From faaba7866c3874d34b7b07cbde36fdb07af10fe9 Mon Sep 17 00:00:00 2001
From: Amir Pournasserian <amir.pournasserian@live.com>
Date: Mon, 19 Oct 2026 08:18:17 -0400
Subject: [PATCH 1/3] Keep the media form's base version and stop refused
 uploads filtering the library

Closes #2629.
---
 .../Components/Pages/MediaAssetView.razor     |  17 ++-
 .../Components/Pages/MediaLibraryView.razor   |  23 +++-
 src/FluentCMS.Admin/Media/MediaForms.cs       |  47 +++++--
 src/FluentCMS.Host/FluentCmsHost.cs           |   1 +
 src/FluentCMS.Host/Media/MediaEndpoints.cs    |  40 +++++-
 .../Media/MediaScreenTests.cs                 | 119 ++++++++++++++----
 .../FluentCMS.Tests/Admin/MediaViewsTests.cs  |  67 +++++++++-
 7 files changed, 265 insertions(+), 49 deletions(-)

diff --git a/src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor b/src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor
index 857265d58..037689c6f 100644
--- a/src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor
+++ b/src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor
@@ -5,6 +5,7 @@
 @using FluentCMS.Core.Media
 @inject IMediaLibrary Library
 @inject IWhereUsed WhereUsed
+@inject FluentCMS.Core.Schema.IContentTypeDirectory ContentTypes
 @inject NavigationManager Navigation
 @inject IStringLocalizer<MediaAssetView> L
 
@@ -66,7 +67,8 @@
             <CardContent>
                 <form method="post" @onsubmit="SaveAsync" @formname="metadata" class="grid gap-4">
                     <AntiforgeryToken />
-                    <input type="hidden" name="Form.BaseVersion" value="@asset.LatestVersion" />
+                    @* The version the shown details were made from: a refused save keeps it, so a change saved meanwhile is a conflict. *@
+                    <input type="hidden" name="Form.BaseVersion" value="@Shown.BaseVersion" />
                     @if (_message is not null)
                     {
                         <p role="status" class="rounded-md border bg-muted/50 px-3 py-2 text-sm" data-testid="media-saved">@_message</p>
@@ -120,7 +122,9 @@
                         {
                             <TableRow data-entry="@usage.EntryId.ToString("N")">
                                 <TableCell>
-                                    <bdi>@usage.ContentType</bdi> <bdi class="font-mono text-xs text-muted-foreground" dir="ltr">@usage.EntryId.ToString("N")[..8]</bdi>
+                                    <a href="@($"audit?type={_subjects.GetValueOrDefault(usage.ContentType, "entry")}&id={usage.EntryId}")" class="underline-offset-4 hover:underline" data-testid="usage-history">
+                                        <bdi>@usage.ContentType</bdi> <bdi class="font-mono text-xs text-muted-foreground" dir="ltr">@usage.EntryId.ToString("N")[..8]</bdi>
+                                    </a>
                                 </TableCell>
                                 <TableCell>
                                     <span class="flex flex-wrap items-center gap-1">
@@ -148,6 +152,9 @@
 @code {
     private MediaAsset? _asset;
     private IReadOnlyList<EntryUsage> _usage = [];
+
+    // The audit subject of each using type's items: an entity type's items are entities in the log, every other type's are entries.
+    private Dictionary<string, string> _subjects = new(StringComparer.Ordinal);
     private IReadOnlyList<string> _errors = [];
     private string? _formError;
     private string? _message;
@@ -192,6 +199,12 @@
             BaseVersion = _asset.LatestVersion,
         };
         _usage = await WhereUsed.ForMediaAsync(Id);
+        foreach (var slug in _usage.Select(usage => usage.ContentType).Distinct())
+        {
+            var type = await ContentTypes.GetAsync(slug);
+            _subjects[slug] = type.IsSuccess && type.Value.Definition.IsEntity ? "entity" : "entry";
+        }
+
         return true;
     }
 
diff --git a/src/FluentCMS.Admin/Components/Pages/MediaLibraryView.razor b/src/FluentCMS.Admin/Components/Pages/MediaLibraryView.razor
index d60347fca..0a7e9c4b1 100644
--- a/src/FluentCMS.Admin/Components/Pages/MediaLibraryView.razor
+++ b/src/FluentCMS.Admin/Components/Pages/MediaLibraryView.razor
@@ -60,17 +60,17 @@
                         <Input Type="file" name="file" accept="@string.Join(",", MediaTypes.Allowed)" required />
                     </FormField>
                     <div class="grid gap-4 sm:grid-cols-2">
-                        <FormField Label="@L["Folder"]" Description="@L["Optional, such as products/drills."]" Error="@UploadError(MediaErrorCodes.FolderInvalid)">
-                            <Input name="Folder" value="@(UploadFolder ?? Folder)" dir="ltr" />
+                        <FormField Label="@L["Folder"]" Description="@L["Optional, such as products/drills."]" Error="@(UploadError(MediaErrorCodes.FolderInvalid) ?? Dropped(MediaUploadForm.FolderName))">
+                            <Input name="Folder" value="@(UploadErrors is null ? Folder : UploadFolder)" dir="ltr" />
                         </FormField>
-                        <FormField Label="@L["Tags"]" Description="@L["Optional, separated by commas, such as product-shot, hero."]" Error="@UploadError(MediaErrorCodes.TagInvalid)">
+                        <FormField Label="@L["Tags"]" Description="@L["Optional, separated by commas, such as product-shot, hero."]" Error="@(UploadError(MediaErrorCodes.TagInvalid) ?? Dropped(MediaUploadForm.TagsName))">
                             <Input name="Tags" value="@UploadTags" dir="ltr" />
                         </FormField>
                     </div>
-                    <FormField Label="@L["Alt text"]" Error="@UploadError(MediaErrorCodes.AltTextInvalid)">
+                    <FormField Label="@L["Alt text"]" Error="@(UploadError(MediaErrorCodes.AltTextInvalid) ?? Dropped(MediaUploadForm.AltTextName))">
                         <Textarea name="AltText" rows="2" value="@UploadAltText" />
                     </FormField>
-                    <FormField Label="@L["Caption"]" Error="@UploadError(MediaErrorCodes.CaptionInvalid)">
+                    <FormField Label="@L["Caption"]" Error="@(UploadError(MediaErrorCodes.CaptionInvalid) ?? Dropped(MediaUploadForm.CaptionName))">
                         <Textarea name="Caption" rows="2" value="@UploadCaption" />
                     </FormField>
                     @if (UploadFormError is { } formError)
@@ -162,8 +162,11 @@
     [SupplyParameterFromQuery(Name = "folder")]
     private string? Folder { get; set; }
 
