feat: add docker pipeline and preview fixes

2026-05-06 12:59:50 +08:00
commit 9ba85b01f3
44 changed files with 13894 additions and 0 deletions
@@ -0,0 +1,743 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { createServer } from 'node:http';
+import { rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { createServerApp } from '../src/server.js';
+import {
+  createDuplicatiFixture,
+  createDuplicatiServerDbFixture
+} from './support/duplicatiFixture.js';
+
+async function startTestServer() {
+  const tempDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'duplicati-server-'));
+  const appDbPath = path.join(tempDirectory, 'app.sqlite');
+  const uploadDir = path.join(tempDirectory, 'sources');
+  const runtime = await createServerApp({
+    appDbPath,
+    uploadDir,
+    previewMaxBytes: 1024
+  });
+
+  const server = await new Promise((resolve) => {
+    const instance = runtime.app.listen(0, () => resolve(instance));
+  });
+  const address = server.address();
+  const baseUrl = `http://127.0.0.1:${address.port}`;
+
+  return {
+    baseUrl,
+    appDbPath,
+    uploadDir,
+    runtime,
+    server,
+    async close() {
+      await new Promise((resolve, reject) => {
+        server.close((error) => {
+          if (error) {
+            reject(error);
+            return;
+          }
+
+          resolve();
+        });
+      });
+      await runtime.close();
+      await rm(tempDirectory, { recursive: true, force: true });
+    }
+  };
+}
+
+async function uploadFixture(baseUrl, fixture) {
+  return uploadDatabase(baseUrl, '/api/sources/upload', fixture);
+}
+
+async function uploadServerDbFixture(baseUrl, fixture) {
+  return uploadDatabase(baseUrl, '/api/server-db/upload', fixture);
+}
+
+async function uploadDatabase(baseUrl, endpoint, fixture) {
+  const form = new FormData();
+  const bytes = await fs.promises.readFile(fixture.databasePath);
+  form.set('database', new File([bytes], path.basename(fixture.databasePath), { type: 'application/octet-stream' }));
+
+  const response = await fetch(`${baseUrl}${endpoint}`, {
+    method: 'POST',
+    body: form
+  });
+  const payload = await response.json();
+  return { response, payload };
+}
+
+function createBasicHeader(username, password) {
+  return `Basic ${Buffer.from(`${username}:${password}`, 'utf8').toString('base64')}`;
+}
+
+async function startRemoteVolumeServer({ remoteDir, username, password }) {
+  const expectedAuth = createBasicHeader(username, password);
+  const server = createServer(async (request, response) => {
+    if ((request.headers.authorization ?? '') !== expectedAuth) {
+      response.writeHead(401, { 'WWW-Authenticate': 'Basic realm="test"' });
+      response.end('unauthorized');
+      return;
+    }
+
+    const filename = decodeURIComponent(new URL(request.url, 'http://127.0.0.1').pathname.slice(1));
+    const targetPath = path.join(remoteDir, filename);
+
+    try {
+      const stat = await fs.promises.stat(targetPath);
+      response.writeHead(200, {
+        'Content-Length': stat.size,
+        'Content-Type': 'application/octet-stream'
+      });
+      fs.createReadStream(targetPath).pipe(response);
+    } catch (error) {
+      response.writeHead(404);
+      response.end('missing');
+    }
+  });
+
+  await new Promise((resolve) => server.listen(0, resolve));
+  const address = server.address();
+  const baseUrl = `http://127.0.0.1:${address.port}/`;
+
+  return {
+    baseUrl,
+    server,
+    async close() {
+      await new Promise((resolve, reject) => {
+        server.close((error) => {
+          if (error) {
+            reject(error);
+            return;
+          }
+
+          resolve();
+        });
+      });
+    }
+  };
+}
+
+async function waitForEnhancementStatus(baseUrl, sourceId, allowedStatuses) {
+  for (let attempt = 0; attempt < 120; attempt += 1) {
+    const payload = await fetch(`${baseUrl}/api/sources/${sourceId}/enhance/status`).then((response) =>
+      response.json()
+    );
