fix(library): a track delete that cannot remove its file deletes nothing — #3918

Two delete paths had opposite failure policies. tracks.RemoveTrack
logged a failed os.Remove and deleted the row anyway, which CASCADEs
likes, plays, playlist memberships and tags, while the file survived
for the next scan to re-import as a stranger. library.DeleteTrackFile
stopped correctly but reported it as a bare 500 nobody could read.

One path now: library.DeleteTrackFile removes the file first and, on
anything but ErrNotExist, returns *FileRemoveError with nothing
deleted. Only then does it delete the row and tidy an emptied album
and artist in one transaction, log the sync change and clear orphaned
artist art. RemoveTrack calls it, which also fixes RemoveTrack never
logging a sync change. Quarantine Delete file now tidies emptied
albums and artists too.

Both endpoints answer an unwritable library (EROFS, EACCES, EPERM) with
409 library_not_writable. The message names the directory (removal
writes to the parent), the uid:gid the server runs as, and that
nothing was deleted. Other remove errors are 500 file_delete_failed
with the path.

The reachable surface is quarantine Delete file, which failed
silently: no copy for the code on either client, and Android swallowed
the exception so the row just reappeared. Web and Android now have
copy for both codes and append the server message for exactly those
two. Android's quarantine screen shows it in a snackbar.

DELETE /api/admin/tracks/{id} has had no client since f7278f24, which
kept it on purpose for a safer admin surface, so its history loss was
latent. Fixed rather than removed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SQ31KQpYbStyK5y58UmPLH

internal/tracks/service.go

@@ -1,9 +1,9 @@
-// Package tracks owns the track-level admin actions exposed by the
-// M7 #372 track-actions menu. Today that's RemoveTrack: the destructive
-// part is always handled directly by Minstrel (os.Remove + DB delete +
-// cascade); when the operator opts in via `unmonitor=true` the service
-// also tells Lidarr to flip the track's monitored flag off so Lidarr
-// doesn't search for a replacement.
+// Package tracks owns the track-level admin actions behind DELETE
+// /api/admin/tracks/{id}. Today that's RemoveTrack: the destructive part goes
+// through library.DeleteTrackFile — the one path that deletes a track file —
+// and when the operator opts in via `unmonitor=true` the service also tells
+// Lidarr to flip the track's monitored flag off so Lidarr doesn't search for a
+// replacement.
 //
 // History: an earlier shape (commit 50a231f, since rewritten) routed
 // Lidarr-managed tracks through lidarrquarantine.DeleteViaLidarr — but
@@ -12,6 +12,9 @@
 // drop sibling tracks the operator didn't ask to remove. The current
 // shape per spec revision 723eee9 is "always direct delete; opt-in
 // Lidarr unmonitor for replacement-suppression."
+//
+// The web track-kebab entry that called this was removed in f7278f24; the
+// endpoint was kept deliberately for a safer admin surface to rebind.
 package tracks
 
 import (
@@ -19,15 +22,14 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	"os"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
-	"git.fabledsword.com/bvandeusen/minstrel/internal/coverart"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
 )
 
 // ErrNotFound is returned when the track id doesn't resolve. Aliased
@@ -69,10 +71,10 @@ func NewService(pool *pgxpool.Pool, logger *slog.Logger, lidarr LidarrUnmonitore
 	return &Service{pool: pool, logger: logger, lidarr: lidarr, dataDir: dataDir}
 }
 
-// RemoveTrack deletes the file from disk and the DB rows, runs the
-// album-empty / artist-empty cascade tidy-up, and (when unmonitor is
-// true and the track is Lidarr-managed) tells Lidarr to flip the track's
-// monitored flag off so it won't search for a replacement.
+// RemoveTrack deletes the track's file and then its row, tidies away an album
+// or artist the delete empties, and (when unmonitor is true and the track is
+// Lidarr-managed) tells Lidarr to flip the track's monitored flag off so it
+// won't search for a replacement.
 //
 // Returns:
 //   - deletedAlbumID: non-nil when removing the track left the album
@@ -81,9 +83,10 @@ func NewService(pool *pgxpool.Pool, logger *slog.Logger, lidarr LidarrUnmonitore
 //     empty (only set if deletedAlbumID is also set).
 //   - lidarrUnmonitorFailed: true when the operator requested unmonitor
 //     and the Lidarr call failed; the file + DB delete still succeeded.
-//   - err: only for failures *before* the destructive part completes.
-//     A failed os.Remove is logged and tolerated. A failed Lidarr
-//     unmonitor is reflected in the bool flag, not the error.
+//   - err: ErrNotFound, or a failure before anything was deleted. When the
+//     file cannot be removed it is a *library.FileRemoveError and NOTHING was
+//     deleted — see library.DeleteTrackFile for why that order is the contract
+//     (#3918). A failed Lidarr unmonitor is reflected in the bool, not here.
 //
 // adminID is currently unused — the cascade audit-log line that would
 // reference it isn't wired in this slice. It's threaded through the
@@ -104,10 +107,9 @@ func (s *Service) RemoveTrack(
 		return nil, nil, false, fmt.Errorf("get track: %w", err)
 	}
 
