feat: add file list

Author: PttCodingMan

backend/app/database.py

@@ -93,6 +93,14 @@
     uploaded_at   TIMESTAMP DEFAULT CURRENT_TIMESTAMP
 );
 
+CREATE TABLE IF NOT EXISTS media_references (
+    page_id  INTEGER NOT NULL REFERENCES pages(id) ON DELETE CASCADE,
+    media_id INTEGER NOT NULL REFERENCES media(id) ON DELETE CASCADE,
+    PRIMARY KEY (page_id, media_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_media_refs_media ON media_references(media_id);
+
 CREATE TABLE IF NOT EXISTS diagrams (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
     page_id    INTEGER REFERENCES pages(id) ON DELETE SET NULL,
@@ -881,6 +889,21 @@ async def rebuild_all_backlinks(db):
         await db.commit()
 
 
+async def rebuild_all_media_refs(db):
+    """Rebuild media_references for all existing pages (one-time backfill)."""
+    from app.services.media_ref import parse_and_update_media_refs
+
+    rows = await db.execute_fetchall("SELECT COUNT(*) as cnt FROM media_references")
+    if rows[0]["cnt"] > 0:
+        return  # Already populated
+
+    pages = await db.execute_fetchall("SELECT id, content_md FROM pages")
+    for p in pages:
+        await parse_and_update_media_refs(db, p["id"], p["content_md"])
+    if pages:
+        await db.commit()
+
+
 async def seed_welcome_page(db):
     """Create a welcome/guide page on first launch when no pages exist."""
     # Ensure logo.png exists in media directory (independent of whether pages exist)
@@ -999,6 +1022,9 @@ async def init_db():
     # Rebuild backlinks for existing pages
     await rebuild_all_backlinks(db)
 
+    # Rebuild media references for existing pages
+    await rebuild_all_media_refs(db)
+
     # Seed default templates
     for t in DEFAULT_TEMPLATES:
         existing = await db.execute_fetchall(

backend/app/routers/media.py

@@ -2,8 +2,8 @@
 from pathlib import Path
 from fastapi import APIRouter, UploadFile, File, Depends, HTTPException
 from fastapi.responses import FileResponse
-from app.schemas import MediaResponse
-from app.auth import get_current_user
+from app.schemas import MediaResponse, MediaListItem
+from app.auth import get_current_user, require_admin
 from app.config import settings
 from app.database import get_db
 
@@ -55,6 +55,80 @@ async def upload_media(
     }
 
 
+@router.get("", response_model=list[MediaListItem])
+async def list_media(user=Depends(get_current_user)):
+    """List all uploaded media with reference counts and linked pages.
+
+    Any authenticated user can browse the library (same permission level as
+    uploading), but only admins can delete entries.
+    """
+    db = await get_db()
+    rows = await db.execute_fetchall(
+        """SELECT m.id, m.filename, m.original_name, m.mime_type, m.size_bytes,
+                  m.uploaded_by, m.uploaded_at,
+                  CASE WHEN u.display_name IS NOT NULL AND u.display_name != ''
+                       THEN u.display_name ELSE u.username END AS uploaded_by_name,
+                  (SELECT COUNT(*) FROM media_references r
+                                    JOIN pages p ON p.id = r.page_id
+                                    WHERE r.media_id = m.id AND p.deleted_at IS NULL) AS reference_count
+           FROM media m
+           LEFT JOIN users u ON u.id = m.uploaded_by
+           ORDER BY m.uploaded_at DESC"""
+    )
+
+    items: list[dict] = []
+    for r in rows:
+        item = dict(r)
+        pages = await db.execute_fetchall(
+            """SELECT p.id, p.slug, p.title
+               FROM media_references mr
+               JOIN pages p ON p.id = mr.page_id
+               WHERE mr.media_id = ? AND p.deleted_at IS NULL
+               ORDER BY p.title""",
+            (item["id"],),
+        )
+        item["referenced_pages"] = [dict(p) for p in pages]
+        item["url"] = f"/api/media/{item['filename']}"
+        items.append(item)
+    return items
+
+
+@router.delete("/{media_id}", status_code=204)
+async def delete_media(media_id: int, user=Depends(require_admin)):
+    """Delete an uploaded media file. Refuses if any live page still references it."""
+    db = await get_db()
+    rows = await db.execute_fetchall(
+        "SELECT filename, filepath FROM media WHERE id = ?", (media_id,)
+    )
+    if not rows:
+        raise HTTPException(status_code=404, detail="Media not found")
+
+    ref_rows = await db.execute_fetchall(
+        """SELECT COUNT(*) AS cnt
+           FROM media_references mr
+           JOIN pages p ON p.id = mr.page_id
+           WHERE mr.media_id = ? AND p.deleted_at IS NULL""",
+        (media_id,),
+    )
+    if ref_rows[0]["cnt"] > 0:
+        raise HTTPException(
+            status_code=409,
+            detail="Media is referenced by one or more pages and cannot be deleted",
+        )
+
+    # Remove the file on disk. Guard against path traversal and missing files.
+    media_dir = Path(settings.MEDIA_DIR).resolve()
+    filepath = (media_dir / rows[0]["filename"]).resolve()
+    if str(filepath).startswith(str(media_dir) + "/") and filepath.exists():
+        try:
+            filepath.unlink()
+        except OSError:
+            pass  # Row deletion still proceeds; orphan file can be cleaned later.
+
+    await db.execute("DELETE FROM media WHERE id = ?", (media_id,))
+    await db.commit()
+
+
 @router.get("/{filename}")
 async def get_media(filename: str):
     media_dir = Path(settings.MEDIA_DIR).resolve()