+    if (allowedStatuses.includes(payload.enhancement.status)) {
+      return payload.enhancement;
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+
+  throw new Error(`Timed out waiting for enhancement status ${allowedStatuses.join(', ')}`);
+}
+
+test('multi-source uploads coexist, duplicate uploads reuse the existing source, and sourceId becomes required', async () => {
+  const server = await startTestServer();
+  const firstFixture = createDuplicatiFixture({
+    filename: 'first.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false
+  });
+  const secondFixture = createDuplicatiFixture({
+    filename: 'second.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false,
+    demoFileName: 'demo-v2.mp4',
+    demoFileHash: 'filehash-demo-v2=='
+  });
+
+  try {
+    const emptySources = await fetch(`${server.baseUrl}/api/sources`).then((response) => response.json());
+    assert.equal(emptySources.sources.length, 0);
+
+    const firstUpload = await uploadFixture(server.baseUrl, firstFixture);
+    assert.equal(firstUpload.response.status, 201);
+    assert.equal(firstUpload.payload.reused, false);
+
+    const duplicateUpload = await uploadFixture(server.baseUrl, firstFixture);
+    assert.equal(duplicateUpload.response.status, 200);
+    assert.equal(duplicateUpload.payload.reused, true);
+    assert.equal(duplicateUpload.payload.source.id, firstUpload.payload.source.id);
+
+    const secondUpload = await uploadFixture(server.baseUrl, secondFixture);
+    assert.equal(secondUpload.response.status, 201);
+    assert.notEqual(secondUpload.payload.source.id, firstUpload.payload.source.id);
+
+    const compatCurrent = await fetch(`${server.baseUrl}/api/source/current`);
+    const compatPayload = await compatCurrent.json();
+    assert.equal(compatCurrent.status, 409);
+    assert.equal(compatPayload.error.code, 'SOURCE_ID_REQUIRED');
+
+    const missingSourceId = await fetch(`${server.baseUrl}/api/ls?path=/source/media/movies`).then((response) =>
+      response.json()
+    );
+    assert.equal(missingSourceId.error.code, 'SOURCE_ID_REQUIRED');
+
+    const firstListing = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${firstUpload.payload.source.id}&path=/source/media/movies`
+    ).then((response) => response.json());
+    assert.equal(firstListing.sourceId, firstUpload.payload.source.id);
+
+    const secondListing = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${secondUpload.payload.source.id}&path=/source/media/movies`
+    ).then((response) => response.json());
+    assert.equal(secondListing.sourceId, secondUpload.payload.source.id);
+
+    const filesInSourceRoot = await fs.promises.readdir(server.uploadDir, { withFileTypes: true });
+    const sourceDirectories = filesInSourceRoot.filter(
+      (entry) => entry.isDirectory() && entry.name !== '_staging' && entry.name !== '_server'
+    );
+    assert.equal(sourceDirectories.length, 2);
+  } finally {
+    firstFixture.cleanup();
+    secondFixture.cleanup();
+    await server.close();
+  }
+});
+
+test('deleting a single source removes only that source and keeps the server database intact', async () => {
+  const server = await startTestServer();
+  const sourceA = createDuplicatiFixture({
+    filename: 'delete-a.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false
+  });
+  const sourceB = createDuplicatiFixture({
+    filename: 'delete-b.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false,
+    demoFileName: 'delete-b.mp4',
+    demoFileHash: 'delete-b-hash=='
+  });
+  const serverDb = createDuplicatiServerDbFixture({
+    backups: [
+      { id: 21, name: 'Delete A', dbPath: '/data/Duplicati/delete-a.sqlite' },
+      { id: 22, name: 'Delete B', dbPath: '/data/Duplicati/delete-b.sqlite' }
+    ]
+  });
+
+  try {
+    const uploadA = await uploadFixture(server.baseUrl, sourceA);
+    const uploadB = await uploadFixture(server.baseUrl, sourceB);
+    const deleteSourceDir = path.join(server.uploadDir, uploadA.payload.source.id);
