Collections (#688)

* initial draft; unfinished

* images, fixes

* fixes

* println

* revisions

* fixes

* alternate context setup version

* rev

* partial revs

* rev

* clippy ,fmt

* fmt/clippy/prepare

* fixes

* revs

src/routes/v2/collections.rs

@@ -0,0 +1,533 @@
+use crate::auth::checks::{filter_authorized_collections, is_authorized_collection};
+use crate::auth::get_user_from_headers;
+use crate::database;
+use crate::database::models::{collection_item, generate_collection_id, project_item};
+use crate::file_hosting::FileHost;
+use crate::models::collections::{Collection, CollectionStatus};
+use crate::models::ids::base62_impl::parse_base62;
+use crate::models::ids::{CollectionId, ProjectId};
+use crate::models::pats::Scopes;
+use crate::queue::session::AuthQueue;
+use crate::routes::ApiError;
+use crate::util::routes::read_from_payload;
+use crate::util::validate::validation_errors_to_string;
+use actix_web::web::Data;
+use actix_web::{delete, get, patch, post, web, HttpRequest, HttpResponse};
+use chrono::Utc;
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use std::sync::Arc;
+use validator::Validate;
+
+use super::project_creation::CreateError;
+
+pub fn config(cfg: &mut web::ServiceConfig) {
+    cfg.service(collections_get);
+    cfg.service(collection_create);
+    cfg.service(
+        web::scope("collection")
+            .service(collection_get)
+            .service(collection_delete)
+            .service(collection_edit)
+            .service(collection_icon_edit)
+            .service(delete_collection_icon),
+    );
+}
+
+#[derive(Serialize, Deserialize, Validate, Clone)]
+pub struct CollectionCreateData {
+    #[validate(
+        length(min = 3, max = 64),
+        custom(function = "crate::util::validate::validate_name")
+    )]
+    /// The title or name of the project.
+    pub title: String,
+    #[validate(length(min = 3, max = 255))]
+    /// A short description of the collection.
+    pub description: String,
+    #[validate(length(max = 32))]
+    #[serde(default = "Vec::new")]
+    /// A list of initial projects to use with the created collection
+    pub projects: Vec<String>,
+}
+
+#[post("collection")]
+pub async fn collection_create(
+    req: HttpRequest,
+    collection_create_data: web::Json<CollectionCreateData>,
+    client: Data<PgPool>,
+    redis: Data<deadpool_redis::Pool>,
+    session_queue: Data<AuthQueue>,
+) -> Result<HttpResponse, CreateError> {
+    let collection_create_data = collection_create_data.into_inner();
+
+    // The currently logged in user
+    let current_user = get_user_from_headers(
+        &req,
+        &**client,
+        &redis,
+        &session_queue,
+        Some(&[Scopes::COLLECTION_CREATE]),
+    )
+    .await?
+    .1;
+
+    collection_create_data
+        .validate()
+        .map_err(|err| CreateError::InvalidInput(validation_errors_to_string(err, None)))?;
+
+    let mut transaction = client.begin().await?;
+
+    let collection_id: CollectionId = generate_collection_id(&mut transaction).await?.into();
+
+    let initial_project_ids =
+        project_item::Project::get_many(&collection_create_data.projects, &mut transaction, &redis)
+            .await?
+            .into_iter()
+            .map(|x| x.inner.id.into())
+            .collect::<Vec<ProjectId>>();
+
+    let collection_builder_actual = collection_item::CollectionBuilder {
+        collection_id: collection_id.into(),
+        user_id: current_user.id.into(),
+        title: collection_create_data.title,
+        description: collection_create_data.description,
+        status: CollectionStatus::Listed,
+        projects: initial_project_ids
+            .iter()
+            .copied()
+            .map(|x| x.into())
+            .collect(),
+    };
+    let collection_builder = collection_builder_actual.clone();
+
+    let now = Utc::now();
+    collection_builder_actual.insert(&mut transaction).await?;
+
+    let response = crate::models::collections::Collection {
+        id: collection_id,
+        user: collection_builder.user_id.into(),
+        title: collection_builder.title.clone(),
+        description: collection_builder.description.clone(),
+        created: now,
+        updated: now,
+        icon_url: None,
+        color: None,
+        status: collection_builder.status,
+        projects: initial_project_ids,
+    };
+    transaction.commit().await?;
+
+    Ok(HttpResponse::Ok().json(response))
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct CollectionIds {
+    pub ids: String,
+}
+#[get("collections")]
+pub async fn collections_get(
+    req: HttpRequest,
+    web::Query(ids): web::Query<CollectionIds>,
+    pool: web::Data<PgPool>,
+    redis: web::Data<deadpool_redis::Pool>,
+    session_queue: web::Data<AuthQueue>,
+) -> Result<HttpResponse, ApiError> {
+    let ids = serde_json::from_str::<Vec<&str>>(&ids.ids)?;
+    let ids = ids
+        .into_iter()
+        .map(|x| parse_base62(x).map(|x| database::models::CollectionId(x as i64)))
+        .collect::<Result<Vec<_>, _>>()?;
+
+    let collections_data = database::models::Collection::get_many(&ids, &**pool, &redis).await?;
+
+    let user_option = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Some(&[Scopes::COLLECTION_READ]),
+    )
+    .await
+    .map(|x| x.1)
+    .ok();
+
+    let collections = filter_authorized_collections(collections_data, &user_option, &pool).await?;
+
+    Ok(HttpResponse::Ok().json(collections))
+}
+
+#[get("{id}")]
+pub async fn collection_get(
+    req: HttpRequest,
+    info: web::Path<(String,)>,
+    pool: web::Data<PgPool>,
+    redis: web::Data<deadpool_redis::Pool>,
+    session_queue: web::Data<AuthQueue>,
+) -> Result<HttpResponse, ApiError> {
+    let string = info.into_inner().0;
+
