Restrictive upload identification code makes it tricky to write theme components that use uploaded assets

Feature
1

Hi all,

Recently I wrote a Discourse theme component (GitHub - Beholder-Vision/discourse-insert-model-3d: A Discourse theme component for adding 3D models to topics) that allows Discourse admins to enable the upload and display of 3D models to their forums.

Things seemed to work well at first until I got a report that some uploaded models had disappeared, and then checking my own forum I saw that the uploaded assets (3D models and poster images) had been purged too Insert Model 3D - #2 by patrickemin.

Reading the docs (Understanding Uploads, Images, and Attachments), I had assumed that the uploaded assets would be ok because they were referenced by a post, but after doing some digging, I found this code, discourse/app/models/post.rb at 03bb43f7468d3aa6e73bba0805193ae50c7ec2d5 · discourse/discourse · GitHub that appears to be doing the work of identifying uploads on the server. From what I can make out, an uploaded file is only counted as being referenced by a post if it is referenced by one of a limited number of HTML tags. So a linked upload will be recognised if referenced by the href attribute of a <a> element but not if it’s referenced by the src attribute of a <model-viewer> element (which is what my new theme component adds in).

Can someone who is familiar with that code please confirm if my understanding here is correct or not? If that is correct then I think that people creating theme components can mark assets as uploads by generating a hidden <a> link that references the asset, but it would be really useful if the docs (Understanding Uploads, Images, and Attachments) could be updated to highlight this gotcha.

Many thanks
Alan

3 Likes
2

Your params and src are coming from a JSON parse, so doing this automatically feels tricky (to say the least).

I feel like, at a fundamental level, this is asking for the API to “hard attach” an upload to a post and flag it in such a way that it never gets cleaned up.

This kind of opens the floodgates to other issues (where can I see what uploads are hard-attached? What are the limits?).

That said, hard-attaching feels like the only clean way to resolve this.

A hidden link will indeed work as a workaround.

I am shifting this to a feature request because it is working as designed, but the API is not making your life easy here.

I will flag the dev-xp team, who may have more thoughts on this.