+
+
+
+ Redact document
+ Draw black boxes to censor sensitive areas,
then save a new redacted copy +
+ then save a new redacted copy +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {{ redaction.title || redaction.filename }}
+
+
+
+
+
+
+
+
-
-
-
-
-
-
+
+
+
+
+
+
+
`,
-});
\ No newline at end of file
+});
diff --git a/enferno/static/js/components/MediaRedactor.js b/enferno/static/js/components/MediaRedactor.js
new file mode 100644
index 000000000..24848bf0e
--- /dev/null
+++ b/enferno/static/js/components/MediaRedactor.js
@@ -0,0 +1,608 @@
+const REDACTOR_MAX_ZOOM = 6;
+
+const MediaRedactor = Vue.defineComponent({
+ props: {
+ modelValue: { type: Boolean, default: false },
+ media: { type: Object, default: null },
+ },
+ emits: ['update:modelValue', 'redacted'],
+
+ data() {
+ return {
+ REDACTOR_MAX_ZOOM,
+ loading: false,
+ saving: false,
+ error: null,
+ label: '',
+ pages: [],
+ boxes: {},
+ draft: null,
+ drag: null,
+ resize: null,
+ hoveredBox: null,
+ activeBox: null,
+ spaceDown: false,
+ panning: null,
+ zoom: 1,
+ baseWidth: 0,
+ pinchStartDistance: null,
+ pinchStartZoom: 1,
+ };
+ },
+
+ computed: {
+ show: {
+ get() {
+ return this.modelValue;
+ },
+ set(value) {
+ this.$emit('update:modelValue', value);
+ },
+ },
+ src() {
+ if (!this.media?.id) return null;
+ // Bust the browser cache when a copy is re-edited in place (filename stays, bytes change).
+ const v = this.media.etag ? `?v=${this.media.etag}` : '';
+ return `/admin/api/media/${this.media.id}/proxy${v}`;
+ },
+ isRedactedCopy() {
+ return !!(this.media?.isRedaction || this.media?.originalMediaId);
+ },
+ mediaKind() {
+ const fileType = this.media?.fileType || '';
+ if (fileType.includes('pdf')) return 'pdf';
+ if (fileType.includes('image')) return 'image';
+ const filename = this.media?.filename || '';
+ if (filename.toLowerCase().endsWith('.pdf')) return 'pdf';
+ if (/\.(jpe?g|png)$/i.test(filename)) return 'image';
+ return 'unsupported';
+ },
+ canSubmit() {
+ return Object.values(this.boxes).some(pageBoxes => pageBoxes.length);
+ },
+ orientation() {
+ return this.media?.orientation || 0;
+ },
+ imageStyle() {
+ return (page) => {
+ const o = this.orientation;
+ if ((o === 90 || o === 270) && page.width && page.height) {
+ // Container: width=CW, height=CW*(W/H) (swapped aspect-ratio H/W).
+ // Image pre-rotation must be W×H to visually fill CW×(CW*W/H) after rotating.