+    let id = database::models::CollectionId(parse_base62(&string)? as i64);
+    let collection_data = database::models::Collection::get(id, &**pool, &redis).await?;
+    let user_option = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Some(&[Scopes::COLLECTION_READ]),
+    )
+    .await
+    .map(|x| x.1)
+    .ok();
+
+    if let Some(data) = collection_data {
+        if is_authorized_collection(&data, &user_option).await? {
+            return Ok(HttpResponse::Ok().json(Collection::from(data)));
+        }
+    }
+    Ok(HttpResponse::NotFound().body(""))
+}
+
+#[derive(Deserialize, Validate)]
+pub struct EditCollection {
+    #[validate(
+        length(min = 3, max = 64),
+        custom(function = "crate::util::validate::validate_name")
+    )]
+    pub title: Option<String>,
+    #[validate(length(min = 3, max = 256))]
+    pub description: Option<String>,
+    pub status: Option<CollectionStatus>,
+    #[validate(length(max = 64))]
+    pub new_projects: Option<Vec<String>>,
+}
+
+#[patch("{id}")]
+pub async fn collection_edit(
+    req: HttpRequest,
+    info: web::Path<(String,)>,
+    pool: web::Data<PgPool>,
+    new_collection: web::Json<EditCollection>,
+    redis: web::Data<deadpool_redis::Pool>,
+    session_queue: web::Data<AuthQueue>,
+) -> Result<HttpResponse, ApiError> {
+    let user_option = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Some(&[Scopes::COLLECTION_WRITE]),
+    )
+    .await
+    .map(|x| x.1)
+    .ok();
+
+    new_collection
+        .validate()
+        .map_err(|err| ApiError::Validation(validation_errors_to_string(err, None)))?;
+
+    let string = info.into_inner().0;
+    let id = database::models::CollectionId(parse_base62(&string)? as i64);
+    let result = database::models::Collection::get(id, &**pool, &redis).await?;
+
+    if let Some(collection_item) = result {
+        if !is_authorized_collection(&collection_item, &user_option).await? {
+            return Ok(HttpResponse::Unauthorized().body(""));
+        }
+
+        let id = collection_item.id;
+
+        let mut transaction = pool.begin().await?;
+
+        if let Some(title) = &new_collection.title {
+            sqlx::query!(
+                "
+                UPDATE collections
+                SET title = $1
+                WHERE (id = $2)
+                ",
+                title.trim(),
+                id as database::models::ids::CollectionId,
+            )
+            .execute(&mut *transaction)
+            .await?;
+        }
+
+        if let Some(description) = &new_collection.description {
+            sqlx::query!(
+                "
+                UPDATE collections
+                SET description = $1
+                WHERE (id = $2)
+                ",
+                description,
+                id as database::models::ids::CollectionId,
+            )
+            .execute(&mut *transaction)
+            .await?;
+        }
+
+        if let Some(status) = &new_collection.status {
+            if let Some(user) = user_option {
+                if !(user.role.is_mod()
+                    || collection_item.status.is_approved() && status.can_be_requested())
+                {
+                    return Err(ApiError::CustomAuthentication(
+                        "You don't have permission to set this status!".to_string(),
+                    ));
+                }
+
+                sqlx::query!(
+                    "
+                    UPDATE collections
+                    SET status = $1
+                    WHERE (id = $2)
+                    ",
+                    status.to_string(),
+                    id as database::models::ids::CollectionId,
+                )
+                .execute(&mut *transaction)
+                .await?;
+            }
+        }
+
+        if let Some(new_project_ids) = &new_collection.new_projects {
+            // Delete all existing projects
+            sqlx::query!(
+                "
+                DELETE FROM collections_mods
+                WHERE collection_id = $1
+                ",
+                collection_item.id as database::models::ids::CollectionId,
+            )
+            .execute(&mut *transaction)
+            .await?;
+
+            for project_id in new_project_ids {
+                let project = database::models::Project::get(project_id, &**pool, &redis)
+                    .await?
+                    .ok_or_else(|| {
+                        ApiError::InvalidInput(format!(
+                            "The specified project {project_id} does not exist!"
+                        ))
+                    })?;
+
+                // Insert- don't throw an error if it already exists
+                sqlx::query!(
+                    "
+                            INSERT INTO collections_mods (collection_id, mod_id)
+                            VALUES ($1, $2)
+                            ON CONFLICT DO NOTHING
+                            ",
+                    collection_item.id as database::models::ids::CollectionId,
+                    project.inner.id as database::models::ids::ProjectId,
+                )
+                .execute(&mut *transaction)
+                .await?;
+            }
+        }
+
+        database::models::Collection::clear_cache(collection_item.id, &redis).await?;
+
+        transaction.commit().await?;
+        Ok(HttpResponse::NoContent().body(""))
+    } else {
+        Ok(HttpResponse::NotFound().body(""))
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct Extension {
+    pub ext: String,
+}
+
+#[patch("{id}/icon")]
+#[allow(clippy::too_many_arguments)]
+pub async fn collection_icon_edit(
+    web::Query(ext): web::Query<Extension>,
+    req: HttpRequest,
+    info: web::Path<(String,)>,
+    pool: web::Data<PgPool>,
+    redis: web::Data<deadpool_redis::Pool>,
