release: v1.2.0 — unified images/ storage and legacy migration

Consolidate local images under data/images/, add docker migrate CLI,
startup index sync with orphan cleanup, and remove upload folder UI/API.

server/api/images/batch-delete.post.ts

@@ -3,8 +3,9 @@ import { requireApiOrAdminAuth, assertImageOwnership, resolveActivitySource } fr
 import { createApiError } from '../../utils/api-error'
 import { MAX_DELETE_BATCH } from '../../utils/constants'
 import { insertActivityLog } from '../../utils/db'
-import { validateImageKey } from '../../utils/image-key'
-import { deleteImage, headImage } from '../../utils/storage'
+import { getImageIndexRow, deleteImageIndex } from '../../utils/image-index'
+import { toCanonicalImageKey, validateImageKey } from '../../utils/image-key'
+import { deleteImage, headImage, resolveStorageImageKey } from '../../utils/storage'
 import { logInfo } from '../../utils/logger'
 
 interface BatchDeleteBody {
@@ -33,7 +34,11 @@ export default defineEventHandler(async (event) => {
     }
 
     for (const key of keys) {
-      if (!validateImageKey(key)) {
+      if (
+        !validateImageKey(key)
+        && !toCanonicalImageKey(key)
+        && !getImageIndexRow(key)
+      ) {
         createApiError(event, 'INVALID_IMAGE_KEY', `无效的图片路径: ${key}`, 400)
       }
     }
@@ -43,7 +48,38 @@ export default defineEventHandler(async (event) => {
 
     for (const key of keys) {
       try {
-        const existing = await headImage(key)
+        const storageKey = await resolveStorageImageKey(key) ?? key
+        const existing = await headImage(storageKey)
+        const indexed = getImageIndexRow(key) ?? getImageIndexRow(storageKey)
+
+        if (!existing && indexed) {
+          try {
+            await assertImageOwnership(event, indexed.user_id)
+          } catch {
+            failed.push({
+              key,
+              error: { code: 'FORBIDDEN', message: '无权操作此图片' }
+            })
+            continue
+          }
+
+          deleteImageIndex(key)
+          if (storageKey !== key) deleteImageIndex(storageKey)
+
+          deleted.push(key)
+          insertActivityLog({
+            action: 'delete',
+            key,
+            originalName: indexed.original_name,
+            size: indexed.size,
+            contentType: indexed.content_type,
+            source: resolveActivitySource(event),
+            userId: indexed.user_id ?? null,
+            backendId: indexed.backend_id ?? null
+          })
+          logInfo('delete orphan index', { key })
+          continue
+        }
 
         if (!existing) {
           failed.push({
@@ -63,7 +99,7 @@ export default defineEventHandler(async (event) => {
           continue
         }
 
-        await deleteImage(key)
+        await deleteImage(storageKey, key)
         deleted.push(key)
 
         insertActivityLog({
@@ -77,7 +113,7 @@ export default defineEventHandler(async (event) => {
           backendId: existing.backendId ?? null
         })
 
-        logInfo('delete success', { key, size: existing.size })
+        logInfo('delete success', { key: storageKey, size: existing.size })
       } catch {
         failed.push({
           key,

server/api/images/count.get.ts

@@ -1,5 +1,4 @@
 import { getImageUserFilter, requireApiOrAdminAuth } from '../../utils/access'
-import { isValidFolderName } from '../../utils/image-key'
 import { readBackendIdQuery } from '../../utils/image-query'
 import { createApiError } from '../../utils/api-error'
 import { countImages } from '../../utils/storage'
@@ -9,14 +8,12 @@ export default defineEventHandler(async (event) => {
   const userFilter = await getImageUserFilter(event)
 
   const query = getQuery(event)
-  const raw = typeof query.folder === 'string' ? query.folder.trim() : ''
-  const folder = raw && raw !== 'all' && isValidFolderName(raw) ? raw : undefined
   const backendId = readBackendIdQuery(query)
   if (backendId === null) {
     createApiError(event, 'INVALID_REQUEST', '无效的存储后端', 400)
   }
 
