Using `disconnect` on one file relation removes all file relations

[jbhammon]

Bug report

Required System information

• Node.js version: v18.17.1
• NPM version: 9.6.7
• Strapi version: 4.25.3
• Database: sqlite
• Operating system: darwin-arm64
• Is your project Javascript or Typescript: Typescript

Describe the bug

Using disconnect in the body of a PUT request for an entity to disconnect a related file upload will remove all file relations.

If an upload ID is used that the entity isn't related to, then the request correctly doesn't make any changes. If an upload ID is used that the entity IS related to, then all upload relations are removed.

Steps to reproduce the behavior

1. Have a content type, Listings, that has a media field, that allows multiple uploads and only image files
2. Upload two files when you create a Listing entity like these docs state. The file uploads have IDs 1 and 2.
3. Make a PUT request to update the entity, and try to disconnect file 1 like this:

const response = await fetch(`my-strapi-url/api/listings/${id}`, {
  method: "PUT",
  body: JSON.stringify({
    data: {
      images: {
        disconnect: [{ id: 1 }],
      },
    },
}),

4. See that file 1 AND file 2 are not related to the Listing entity any longer

Expected behavior

Given what is in the docs I would expect that the file with ID 1 would no longer be related to this Listing entity, and file 2 would still be related. I don't expect file 1 to have been deleted from the CMS or my external storage location, just no longer associated with this Listing.

I see the docs state that connect can't be used to add media relations. It's unclear if that means I can't upload new files that way (not my goal here), but I wonder if that means we cannot manage media relations at all this way because of how the upload plugin works.

Screenshots

n/a, but happy to provide some if needed

Code snippets

n/a, but happy to provide some if needed

Additional context

My ultimate goal is to allow end users to remove images from the entities that they've created, via that entity's API endpoints. I need ownership enforcement on these entities and their related images, and it would be great to not have to open the upload endpoints directly to users and have to manage ownership issues there as well.

[jbhammon]

Additionally, this behavior happens even if I'm just using the entity service in a custom controller.

async disconnectImage(ctx) {
  const recordId = ctx.params.id;
  // imageIds is an array of file IDs
  const { imageIds } = ctx.request.body;

  await strapi.entityService.update("api::listing.listing", recordId, {
    data: {
      images: {
        // @ts-ignore
        disconnect: imageIds,
      },
    },
    populate: {
      images: true,
    },
  });

  ctx.send({ message: "File disconnected successfully" });
},

Making a POST request to this controller with an array of one file ID will disconnect all the file IDs on a record.

[strapi-bot]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/is-it-possible-to-disconnect-media-uploads-from-entities-programmatically/40754/1

[derrickmehaffy]

That most certainly should not be happening and connect should allow connecting existing files but not uploading new ones.

I'll try testing this on V4 and V5 as it could be impacting both.