+    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    mut payload: web::Payload,
+    session_queue: web::Data<AuthQueue>,
+) -> Result<HttpResponse, ApiError> {
+    if let Some(content_type) = crate::util::ext::get_image_content_type(&ext.ext) {
+        let cdn_url = dotenvy::var("CDN_URL")?;
+        let user_option = get_user_from_headers(
+            &req,
+            &**pool,
+            &redis,
+            &session_queue,
+            Some(&[Scopes::COLLECTION_WRITE]),
+        )
+        .await
+        .map(|x| x.1)
+        .ok();
+
+        let string = info.into_inner().0;
+        let id = database::models::CollectionId(parse_base62(&string)? as i64);
+        let collection_item = database::models::Collection::get(id, &**pool, &redis)
+            .await?
+            .ok_or_else(|| {
+                ApiError::InvalidInput("The specified collection does not exist!".to_string())
+            })?;
+
+        if !is_authorized_collection(&collection_item, &user_option).await? {
+            return Ok(HttpResponse::Unauthorized().body(""));
+        }
+
+        if let Some(icon) = collection_item.icon_url {
+            let name = icon.split(&format!("{cdn_url}/")).nth(1);
+
+            if let Some(icon_path) = name {
+                file_host.delete_file_version("", icon_path).await?;
+            }
+        }
+
+        let bytes =
+            read_from_payload(&mut payload, 262144, "Icons must be smaller than 256KiB").await?;
+
+        let color = crate::util::img::get_color_from_img(&bytes)?;
+
+        let hash = sha1::Sha1::from(&bytes).hexdigest();
+        let collection_id: CollectionId = collection_item.id.into();
+        let upload_data = file_host
+            .upload_file(
+                content_type,
+                &format!("data/{}/{}.{}", collection_id, hash, ext.ext),
+                bytes.freeze(),
+            )
+            .await?;
+
+        let mut transaction = pool.begin().await?;
+
+        sqlx::query!(
+            "
+            UPDATE collections
+            SET icon_url = $1, color = $2
+            WHERE (id = $3)
+            ",
+            format!("{}/{}", cdn_url, upload_data.file_name),
+            color.map(|x| x as i32),
+            collection_item.id as database::models::ids::CollectionId,
+        )
+        .execute(&mut *transaction)
+        .await?;
+
+        database::models::Collection::clear_cache(collection_item.id, &redis).await?;
+
+        transaction.commit().await?;
+
+        Ok(HttpResponse::NoContent().body(""))
+    } else {
+        Err(ApiError::InvalidInput(format!(
+            "Invalid format for collection icon: {}",
+            ext.ext
+        )))
+    }
+}
+
+#[delete("{id}/icon")]
+pub async fn delete_collection_icon(
+    req: HttpRequest,
+    info: web::Path<(String,)>,
+    pool: web::Data<PgPool>,
+    redis: web::Data<deadpool_redis::Pool>,
+    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    session_queue: web::Data<AuthQueue>,
+) -> Result<HttpResponse, ApiError> {
+    let user_option = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Some(&[Scopes::COLLECTION_WRITE]),
+    )
+    .await
+    .map(|x| x.1)
+    .ok();
+    let string = info.into_inner().0;
+    let id = database::models::CollectionId(parse_base62(&string)? as i64);
+    let collection_item = database::models::Collection::get(id, &**pool, &redis)
+        .await?
+        .ok_or_else(|| {
+            ApiError::InvalidInput("The specified collection does not exist!".to_string())
+        })?;
+    if !is_authorized_collection(&collection_item, &user_option).await? {
+        return Ok(HttpResponse::Unauthorized().body(""));
+    }
+
+    let cdn_url = dotenvy::var("CDN_URL")?;
+    if let Some(icon) = collection_item.icon_url {
+        let name = icon.split(&format!("{cdn_url}/")).nth(1);
+
+        if let Some(icon_path) = name {
+            file_host.delete_file_version("", icon_path).await?;
+        }
+    }
+
+    let mut transaction = pool.begin().await?;
+
+    sqlx::query!(
+        "
+        UPDATE collections
+        SET icon_url = NULL, color = NULL
+        WHERE (id = $1)
+        ",
+        collection_item.id as database::models::ids::CollectionId,
+    )
+    .execute(&mut *transaction)
+    .await?;
+
+    database::models::Collection::clear_cache(collection_item.id, &redis).await?;
+
+    transaction.commit().await?;
+
+    Ok(HttpResponse::NoContent().body(""))
+}
+
+#[delete("{id}")]
+pub async fn collection_delete(
+    req: HttpRequest,
+    info: web::Path<(String,)>,
+    pool: web::Data<PgPool>,
+    redis: web::Data<deadpool_redis::Pool>,
+    session_queue: web::Data<AuthQueue>,
+) -> Result<HttpResponse, ApiError> {
+    let user_option = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Some(&[Scopes::COLLECTION_DELETE]),
+    )
+    .await
+    .map(|x| x.1)
+    .ok();
+
+    let string = info.into_inner().0;
+    let id = database::models::CollectionId(parse_base62(&string)? as i64);
+    let collection = database::models::Collection::get(id, &**pool, &redis)
+        .await?
+        .ok_or_else(|| {
+            ApiError::InvalidInput("The specified collection does not exist!".to_string())
+        })?;
+    if !is_authorized_collection(&collection, &user_option).await? {
+        return Ok(HttpResponse::Unauthorized().body(""));
+    }
+    let mut transaction = pool.begin().await?;
+
+    let result =
+        database::models::Collection::remove(collection.id, &mut transaction, &redis).await?;
+    database::models::Collection::clear_cache(collection.id, &redis).await?;
+
+    transaction.commit().await?;
+
+    if result.is_some() {
+        Ok(HttpResponse::NoContent().body(""))
+    } else {
+        Ok(HttpResponse::NotFound().body(""))
+    }
+}