-  const total = await countImages(folder, userFilter, backendId)
+  const total = await countImages(userFilter, backendId)
 
   return { total }
 })

server/api/images/index.delete.ts

@@ -2,8 +2,9 @@ import type { DeleteResponse } from '~/types/image'
 import { requireApiOrAdminAuth, assertImageOwnership, resolveActivitySource } from '../../utils/access'
 import { createApiError } from '../../utils/api-error'
 import { insertActivityLog } from '../../utils/db'
-import { validateImageKey } from '../../utils/image-key'
-import { deleteImage, headImage } from '../../utils/storage'
+import { getImageIndexRow, deleteImageIndex } from '../../utils/image-index'
+import { toCanonicalImageKey, validateImageKey } from '../../utils/image-key'
+import { deleteImage, headImage, resolveStorageImageKey } from '../../utils/storage'
 import { logInfo } from '../../utils/logger'
 
 interface DeleteBody {
@@ -19,11 +20,43 @@ export default defineEventHandler(async (event) => {
     const key = (typeof query.key === 'string' ? query.key : undefined)
       ?? body?.key
 
-    if (!key || !validateImageKey(key)) {
+    if (
+      !key
+      || (
+        !validateImageKey(key)
+        && !toCanonicalImageKey(key)
+        && !getImageIndexRow(key)
+      )
+    ) {
       createApiError(event, 'INVALID_IMAGE_KEY', '无效的图片路径', 400)
     }
 
-    const existing = await headImage(key)
+    const storageKey = await resolveStorageImageKey(key) ?? key
+    const existing = await headImage(storageKey)
+    const indexed = getImageIndexRow(key) ?? getImageIndexRow(storageKey)
+
+    if (!existing && indexed) {
+      await assertImageOwnership(event, indexed.user_id)
+      deleteImageIndex(key)
+      if (storageKey !== key) deleteImageIndex(storageKey)
+
+      insertActivityLog({
+        action: 'delete',
+        key,
+        originalName: indexed.original_name,
+        size: indexed.size,
+        contentType: indexed.content_type,
+        source: resolveActivitySource(event),
+        userId: indexed.user_id ?? null,
+        backendId: indexed.backend_id ?? null
+      })
+
+      logInfo('delete orphan index', { key })
+
+      const response: DeleteResponse = { success: true }
+      return response
+    }
+
     if (!existing) {
       createApiError(event, 'IMAGE_NOT_FOUND', '图片不存在', 404)
     }
@@ -31,7 +64,7 @@ export default defineEventHandler(async (event) => {
     await assertImageOwnership(event, existing.userId)
 
     try {
-      await deleteImage(key)
+      await deleteImage(storageKey, key)
     } catch {
       createApiError(event, 'DELETE_FAILED', '删除失败', 500)
     }
@@ -47,7 +80,7 @@ export default defineEventHandler(async (event) => {
       backendId: existing.backendId ?? null
     })
 
-    logInfo('delete success', { key, size: existing.size })
+    logInfo('delete success', { key: storageKey, size: existing.size })
 
     const response: DeleteResponse = { success: true }
     return response

server/api/images/index.get.ts

@@ -9,16 +9,9 @@ import { createApiError } from '../../utils/api-error'
 import { listUserIdUsernameMap } from '../../utils/db'
 import { mapStoredImageToItem } from '../../utils/image-response'
 import { listStorageBackendNameMap } from '../../utils/storage-backends'
-import { isValidFolderName } from '../../utils/image-key'
 import { readBackendIdQuery } from '../../utils/image-query'
 import { listImages } from '../../utils/storage'
 
-function readFolderQuery(query: Record<string, unknown>): string | undefined {
-  const raw = typeof query.folder === 'string' ? query.folder.trim() : ''
-  if (!raw || raw === 'all') return undefined
-  return isValidFolderName(raw) ? raw : undefined
-}
-
 export default defineEventHandler(async (event) => {
   await requireApiOrAdminAuth(event)
 
@@ -34,14 +27,13 @@ export default defineEventHandler(async (event) => {
     ? Math.floor(pageRaw)
     : 1
 
-  const folder = readFolderQuery(query)
   const backendId = readBackendIdQuery(query)
   if (backendId === null) {
     createApiError(event, 'INVALID_REQUEST', '无效的存储后端', 400)
   }
   const userFilter = await getImageUserFilter(event)
 
-  const listing = await listImages({ limit, page, folder, userFilter, backendId })
+  const listing = await listImages({ limit, page, userFilter, backendId })
 
   const user = await getCurrentUser(event)
   const ownerMap = user?.role === 'admin' ? listUserIdUsernameMap() : undefined

server/api/images/search.get.ts

@@ -9,16 +9,9 @@ import { createApiError } from '../../utils/api-error'
 import { listUserIdUsernameMap } from '../../utils/db'
 import { mapStoredImageToItem } from '../../utils/image-response'
 import { listStorageBackendNameMap } from '../../utils/storage-backends'
-import { isValidFolderName } from '../../utils/image-key'
 import { readBackendIdQuery } from '../../utils/image-query'
 import { searchImages } from '../../utils/storage'
 