+    const keepSourceDir = path.join(server.uploadDir, uploadB.payload.source.id);
+
+    const serverDbUpload = await uploadServerDbFixture(server.baseUrl, serverDb);
+    assert.equal(serverDbUpload.response.status, 201);
+
+    const deleteResponse = await fetch(`${server.baseUrl}/api/sources/${uploadA.payload.source.id}`, {
+      method: 'DELETE'
+    });
+    const deletePayload = await deleteResponse.json();
+    assert.equal(deleteResponse.status, 200);
+    assert.equal(deletePayload.deleted.id, uploadA.payload.source.id);
+
+    const remainingSources = await fetch(`${server.baseUrl}/api/sources`).then((response) => response.json());
+    assert.equal(remainingSources.sources.length, 1);
+    assert.equal(remainingSources.sources[0].id, uploadB.payload.source.id);
+
+    const deletedLookup = await fetch(`${server.baseUrl}/api/sources/${uploadA.payload.source.id}`).then((response) =>
+      response.json()
+    );
+    assert.equal(deletedLookup.error.code, 'SOURCE_NOT_FOUND');
+
+    await assert.rejects(() => fs.promises.stat(deleteSourceDir));
+    const keptStat = await fs.promises.stat(keepSourceDir);
+    assert.equal(keptStat.isDirectory(), true);
+
+    const serverDbSummary = await fetch(`${server.baseUrl}/api/server-db`).then((response) => response.json());
+    assert.equal(serverDbSummary.serverDb.available, true);
+    assert.equal(serverDbSummary.serverDb.backupCount, 2);
+  } finally {
+    sourceA.cleanup();
+    sourceB.cleanup();
+    serverDb.cleanup();
+    await server.close();
+  }
+});
+
+test('server db upload maps task names onto existing sources and replacement remaps them', async () => {
+  const server = await startTestServer();
+  const sourceA = createDuplicatiFixture({
+    filename: 'TMQRJYNADS.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false
+  });
+  const sourceB = createDuplicatiFixture({
+    filename: 'ENVPLWAIWJ.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false,
+    demoFileName: 'env-demo.mp4',
+    demoFileHash: 'env-demo-hash=='
+  });
+  const firstServerDb = createDuplicatiServerDbFixture({
+    backups: [
+      { id: 2, name: '四川农场主', dbPath: '/data/Duplicati/TMQRJYNADS.sqlite' },
+      { id: 3, name: '小白', dbPath: '/data/Duplicati/ENVPLWAIWJ.sqlite' }
+    ]
+  });
+  const replacementServerDb = createDuplicatiServerDbFixture({
+    backups: [
+      { id: 2, name: '四川农场主-新', dbPath: '/data/Duplicati/TMQRJYNADS.sqlite' },
+      { id: 3, name: '小白-新', dbPath: '/data/Duplicati/ENVPLWAIWJ.sqlite' }
+    ]
+  });
+
+  try {
+    const invalidServerDbUpload = await uploadDatabase(server.baseUrl, '/api/sources/upload', firstServerDb);
+    assert.equal(invalidServerDbUpload.response.status, 422);
+    assert.equal(invalidServerDbUpload.payload.error.code, 'INVALID_SOURCE_SCHEMA');
+
+    const uploadA = await uploadFixture(server.baseUrl, sourceA);
+    const uploadB = await uploadFixture(server.baseUrl, sourceB);
+    assert.equal(uploadA.payload.source.displayName, 'TMQRJYNADS.sqlite');
+    assert.equal(uploadA.payload.source.displayNameSource, 'filename');
+
+    const firstServerDbUpload = await uploadServerDbFixture(server.baseUrl, firstServerDb);
+    assert.equal(firstServerDbUpload.response.status, 201);
+    assert.equal(firstServerDbUpload.payload.serverDb.available, true);
+    assert.equal(firstServerDbUpload.payload.serverDb.backupCount, 2);
+
+    const sourcesAfterMapping = await fetch(`${server.baseUrl}/api/sources`).then((response) => response.json());
+    const mappedA = sourcesAfterMapping.sources.find((source) => source.id === uploadA.payload.source.id);
+    const mappedB = sourcesAfterMapping.sources.find((source) => source.id === uploadB.payload.source.id);
+    assert.equal(mappedA.displayName, '四川农场主');
+    assert.equal(mappedA.displayNameSource, 'server-db');
+    assert.equal(mappedA.matchedBackupName, '四川农场主');
+    assert.equal(mappedB.displayName, '小白');
+
+    const serverDbSummary = await fetch(`${server.baseUrl}/api/server-db`).then((response) => response.json());