src/routes/v2/images.rs

@@ -0,0 +1,233 @@
+use std::sync::Arc;
+
+use crate::auth::{get_user_from_headers, is_authorized, is_authorized_version};
+use crate::database;
+use crate::database::models::{project_item, report_item, thread_item, version_item};
+use crate::file_hosting::FileHost;
+use crate::models::ids::{ThreadMessageId, VersionId};
+use crate::models::images::{Image, ImageContext};
+use crate::models::reports::ReportId;
+use crate::queue::session::AuthQueue;
+use crate::routes::v2::threads::is_authorized_thread;
+use crate::routes::ApiError;
+use crate::util::routes::read_from_payload;
+use actix_web::{post, web, HttpRequest, HttpResponse};
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+
+pub fn config(cfg: &mut web::ServiceConfig) {
+    cfg.service(images_add);
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct ImageUpload {
+    pub ext: String,
+
+    // Context must be an allowed context
+    // currently: project, version, thread_message, report
+    pub context: String,
+
+    // Optional context id to associate with
+    pub project_id: Option<String>, // allow slug or id
+    pub version_id: Option<VersionId>,
+    pub thread_message_id: Option<ThreadMessageId>,
+    pub report_id: Option<ReportId>,
+}
+
+#[post("image")]
+pub async fn images_add(
+    req: HttpRequest,
+    web::Query(data): web::Query<ImageUpload>,
+    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    mut payload: web::Payload,
+    pool: web::Data<PgPool>,
+    redis: web::Data<deadpool_redis::Pool>,
+    session_queue: web::Data<AuthQueue>,
+) -> Result<HttpResponse, ApiError> {
+    if let Some(content_type) = crate::util::ext::get_image_content_type(&data.ext) {
+        let mut context = ImageContext::from_str(&data.context, None);
+
+        let scopes = vec![context.relevant_scope()];
+
+        let cdn_url = dotenvy::var("CDN_URL")?;
+        let user = get_user_from_headers(&req, &**pool, &redis, &session_queue, Some(&scopes))
+            .await?
+            .1;
+
+        // Attempt to associated a supplied id with the context
+        // If the context cannot be found, or the user is not authorized to upload images for the context, return an error
+        match &mut context {
+            ImageContext::Project { project_id } => {
+                if let Some(id) = data.project_id {
+                    let project = project_item::Project::get(&id, &**pool, &redis).await?;
+                    if let Some(project) = project {
+                        if is_authorized(&project.inner, &Some(user.clone()), &pool).await? {
+                            *project_id = Some(project.inner.id.into());
+                        } else {
+                            return Err(ApiError::CustomAuthentication(
+                                "You are not authorized to upload images for this project"
+                                    .to_string(),
+                            ));
+                        }
+                    } else {
+                        return Err(ApiError::InvalidInput(
+                            "The project could not be found.".to_string(),
+                        ));
+                    }
+                }
+            }
+            ImageContext::Version { version_id } => {
+                if let Some(id) = data.version_id {
+                    let version = version_item::Version::get(id.into(), &**pool, &redis).await?;
+                    if let Some(version) = version {
+                        if is_authorized_version(&version.inner, &Some(user.clone()), &pool).await?
+                        {
+                            *version_id = Some(version.inner.id.into());
+                        } else {
+                            return Err(ApiError::CustomAuthentication(
+                                "You are not authorized to upload images for this version"
+                                    .to_string(),
+                            ));
+                        }
+                    } else {
+                        return Err(ApiError::InvalidInput(
+                            "The version could not be found.".to_string(),
+                        ));
+                    }
+                }
+            }
+            ImageContext::ThreadMessage { thread_message_id } => {
+                if let Some(id) = data.thread_message_id {
+                    let thread_message = thread_item::ThreadMessage::get(id.into(), &**pool)
+                        .await?
+                        .ok_or_else(|| {
+                            ApiError::InvalidInput(
+                                "The thread message could not found.".to_string(),
+                            )
+                        })?;
+                    let thread = thread_item::Thread::get(thread_message.thread_id, &**pool)
+                        .await?
+                        .ok_or_else(|| {
+                            ApiError::InvalidInput(
+                                "The thread associated with the thread message could not be found"
+                                    .to_string(),
+                            )
+                        })?;
+                    if is_authorized_thread(&thread, &user, &pool).await? {
+                        *thread_message_id = Some(thread_message.id.into());
+                    } else {
+                        return Err(ApiError::CustomAuthentication(
+                            "You are not authorized to upload images for this thread message"
+                                .to_string(),
+                        ));
+                    }
+                }
+            }
+            ImageContext::Report { report_id } => {
+                if let Some(id) = data.report_id {
+                    let report = report_item::Report::get(id.into(), &**pool)
+                        .await?
+                        .ok_or_else(|| {
+                            ApiError::InvalidInput("The report could not be found.".to_string())
+                        })?;
+                    let thread = thread_item::Thread::get(report.thread_id, &**pool)
+                        .await?
+                        .ok_or_else(|| {
+                            ApiError::InvalidInput(
+                                "The thread associated with the report could not be found."
+                                    .to_string(),
+                            )
+                        })?;
+                    if is_authorized_thread(&thread, &user, &pool).await? {
+                        *report_id = Some(report.id.into());
+                    } else {
+                        return Err(ApiError::CustomAuthentication(
+                            "You are not authorized to upload images for this report".to_string(),
+                        ));
+                    }
+                }
+            }
+            ImageContext::Unknown => {
+                return Err(ApiError::InvalidInput(
+                    "Context must be one of: project, version, thread_message, report".to_string(),
+                ));
+            }
+        }
+
+        // Upload the image to the file host
+        let bytes =
+            read_from_payload(&mut payload, 1_048_576, "Icons must be smaller than 1MiB").await?;
+
+        let hash = sha1::Sha1::from(&bytes).hexdigest();
+        let upload_data = file_host
+            .upload_file(
+                content_type,
+                &format!("data/cached_images/{}.{}", hash, data.ext),
+                bytes.freeze(),
+            )
+            .await?;
+
+        let mut transaction = pool.begin().await?;
+
+        let db_image: database::models::Image = database::models::Image {
+            id: database::models::generate_image_id(&mut transaction).await?,
+            url: format!("{}/{}", cdn_url, upload_data.file_name),
+            size: upload_data.content_length as u64,
+            created: chrono::Utc::now(),
+            owner_id: database::models::UserId::from(user.id),
+            context: context.context_as_str().to_string(),
+            project_id: if let ImageContext::Project {
+                project_id: Some(id),
+            } = context
+            {
+                Some(database::models::ProjectId::from(id))
+            } else {
+                None
+            },
+            version_id: if let ImageContext::Version {
+                version_id: Some(id),
+            } = context
+            {
+                Some(database::models::VersionId::from(id))
+            } else {
+                None
+            },
+            thread_message_id: if let ImageContext::ThreadMessage {
+                thread_message_id: Some(id),
+            } = context
+            {
+                Some(database::models::ThreadMessageId::from(id))
+            } else {
+                None
+            },
+            report_id: if let ImageContext::Report {
+                report_id: Some(id),
+            } = context
+            {
+                Some(database::models::ReportId::from(id))
+            } else {
+                None
+            },
+        };
+
+        // Insert
+        db_image.insert(&mut transaction).await?;
+
+        let image = Image {
+            id: db_image.id.into(),
+            url: db_image.url,
+            size: db_image.size,
+            created: db_image.created,
+            owner_id: db_image.owner_id.into(),
+            context,
+        };
+
+        transaction.commit().await?;
+
+        Ok(HttpResponse::Ok().json(image))
+    } else {
+        Err(ApiError::InvalidInput(
+            "The specified file is not an image!".to_string(),
+        ))
+    }
+}

