fix(12-05): store WinterCMS's broken-image thumbnail for an unusable original (T-12-16)

A photo whose original is missing, does not decode or declares more than
4096x4096 pixels made attach.File.Thumb return an error, and every listing
that shows the photo answered 500 from then on: one 100-byte PNG uploaded
by any household member broke GET collections and the album for everyone.

Thumb now follows WinterCMS's File::makeThumb catch branch: it logs the
reason at warn level, stores WinterCMS's BrokenImage picture (exported as
attach.BrokenImagePNG) under the thumbnail key and returns its URL. Invalid
arguments, storage errors and encode failures are still errors.

docs/database/attachments.md

@@ -84,7 +84,7 @@ fmt.Println(url)
 
 URLs start with `storage.uploads.public_path_prefix` (`/storage/uploads` by default). `attach.File.URL` returns the URL of the original, the path WinterCMS's `File::getPath()` returns, and `attach.PublicURL` the URL of any blob key; [Storage](../services/storage.md#the-wintercms-layout) shows the configuration that reproduces WinterCMS's URLs exactly.
 
-Originals in JPEG, PNG, GIF and WebP can be thumbnailed. The thumbnailer cannot write WebP, so the thumbnail of a `.webp` original holds JPEG bytes under the original's `.webp` name, and it is stored with the `image/jpeg` content type. Before decoding, the thumbnailer reads the image size from the file header and refuses an image larger than 4096 by 4096 pixels. `attach.StaticHandler` serves originals and thumbnails under that prefix; `attach.StaticHandlerPublic` does the same and answers 404 for a row whose `is_public` flag is false. Mount the gated handler when a bucket holds any private file.
+Originals in JPEG, PNG, GIF and WebP can be thumbnailed. The thumbnailer cannot write WebP, so the thumbnail of a `.webp` original holds JPEG bytes under the original's `.webp` name, and it is stored with the `image/jpeg` content type. Before decoding, the thumbnailer reads the image size from the file header, so an image larger than 4096 by 4096 pixels is never decoded. As WinterCMS's `File::makeThumb` does, an original that is missing, does not decode or is too large gets WinterCMS's 200 by 200 broken-image picture (`attach.BrokenImagePNG`) stored as its thumbnail, and the reason is logged at warn level: one unusable upload never makes the pages that list it fail. `attach.StaticHandler` serves originals and thumbnails under that prefix; `attach.StaticHandlerPublic` does the same and answers 404 for a row whose `is_public` flag is false. Mount the gated handler when a bucket holds any private file.
 
 > [!WARNING]
 > Serve uploads from a separate origin, or at least never mount the ungated handler on the application's own origin. An uploaded file served with its own content type from the API's origin can run script in that origin.

modules/lagoon/README.md

@@ -24,7 +24,7 @@ Postgres data layer: the shared GORM connection, per-plugin migrations, model he
 - Column types: `lagoon.Encrypted` stores AES-256-GCM ciphertext under a key derived from `app.key`, decrypts with previous keys during rotation, and always redacts itself in JSON and string output; `lagoon.Jsonable` stores JSON as TEXT and keeps SQL NULL distinct from an empty value.
 - Lifecycle and relations: hook interfaces matching GORM's native method names (`lagoon.HasBeforeCreate`, `lagoon.HasBeforeSave`, `lagoon.HasBeforeDelete`, `lagoon.HasAfterDelete`) plus `lagoon.HasBeforeValidate`; `lagoon.WithSoftDeleteCascade` runs a cascade inside the parent delete; `lagoon.RegisterJoinTable` wires pivot models with business columns.
 - Imports from Laravel: `lagoon.DecryptLaravelPayload` decrypts Laravel `encrypted` payloads with the old application key, for one-off data imports.
-- Attachments (`attach`): the `attach.File` model for `system_files` rows, WinterCMS-compatible partitioned storage keys (`attach.BlobKey`, `attach.PartitionDirectory`), public URLs (`attach.PublicURL` for any key, `attach.File.URL` for an original, matching WinterCMS's `File::getPath()` under the WinterCMS layout), on-demand thumbnails through `attach.File.Thumb` for JPEG, PNG, GIF and WebP originals (a WebP original's thumbnail is JPEG bytes under its `.webp` name, since WebP cannot be encoded), static serving with an optional `is_public` gate (`attach.StaticHandlerPublic`), and a two-phase delete that removes blobs only after the database transaction commits (`attach.DeleteForOwner`, `attach.DeleteKeys`).
+- Attachments (`attach`): the `attach.File` model for `system_files` rows, WinterCMS-compatible partitioned storage keys (`attach.BlobKey`, `attach.PartitionDirectory`), public URLs (`attach.PublicURL` for any key, `attach.File.URL` for an original, matching WinterCMS's `File::getPath()` under the WinterCMS layout), on-demand thumbnails through `attach.File.Thumb` for JPEG, PNG, GIF and WebP originals (a WebP original's thumbnail is JPEG bytes under its `.webp` name, since WebP cannot be encoded; a missing, undecodable or oversized original gets WinterCMS's broken-image picture, `attach.BrokenImagePNG`, as its thumbnail, as `File::makeThumb` does), static serving with an optional `is_public` gate (`attach.StaticHandlerPublic`), and a two-phase delete that removes blobs only after the database transaction commits (`attach.DeleteForOwner`, `attach.DeleteKeys`).
 