+    // Read as text: a link may say 1 or 0 as well as true or false, and an unknown value means no subfolders rather than an error.
     [SupplyParameterFromQuery(Name = "sub")]
-    private bool Subfolders { get; set; }
+    private string? Sub { get; set; }
+
+    private bool Subfolders => Sub == "1" || (bool.TryParse(Sub, out var subfolders) && subfolders);
 
     [SupplyParameterFromQuery(Name = "tag")]
     private string? Tag { get; set; }
@@ -184,6 +187,9 @@
     [SupplyParameterFromQuery(Name = MediaUploadForm.CaptionName)]
     private string? UploadCaption { get; set; }
 
+    [SupplyParameterFromQuery(Name = MediaUploadForm.DroppedName)]
+    private string? UploadDropped { get; set; }
+
     private static readonly HashSet<string> FieldCodes =
     [
         MediaUploadForm.FileMissing,
@@ -232,6 +238,11 @@
         };
     }
 
+    private string? Dropped(string name)
+    {
+        return (UploadDropped ?? string.Empty).Split(',').Contains(name) ? L["This was too long to bring back here. Type it again."].Value : null;
+    }
+
     private static string Filter(bool current) => ClassNames.Cn(
         "block rounded-md px-2 py-1 hover:bg-accent hover:text-accent-foreground",
         current ? "bg-secondary font-medium text-secondary-foreground" : "text-muted-foreground");
diff --git a/src/FluentCMS.Admin/Media/MediaForms.cs b/src/FluentCMS.Admin/Media/MediaForms.cs
index ae079e411..1da4769b1 100644
--- a/src/FluentCMS.Admin/Media/MediaForms.cs
+++ b/src/FluentCMS.Admin/Media/MediaForms.cs
@@ -31,27 +31,48 @@ public static IReadOnlyList<string> SplitTags(string? tags)
 }
 
 // The library's upload form as it posts to the host's upload endpoint; the file arrives beside it. A refused upload comes back to the
-// library with ReturnQuery, so the page can show each problem next to its field and keep what was typed.
+// library with ReturnQuery, so the page can show each problem next to its field and keep what was typed. The names are the upload's
+// own, so they never filter the list the library shows.
 public sealed class MediaUploadForm : MediaMetadataFields
 {
     public const string FileMissing = "media_file_missing";
 
-    public const string ErrorName = "error";
-    public const string FolderName = "folder";
-    public const string TagsName = "tags";
-    public const string AltTextName = "alt";
-    public const string CaptionName = "caption";
+    public const string ErrorName = "upload-error";
+    public const string FolderName = "upload-folder";
+    public const string TagsName = "upload-tags";
+    public const string AltTextName = "upload-alt";
+    public const string CaptionName = "upload-caption";
+    public const string DroppedName = "upload-dropped";
+
+    // Past this, a field is not carried back, so the redirect stays well inside the server's request line limit.
+    public const int MaxReturnedLength = 1500;
 
     public Dictionary<string, string?> ReturnQuery(IEnumerable<Error> errors)
     {
-        return new Dictionary<string, string?>
+        var query = new Dictionary<string, string?> { [ErrorName] = string.Join(",", errors.Select(error => error.Code).Distinct()) };
+        var dropped = new List<string>();
+        foreach (var (name, text) in new[] { (FolderName, Folder), (TagsName, Tags), (AltTextName, AltText), (CaptionName, Caption) })
+        {
+            if (text is null)
+            {
+                continue;
+            }
+
+            if (Uri.EscapeDataString(text).Length > MaxReturnedLength)
+            {
+                dropped.Add(name);
+                continue;
+            }
+
+            query[name] = text;
+        }
+
+        if (dropped.Count > 0)
         {
-            [ErrorName] = string.Join(",", errors.Select(error => error.Code).Distinct()),
-            [FolderName] = Folder,
-            [TagsName] = Tags,
-            [AltTextName] = AltText,
-            [CaptionName] = Caption,
-        };
+            query[DroppedName] = string.Join(",", dropped);
+        }
+
+        return query;
     }
 }
 
diff --git a/src/FluentCMS.Host/FluentCmsHost.cs b/src/FluentCMS.Host/FluentCmsHost.cs
index 01e4dade7..504e6e782 100644
--- a/src/FluentCMS.Host/FluentCmsHost.cs
+++ b/src/FluentCMS.Host/FluentCmsHost.cs
@@ -65,6 +65,7 @@ public static WebApplication BuildWebApplication(string[] args, Action<WebApplic
         app.UseRateLimiter();
         app.UseAuthentication();
         app.UseAuthorization();
+        app.UseMediaUploadLimit();
         app.UseAntiforgery();
         MapStaticAssets(app);
         app.MapHealthChecks("/health");
diff --git a/src/FluentCMS.Host/Media/MediaEndpoints.cs b/src/FluentCMS.Host/Media/MediaEndpoints.cs
index afd0c61a5..38c9a14fe 100644
--- a/src/FluentCMS.Host/Media/MediaEndpoints.cs
+++ b/src/FluentCMS.Host/Media/MediaEndpoints.cs
@@ -3,6 +3,7 @@
 using FluentCMS.Core.Media;
 using FluentCMS.Core.Results;
 using FluentCMS.Infrastructure.Media;
+using Microsoft.AspNetCore.Http.Features;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
 using Microsoft.Net.Http.Headers;
@@ -16,9 +17,41 @@ internal static class MediaEndpoints
     // Room for the form's other fields and the multipart framing around a file of the largest size the library accepts.
     private const long FormOverhead = 1024 * 1024;
 