src/routes/v2/mod.rs

@@ -1,4 +1,6 @@
 mod admin;
+mod collections;
+mod images;
 mod analytics_get;
 mod moderation;
 mod notifications;
@@ -30,6 +32,8 @@ pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
             .configure(notifications::config)
             //.configure(pats::config)
             .configure(project_creation::config)
+            .configure(collections::config)
+            .configure(images::config)
             .configure(projects::config)
             .configure(reports::config)
             .configure(statistics::config)

src/routes/v2/project_creation.rs

@@ -1,9 +1,11 @@
 use super::version_creation::InitialVersionData;
 use crate::auth::{get_user_from_headers, AuthenticationError};
-use crate::database::models;
 use crate::database::models::thread_item::ThreadBuilder;
+use crate::database::models::{self, image_item};
 use crate::file_hosting::{FileHost, FileHostingError};
 use crate::models::error::ApiError;
+use crate::models::ids::ImageId;
+use crate::models::images::{Image, ImageContext};
 use crate::models::pats::Scopes;
 use crate::models::projects::{
     DonationLink, License, MonetizationStatus, ProjectId, ProjectStatus, SideType, VersionId,
@@ -233,6 +235,11 @@ struct ProjectCreateData {
     #[serde(default = "default_requested_status")]
     /// The status of the mod to be set once it is approved
     pub requested_status: ProjectStatus,
+
+    // Associations to uploaded images in body/description
+    #[validate(length(max = 10))]
+    #[serde(default)]
+    pub uploaded_images: Vec<ImageId>,
 }
 
 #[derive(Serialize, Deserialize, Validate, Clone)]
@@ -466,7 +473,6 @@ async fn project_create_inner(
                 .await?,
             );
         }
-
         project_create_data = create_data;
     }
 
@@ -512,7 +518,7 @@ async fn project_create_inner(
                 icon_data = Some(
                     process_icon_upload(
                         uploaded_files,
-                        project_id,
+                        project_id.0,
                         file_extension,
                         file_host,
                         field,
@@ -779,6 +785,41 @@ async fn project_create_inner(
 
         let id = project_builder_actual.insert(&mut *transaction).await?;
 