-	// Capture the album's mbid *before* the cascade-delete transaction.
-	// If removing this track empties the album, DeleteAlbumIfEmpty
-	// removes the row and a post-commit GetAlbumByID would return
-	// pgx.ErrNoRows — leaving the unmonitor walk with no album mbid.
+	// Capture the album's mbid *before* the delete. If removing this track
+	// empties the album, its row is gone afterwards and the unmonitor walk
+	// would have no album mbid to name.
 	var albumMbid string
 	if track.Mbid != nil && *track.Mbid != "" && unmonitor && s.lidarr != nil {
 		alb, alerr := q.GetAlbumByID(ctx, track.AlbumID)
@@ -118,64 +120,14 @@ func (s *Service) RemoveTrack(
 		// "no albumMbid → can't unmonitor → flag failure."
 	}
 
-	// Always: remove the file. Tolerate already-missing.
-	if track.FilePath != "" {
-		if rerr := os.Remove(track.FilePath); rerr != nil && !errors.Is(rerr, os.ErrNotExist) {
-			s.logger.Warn("track delete: file remove failed",
-				"path", track.FilePath, "track_id", trackID, "err", rerr)
-			// Proceed: DB consistency is the priority.
+	deleted, err := library.DeleteTrackFile(ctx, s.pool, s.logger, s.dataDir, trackID)
+	if err != nil {
+		if errors.Is(err, library.ErrTrackNotFound) {
+			return nil, nil, false, ErrNotFound
 		}
-	}
-
-	// DB cleanup in a transaction so a midway failure leaves things consistent.
-	tx, err := s.pool.Begin(ctx)
-	if err != nil {
-		return nil, nil, false, fmt.Errorf("begin tx: %w", err)
-	}
-	defer func() { _ = tx.Rollback(ctx) }()
-
-	tq := dbq.New(tx)
-
-	deleted, err := tq.DeleteTrack(ctx, trackID)
-	if err != nil {
 		return nil, nil, false, fmt.Errorf("delete track: %w", err)
 	}
 
-	albumRow, aerr := tq.DeleteAlbumIfEmpty(ctx, deleted.AlbumID)
-	switch {
-	case aerr == nil:
-		albumID := albumRow.ID
-		deletedAlbumID = &albumID
-		artistID, arerr := tq.DeleteArtistIfEmpty(ctx, albumRow.ArtistID)
-		switch {
-		case arerr == nil:
-			id := artistID
-			deletedArtistID = &id
-		case errors.Is(arerr, pgx.ErrNoRows):
-			// Artist still has other albums or stray tracks. OK.
-		default:
-			return nil, nil, false, fmt.Errorf("delete artist if empty: %w", arerr)
-		}
-	case errors.Is(aerr, pgx.ErrNoRows):
-		// Album still has other tracks. OK.
-	default:
-		return nil, nil, false, fmt.Errorf("delete album if empty: %w", aerr)
-	}
-
-	if err := tx.Commit(ctx); err != nil {
-		return nil, nil, false, fmt.Errorf("commit: %w", err)
-	}
-
-	// Cleanup artist-art filesystem cache if the delete cascade orphaned
-	// an artist. Non-fatal — the destructive part is done; we just want
-	// to keep the dataDir tidy.
-	if deletedArtistID != nil && s.dataDir != "" {
-		if err := coverart.CleanupArtistArt(s.dataDir, *deletedArtistID); err != nil {
-			s.logger.Warn("track delete: artist-art cleanup failed",
-				"artist_id", *deletedArtistID, "err", err)
-		}
-	}
-
 	// Lidarr unmonitor — non-fatal. The destructive part is done; any
 	// failure here is informational so the operator can retry manually.
 	if unmonitor && track.Mbid != nil && *track.Mbid != "" && s.lidarr != nil {
@@ -193,5 +145,5 @@ func (s *Service) RemoveTrack(
 		}
 	}
 
-	return deletedAlbumID, deletedArtistID, lidarrUnmonitorFailed, nil
+	return deleted.AlbumID, deleted.ArtistID, lidarrUnmonitorFailed, nil
 }