+    assert.equal(serverDbSummary.serverDb.available, true);
+    assert.equal(serverDbSummary.serverDb.backupCount, 2);
+
+    const replacementUpload = await uploadServerDbFixture(server.baseUrl, replacementServerDb);
+    assert.equal(replacementUpload.response.status, 201);
+
+    const sourcesAfterReplacement = await fetch(`${server.baseUrl}/api/sources`).then((response) => response.json());
+    const remappedA = sourcesAfterReplacement.sources.find((source) => source.id === uploadA.payload.source.id);
+    const remappedB = sourcesAfterReplacement.sources.find((source) => source.id === uploadB.payload.source.id);
+    assert.equal(remappedA.displayName, '四川农场主-新');
+    assert.equal(remappedB.displayName, '小白-新');
+  } finally {
+    sourceA.cleanup();
+    sourceB.cleanup();
+    firstServerDb.cleanup();
+    replacementServerDb.cleanup();
+    await server.close();
+  }
+});
+
+test('global WebDAV defaults plus server-db target URL allow enhancement without per-source credential re-entry', async () => {
+  const server = await startTestServer();
+  const fixture = createDuplicatiFixture({
+    filename: 'global-defaults.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false,
+    withRemoteVolumes: true
+  });
+  const remote = await startRemoteVolumeServer({
+    remoteDir: fixture.remoteDir,
+    username: 'demo',
+    password: 'secret'
+  });
+  const serverDb = createDuplicatiServerDbFixture({
+    backups: [
+      {
+        id: 7,
+        name: 'Global Defaults Demo',
+        dbPath: '/data/Duplicati/global-defaults.sqlite',
+        targetUrl: remote.baseUrl.replace('http://', 'webdav://')
+      }
+    ]
+  });
+
+  try {
+    const upload = await uploadFixture(server.baseUrl, fixture);
+    const sourceId = upload.payload.source.id;
+
+    const defaultsResponse = await fetch(`${server.baseUrl}/api/webdav-defaults`, {
+      method: 'PUT',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        authMode: 'basic',
+        username: 'demo',
+        password: 'secret',
+        passphrase: fixture.passphrase
+      })
+    });
+    const defaultsPayload = await defaultsResponse.json();
+    assert.equal(defaultsResponse.status, 200);
+    assert.equal(defaultsPayload.defaults.configured, true);
+    assert.equal(defaultsPayload.defaults.hasPassphrase, true);
+
+    const serverDbUpload = await uploadServerDbFixture(server.baseUrl, serverDb);
+    assert.equal(serverDbUpload.response.status, 201);
+
+    const sourceDetail = await fetch(`${server.baseUrl}/api/sources/${sourceId}`).then((response) =>
+      response.json()
+    );
+    assert.equal(sourceDetail.source.webdav.derivedWebdavBaseUrl, remote.baseUrl);
+    assert.equal(sourceDetail.source.webdav.effectiveWebdavBaseUrl, remote.baseUrl);
+    assert.equal(sourceDetail.source.webdav.effectiveWebdavBaseUrlSource, 'server-db');
+
+    const browserSecrets = await fetch(`${server.baseUrl}/api/sources/${sourceId}/browser-secrets`).then((response) =>
+      response.json()
+    );
+    assert.equal(browserSecrets.secrets.webdavBaseUrl, remote.baseUrl);
+    assert.equal(browserSecrets.secrets.username, 'demo');
+    assert.equal(browserSecrets.secrets.password, 'secret');
+    assert.equal(browserSecrets.secrets.passphrase, fixture.passphrase);
+    assert.equal(browserSecrets.secrets.authMode, 'basic');
+
+    const enhanceResponse = await fetch(`${server.baseUrl}/api/sources/${sourceId}/enhance`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({})
+    });
+    assert.equal(enhanceResponse.status, 202);
+
+    const enhancement = await waitForEnhancementStatus(server.baseUrl, sourceId, ['ready', 'failed']);
+    assert.equal(enhancement.status, 'ready');
+  } finally {
+    await remote.close();
+    fixture.cleanup();
+    serverDb.cleanup();
+    await server.close();
+  }
+});
+
+test('raw source keeps browsing available, gates file-info, and does not leak saved secrets', async () => {