+        for image_id in project_create_data.uploaded_images {
+            if let Some(db_image) =
+                image_item::Image::get(image_id.into(), &mut *transaction, redis).await?
+            {
+                let image: Image = db_image.into();
+                if !matches!(image.context, ImageContext::Project { .. })
+                    || image.context.inner_id().is_some()
+                {
+                    return Err(CreateError::InvalidInput(format!(
+                        "Image {} is not unused and in the 'project' context",
+                        image_id
+                    )));
+                }
+
+                sqlx::query!(
+                    "
+                    UPDATE uploaded_images
+                    SET mod_id = $1
+                    WHERE id = $2
+                    ",
+                    id as models::ids::ProjectId,
+                    image_id.0 as i64
+                )
+                .execute(&mut *transaction)
+                .await?;
+
+                image_item::Image::clear_cache(image.id.into(), redis).await?;
+            } else {
+                return Err(CreateError::InvalidInput(format!(
+                    "Image {} does not exist",
+                    image_id
+                )));
+            }
+        }
+
         let thread_id = ThreadBuilder {
             type_: ThreadType::Project,
             members: vec![],
@@ -935,7 +976,7 @@ async fn create_initial_version(
 
 async fn process_icon_upload(
     uploaded_files: &mut Vec<UploadedFile>,
-    project_id: ProjectId,
+    id: u64,
     file_extension: &str,
     file_host: &dyn FileHost,
     mut field: Field,
@@ -950,7 +991,7 @@ async fn process_icon_upload(
         let upload_data = file_host
             .upload_file(
                 content_type,
-                &format!("data/{project_id}/{hash}.{file_extension}"),
+                &format!("data/{id}/{hash}.{file_extension}"),
                 data.freeze(),
             )
             .await?;

src/routes/v2/projects.rs

@@ -1,10 +1,12 @@
 use crate::auth::{filter_authorized_projects, get_user_from_headers, is_authorized};
 use crate::database;
+use crate::database::models::image_item;
 use crate::database::models::notification_item::NotificationBuilder;
 use crate::database::models::thread_item::ThreadMessageBuilder;
 use crate::file_hosting::FileHost;
 use crate::models;
 use crate::models::ids::base62_impl::parse_base62;
+use crate::models::images::ImageContext;
 use crate::models::notifications::NotificationBody;
 use crate::models::pats::Scopes;
 use crate::models::projects::{
@@ -15,6 +17,7 @@ use crate::models::threads::MessageBody;
 use crate::queue::session::AuthQueue;
 use crate::routes::ApiError;
 use crate::search::{search_for_project, SearchConfig, SearchError};
+use crate::util::img;
 use crate::util::routes::read_from_payload;
 use crate::util::validate::validation_errors_to_string;
 use actix_web::{delete, get, patch, post, web, HttpRequest, HttpResponse};
@@ -1112,6 +1115,18 @@ pub async fn project_edit(
                 .await?;
             }
 
+            // check new description and body for links to associated images
+            // if they no longer exist in the description or body, delete them
+            let checkable_strings: Vec<&str> = vec![&new_project.description, &new_project.body]
+                .into_iter()
+                .filter_map(|x| x.as_ref().map(|y| y.as_str()))
+                .collect();
+
+            let context = ImageContext::Project {
+                project_id: Some(id.into()),
+            };
+
+            img::delete_unused_images(context, checkable_strings, &mut transaction, &redis).await?;
             database::models::Project::clear_cache(
                 project_item.inner.id,
                 project_item.inner.slug,
@@ -2280,6 +2295,24 @@ pub async fn project_delete(
     }
 
     let mut transaction = pool.begin().await?;
+    let context = ImageContext::Project {
+        project_id: Some(project.inner.id.into()),
+    };
+    let uploaded_images =
+        database::models::Image::get_many_contexted(context, &mut transaction).await?;
+    for image in uploaded_images {
+        image_item::Image::remove(image.id, &mut transaction, &redis).await?;
+    }
+
+    sqlx::query!(
+        "
+        DELETE FROM collections_mods
+        WHERE mod_id = $1
+        ",
+        project.inner.id as database::models::ids::ProjectId,
+    )
+    .execute(&mut *transaction)
+    .await?;
 
     let result =
         database::models::Project::remove(project.inner.id, &mut transaction, &redis).await?;

src/routes/v2/reports.rs

@@ -1,11 +1,16 @@
 use crate::auth::{check_is_moderator_from_headers, get_user_from_headers};
+use crate::database;
+use crate::database::models::image_item;
 use crate::database::models::thread_item::{ThreadBuilder, ThreadMessageBuilder};
+use crate::models::ids::ImageId;
 use crate::models::ids::{base62_impl::parse_base62, ProjectId, UserId, VersionId};
+use crate::models::images::{Image, ImageContext};
 use crate::models::pats::Scopes;
 use crate::models::reports::{ItemType, Report};
 use crate::models::threads::{MessageBody, ThreadType};
 use crate::queue::session::AuthQueue;
 use crate::routes::ApiError;
+use crate::util::img;
 use actix_web::{delete, get, patch, post, web, HttpRequest, HttpResponse};
 use chrono::Utc;
 use futures::StreamExt;
@@ -22,12 +27,16 @@ pub fn config(cfg: &mut web::ServiceConfig) {
     cfg.service(report_get);
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Validate)]
 pub struct CreateReport {
     pub report_type: String,
     pub item_id: String,
     pub item_type: ItemType,
     pub body: String,
+    // Associations to uploaded images
+    #[validate(length(max = 10))]
+    #[serde(default)]
+    pub uploaded_images: Vec<ImageId>,
 }
 