+    // The largest refused body read through to answer it, so a mistaken upload of a large file gets the message.
+    private const long DrainCap = 1024L * 1024 * 1024;
+
+    // A signed-in person's upload that declares a body over the limit is sent back to the library without being parsed, the
+    // anti-forgery check included, so they get the library's own message rather than a reset connection. The body is read and
+    // discarded first, since a browser still sending it treats an early answer as a failure. A body declared over DrainCap, or a
+    // chunked one that declares no length, still meets the server's limit.
+    public static IApplicationBuilder UseMediaUploadLimit(this IApplicationBuilder app)
+    {
+        var limit = UploadLimit(app.ApplicationServices);
+        return app.Use(async (context, next) =>
+        {
+            if (HttpMethods.IsPost(context.Request.Method)
+                && context.Request.Path.Equals(AdminRoutes.MediaUpload, StringComparison.OrdinalIgnoreCase)
+                && context.User.Identity?.IsAuthenticated == true
+                && context.Request.ContentLength is { } length && length > limit && length <= DrainCap)
+            {
+                if (context.Features.Get<IHttpMaxRequestBodySizeFeature>() is { IsReadOnly: false } size)
+                {
+                    size.MaxRequestBodySize = null;
+                }
+
+                await context.Request.Body.CopyToAsync(Stream.Null, context.RequestAborted);
+                context.Response.Redirect(AdminRoutes.Media + QueryString.Create(new MediaUploadForm().ReturnQuery(
+                    [new Error(MediaErrorCodes.MediaTooLarge, "The file is larger than the library accepts.")])));
+                return;
+            }
+
+            await next(context);
+        });
+    }
+
     public static void MapMediaLibrary(this IEndpointRouteBuilder endpoints)
     {
-        var limit = endpoints.ServiceProvider.GetRequiredService<IOptions<MediaOptions>>().Value.MaxBytes + FormOverhead;
+        var limit = UploadLimit(endpoints.ServiceProvider);
 
         endpoints.MapPost(AdminRoutes.MediaUpload, UploadAsync)
             .RequireAuthorization()
@@ -76,6 +109,11 @@ private static async Task<IResult> FileAsync(Guid id, int? version, IMediaLibrar
         return Results.Stream(content.Content, content.ContentType);
     }
 
+    private static long UploadLimit(IServiceProvider services)
+    {
+        return services.GetRequiredService<IOptions<MediaOptions>>().Value.MaxBytes + FormOverhead;
+    }
+
     private static IResult BackToLibrary(MediaUploadForm form, IEnumerable<Error> errors)
     {
         return Results.LocalRedirect(AdminRoutes.Media + QueryString.Create(form.ReturnQuery(errors)));
diff --git a/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs b/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
index d510c4e12..8e2f231d5 100644
--- a/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
+++ b/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
@@ -15,11 +15,14 @@ public sealed partial class MediaScreenTests
 {
     private static readonly byte[] Png = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52];
 
-    [Fact]
-    public async Task An_administrator_uploads_an_image_lands_on_it_and_its_bytes_come_back()
+    [Theory]
+    [InlineData(DatabaseProviders.Sqlite)]
+    [PostgresData]
+    public async Task An_administrator_uploads_an_image_lands_on_it_and_its_bytes_come_back(string provider)
     {
         using var install = new TemporaryInstall();
-        await using var host = await AdminHost.StartAsync(install);
+        await using var database = await TemporaryDatabase.CreateAsync(provider);
+        await using var host = await AdminHost.StartAsync(install, settings: database.Configuration);
         await host.CreateFirstAdministratorAsync();
         await host.SignInAsync(AdminHost.Owner);
 
@@ -43,37 +46,49 @@ public async Task An_administrator_uploads_an_image_lands_on_it_and_its_bytes_co
         Assert.Equal(HttpStatusCode.NotFound, (await host.Client.GetAsync($"/media/{Guid.NewGuid()}/file")).StatusCode);
     }
 
-    [Fact]
-    public async Task A_refused_upload_comes_back_with_its_problems_next_to_the_fields_and_stores_nothing()
+    [Theory]
+    [InlineData(DatabaseProviders.Sqlite)]
+    [PostgresData]
+    public async Task A_refused_upload_comes_back_with_its_problems_next_to_the_fields_and_stores_nothing(string provider)
     {
         using var install = new TemporaryInstall();
-        await using var host = await AdminHost.StartAsync(install);
-        await host.CreateFirstAdministratorAsync();
+        await using var database = await TemporaryDatabase.CreateAsync(provider);
+        await using var host = await AdminHost.StartAsync(install, settings: database.Configuration);
+        var ownerId = await host.CreateFirstAdministratorAsync();
+        var stored = await StoreAsync(host, ownerId, "logo.jpg", "", [], "The logo.");
         await host.SignInAsync(AdminHost.Owner);
 
         var mismatch = await UploadAsync(host, "notes.png", "image/png", "plain text, not a PNG"u8.ToArray(), ("Folder", "Bad Folder"), ("AltText", "Notes."));
         var noFile = await UploadAsync(host, null, null, null);
+        var svg = await UploadAsync(host, "icon.svg", "image/svg+xml", "<svg xmlns=\"http://www.w3.org/2000/svg\"/>"u8.ToArray());
 
