4 files changed, 51 insertions, 1 deletions

diff --git a/app/controllers/assets_controller.rb b/app/controllers/assets_controller.rb
index fbede0a7..8df4c94d 100644
--- a/app/controllers/assets_controller.rb
+++ b/app/controllers/assets_controller.rb
@@ -81,7 +81,7 @@ class AssetsController < ApplicationController
   # DELETE /assets/1.xml
   def destroy
     @asset = Asset.find(params[:id])
-    @asset.destroy
+    @asset.destroy_witnessed!(:user => current_user)
 
     respond_to do |format|
       format.html { redirect_to(assets_url) }
diff --git a/app/helpers/node_actions_helper.rb b/app/helpers/node_actions_helper.rb
index fd8cc36e..02d1ba83 100644
--- a/app/helpers/node_actions_helper.rb
+++ b/app/helpers/node_actions_helper.rb
@@ -180,4 +180,15 @@ module NodeActionsHelper
     t("node_actions.destroy", :actor => actor_ref(action), :subject => subject_ref(action),
        :path => h(action.metadata["path"])).html_safe
   end
+
+  def summarize_asset_destroy action
+    m = action.metadata
+    parts = [t("node_actions.asset_destroy", :actor => actor_ref(action),
+                :asset => h(m["asset_name"].presence || m["path"]))]
+    parts << t("node_actions.asset_destroy_detached",
+                :paths => h(Array(m["detached_from"]).join(", "))) if m["detached_from"].present?
+    parts << t("node_actions.asset_destroy_headlines",
+                :paths => h(Array(m["headline_removed_from"]).join(", "))) if m["headline_removed_from"].present?
+    safe_join(parts, " ")
+  end
 end
diff --git a/app/models/asset.rb b/app/models/asset.rb
index 73970e21..8cec4371 100644
--- a/app/models/asset.rb
+++ b/app/models/asset.rb
@@ -40,4 +40,34 @@ class Asset < ApplicationRecord
     Node.where("head_id IN (:ids) OR draft_id IN (:ids) OR autosave_id IN (:ids)",
                :ids => page_ids).distinct
   end
+
+  # Witnessed destruction. Destroying an asset is a public-facing act
+  # even when unattached. The original and its variants are publicly
+  # reachable under /system/uploads, so an entry is always written,
+  # before the row and its files die. Every currently-attached node
+  # participates so its zoomed history shows the loss; the asset itself
+  # participates as the first non-Node subject (its participant row
+  # dangles after destroy, by design, the name lives on in metadata).
+  def destroy_witnessed! user:
+    ActiveRecord::Base.transaction do
+      affected = attached_nodes.to_a
+      headline_losses = affected.select do |node|
+        [node.head, node.draft, node.autosave].compact.any? do |row|
+          row.related_assets.exists?(:asset_id => id, :headline => true)
+        end
+      end
+
+      metadata = {
+        :asset_name   => name,
+        :content_type => upload_content_type,
+        :path         => upload.url.sub(/\?\d+$/, ""),
+      }
+      metadata[:detached_from]         = affected.map(&:unique_name)        if affected.any?
+      metadata[:headline_removed_from] = headline_losses.map(&:unique_name) if headline_losses.any?
+
+      NodeAction.record!(:participants => [self] + affected, :user => user,
+                          :action => "asset_destroy", **metadata)
+      destroy!
+    end
+  end
 end
diff --git a/app/models/node_action.rb b/app/models/node_action.rb
index 8a3dd8b7..9ed0b628 100644
--- a/app/models/node_action.rb
+++ b/app/models/node_action.rb
@@ -69,6 +69,15 @@ class NodeAction < ApplicationRecord
   #   "path" -- final path, flat string (create-symmetric)
   #   "destroyed_descendants" -- integer, only when positive; one entry
   #                              at the root, per the subtree rule.
+  # "asset_destroy" (witnessed asset deletion; always written, even for
+  # unattached assets -- the files were publicly reachable; node column
+  # nil, subjects via participants: the asset plus every then-attached
+  # node):
+  #   "asset_name"            -- flat string
+  #   "content_type"          -- flat string
+  #   "path"                  -- public original path, flat string
+  #   "detached_from"         -- array of unique_names, only when any
+  #   "headline_removed_from" -- array of unique_names, only when any
   #
   # Reserved: "demote" (via "trash" | "depublish") for an explicit
   # depublish workflow, if ever built.