 #[post("report")]
@@ -147,6 +156,42 @@ pub async fn report_create(
     }
 
     report.insert(&mut transaction).await?;
+
+    for image_id in new_report.uploaded_images {
+        if let Some(db_image) =
+            image_item::Image::get(image_id.into(), &mut *transaction, &redis).await?
+        {
+            let image: Image = db_image.into();
+            if !matches!(image.context, ImageContext::Report { .. })
+                || image.context.inner_id().is_some()
+            {
+                return Err(ApiError::InvalidInput(format!(
+                    "Image {} is not unused and in the 'report' context",
+                    image_id
+                )));
+            }
+
+            sqlx::query!(
+                "
+                UPDATE uploaded_images
+                SET report_id = $1
+                WHERE id = $2
+                ",
+                id.0 as i64,
+                image_id.0 as i64
+            )
+            .execute(&mut *transaction)
+            .await?;
+
+            image_item::Image::clear_cache(image.id.into(), &redis).await?;
+        } else {
+            return Err(ApiError::InvalidInput(format!(
+                "Image {} could not be found",
+                image_id
+            )));
+        }
+    }
+
     let thread_id = ThreadBuilder {
         type_: ThreadType::Report,
         members: vec![],
@@ -423,6 +468,17 @@ pub async fn report_edit(
             .await?;
         }
 
+        // delete any images no longer in the body
+        let checkable_strings: Vec<&str> = vec![&edit_report.body]
+            .into_iter()
+            .filter_map(|x: &Option<String>| x.as_ref().map(|y| y.as_str()))
+            .collect();
+        let image_context = ImageContext::Report {
+            report_id: Some(id.into()),
+        };
+        img::delete_unused_images(image_context, checkable_strings, &mut transaction, &redis)
+            .await?;
+
         transaction.commit().await?;
 
         Ok(HttpResponse::NoContent().body(""))
@@ -442,11 +498,20 @@ pub async fn report_delete(
     check_is_moderator_from_headers(&req, &**pool, &redis, &session_queue).await?;
 
     let mut transaction = pool.begin().await?;
-    let result = crate::database::models::report_item::Report::remove_full(
-        info.into_inner().0.into(),
-        &mut transaction,
-    )
-    .await?;
+
+    let id = info.into_inner().0;
+    let context = ImageContext::Report {
+        report_id: Some(id),
+    };
+    let uploaded_images =
+        database::models::Image::get_many_contexted(context, &mut transaction).await?;
+    for image in uploaded_images {
+        image_item::Image::remove(image.id, &mut transaction, &redis).await?;
+    }
+
+    let result =
+        crate::database::models::report_item::Report::remove_full(id.into(), &mut transaction)
+            .await?;
     transaction.commit().await?;
 
     if result.is_some() {

src/routes/v2/threads.rs

@@ -1,8 +1,13 @@
+use std::sync::Arc;
+
 use crate::auth::{check_is_moderator_from_headers, get_user_from_headers};
 use crate::database;
+use crate::database::models::image_item;
 use crate::database::models::notification_item::NotificationBuilder;
 use crate::database::models::thread_item::ThreadMessageBuilder;
+use crate::file_hosting::FileHost;
 use crate::models::ids::ThreadMessageId;
+use crate::models::images::{Image, ImageContext};
 use crate::models::notifications::NotificationBody;
 use crate::models::pats::Scopes;
 use crate::models::projects::ProjectStatus;
@@ -327,6 +332,7 @@ pub async fn thread_send_message(
         body,
         replying_to,
         private,
+        ..
     } = &new_message.body
     {
         if body.len() > 65536 {
@@ -452,6 +458,46 @@ pub async fn thread_send_message(
         .execute(&mut *transaction)
         .await?;
 
+        if let MessageBody::Text {
+            associated_images, ..
+        } = &new_message.body
+        {
+            for image_id in associated_images {
+                if let Some(db_image) =
+                    image_item::Image::get((*image_id).into(), &mut *transaction, &redis).await?
+                {
+                    let image: Image = db_image.into();
+                    if !matches!(image.context, ImageContext::ThreadMessage { .. })
+                        || image.context.inner_id().is_some()
+                    {
+                        return Err(ApiError::InvalidInput(format!(
+                            "Image {} is not unused and in the 'thread_message' context",
+                            image_id
+                        )));
+                    }
+
+                    sqlx::query!(
+                        "
+                        UPDATE uploaded_images
+                        SET thread_message_id = $1
+                        WHERE id = $2
+                        ",
+                        thread.id.0,
+                        image_id.0 as i64
+                    )
+                    .execute(&mut *transaction)
+                    .await?;
+
+                    image_item::Image::clear_cache(image.id.into(), &redis).await?;
+                } else {
+                    return Err(ApiError::InvalidInput(format!(
+                        "Image {} does not exist",
+                        image_id
+                    )));
+                }
+            }
+        }
+
         transaction.commit().await?;
 