-        Assert.StartsWith("/media?error=folder_invalid", host.LocationOf(mismatch));
+        // The typed folder comes back to the form, and the library still lists every asset.
+        Assert.StartsWith("/media?upload-error=folder_invalid", host.LocationOf(mismatch));
         var form = await host.Client.GetStringAsync(host.LocationOf(mismatch)!);
         Assert.Contains("A folder is lowercase words joined by hyphens", form);
         Assert.Contains("value=\"Bad Folder\"", form);
         Assert.Contains("Notes.", form);
+        Assert.Equal([stored], Assets(form));
 
         var fixedFolder = await UploadAsync(host, "notes.png", "image/png", "plain text, not a PNG"u8.ToArray());
         Assert.True(fixedFolder.StatusCode == HttpStatusCode.Redirect, $"{fixedFolder.StatusCode}: {await fixedFolder.Content.ReadAsStringAsync()}");
-        Assert.Equal("/media?error=media_content_mismatch", host.LocationOf(fixedFolder)!.Split('&')[0]);
+        Assert.Equal("/media?upload-error=media_content_mismatch", host.LocationOf(fixedFolder)!.Split('&')[0]);
         Assert.Contains("does not match its type", await host.Client.GetStringAsync(host.LocationOf(fixedFolder)!));
         Assert.True(noFile.StatusCode == HttpStatusCode.Redirect, $"{noFile.StatusCode}: {await noFile.Content.ReadAsStringAsync()}");
-        Assert.Equal("/media?error=media_file_missing", host.LocationOf(noFile)!.Split('&')[0]);
-        Assert.Equal(0, await QueryAsync(host, context => context.Set<FluentCMS.Infrastructure.Media.MediaAssetRow>().CountAsync()));
+        Assert.Equal("/media?upload-error=media_file_missing", host.LocationOf(noFile)!.Split('&')[0]);
+        Assert.Equal($"/media?upload-error={MediaErrorCodes.ContentTypeInvalid}", host.LocationOf(svg)!.Split('&')[0]);
+        Assert.Contains("This type of file cannot be uploaded.", await host.Client.GetStringAsync(host.LocationOf(svg)!));
+        Assert.Equal(1, await QueryAsync(host, context => context.Set<FluentCMS.Infrastructure.Media.MediaAssetRow>().CountAsync()));
     }
 
-    [Fact]
-    public async Task The_library_filters_by_folder_subfolders_and_tag_and_marks_images_without_alt_text()
+    [Theory]
+    [InlineData(DatabaseProviders.Sqlite)]
+    [PostgresData]
+    public async Task The_library_filters_by_folder_subfolders_and_tag_and_marks_images_without_alt_text(string provider)
     {
         using var install = new TemporaryInstall();
-        await using var host = await AdminHost.StartAsync(install);
+        await using var database = await TemporaryDatabase.CreateAsync(provider);
+        await using var host = await AdminHost.StartAsync(install, settings: database.Configuration);
         var ownerId = await host.CreateFirstAdministratorAsync();
         var drill = await StoreAsync(host, ownerId, "drill.jpg", "products/drills", ["hero"], "A drill.");
         var saw = await StoreAsync(host, ownerId, "saw.jpg", "products", [], null);
@@ -83,11 +98,15 @@ public async Task The_library_filters_by_folder_subfolders_and_tag_and_marks_ima
         var all = await host.Client.GetStringAsync("/media");
         var products = await host.Client.GetStringAsync("/media?folder=products&sub=true");
         var productsOnly = await host.Client.GetStringAsync("/media?folder=products");
+        var productsByOne = await host.Client.GetStringAsync("/media?folder=products&sub=1");
+        var productsByOther = await host.Client.GetStringAsync("/media?folder=products&sub=yes");
         var hero = await host.Client.GetStringAsync("/media?tag=hero");
 
         Assert.Equal([logo, saw, drill], Assets(all));
         Assert.Equal([saw, drill], Assets(products));
         Assert.Equal([saw], Assets(productsOnly));
+        Assert.Equal([saw, drill], Assets(productsByOne));
+        Assert.Equal([saw], Assets(productsByOther));
         Assert.Equal([logo, drill], Assets(hero));
         Assert.Contains("data-folder=\"products/drills\"", all);
         Assert.Contains("data-tag=\"hero\"", all);
@@ -96,11 +115,14 @@ public async Task The_library_filters_by_folder_subfolders_and_tag_and_marks_ima
         Assert.Equal(1, Regex.Count(all, "data-status=\"no-alt-text\""));
     }
 