 ## Usage
 
@@ -153,6 +153,7 @@ func (p *Plugin) Migrations() []*gormigrate.Migration {
 | `lagoon.DecryptLaravelPayload` | Decrypts a Laravel AES-256-CBC payload for data imports. |
 | `attach.File` | The `system_files` row model; `attach.File.URL` is the public URL of the original. |
 | `attach.PublicURL` | Public URL of a blob key under `storage.uploads.public_path_prefix`. |
+| `attach.BrokenImagePNG` | WinterCMS's broken-image picture, stored as the thumbnail of an unusable original. |
 | `attach.Owner` | Implemented by models that own attachments; returns the stored morph type name. |
 | `attach.OpenBucket` | Opens the uploads bucket from config. |
 | `attach.Publish` | Stores the bucket on the `backpack.App`. |

modules/lagoon/attach/url_test.go

@@ -2,14 +2,19 @@ package attach
 
 import (
 	"bytes"
+	"encoding/binary"
+	"fmt"
+	"hash/crc32"
 	"image"
 	"image/jpeg"
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"git.golem15.com/golem15/summercms/modules/compass"
 	"gocloud.dev/blob"
+	"gocloud.dev/blob/memblob"
 )
 
 // winterLayoutBucket opens a mem:// bucket with the WinterCMS public prefix
@@ -105,3 +110,88 @@ func TestThumbWebP(t *testing.T) {
 		t.Fatalf("thumb size = %v", b)
 	}
 }
+
+// pngHeaderOnly is a PNG holding only a valid IHDR (w x h, 8-bit RGBA) and
+// IEND: image.DecodeConfig accepts it, a full decode would allocate w*h*4
+// bytes.
+func pngHeaderOnly(w, h uint32) []byte {
+	var buf bytes.Buffer
+	buf.WriteString("\x89PNG\r\n\x1a\n")
+	chunk := func(typ string, data []byte) {
+		_ = binary.Write(&buf, binary.BigEndian, uint32(len(data)))
+		buf.WriteString(typ)
+		buf.Write(data)
+		sum := crc32.NewIEEE()
+		sum.Write([]byte(typ))
+		sum.Write(data)
+		_ = binary.Write(&buf, binary.BigEndian, sum.Sum32())
+	}
+	ihdr := make([]byte, 13)
+	binary.BigEndian.PutUint32(ihdr[0:], w)
+	binary.BigEndian.PutUint32(ihdr[4:], h)
+	ihdr[8], ihdr[9] = 8, 6
+	chunk("IHDR", ihdr)
+	chunk("IEND", nil)
+	return buf.Bytes()
+}
+
+// TestThumbBrokenSourceServesPlaceholder: as WinterCMS's File::makeThumb
+// does, an original that is missing, does not decode, or declares more
+// pixels than the thumbnailer accepts gets WinterCMS's 200x200 broken-image
+// picture as its thumbnail instead of an error, so one bad upload can never
+// make every later listing fail (T-12-16). The placeholder is stored under
+// the thumbnail key and reused. Invalid arguments are still errors.
+func TestThumbBrokenSourceServesPlaceholder(t *testing.T) {
+	ctx := t.Context()
+	bucket := memblob.OpenBucket(nil)
+	t.Cleanup(func() { _ = bucket.Close() })
+	cases := []struct {
+		name     string
+		original []byte // nil: no blob at all
+	}{
+		{"missing", nil},
+		{"undecodable", []byte("plain text, not an image")},
+		{"huge-canvas", pngHeaderOnly(30000, 30000)},
+	}
+	for i, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			f := &File{ID: uint(100 + i), DiskName: fmt.Sprintf("abc%03ddefghij.png", i)}
+			if tc.original != nil {
+				if err := bucket.WriteAll(ctx, BlobKey(f.DiskName), tc.original, nil); err != nil {
+					t.Fatal(err)
+				}
+			}
+			start := time.Now()
+			url, err := f.Thumb(ctx, bucket, 200, 200, "crop")
+			if err != nil {
+				t.Fatalf("Thumb: %v", err)
+			}
+			if time.Since(start) > 2*time.Second {
+				t.Fatalf("Thumb took %s", time.Since(start))
+			}
+			key := PartitionDirectory(f.DiskName) + ThumbFilename(f.ID, 200, 200, 0, 0, "crop", "png")
+			if url != PublicURL(key) {
+				t.Fatalf("url %q, want %q", url, PublicURL(key))
+			}
+			stored, err := bucket.ReadAll(ctx, key)
+			if err != nil {
+				t.Fatal(err)
+			}
+			cfg, format, err := image.DecodeConfig(bytes.NewReader(stored))
+			if err != nil || format != "png" || cfg.Width != 200 || cfg.Height != 200 {
+				t.Fatalf("placeholder is not the 200x200 PNG: %s %dx%d %v", format, cfg.Width, cfg.Height, err)
+			}
+			again, err := f.Thumb(ctx, bucket, 200, 200, "crop")
+			if err != nil || again != url {
+				t.Fatalf("second call: %q %v", again, err)
+			}
+		})
+	}
+	f := &File{ID: 1, DiskName: "abcdefghijkl.png"}
+	if _, err := f.Thumb(ctx, bucket, 200, 200, "../x"); err == nil {
+		t.Fatal("an invalid mode must stay an error")
+	}
+	if _, err := f.Thumb(ctx, bucket, 5000, 200, "crop"); err == nil {
+		t.Fatal("an out-of-range size must stay an error")
+	}
+}