Files Recycle Bin Design Evolution

🗑️ Files recycle bin - how the design evolved

Issue #293 · PR #353 by @cloudcogsio · The decisions as they stand: Recycle bin - design

The bin started as one contributor's well-built PR and grew four safety rules during review. This page keeps the reasoning, in order, so nobody has to rediscover why a rule exists before changing it.

1. The proposal (#293)

Files kept deleted items from day one - a soft delete, deleted_datetime - but had no screen to bring them back and nothing that ever removed their stored bytes. @cloudcogsio proposed a recycle bin, and the review on #293 asked for five things: delete every version, keep links from other records honest (deleted, restored, gone), "Name (2)" on a clash, a capability beside the others in Files settings, and corrected wording.

2. The PR (#353)

The PR did all five and more: one service for every rule, permissions as they were before the delete, a deleted folder's hidden subfolders kept out of Look inside and the counts, stored bytes recorded in the same transaction as the rows so nothing is ever forgotten, a request that never hangs on slow storage, and an invisible upgrade. Details: PR review.

It also asked three questions, and flagged one choice for a decision: the retention job needs no permission, so it would delete an expired folder holding a subfolder its deleter could never see. "That matches the design ... but say if you'd rather it skipped those."

3. "Keep it safe"

Ed's answer: skip them - and make it abundantly clear what has happened and what needs doing. A folder nobody may delete by hand should not be deleted by a timer either. That became heldBack() and System → Maintenance → Deleted folders kept.

4. "Should we even allow the delete at all?"

Answering that raised a bigger question. If folder A holds a subfolder B that I cannot change, should I be able to delete A - and B with it - in the first place? Ed: "crazy that someone could delete someone else's folder!!! how does MS Windows handle this kind of thing." Windows refuses: deleting a folder needs the right to delete everything in it. So FreeITSM does the same: Modify on every folder inside, however deep.

Then the message. "If there are lots of files/folders they don't have access to then we don't want to give some messy list. And also we don't want someone to use this as a hack to find the filenames of a subfolder they don't have access to." So one name at most, and only a name the person can already see. And a tool for the administrator to see the rest: D020.

5. Moving, and depth

"You shouldn't be able to move a folder if it contains things you don't have control over - by the way is the check able to catch anything no matter how deep it's buried?" Moving takes everything along just as deleting does, so it follows the same rule. And yes: the check walks every folder with no depth limit - the test builds 10 × 10 × 10 folders with one locked at the bottom, and both delete and move are refused.

6. What the bin still had to handle

The new rule stops new cases, but two remained:

• Folders already in the bin that hold a subfolder their deleter could not change - from before the rule, or because permissions changed after the delete. These are the held folders of §3.
• The owner of such a subfolder could not see the deleted folder, so their own folder had simply vanished from their view. They now see it in their bin, as Deleted along with a folder above it, and can restore it on its own. Its permissions are frozen before it moves, so nobody gains or loses access by it.

7. The clock and the rest

• The clock (Ed: start at the first save): a retention period chosen today must not delete within the hour something binned a year ago. Time in the bin counts from when purging was switched on.
• The purge race found in review: the list of what to delete was read before the row was locked. It is now read after.
• "Analyst 0 means the system" became an explicit null, so a missing session id can never mean "no permission checks".
• Delete permanently stays at Modify; the desktop icon is for everyone.

---

See also: Files · Recycle bin - Developer Guide · Folder control - Developer Guide