-    [Fact]
-    public async Task Saving_details_stores_the_next_version_and_a_form_from_an_older_version_is_refused()
+    [Theory]
+    [InlineData(DatabaseProviders.Sqlite)]
+    [PostgresData]
+    public async Task Saving_details_stores_the_next_version_and_a_form_from_an_older_version_is_refused(string provider)
     {
         using var install = new TemporaryInstall();
-        await using var host = await AdminHost.StartAsync(install);
+        await using var database = await TemporaryDatabase.CreateAsync(provider);
+        await using var host = await AdminHost.StartAsync(install, settings: database.Configuration);
         var ownerId = await host.CreateFirstAdministratorAsync();
         var id = await StoreAsync(host, ownerId, "saw.jpg", "", [], null);
         await host.SignInAsync(AdminHost.Owner);
@@ -119,13 +141,26 @@ public async Task Saving_details_stores_the_next_version_and_a_form_from_an_olde
         Assert.Contains("Each tag is lowercase words", await invalid.Content.ReadAsStringAsync());
         var stored = await host.AsUserAsync<IMediaLibrary, MediaAsset>(ownerId, async library => (await library.GetAsync(id)).Value);
         Assert.Equal((2, "A circular saw."), (stored.LatestVersion, stored.Latest.Metadata.AltText));
+
+        // Someone saves version 3 while this form, made from version 2, is refused for its own problem; its next save is a conflict.
+        await host.AsUserAsync<IMediaLibrary, MediaAsset>(ownerId, async library =>
+            (await library.UpdateAsync(id, 2, AssetMetadata.Create("saw.jpg", "", [], "Theirs.", null).Value)).Value);
+        var refused = await host.SubmitAsync($"/media/{id}", "metadata", Details(2, "Mine.", tags: "Not A Tag!"));
+        Assert.Contains("name=\"Form.BaseVersion\" value=\"2\"", await refused.Content.ReadAsStringAsync());
+        var again = await host.SubmitAsync($"/media/{id}", "metadata", Details(2, "Mine."));
+        Assert.Contains("details since the page was shown.", await again.Content.ReadAsStringAsync());
+        var kept = await host.AsUserAsync<IMediaLibrary, MediaAsset>(ownerId, async library => (await library.GetAsync(id)).Value);
+        Assert.Equal((3, "Theirs."), (kept.LatestVersion, kept.Latest.Metadata.AltText));
     }
 
-    [Fact]
-    public async Task The_asset_page_lists_where_it_is_used()
+    [Theory]
+    [InlineData(DatabaseProviders.Sqlite)]
+    [PostgresData]
+    public async Task The_asset_page_lists_where_it_is_used(string provider)
     {
         using var install = new TemporaryInstall();
-        await using var host = await AdminHost.StartAsync(install);
+        await using var database = await TemporaryDatabase.CreateAsync(provider);
+        await using var host = await AdminHost.StartAsync(install, settings: database.Configuration);
         var ownerId = await host.CreateFirstAdministratorAsync();
         var hero = await StoreAsync(host, ownerId, "hero.jpg", "", [], "A drill on a bench.");
         var unused = await StoreAsync(host, ownerId, "spare.jpg", "", [], "A spare.");
@@ -142,15 +177,19 @@ await host.AsUserAsync<IContentTypeDirectory, ContentType>(ownerId, async types
         var notUsed = await host.Client.GetStringAsync($"/media/{unused}");
 
         Assert.Contains($"data-entry=\"{page.Id:N}\"", used);
+        Assert.Contains($"href=\"audit?type=entry&amp;id={page.Id}\"", used);
         Assert.Contains("/hero", used);
         Assert.Contains("data-testid=\"media-unused\"", notUsed);
     }
 
-    [Fact]
-    public async Task Anonymous_requests_go_to_sign_in_and_an_upload_without_the_token_stores_nothing()
+    [Theory]
+    [InlineData(DatabaseProviders.Sqlite)]
+    [PostgresData]
+    public async Task Anonymous_requests_go_to_sign_in_and_an_upload_without_the_token_stores_nothing(string provider)
     {
         using var install = new TemporaryInstall();
-        await using var host = await AdminHost.StartAsync(install);
+        await using var database = await TemporaryDatabase.CreateAsync(provider);
+        await using var host = await AdminHost.StartAsync(install, settings: database.Configuration);
         var ownerId = await host.CreateFirstAdministratorAsync();
         var id = await StoreAsync(host, ownerId, "saw.jpg", "", [], null);
 
@@ -169,6 +208,40 @@ public async Task Anonymous_requests_go_to_sign_in_and_an_upload_without_the_tok
         Assert.Equal(1, await QueryAsync(host, context => context.Set<FluentCMS.Infrastructure.Media.MediaAssetRow>().CountAsync()));
     }
 
+    [Fact]
+    public async Task A_pdf_downloads_as_an_attachment()
+    {
+        using var install = new TemporaryInstall();
+        await using var host = await AdminHost.StartAsync(install);
+        await host.CreateFirstAdministratorAsync();
+        await host.SignInAsync(AdminHost.Owner);
+
+        var uploaded = await UploadAsync(host, "manual.pdf", "application/pdf", "%PDF-1.4\n%%EOF\n"u8.ToArray());
+        var location = host.LocationOf(uploaded)!;
+        var file = await host.Client.GetAsync($"{location[..location.IndexOf('?')]}/file");
+
+        Assert.Equal("application/pdf", file.Content.Headers.ContentType!.MediaType);
+        Assert.Equal("attachment", file.Content.Headers.ContentDisposition!.DispositionType);
+        Assert.Equal("manual.pdf", file.Content.Headers.ContentDisposition.FileNameStar);
+    }
+
+    // A body declared over the limit is answered before it is read, with the library's own message.
+    [Fact]
+    public async Task An_upload_declared_over_the_limit_comes_back_with_the_too_large_message()
+    {
+        using var install = new TemporaryInstall();
+        await using var host = await AdminHost.StartAsync(install, settings: new Dictionary<string, string?> { ["Media:MaxBytes"] = "1024" });
+        await host.CreateFirstAdministratorAsync();
+        await host.SignInAsync(AdminHost.Owner);
+
+        var refused = await UploadAsync(host, "huge.jpg", "image/jpeg", MediaFiles.Jpeg(1536 * 1024));
+
+        Assert.Equal(HttpStatusCode.Redirect, refused.StatusCode);
+        Assert.Equal($"/media?upload-error={MediaErrorCodes.MediaTooLarge}", host.LocationOf(refused));
+        Assert.Contains("The file is larger than the library accepts.", await host.Client.GetStringAsync(host.LocationOf(refused)!));
+        Assert.Equal(0, await QueryAsync(host, context => context.Set<FluentCMS.Infrastructure.Media.MediaAssetRow>().CountAsync()));
+    }
+
     private static Dictionary<string, string> Details(int baseVersion, string altText, string tags = "")
     {
         return new Dictionary<string, string>
diff --git a/tests/FluentCMS.Tests/Admin/MediaViewsTests.cs b/tests/FluentCMS.Tests/Admin/MediaViewsTests.cs
index cd2db4fac..63888ce6e 100644
--- a/tests/FluentCMS.Tests/Admin/MediaViewsTests.cs
+++ b/tests/FluentCMS.Tests/Admin/MediaViewsTests.cs
@@ -1,9 +1,11 @@
 using Bunit;
 using FluentCMS.Admin.Components.Pages;
 using FluentCMS.Admin.Media;
+using FluentCMS.Core.ChangeSets;
 using FluentCMS.Core.Content;
 using FluentCMS.Core.Media;
 using FluentCMS.Core.Results;
+using FluentCMS.Core.Schema;
 using Microsoft.AspNetCore.Components;
 using Microsoft.Extensions.DependencyInjection;
 
