, profile pictures too (Kind avatar or header, ProfileOfAvatarId), and each of those acts trashes what
it held, as does an upload never posted for a day and a dropped scheduled post. A trashed row is marked in one
conditional update (an upload attached meanwhile is left alone), its files move into media-trash, beside the media
root and outside what /media/files serves, and the janitor deletes them a day later. Nothing is deleted for looking
unused.

Along the way: a profile picture that isn't an image, or can't be read, answers 422 instead of being silently ignored
with a 200; a removed root's scheduled posts are dropped, so nothing of it publishes later; media rows get indexes
(they had none), and the janitor's first pass comes five minutes after boot instead of an hour.

`PrivaPub admin media audit [--fix]` compares the disk with the database. With --fix (as www-data) it gives the
pictures personas show today a row, and trashes media of deleted posts or personas, rows whose files are missing, and
files nothing holds: the leftovers of every deletion until now. MediaLifecycleTests covers each act, that the trash is
never served, and the audit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Domain/Media/MediaAudit.cs

@@ -0,0 +1,101 @@
+using MongoDB.Entities;
+
+using PrivaPub.Models.Media;
+using PrivaPub.Models.User;
+
+using PostEntity = PrivaPub.Models.Post.Post;
+
+namespace PrivaPub.Domain.Media
+{
+	// What the media directory holds against what the database says holds it, and, with fix, the two made to agree:
+	// - a persona's current avatar or header with no row (they had none before) becomes a row of its own;
+	// - media of a deleted post or of a deleted persona go to the trash;
+	// - rows whose files are gone go to the trash;
+	// - files nothing holds (deleted posts' media and replaced pictures, from before media were trashed) get a trashed row
+	//   each.
+	// Trashed files leave what /media/files serves at once, and the janitor deletes them after its grace. Run it without
+	// fix first; with fix it must run as the user that owns the media (www-data).
+	public static class MediaAudit
+	{
+		public sealed record Report(int Files, int Held, int Adopted, int OfDeleted, int MissingFiles, int Unheld, IReadOnlyList<string> Examples, bool Fixed);
+
+		public static async Task<Report> Run(IMediaService media, bool fix, CancellationToken token)
+		{
+			var files = Served(media.Root);
+			var rows = await DB.Default.Find<MediaAttachment>().Match(m => m.TrashedAt == null).ExecuteAsync(token);
+			var held = rows.SelectMany(r => new[] { r.FilePath, r.PreviewPath }).Where(p => !string.IsNullOrEmpty(p)).ToHashSet();
+			var examples = new List<string>();
+
+			// pictures personas show today, kept as rows from now on
+			var prefix = media.Url(string.Empty);
+			var adopted = 0;
+			foreach (var avatar in await DB.Default.Find<Avatar>().Match(a => !a.DeletionAt.HasValue && (a.PictureURL != null || a.ThumbnailURL != null)).ExecuteAsync(token))
+				foreach (var (url, kind) in new[] { (avatar.PictureURL, "avatar"), (avatar.ThumbnailURL, "header") })
+				{
+					if (url?.StartsWith(prefix, StringComparison.Ordinal) != true)
+						continue;
+					var relative = url[prefix.Length..];
+					if (held.Contains(relative) || !files.Contains(relative))
+						continue;
+					adopted++;
+					held.Add(relative);
+					if (fix)
+						await DB.Default.SaveAsync(new MediaAttachment
+						{
+							OwnerAvatarId = avatar.ID,
+							ProfileOfAvatarId = avatar.ID,
+							Kind = kind,
+							ContentType = "image/jpeg",
+							FilePath = relative,
+							Size = new FileInfo(Path.Combine(media.Root, relative)).Length,
+							AttachedAt = DateTime.UtcNow
+						}, token);
+				}
+
+			// held by something that is gone: a deleted post, a deleted persona
+			var postIds = rows.Where(r => r.PostId != null).Select(r => r.PostId).Distinct().ToList();
+			var livePosts = (await DB.Default.Find<PostEntity>().Match(p => postIds.Contains(p.ID) && !p.DeletedAt.HasValue).Project(p => p.Include(x => x.ID)).ExecuteAsync(token))
+				.Select(p => p.ID).ToHashSet();
+			var ownerIds = rows.Select(r => r.OwnerAvatarId).Where(id => id != null).Distinct().ToList();
+			var liveOwners = (await DB.Default.Find<Avatar>().Match(a => ownerIds.Contains(a.ID) && !a.DeletionAt.HasValue).Project(a => a.Include(x => x.ID)).ExecuteAsync(token))
+				.Select(a => a.ID).ToHashSet();
+			var ofDeleted = rows.Where(r => (r.PostId != null && !livePosts.Contains(r.PostId)) || (r.OwnerAvatarId != null && !liveOwners.Contains(r.OwnerAvatarId))).ToList();
+			var missing = rows.Except(ofDeleted).Where(r => !string.IsNullOrEmpty(r.FilePath) && !files.Contains(r.FilePath)).ToList();
+			if (fix)
+				foreach (var row in ofDeleted.Concat(missing))
+					await media.Trash(m => m.ID == row.ID, ofDeleted.Contains(row) ? "audit: its holder is deleted" : "audit: its file is missing", token);
+			foreach (var row in ofDeleted)
+				held.Remove(row.FilePath);
+
+			// files nothing holds
+			var unheld = files.Where(f => !held.Contains(f)).OrderBy(f => f, StringComparer.Ordinal).ToList();
+			examples.AddRange(unheld.Take(10));
+			if (fix)
+				foreach (var relative in unheld)
+				{
+					var orphan = new MediaAttachment
+					{
+						Kind = "orphan",
+						FilePath = relative,
+						Size = new FileInfo(Path.Combine(media.Root, relative)).Length,
+						TrashedAt = DateTime.UtcNow,
+						TrashReason = "audit: nothing holds it"
+					};
+					await DB.Default.SaveAsync(orphan, token);
+					media.Hide(orphan);
+				}
+
+			return new Report(files.Count, rows.Count, adopted, ofDeleted.Count, missing.Count, unheld.Count, examples, fix);
+		}
+
+		// every file /media/files serves: everything under the root
+		static HashSet<string> Served(string root)
+		{
+			if (!Directory.Exists(root))
+				return new HashSet<string>();
+			return Directory.EnumerateFiles(root, "*", SearchOption.AllDirectories)
+				.Select(f => Path.GetRelativePath(root, f).Replace('\\', '/'))
+				.ToHashSet();
+		}
+	}
+}