+  const server = await startTestServer();
+  const rawFixture = createDuplicatiFixture({
+    filename: 'raw-job.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false
+  });
+
+  try {
+    const upload = await uploadFixture(server.baseUrl, rawFixture);
+    assert.equal(upload.response.status, 201);
+
+    const sourceId = upload.payload.source.id;
+    const listing = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${sourceId}&path=/source/media/movies`
+    ).then((response) => response.json());
+    const fileId = listing.entries.find((entry) => entry.type === 'file')?.id;
+    assert.ok(fileId);
+
+    const fileInfoBeforeEnhance = await fetch(
+      `${server.baseUrl}/api/file-info?sourceId=${sourceId}&id=${encodeURIComponent(fileId)}`
+    ).then((response) => response.json());
+    assert.equal(fileInfoBeforeEnhance.error.code, 'ENHANCEMENT_NOT_READY');
+
+    const saveSecretsResponse = await fetch(`${server.baseUrl}/api/sources/${sourceId}/secrets`, {
+      method: 'PUT',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        webdavBaseUrl: 'http://127.0.0.1:9999/remote/',
+        username: 'demo',
+        password: 'secret',
+        passphrase: 'passphrase',
+        authMode: 'basic'
+      })
+    });
+    const saveSecretsPayload = await saveSecretsResponse.json();
+    assert.equal(saveSecretsResponse.status, 200);
+    assert.equal(saveSecretsPayload.source.credentialsSaved, true);
+    assert.equal(saveSecretsPayload.source.password, undefined);
+    assert.equal(saveSecretsPayload.source.passphrase, undefined);
+
+    const sourceDetail = await fetch(`${server.baseUrl}/api/sources/${sourceId}`).then((response) =>
+      response.json()
+    );
+    assert.equal(sourceDetail.source.credentialsSaved, true);
+    assert.equal(sourceDetail.source.username, undefined);
+    assert.equal(sourceDetail.source.password, undefined);
+  } finally {
+    rawFixture.cleanup();
+    await server.close();
+  }
+});
+
+test('enhancement job builds archive indexes from Basic-auth WebDAV volumes and old file ids stay valid', async () => {
+  const server = await startTestServer();
+  const fixture = createDuplicatiFixture({
+    filename: 'enhance.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false,
+    withRemoteVolumes: true,
+    includeAesExtensions: true
+  });
+  const remote = await startRemoteVolumeServer({
+    remoteDir: fixture.remoteDir,
+    username: 'demo',
+    password: 'secret'
+  });
+
+  try {
+    const upload = await uploadFixture(server.baseUrl, fixture);
+    const sourceId = upload.payload.source.id;
+
+    const listing = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${sourceId}&path=/source/media/movies`
+    ).then((response) => response.json());
+    const fileId = listing.entries.find((entry) => entry.type === 'file')?.id;
+    assert.ok(fileId);
+
+    const enhanceResponse = await fetch(`${server.baseUrl}/api/sources/${sourceId}/enhance`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        webdavBaseUrl: remote.baseUrl,
+        username: 'demo',
+        password: 'secret',
+        passphrase: fixture.passphrase,
+        authMode: 'basic'
+      })
+    });
+    assert.equal(enhanceResponse.status, 202);
+
+    const enhancement = await waitForEnhancementStatus(server.baseUrl, sourceId, ['ready', 'failed']);
+    assert.equal(enhancement.status, 'ready');
+    assert.equal(enhancement.processedVolumes, 2);
+    assert.equal(enhancement.totalVolumes, 2);
+
+    const sourceDetail = await fetch(`${server.baseUrl}/api/sources/${sourceId}`).then((response) =>
+      response.json()
+    );
+    assert.equal(sourceDetail.source.capabilities.archiveEntryIndex, true);
+    assert.equal(sourceDetail.source.capabilities.volumeCryptoCache, true);
+
+    const fileInfo = await fetch(
+      `${server.baseUrl}/api/file-info?sourceId=${sourceId}&id=${encodeURIComponent(fileId)}`
+    ).then((response) => response.json());
+    assert.equal(fileInfo.file.path, '/source/media/movies/demo.mp4');