@@ -50,8 +52,9 @@ public void A_folder_or_tag_in_the_address_filters_the_list()
     [Fact]
     public void The_upload_form_posts_to_the_endpoint_and_shows_a_refused_upload_next_to_its_fields()
     {
-        using var context = Context(new FakeLibrary());
-        context.Services.GetRequiredService<NavigationManager>().NavigateTo("/media?error=media_content_mismatch,folder_invalid&folder=Bad&alt=A%20drill.");
+        var library = new FakeLibrary();
+        using var context = Context(library);
+        context.Services.GetRequiredService<NavigationManager>().NavigateTo("/media?upload-error=media_content_mismatch,folder_invalid&upload-folder=Bad&upload-alt=A%20drill.&upload-dropped=upload-caption");
 
         var cut = context.Render<MediaLibraryView>();
 
@@ -63,7 +66,11 @@ public void The_upload_form_posts_to_the_endpoint_and_shows_a_refused_upload_nex
         Assert.Contains("A folder is lowercase words", form.TextContent);
         Assert.Equal("Bad", cut.Find("input[name=Folder]").GetAttribute("value"));
         Assert.Equal("A drill.", cut.Find("textarea[name=AltText]").GetAttribute("value"));
+        Assert.Contains("This was too long to bring back here.", form.TextContent);
         Assert.Empty(cut.FindAll("[data-testid=media-upload-error]"));
+
+        // The upload's fields never filter the list.
+        Assert.Equal(new MediaQuery(), Assert.Single(library.Queries));
     }
 
     [Fact]
@@ -83,6 +90,7 @@ public void The_asset_page_shows_the_preview_the_details_form_and_where_it_is_us
         var usage = cut.Find("[data-entry]");
         Assert.Contains("/hero", usage.TextContent);
         Assert.Contains("product-page", usage.TextContent);
+        Assert.StartsWith("audit?type=entry&id=", usage.QuerySelector("[data-testid=usage-history]")!.GetAttribute("href"));
         Assert.Empty(cut.FindAll("[data-testid=media-no-alt-text]"));
     }
 
@@ -128,16 +136,48 @@ public void A_refused_upload_returns_its_codes_and_fields_and_blank_texts_mean_n
         var query = form.ReturnQuery([new Error("folder_invalid", "x"), new Error("folder_invalid", "y"), new Error("tag_invalid", "z")]);
         var metadata = new MediaUploadForm { Folder = "products", Tags = "Hero", AltText = " " }.ToMetadata("drill.jpg").Value;
 
-        Assert.Equal("folder_invalid,tag_invalid", query["error"]);
-        Assert.Equal(("Bad", "a, b", " ", "Shown."), (query["folder"], query["tags"], query["alt"], query["caption"]));
+        Assert.Equal("folder_invalid,tag_invalid", query["upload-error"]);
+        Assert.Equal(("Bad", "a, b", " ", "Shown."), (query["upload-folder"], query["upload-tags"], query["upload-alt"], query["upload-caption"]));
+        Assert.False(query.ContainsKey("upload-dropped"));
         Assert.Equal(("products", "hero", null), (metadata.Folder, Assert.Single(metadata.Tags), metadata.AltText));
     }
 
+    [Fact]
+    public void A_text_too_long_for_the_return_address_is_dropped_and_named()
+    {
+        var form = new MediaUploadForm { Folder = "ok", AltText = new string('ä', 1000) };
+
+        var query = form.ReturnQuery([new Error("tag_invalid", "x")]);
+
+        Assert.Equal("ok", query["upload-folder"]);
+        Assert.False(query.ContainsKey("upload-alt"));
+        Assert.Equal("upload-alt", query["upload-dropped"]);
+    }
+
+    [Theory]
+    [InlineData("1", true)]
+    [InlineData("true", true)]
+    [InlineData("True", true)]
+    [InlineData("0", false)]
+    [InlineData("false", false)]
+    [InlineData("yes", false)]
+    public void The_subfolder_flag_takes_one_or_true(string sub, bool subfolders)
+    {
+        var library = new FakeLibrary();
+        using var context = Context(library);
+        context.Services.GetRequiredService<NavigationManager>().NavigateTo($"/media?folder=products&sub={sub}");
+
+        context.Render<MediaLibraryView>();
+
+        Assert.Equal(new MediaQuery("products", subfolders, null), library.Queries[^1]);
+    }
+
     private static AdminTestContext Context(FakeLibrary library)
     {
         var context = new AdminTestContext();
         context.Services.AddSingleton<IMediaLibrary>(library);
         context.Services.AddSingleton<IWhereUsed>(new FakeUsage(library));
+        context.Services.AddSingleton<IContentTypeDirectory>(new FakeContentTypes());
         return context;
     }
 