-function readFolderQuery(query: Record<string, unknown>): string | undefined {
-  const raw = typeof query.folder === 'string' ? query.folder.trim() : ''
-  if (!raw || raw === 'all') return undefined
-  return isValidFolderName(raw) ? raw : undefined
-}
-
 export default defineEventHandler(async (event) => {
   await requireApiOrAdminAuth(event)
 
@@ -43,14 +36,13 @@ export default defineEventHandler(async (event) => {
     ? Math.floor(pageRaw)
     : 1
 
-  const folder = readFolderQuery(query)
   const backendId = readBackendIdQuery(query)
   if (backendId === null) {
     createApiError(event, 'INVALID_REQUEST', '无效的存储后端', 400)
   }
   const userFilter = await getImageUserFilter(event)
 
-  const result = await searchImages({ query: q, limit, page, folder, userFilter, backendId })
+  const result = await searchImages({ query: q, limit, page, userFilter, backendId })
 
   const user = await getCurrentUser(event)
   const ownerMap = user?.role === 'admin' ? listUserIdUsernameMap() : undefined

server/api/images/upload.post.ts

@@ -1,6 +1,6 @@
 import { readMultipartFormData } from 'h3'
 import type { UploadResponse, UploadErrorItem, ImageItem } from '~/types/image'
-import { requireUploadAuth, verifyApiUploadToken, getUploadUserId, canUseCustomUploadFolder } from '../../utils/access'
+import { requireUploadAuth, verifyApiUploadToken, getUploadUserId } from '../../utils/access'
 import { MAX_FILES_PER_UPLOAD } from '../../utils/constants'
 import {
   detectMimeFromSignature,
@@ -11,22 +11,8 @@ import {
   processSingleImageUpload
 } from '../../utils/process-image-upload'
 import { createApiError } from '../../utils/api-error'
-import {
-  DEFAULT_FOLDER,
-  isValidFolderName,
-  normalizeFolderName
-} from '../../utils/image-key'
 import { checkUploadRateLimit } from '../../utils/rate-limit'
 
-function readFormText(
-  formData: { name?: string, data?: Buffer | Uint8Array }[],
-  name: string
-): string {
-  const part = formData.find(item => item.name === name && item.data?.length)
-  if (!part?.data) return ''
-  return new TextDecoder().decode(part.data).trim()
-}
-
 export default defineEventHandler(async (event) => {
   await requireUploadAuth(event)
 
@@ -44,36 +30,6 @@ export default defineEventHandler(async (event) => {
   const source = verifyApiUploadToken(event) ? 'api' : 'web'
   const uploadUserId = await getUploadUserId(event)
 
-  const query = getQuery(event)
-  const folderFromForm = readFormText(formData, 'folder') || readFormText(formData, 'type')
-  const folderFromQuery = typeof query.folder === 'string'
-    ? query.folder
-    : typeof query.type === 'string'
-      ? query.type
-      : ''
-  const requestedFolder = normalizeFolderName(folderFromForm || folderFromQuery)
-  const canCustomFolder = await canUseCustomUploadFolder(event)
-
-  if (!canCustomFolder && requestedFolder && requestedFolder !== DEFAULT_FOLDER) {
-    createApiError(
-      event,
-      'FORBIDDEN',
-      '当前账号不支持自定义上传目录',
-      403
-    )
-  }
-
-  const folder = canCustomFolder ? requestedFolder : ''
-
-  if (folder && !isValidFolderName(folder)) {
-    createApiError(
-      event,
-      'INVALID_REQUEST',
-      '无效的 folder：仅允许字母数字开头，可含 - _，最长 32 位，且不能是 api/stats 等保留名',
-      400
-    )
-  }
-
   // 兼容 image / file / files 字段名（图床脚本 / 通用客户端 / 网页多图）
   const fileParts = formData.filter(
     part => (part.name === 'image' || part.name === 'file' || part.name === 'files')
@@ -127,7 +83,6 @@ export default defineEventHandler(async (event) => {
       bytes,
       filename: part.filename,
       source,
-      prefix: folder || DEFAULT_FOLDER,
       userId: uploadUserId
     })