+    assert.equal(fileInfo.restorePlan.segmentCount, 3);
+    assert.equal(fileInfo.requiredDblocks[0], 'duplicati-demo.dblock.zip.aes');
+    assert.equal(fileInfo.volumes[0].encryption.streamFormat, 'v2');
+  } finally {
+    await remote.close();
+    fixture.cleanup();
+    await server.close();
+  }
+});
+
+test('video thumbnails can be uploaded, listed, fetched, deleted, and cleared per source', async () => {
+  const server = await startTestServer();
+  const fixture = createDuplicatiFixture({
+    filename: 'thumbs.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false,
+    withRemoteVolumes: true
+  });
+  const remote = await startRemoteVolumeServer({
+    remoteDir: fixture.remoteDir,
+    username: 'demo',
+    password: 'secret'
+  });
+
+  try {
+    const upload = await uploadFixture(server.baseUrl, fixture);
+    const sourceId = upload.payload.source.id;
+
+    const enhanceResponse = await fetch(`${server.baseUrl}/api/sources/${sourceId}/enhance`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        webdavBaseUrl: remote.baseUrl,
+        username: 'demo',
+        password: 'secret',
+        passphrase: fixture.passphrase,
+        authMode: 'basic'
+      })
+    });
+    assert.equal(enhanceResponse.status, 202);
+
+    const enhancement = await waitForEnhancementStatus(server.baseUrl, sourceId, ['ready', 'failed']);
+    assert.equal(enhancement.status, 'ready');
+
+    const listingBefore = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${sourceId}&path=/source/media/movies`
+    ).then((response) => response.json());
+    const fileEntry = listingBefore.entries.find((entry) => entry.type === 'file');
+    assert.ok(fileEntry);
+    assert.equal(fileEntry.thumbnail.available, false);
+
+    const fileInfoBefore = await fetch(
+      `${server.baseUrl}/api/file-info?sourceId=${sourceId}&id=${encodeURIComponent(fileEntry.id)}`
+    ).then((response) => response.json());
+    assert.equal(fileInfoBefore.file.thumbnail.available, false);
+
+    const thumbnailForm = new FormData();
+    thumbnailForm.set('fileId', fileEntry.id);
+    thumbnailForm.set(
+      'image',
+      new File([Uint8Array.from([0x52, 0x49, 0x46, 0x46, 0x10, 0x00, 0x00, 0x00])], 'preview.webp', {
+        type: 'image/webp'
+      })
+    );
+
+    const thumbnailUploadResponse = await fetch(`${server.baseUrl}/api/sources/${sourceId}/thumbnails`, {
+      method: 'POST',
+      body: thumbnailForm
+    });
+    const thumbnailUploadPayload = await thumbnailUploadResponse.json();
+    assert.equal(thumbnailUploadResponse.status, 201);
+    assert.equal(thumbnailUploadPayload.thumbnail.available, true);
+    assert.ok(thumbnailUploadPayload.thumbnail.thumbnailId);
+
+    const thumbnailFetchResponse = await fetch(`${server.baseUrl}${thumbnailUploadPayload.thumbnail.thumbnailUrl}`);
+    assert.equal(thumbnailFetchResponse.status, 200);
+    assert.equal(thumbnailFetchResponse.headers.get('content-type'), 'image/webp');
+    assert.deepEqual(new Uint8Array(await thumbnailFetchResponse.arrayBuffer()), Uint8Array.from([0x52, 0x49, 0x46, 0x46, 0x10, 0x00, 0x00, 0x00]));
+
+    const listingAfterUpload = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${sourceId}&path=/source/media/movies`
+    ).then((response) => response.json());
+    const listedFileAfterUpload = listingAfterUpload.entries.find((entry) => entry.id === fileEntry.id);
+    assert.equal(listedFileAfterUpload.thumbnail.available, true);
+    assert.equal(listedFileAfterUpload.thumbnail.thumbnailId, thumbnailUploadPayload.thumbnail.thumbnailId);
+
+    const fileInfoAfterUpload = await fetch(
+      `${server.baseUrl}/api/file-info?sourceId=${sourceId}&id=${encodeURIComponent(fileEntry.id)}`
+    ).then((response) => response.json());
+    assert.equal(fileInfoAfterUpload.file.thumbnail.available, true);
+
+    const sourceDetailAfterUpload = await fetch(`${server.baseUrl}/api/sources/${sourceId}`).then((response) =>
+      response.json()