@@ -187,6 +227,25 @@ public Task<Result<MediaAsset>> GetAsync(Guid id, CancellationToken cancellation
         public Task<Result<MediaContent>> OpenAsync(Guid id, int? version = null, CancellationToken cancellationToken = default) => throw new NotSupportedException();
     }
 
+    // Every type is a plain content type, so its items are entries in the audit log.
+    private sealed class FakeContentTypes : IContentTypeDirectory
+    {
+        public Task<Result<ContentType>> GetAsync(string slug, CancellationToken cancellationToken = default)
+        {
+            return Task.FromResult(ContentType.Create(Guid.NewGuid(), slug, slug, new ContentTypeDefinition([]), new FieldTypeRegistry([])));
+        }
+
+        public Task<IReadOnlyList<ContentTypeSummary>> ListAsync(CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<Result<ContentType>> GetPublishedAsync(string slug, CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<Result<ContentType>> GetVersionAsync(string slug, int version, CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<Result<ContentType>> CreateAsync(NewContentType contentType, ChangeSetTarget changeSet, CancellationToken cancellationToken = default) => throw new NotSupportedException();
+
+        public Task<Result<ContentType>> ReviseAsync(string slug, int baseVersion, ContentTypeDefinition definition, ChangeSetTarget changeSet, CancellationToken cancellationToken = default) => throw new NotSupportedException();
+    }
+
     private sealed class FakeUsage(FakeLibrary library) : IWhereUsed
     {
         public Task<IReadOnlyList<EntryUsage>> ForMediaAsync(Guid assetId, CancellationToken cancellationToken = default)

From a60b70dac45564bc7aaad01973085beada8db700 Mon Sep 17 00:00:00 2001
From: Amir Pournasserian <amir.pournasserian@live.com>
Date: Mon, 19 Oct 2026 18:57:42 -0400
Subject: [PATCH 2/3] Read the asset page's uploaded flag as text

---
 src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor  | 5 ++++-
 tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor b/src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor
index 037689c6f..7a3d15e9a 100644
--- a/src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor
+++ b/src/FluentCMS.Admin/Components/Pages/MediaAssetView.razor
@@ -161,8 +161,11 @@
 
     [Parameter] public Guid Id { get; set; }
 
+    // Read as text, as the library's sub flag is, so a value that is not true or false shows the page rather than failing it.
     [SupplyParameterFromQuery(Name = "uploaded")]
-    private bool Uploaded { get; set; }
+    private string? UploadedText { get; set; }
+
+    private bool Uploaded => bool.TryParse(UploadedText, out var uploaded) && uploaded;
 
     [SupplyParameterFromForm(FormName = "metadata")]
     private MediaMetadataForm? Form { get; set; }
diff --git a/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs b/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
index 8e2f231d5..1e24607ea 100644
--- a/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
+++ b/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
@@ -34,6 +34,7 @@ public async Task An_administrator_uploads_an_image_lands_on_it_and_its_bytes_co
         var id = Guid.Parse(location["/media/".Length..location.IndexOf('?')]);
         var page = await host.Client.GetStringAsync(location);
         Assert.Contains("data-testid=\"media-uploaded\"", page);
+        Assert.DoesNotContain("data-testid=\"media-uploaded\"", await host.Client.GetStringAsync($"/media/{id}?uploaded=abc"));
         Assert.Contains($"src=\"media/{id}/file?version=1\" alt=\"A cordless drill.\"", page);
         Assert.Contains("value=\"product-shot, hero\"", page);
 

From 4bbdcda2d4aed35af9c0730bd763d79b392d825c Mon Sep 17 00:00:00 2001
From: Amir Pournasserian <amir.pournasserian@live.com>
Date: Mon, 19 Oct 2026 19:30:39 -0400
Subject: [PATCH 3/3] Test an anonymous upload and the entity link, run the new
 media tests on both providers, and name a page that hangs

---
 .../Desk/SignedInPageTests.cs                 | 15 ++++++++---
 .../Media/MediaScreenTests.cs                 | 25 ++++++++++++++-----
 .../FluentCMS.Tests/Admin/MediaViewsTests.cs  | 10 +++++---
 3 files changed, 38 insertions(+), 12 deletions(-)

diff --git a/tests/FluentCMS.IntegrationTests/Desk/SignedInPageTests.cs b/tests/FluentCMS.IntegrationTests/Desk/SignedInPageTests.cs
index 309f74784..2301dba03 100644
--- a/tests/FluentCMS.IntegrationTests/Desk/SignedInPageTests.cs
+++ b/tests/FluentCMS.IntegrationTests/Desk/SignedInPageTests.cs
@@ -36,10 +36,19 @@ public async Task Every_signed_in_page_loads_every_time(string provider)
         {
             foreach (var path in paths)
             {
-                var response = await host.Client.GetAsync(path);
-                if (response.StatusCode != HttpStatusCode.OK)
+                // A query that collides can hang the request rather than fail it, so each has a deadline that names the page.
+                using var deadline = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+                try
                 {
-                    failures.Add($"{path}: {(int)response.StatusCode}");
+                    var response = await host.Client.GetAsync(path, deadline.Token);
+                    if (response.StatusCode != HttpStatusCode.OK)
+                    {
+                        failures.Add($"{path}: {(int)response.StatusCode}");
+                    }
+                }
+                catch (OperationCanceledException) when (deadline.IsCancellationRequested)
+                {
+                    failures.Add($"{path}: no answer in 30 seconds, round {round + 1}");
                 }
             }
         }
diff --git a/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs b/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
index 1e24607ea..a62ae85b3 100644
--- a/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
+++ b/tests/FluentCMS.IntegrationTests/Media/MediaScreenTests.cs
@@ -201,6 +201,13 @@ public async Task Anonymous_requests_go_to_sign_in_and_an_upload_without_the_tok
             Assert.StartsWith("/sign-in?ReturnUrl=", host.LocationOf(response));
         }
 