backend/app/routers/pages.py

@@ -6,6 +6,7 @@
 from app.database import get_db
 from app.services.search import rebuild_search_index, remove_from_search_index
 from app.services.wikilink import parse_and_update_backlinks
+from app.services.media_ref import parse_and_update_media_refs
 from app.routers.activity import log_activity
 from app.routers.versions import save_version
 
@@ -132,6 +133,8 @@ async def create_page(body: PageCreate, user=Depends(get_current_user)):
     await rebuild_search_index(db, page_id, body.title, content)
     # Parse wikilinks → update backlinks
     await parse_and_update_backlinks(db, page_id, content)
+    # Parse media URLs → update media_references
+    await parse_and_update_media_refs(db, page_id, content)
     # Log activity
     await log_activity(db, user["id"], "created", "page", page_id, {"title": body.title, "slug": slug})
     await db.commit()
@@ -223,6 +226,8 @@ async def update_page(slug: str, body: PageUpdate, user=Depends(get_current_user
     await rebuild_search_index(db, current["id"], title, content)
     # Parse wikilinks → update backlinks
     await parse_and_update_backlinks(db, current["id"], content)
+    # Parse media URLs → update media_references
+    await parse_and_update_media_refs(db, current["id"], content)
     # Log activity
     if content_changed or title_changed:
         await log_activity(db, user["id"], "updated", "page", current["id"], {"title": title, "slug": slug})

backend/app/schemas.py

@@ -109,6 +109,26 @@ class MediaResponse(BaseModel):
     url: str = ""
 
 
+class MediaReferencedPage(BaseModel):
+    id: int
+    slug: str
+    title: str
+
+
+class MediaListItem(BaseModel):
+    id: int
+    filename: str
+    original_name: str
+    mime_type: str
+    size_bytes: Optional[int] = None
+    uploaded_by: Optional[int] = None
+    uploaded_by_name: Optional[str] = None
+    uploaded_at: Optional[str] = None
+    url: str = ""
+    reference_count: int = 0
+    referenced_pages: list[MediaReferencedPage] = []
+
+
 # ── Diagrams ──
 class DiagramCreate(BaseModel):
     name: str

backend/app/services/media_ref.py

@@ -0,0 +1,32 @@
+import re
+
+# Match /api/media/{filename} inside markdown image tags, plain URLs, or HTML attrs.
+# Filename is whatever isn't a quote, paren, whitespace, or closing bracket.
+MEDIA_URL_RE = re.compile(r'/api/media/([^\s"\'()<>\]]+)')
+
+
+def extract_media_filenames(content_md: str) -> set[str]:
+    """Extract all referenced media filenames from markdown content."""
+    return {m.group(1) for m in MEDIA_URL_RE.finditer(content_md or "")}
+
+
+async def parse_and_update_media_refs(db, page_id: int, content_md: str):
+    """Parse media URLs from content and update the media_references table."""
+    filenames = extract_media_filenames(content_md)
+
+    await db.execute("DELETE FROM media_references WHERE page_id = ?", (page_id,))
+
+    if not filenames:
+        return
+
+    placeholders = ",".join("?" for _ in filenames)
+    rows = await db.execute_fetchall(
+        f"SELECT id FROM media WHERE filename IN ({placeholders})",
+        list(filenames),
+    )
+
+    for row in rows:
+        await db.execute(
+            "INSERT OR IGNORE INTO media_references (page_id, media_id) VALUES (?, ?)",
+            (page_id, row["id"]),
+        )

