feat(anhaenge): Datenmodell und Ablage fuer Termin-Anhaenge

Neue Tabelle event_attachments samt Ablage-Modul. Dateien liegen unter
DATA_DIR/attachments, geshardet nach einem servergenerierten Namen -- weder
der hochgeladene Dateiname noch die Termin-UID beruehren je einen Pfad, da
die UID bei CalDAV-Terminen aus einem fremden Client stammt.

Der Dateityp wird an den Bytes bestimmt, nie am Content-Type des Clients.
SVG und HTML sind bewusst nicht erlaubt: beide fuehren Skript im Origin der
App aus, wo das Sitzungstoken liegt.

Aufgeraeumt wird an allen fuenf Loeschpfaden (Termin, Kalender, Gruppe,
Benutzer, CalDAV-DELETE), und zwar Zeilen vor dem Commit, Dateien erst
danach -- ein Rollback darf keine Bytes verlieren. Der Sweep als
Sicherheitsnetz ist implementiert, haengt aber noch an keinem Scheduler.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/routers/dav_router.py

@@ -30,6 +30,7 @@ from fastapi.responses import RedirectResponse, Response
 from sqlalchemy import func
 from sqlalchemy.orm import Session
 
+import attachments_store
 import dav_util
 import ical_io
 import models
@@ -357,6 +358,10 @@ def _handle_put(cal: models.LocalCalendar, resource: str, body: bytes, db: Sessi
     ev.description = item.get("description")
     ev.rrule = item.get("rrule")
     ev.exdate = item.get("exdate")
+    # Only LocalEvent columns are written here, so attachments in the side table
+    # survive an external client rewriting the event. Do NOT start parsing the
+    # ICS ATTACH property: an inline ENCODING=BASE64 attachment would be
+    # unbounded in size and its content never sniffed.
     dav_util.bump_dav(cal, ev)
     db.commit()
     db.refresh(ev)
@@ -368,8 +373,10 @@ def _handle_delete(cal: models.LocalCalendar, resource: str, db: Session) -> Res
     if not ev:
         return Response(status_code=404)
     dav_util.bump_dav(cal)
+    stale = attachments_store.purge_for_events(db, [ev.id])
     db.delete(ev)
     db.commit()
+    attachments_store.unlink_all(stale)
     return Response(status_code=204)
 
 

backend/routers/groups_router.py

@@ -16,6 +16,7 @@ from pydantic import BaseModel
 from sqlalchemy import or_
 from sqlalchemy.orm import Session
 
+import attachments_store
 import models
 from auth import get_current_user
 from database import get_db
@@ -311,12 +312,15 @@ def delete_group(
     _require_owner(db, group, current_user)
     # Remove the group calendar (and its events) too.
     gc = db.query(models.GroupCalendar).filter(models.GroupCalendar.group_id == group_id).first()
+    stale = []
     if gc:
         cal = db.query(models.LocalCalendar).filter(models.LocalCalendar.id == gc.calendar_id).first()
         if cal:
+            stale = attachments_store.purge_for_calendars(db, [cal.id])
             db.delete(cal)  # cascades to events
     db.delete(group)  # cascades to members + group_calendar link
     db.commit()
+    attachments_store.unlink_all(stale)
     return {"ok": True}
 
 

backend/routers/local_router.py

@@ -7,6 +7,7 @@ from fastapi.responses import Response
 from pydantic import BaseModel
 from sqlalchemy.orm import Session
 
+import attachments_store
 import dav_util
 import ical_io
 import models
@@ -391,8 +392,10 @@ def delete_calendar(
     )
     if not cal:
         raise HTTPException(404, "Calendar not found")
+    stale = attachments_store.purge_for_calendars(db, [cal.id])
     db.delete(cal)
     db.commit()
+    attachments_store.unlink_all(stale)
     return {"ok": True}
 
 
@@ -525,8 +528,12 @@ def delete_event(
 ):
     ev = _writable_event(db, current_user, uid)
     dav_util.bump_dav(ev.calendar)
+    # Drop the attachment rows here so their files can be named, then unlink
+    # only after the commit — a rollback must not leave rows without bytes.
+    stale = attachments_store.purge_for_events(db, [ev.id])
     db.delete(ev)
     db.commit()
+    attachments_store.unlink_all(stale)
     return {"ok": True}
 
 

backend/routers/users_router.py

@@ -5,6 +5,7 @@ from pydantic import BaseModel
 from sqlalchemy import func
 from sqlalchemy.orm import Session
 
+import attachments_store
 import models
 from auth import get_current_admin, get_current_user, get_password_hash
 from database import get_db
@@ -101,8 +102,18 @@ def delete_user(
     user = db.query(models.User).filter(models.User.id == user_id).first()
     if not user:
         raise HTTPException(404, "User not found")
+    # user -> calendars -> events -> attachments: the longest cascade chain, and
+    # the one where orphaned files would pile up unnoticed.
+    cal_ids = [
+        r[0]
+        for r in db.query(models.LocalCalendar.id)
+        .filter(models.LocalCalendar.user_id == user_id)
+        .all()
+    ]
+    stale = attachments_store.purge_for_calendars(db, cal_ids)
     db.delete(user)
     db.commit()
+    attachments_store.unlink_all(stale)
     return {"ok": True}