         Ok(HttpResponse::NoContent().body(""))
@@ -523,6 +569,7 @@ pub async fn message_delete(
     pool: web::Data<PgPool>,
     redis: web::Data<deadpool_redis::Pool>,
     session_queue: web::Data<AuthQueue>,
+    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
         &req,
@@ -544,6 +591,20 @@ pub async fn message_delete(
         }
 
         let mut transaction = pool.begin().await?;
+
+        let context = ImageContext::ThreadMessage {
+            thread_message_id: Some(thread.id.into()),
+        };
+        let images = database::Image::get_many_contexted(context, &mut transaction).await?;
+        let cdn_url = dotenvy::var("CDN_URL")?;
+        for image in images {
+            let name = image.url.split(&format!("{cdn_url}/")).nth(1);
+            if let Some(icon_path) = name {
+                file_host.delete_file_version("", icon_path).await?;
+            }
+            database::Image::remove(image.id, &mut transaction, &redis).await?;
+        }
+
         database::models::ThreadMessage::remove_full(thread.id, &mut transaction).await?;
         transaction.commit().await?;
 

src/routes/v2/version_creation.rs

@@ -1,11 +1,12 @@
 use super::project_creation::{CreateError, UploadedFile};
 use crate::auth::get_user_from_headers;
-use crate::database::models;
 use crate::database::models::notification_item::NotificationBuilder;
 use crate::database::models::version_item::{
     DependencyBuilder, VersionBuilder, VersionFileBuilder,
 };
+use crate::database::models::{self, image_item};
 use crate::file_hosting::FileHost;
+use crate::models::images::{Image, ImageContext, ImageId};
 use crate::models::notifications::NotificationBody;
 use crate::models::pack::PackFileHash;
 use crate::models::pats::Scopes;
@@ -70,6 +71,10 @@ pub struct InitialVersionData {
     pub status: VersionStatus,
     #[serde(default = "HashMap::new")]
     pub file_types: HashMap<String, Option<FileType>>,
+    // Associations to uploaded images in changelog
+    #[validate(length(max = 10))]
+    #[serde(default)]
+    pub uploaded_images: Vec<ImageId>,
 }
 
 #[derive(Serialize, Deserialize, Clone)]
@@ -436,6 +441,41 @@ async fn version_create_inner(
     let project_id = builder.project_id;
     builder.insert(transaction).await?;
 
+    for image_id in version_data.uploaded_images {
+        if let Some(db_image) =
+            image_item::Image::get(image_id.into(), &mut *transaction, redis).await?
+        {
+            let image: Image = db_image.into();
+            if !matches!(image.context, ImageContext::Report { .. })
+                || image.context.inner_id().is_some()
+            {
+                return Err(CreateError::InvalidInput(format!(
+                    "Image {} is not unused and in the 'version' context",
+                    image_id
+                )));
+            }
+
+            sqlx::query!(
+                "
+                UPDATE uploaded_images
+                SET version_id = $1
+                WHERE id = $2
+                ",
+                version_id.0 as i64,
+                image_id.0 as i64
+            )
+            .execute(&mut *transaction)
+            .await?;
+
+            image_item::Image::clear_cache(image.id.into(), redis).await?;
+        } else {
+            return Err(CreateError::InvalidInput(format!(
+                "Image {} does not exist",
+                image_id
+            )));
+        }
+    }
+
     models::Project::update_game_versions(project_id, &mut *transaction).await?;
     models::Project::update_loaders(project_id, &mut *transaction).await?;
     models::Project::clear_cache(project_id, None, Some(true), redis).await?;

src/routes/v2/versions.rs

@@ -3,12 +3,15 @@ use crate::auth::{
     filter_authorized_versions, get_user_from_headers, is_authorized, is_authorized_version,
 };
 use crate::database;
+use crate::database::models::image_item;
 use crate::models;
 use crate::models::ids::base62_impl::parse_base62;
+use crate::models::images::ImageContext;
 use crate::models::pats::Scopes;
 use crate::models::projects::{Dependency, FileType, VersionStatus, VersionType};
 use crate::models::teams::Permissions;
 use crate::queue::session::AuthQueue;
+use crate::util::img;
 use crate::util::validate::validation_errors_to_string;
 use actix_web::{delete, get, patch, post, web, HttpRequest, HttpResponse};
 use chrono::{DateTime, Utc};
@@ -672,6 +675,17 @@ pub async fn version_edit(
                 }
             }
 
+            // delete any images no longer in the changelog
+            let checkable_strings: Vec<&str> = vec![&new_version.changelog]
+                .into_iter()
+                .filter_map(|x| x.as_ref().map(|y| y.as_str()))
+                .collect();
+            let context = ImageContext::Version {
+                version_id: Some(version_item.inner.id.into()),
+            };
+
+            img::delete_unused_images(context, checkable_strings, &mut transaction, &redis).await?;
+
             database::models::Version::clear_cache(&version_item, &redis).await?;
             database::models::Project::clear_cache(
                 version_item.inner.project_id,
@@ -823,6 +837,14 @@ pub async fn version_delete(
     }
 
     let mut transaction = pool.begin().await?;
+    let context = ImageContext::Version {
+        version_id: Some(version.inner.id.into()),
+    };
+    let uploaded_images =
+        database::models::Image::get_many_contexted(context, &mut transaction).await?;
+    for image in uploaded_images {
+        image_item::Image::remove(image.id, &mut transaction, &redis).await?;
+    }
 
     let result =
         database::models::Version::remove_full(version.inner.id, &redis, &mut transaction).await?;