feat: delete orphaned files when their post is deleted

extend.php

@@ -19,6 +19,7 @@
 use Flarum\Gdpr\Extend\UserData;
 use Flarum\Post\Event\Posted;
 use Flarum\Post\Event\Revised;
+use Flarum\Post\Post;
 use Flarum\Search\Database\DatabaseSearchDriver;
 use Flarum\Settings\Event\Deserializing;
 use Flarum\Settings\SettingsRepositoryInterface;
@@ -132,6 +133,8 @@
         ->listen(Revised::class, Listeners\LinkFilesToPostOnSave::class)
         ->listen(WillBeUploaded::class, Listeners\AddImageProcessor::class),
 
+    new Extend\ModelObserver(Post::class, Listeners\CleanUpFilesOnPostDelete::class),
+
     (new Extend\Filesystem())
         ->disk('private-shared', Extenders\PrivateSharedDiskConfig::class),
 
@@ -162,7 +165,8 @@
         ->default('fof-upload.svgAnimateAllowed', false)
         ->default('fof-upload.generateThumbnails', true)
         ->default('fof-upload.thumbnailWebp', true)
-        ->default('fof-upload.thumbnailMaxWidth', 1000),
+        ->default('fof-upload.thumbnailMaxWidth', 1000)
+        ->default('fof-upload.deleteFilesOnPostDelete', false),
 
     new Extenders\AddPostDownloadTags(),
     new Extenders\CreateStorageFolder('tmp'),

js/src/admin/components/UploadPage.tsx

@@ -120,6 +120,7 @@ export default class UploadPage extends ExtensionPage<ExtensionPageAttrs> {
       'addsWatermarks',
       'disableHotlinkProtection',
       'disableDownloadLogging',
+      'deleteFilesOnPostDelete',
       'awsS3UsePathStyleEndpoint',
       'svgAnimateAllowed',
     ];
@@ -479,6 +480,13 @@ export default class UploadPage extends ExtensionPage<ExtensionPageAttrs> {
                     {app.translator.trans('fof-upload.admin.labels.disable-download-logging.toggle')}
                   </Switch>
                 </div>
+                <legend>{app.translator.trans('fof-upload.admin.labels.delete-files-on-post-delete.title')}</legend>
+                <p className="helpText">{app.translator.trans('fof-upload.admin.help_texts.delete-files-on-post-delete')}</p>
+                <div className="Form-group">
+                  <Switch state={this.values.deleteFilesOnPostDelete() || false} onchange={this.values.deleteFilesOnPostDelete}>
+                    {app.translator.trans('fof-upload.admin.labels.delete-files-on-post-delete.toggle')}
+                  </Switch>
+                </div>
               </fieldset>
 
               {!this.uploadLocalCdnSetByEnv && (

resources/locale/en.yml

@@ -23,6 +23,10 @@ fof-upload:
       title: Upload
       description: Set up uploading services and preferences.
     help_texts:
+      delete-files-on-post-delete: |
+        When enabled, files exclusively attached to a deleted post are immediately removed from storage and the database.
+        Files referenced by multiple posts are not affected. When disabled (default), orphaned files are only removed
+        when the cleanup command is run manually: php flarum fof:upload --cleanup
       disable-download-logging: |
         Disable logging every download made by users of your forum. Keeping it enabled allows you to view the number of downloads and other metrics in the nearby future.
       disable-hotlink-protection: |
@@ -67,6 +71,9 @@ fof-upload:
         use_path_style_endpoint: Use path style endpoint
         acl: Access Control List (ACL)
         custom_url: Custom S3 URL
+      delete-files-on-post-delete:
+        title: File cleanup on post deletion
+        toggle: Delete uploaded files when the containing post is deleted
       disable-download-logging:
         title: Disable logging downloads
         toggle: Disable

src/Listeners/CleanUpFilesOnPostDelete.php

@@ -0,0 +1,58 @@
+<?php
+
+/*
+ * This file is part of fof/upload.
+ *
+ * Copyright (c) FriendsOfFlarum.
+ * Copyright (c) Flagrow.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace FoF\Upload\Listeners;
+
+use Flarum\Post\Post;
+use Flarum\Settings\SettingsRepositoryInterface;
+use FoF\Upload\Adapters\Manager;
+
+class CleanUpFilesOnPostDelete
+{
+    public function __construct(
+        private SettingsRepositoryInterface $settings,
+        private Manager $manager,
+    ) {
+    }
+
+    /**
+     * Fires before the post is deleted (and before the DB cascade removes pivot rows),
+     * so we can still read which files are associated with this post.
+     */
+    public function deleting(Post $post): void
+    {
+        if (!$this->settings->get('fof-upload.deleteFilesOnPostDelete', false)) {
+            return;
+        }
+
+        // Load files now — before the cascade wipes the fof_upload_file_posts rows.
+        $files = $post->files()
+            ->where('shared', false)
+            ->get();
+
+        foreach ($files as $file) {
+            // Only delete if this post is the file's sole association.
+            // posts()->count() is still accurate here because the cascade hasn't run yet.
+            if ($file->posts()->count() !== 1) {
+                // File is referenced by other posts — leave it; cascade removes only this pivot row.
+                continue;
+            }
+
+            $adapter = $this->manager->instantiate($file->upload_method);
+
+            if ($adapter->delete($file)) {
+                $file->delete();
+            }
+            // If storage deletion fails we leave the DB record intact — no silent data loss.
+        }
+    }
+}