+        using (var anonymousForm = new MultipartFormDataContent { { File("drill.png", "image/png", Png), "file" } })
+        {
+            var anonymous = await host.Client.PostAsync("/media/upload", anonymousForm);
+            Assert.Equal(HttpStatusCode.Redirect, anonymous.StatusCode);
+            Assert.StartsWith("/sign-in?ReturnUrl=", host.LocationOf(anonymous));
+        }
+
         await host.SignInAsync(AdminHost.Owner);
         using var form = new MultipartFormDataContent { { File("drill.png", "image/png", Png), "file" } };
         var forged = await host.Client.PostAsync("/media/upload", form);
@@ -209,11 +216,14 @@ public async Task Anonymous_requests_go_to_sign_in_and_an_upload_without_the_tok
         Assert.Equal(1, await QueryAsync(host, context => context.Set<FluentCMS.Infrastructure.Media.MediaAssetRow>().CountAsync()));
     }
 
-    [Fact]
-    public async Task A_pdf_downloads_as_an_attachment()
+    [Theory]
+    [InlineData(DatabaseProviders.Sqlite)]
+    [PostgresData]
+    public async Task A_pdf_downloads_as_an_attachment(string provider)
     {
         using var install = new TemporaryInstall();
-        await using var host = await AdminHost.StartAsync(install);
+        await using var database = await TemporaryDatabase.CreateAsync(provider);
+        await using var host = await AdminHost.StartAsync(install, settings: database.Configuration);
         await host.CreateFirstAdministratorAsync();
         await host.SignInAsync(AdminHost.Owner);
 
@@ -227,11 +237,14 @@ public async Task A_pdf_downloads_as_an_attachment()
     }
 
     // A body declared over the limit is answered before it is read, with the library's own message.
-    [Fact]
-    public async Task An_upload_declared_over_the_limit_comes_back_with_the_too_large_message()
+    [Theory]
+    [InlineData(DatabaseProviders.Sqlite)]
+    [PostgresData]
+    public async Task An_upload_declared_over_the_limit_comes_back_with_the_too_large_message(string provider)
     {
         using var install = new TemporaryInstall();
-        await using var host = await AdminHost.StartAsync(install, settings: new Dictionary<string, string?> { ["Media:MaxBytes"] = "1024" });
+        await using var database = await TemporaryDatabase.CreateAsync(provider);
+        await using var host = await AdminHost.StartAsync(install, settings: new Dictionary<string, string?>(database.Configuration) { ["Media:MaxBytes"] = "1024" });
         await host.CreateFirstAdministratorAsync();
         await host.SignInAsync(AdminHost.Owner);
 
diff --git a/tests/FluentCMS.Tests/Admin/MediaViewsTests.cs b/tests/FluentCMS.Tests/Admin/MediaViewsTests.cs
index 63888ce6e..f4a8e16dd 100644
--- a/tests/FluentCMS.Tests/Admin/MediaViewsTests.cs
+++ b/tests/FluentCMS.Tests/Admin/MediaViewsTests.cs
@@ -90,7 +90,9 @@ public void The_asset_page_shows_the_preview_the_details_form_and_where_it_is_us
         var usage = cut.Find("[data-entry]");
         Assert.Contains("/hero", usage.TextContent);
         Assert.Contains("product-page", usage.TextContent);
-        Assert.StartsWith("audit?type=entry&id=", usage.QuerySelector("[data-testid=usage-history]")!.GetAttribute("href"));
+        Assert.Equal(
+            ["audit?type=entry&id=", "audit?type=entity&id="],
+            cut.FindAll("[data-testid=usage-history]").Select(link => link.GetAttribute("href")![..(link.GetAttribute("href")!.IndexOf("id=", StringComparison.Ordinal) + 3)]));
         Assert.Empty(cut.FindAll("[data-testid=media-no-alt-text]"));
     }
 
@@ -232,7 +234,7 @@ private sealed class FakeContentTypes : IContentTypeDirectory
     {
         public Task<Result<ContentType>> GetAsync(string slug, CancellationToken cancellationToken = default)
         {
-            return Task.FromResult(ContentType.Create(Guid.NewGuid(), slug, slug, new ContentTypeDefinition([]), new FieldTypeRegistry([])));
+            return Task.FromResult(ContentType.Create(Guid.NewGuid(), slug, slug, new ContentTypeDefinition([], isEntity: slug == "supplier"), new FieldTypeRegistry([])));
         }
 
         public Task<IReadOnlyList<ContentTypeSummary>> ListAsync(CancellationToken cancellationToken = default) => throw new NotSupportedException();
@@ -250,7 +252,9 @@ private sealed class FakeUsage(FakeLibrary library) : IWhereUsed
     {
         public Task<IReadOnlyList<EntryUsage>> ForMediaAsync(Guid assetId, CancellationToken cancellationToken = default)
         {
-            IReadOnlyList<EntryUsage> usage = assetId == library.Drill.Id ? [new EntryUsage(Guid.NewGuid(), "product-page", 3, true, true, ["/hero"])] : [];
+            IReadOnlyList<EntryUsage> usage = assetId == library.Drill.Id
+                ? [new EntryUsage(Guid.NewGuid(), "product-page", 3, true, true, ["/hero"]), new EntryUsage(Guid.NewGuid(), "supplier", 1, true, false, ["/logo/value"])]
+                : [];
             return Task.FromResult(usage);
         }