+    );
+    assert.equal(sourceDetailAfterUpload.source.thumbnailCache.count, 1);
+
+    const singleDeleteResponse = await fetch(
+      `${server.baseUrl}/api/sources/${sourceId}/thumbnails/${encodeURIComponent(thumbnailUploadPayload.thumbnail.thumbnailId)}`,
+      {
+        method: 'DELETE'
+      }
+    );
+    const singleDeletePayload = await singleDeleteResponse.json();
+    assert.equal(singleDeleteResponse.status, 200);
+    assert.equal(singleDeletePayload.deleted.fileId, fileEntry.id);
+
+    const listingAfterSingleDelete = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${sourceId}&path=/source/media/movies`
+    ).then((response) => response.json());
+    const listedFileAfterDelete = listingAfterSingleDelete.entries.find((entry) => entry.id === fileEntry.id);
+    assert.equal(listedFileAfterDelete.thumbnail.available, false);
+
+    const secondThumbnailForm = new FormData();
+    secondThumbnailForm.set('fileId', fileEntry.id);
+    secondThumbnailForm.set(
+      'image',
+      new File([Uint8Array.from([0x57, 0x45, 0x42, 0x50])], 'preview-2.webp', {
+        type: 'image/webp'
+      })
+    );
+    const secondUploadResponse = await fetch(`${server.baseUrl}/api/sources/${sourceId}/thumbnails`, {
+      method: 'POST',
+      body: secondThumbnailForm
+    });
+    assert.equal(secondUploadResponse.status, 201);
+
+    const clearResponse = await fetch(`${server.baseUrl}/api/sources/${sourceId}/thumbnails`, {
+      method: 'DELETE'
+    });
+    const clearPayload = await clearResponse.json();
+    assert.equal(clearResponse.status, 200);
+    assert.equal(clearPayload.cleared.removedCount, 1);
+
+    const sourceDetailAfterClear = await fetch(`${server.baseUrl}/api/sources/${sourceId}`).then((response) =>
+      response.json()
+    );
+    assert.equal(sourceDetailAfterClear.source.thumbnailCache.count, 0);
+  } finally {
+    await remote.close();
+    fixture.cleanup();
+    await server.close();
+  }
+});
+
+test('failed enhancement keeps directory browsing available and surfaces ENHANCEMENT_FAILED', async () => {
+  const server = await startTestServer();
+  const fixture = createDuplicatiFixture({
+    filename: 'enhance-fail.sqlite',
+    layout: 'file_lookup',
+    includeArchiveEntryIndex: false,
+    includeVolumeCryptoCache: false,
+    withRemoteVolumes: true
+  });
+  const remote = await startRemoteVolumeServer({
+    remoteDir: fixture.remoteDir,
+    username: 'demo',
+    password: 'secret'
+  });
+
+  try {
+    const upload = await uploadFixture(server.baseUrl, fixture);
+    const sourceId = upload.payload.source.id;
+
+    const listingBefore = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${sourceId}&path=/source/media/movies`
+    ).then((response) => response.json());
+    const fileId = listingBefore.entries.find((entry) => entry.type === 'file')?.id;
+    assert.ok(fileId);
+
+    const enhanceResponse = await fetch(`${server.baseUrl}/api/sources/${sourceId}/enhance`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        webdavBaseUrl: remote.baseUrl,
+        username: 'demo',
+        password: 'secret',
+        passphrase: 'wrong-passphrase',
+        authMode: 'basic'
+      })
+    });
+    assert.equal(enhanceResponse.status, 202);
+
+    const enhancement = await waitForEnhancementStatus(server.baseUrl, sourceId, ['ready', 'failed']);
+    assert.equal(enhancement.status, 'failed');
+
+    const listingAfter = await fetch(
+      `${server.baseUrl}/api/ls?sourceId=${sourceId}&path=/source/media/movies`
+    ).then((response) => response.json());
+    assert.equal(listingAfter.entries.length, listingBefore.entries.length);
+
+    const fileInfo = await fetch(
+      `${server.baseUrl}/api/file-info?sourceId=${sourceId}&id=${encodeURIComponent(fileId)}`
+    ).then((response) => response.json());
+    assert.equal(fileInfo.error.code, 'ENHANCEMENT_FAILED');
+  } finally {
+    await remote.close();
+    fixture.cleanup();
+    await server.close();
+  }
+});