backend/tests/test_media.py

@@ -1,11 +1,14 @@
 import pytest
 
+from app.services.media_ref import extract_media_filenames
+
+
 @pytest.mark.asyncio
 async def test_media_upload_and_get(auth_client):
     # Mock a file upload
     file_content = b"fake image content"
     files = {"file": ("test.png", file_content, "image/png")}
-    
+
     response = await auth_client.post("/api/media/upload", files=files)
     assert response.status_code == 201
     data = response.json()
@@ -16,3 +19,105 @@ async def test_media_upload_and_get(auth_client):
     response = await auth_client.get(f"/api/media/{filename}")
     assert response.status_code == 200
     assert response.content == file_content
+
+
+def test_extract_media_filenames_markdown_image():
+    md = "![alt](/api/media/abc123.png)"
+    assert extract_media_filenames(md) == {"abc123.png"}
+
+
+def test_extract_media_filenames_multiple_and_html():
+    md = """
+    ![one](/api/media/one.png)
+    <img src="/api/media/two.jpg" />
+    Plain link: /api/media/three.pdf
+    """
+    assert extract_media_filenames(md) == {"one.png", "two.jpg", "three.pdf"}
+
+
+def test_extract_media_filenames_empty():
+    assert extract_media_filenames("") == set()
+    assert extract_media_filenames("no media here") == set()
+
+
+@pytest.mark.asyncio
+async def test_media_list_available_to_editors(auth_client):
+    # Any authenticated user can browse the library to reuse assets.
+    response = await auth_client.get("/api/media")
+    assert response.status_code == 200
+    assert isinstance(response.json(), list)
+
+
+@pytest.mark.asyncio
+async def test_media_list_shows_upload_with_zero_refs(admin_client):
+    files = {"file": ("zero.png", b"zero", "image/png")}
+    up = await admin_client.post("/api/media/upload", files=files)
+    assert up.status_code == 201
+    uploaded = up.json()
+
+    response = await admin_client.get("/api/media")
+    assert response.status_code == 200
+    items = response.json()
+    match = next((m for m in items if m["id"] == uploaded["id"]), None)
+    assert match is not None
+    assert match["reference_count"] == 0
+    assert match["referenced_pages"] == []
+    assert match["url"] == f"/api/media/{uploaded['filename']}"
+
+
+@pytest.mark.asyncio
+async def test_media_reference_tracking_and_delete(admin_client):
+    files = {"file": ("ref.png", b"ref", "image/png")}
+    up = await admin_client.post("/api/media/upload", files=files)
+    media = up.json()
+
+    # Create a page that references the uploaded media
+    page_body = {
+        "title": "References media",
+        "content_md": f"Here is an image: ![x](/api/media/{media['filename']})",
+    }
+    page_resp = await admin_client.post("/api/pages", json=page_body)
+    assert page_resp.status_code == 201
+    page = page_resp.json()
+
+    # The list endpoint should now report 1 reference
+    listing = await admin_client.get("/api/media")
+    match = next(m for m in listing.json() if m["id"] == media["id"])
+    assert match["reference_count"] == 1
+    assert len(match["referenced_pages"]) == 1
+    assert match["referenced_pages"][0]["slug"] == page["slug"]
+
+    # Delete should be blocked while referenced
+    blocked = await admin_client.delete(f"/api/media/{media['id']}")
+    assert blocked.status_code == 409
+
+    # Remove the reference by updating the page
+    upd = await admin_client.put(
+        f"/api/pages/{page['slug']}",
+        json={"content_md": "No media anymore"},
+    )
+    assert upd.status_code == 200
+
+    listing2 = await admin_client.get("/api/media")
+    match2 = next(m for m in listing2.json() if m["id"] == media["id"])
+    assert match2["reference_count"] == 0
+
+    # Delete should now succeed
+    ok = await admin_client.delete(f"/api/media/{media['id']}")
+    assert ok.status_code == 204
+
+    # The media entry is gone
+    listing3 = await admin_client.get("/api/media")
+    assert all(m["id"] != media["id"] for m in listing3.json())
+
+
+@pytest.mark.asyncio
+async def test_media_delete_non_admin_forbidden(auth_client):
+    response = await auth_client.delete("/api/media/1")
+    assert response.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_media_delete_not_found(admin_client):
+    response = await admin_client.delete("/api/media/99999999")
+    assert response.status_code == 404