+ // width as % of CW: W/H * 100%
+ // height as % of containerHeight (CW*W/H): need CW → CW/(CW*W/H) = H/W → (H/W)*100%
+ return {
+ position: 'absolute',
+ top: '50%',
+ left: '50%',
+ width: `${(page.width / page.height) * 100}%`,
+ height: `${(page.height / page.width) * 100}%`,
+ objectFit: 'fill',
+ transform: `translate(-50%, -50%) rotate(${o}deg)`,
+ };
+ }
+ return { transform: `rotate(${o}deg)`, width: '100%' };
+ };
+ },
+ },
+
+ watch: {
+ async show(value) {
+ if (value) {
+ this.load();
+ await this.$nextTick();
+ const el = this.$refs.scrollPane?.$el ?? this.$refs.scrollPane;
+ if (el) {
+ this._scrollPane = el;
+ el.addEventListener('touchmove', this._touchMoveHandler, { passive: false });
+ el.addEventListener('wheel', this._wheelHandler, { passive: false });
+ }
+ window.addEventListener('keydown', this._keydownHandler);
+ window.addEventListener('keyup', this._keyupHandler);
+ } else {
+ this._scrollPane?.removeEventListener('touchmove', this._touchMoveHandler);
+ this._scrollPane?.removeEventListener('wheel', this._wheelHandler);
+ this._scrollPane = null;
+ window.removeEventListener('keydown', this._keydownHandler);
+ window.removeEventListener('keyup', this._keyupHandler);
+ this.reset();
+ }
+ },
+ media() {
+ if (this.show) this.load();
+ },
+ },
+
+ created() {
+ this._pdf = null;
+ this._loadId = 0;
+ this._touchMoveHandler = (e) => this.onTouchMove(e);
+ this._wheelHandler = (e) => this.onWheel(e);
+ this._keydownHandler = (e) => this.onKeydown(e);
+ this._keyupHandler = (e) => this.onKeyup(e);
+ },
+
+ beforeUnmount() {
+ this._scrollPane?.removeEventListener('touchmove', this._touchMoveHandler);
+ this._scrollPane?.removeEventListener('wheel', this._wheelHandler);
+ window.removeEventListener('keydown', this._keydownHandler);
+ window.removeEventListener('keyup', this._keyupHandler);
+ this._pdf?.destroy?.();
+ },
+
+ methods: {
+ reset() {
+ this._loadId++;
+ this.loading = false;
+ this.saving = false;
+ this.error = null;
+ this.label = '';
+ this.pages = [];
+ this.boxes = {};
+ this.draft = null;
+ this.drag = null;
+ this.resize = null;
+ this.hoveredBox = null;
+ this.activeBox = null;
+ this.spaceDown = false;
+ this.panning = null;
+ this.zoom = 1;
+ this.baseWidth = 0;
+ this.pinchStartDistance = null;
+ this.pinchStartZoom = 1;
+ this._pdf?.destroy?.();
+ this._pdf = null;
+ },
+ async load() {
+ this.reset();
+ if (!this.src) return;
+ if (this.mediaKind === 'pdf') return this.loadPdf();
+ if (this.mediaKind === 'image') {
+ this.pages = [{ index: 0, width: 1, height: 1, rendered: true }];
+ this.boxes = { 0: [] };
+ return;
+ }
+ this.error = 'Unsupported file type';
+ },
+ async loadPdf() {
+ const loadId = this._loadId;
+ this.loading = true;
+ try {
+ await loadScript('/static/js/pdf.js/pdf.min.mjs');
+ pdfjsLib.GlobalWorkerOptions.workerSrc = '/static/js/pdf.js/pdf.worker.min.mjs';
+ const pdf = await pdfjsLib.getDocument({ url: this.src, disableStream: true, disableRange: true }).promise;
+ if (loadId !== this._loadId) { pdf.destroy(); return; }
+ this._pdf = pdf;
+ const pages = [];
+ for (let index = 0; index < pdf.numPages; index++) {
+ const page = await pdf.getPage(index + 1);
+ if (loadId !== this._loadId) return;
+ const viewport = page.getViewport({ scale: 1 });
+ pages.push({ index, width: viewport.width, height: viewport.height });
+ this.boxes[index] = [];
+ await page.cleanup();
+ }
+ if (loadId !== this._loadId) return;
+ this.pages = pages;
+ this.loading = false;
+ await this.$nextTick();
+ for (const page of pages) {
+ if (loadId !== this._loadId) return;
+ await this.renderPdfPage(page.index);
+ }
+ } catch (e) {
+ if (loadId !== this._loadId) return;
+ console.error('PDF redactor load failed:', e);
+ this.error = 'Failed to load document';
+ this.loading = false;
+ }
+ },
+ canvasRef(index) {
+ const ref = this.$refs[`redactCanvas-${index}`];
+ return Array.isArray(ref) ? ref[0] : ref;
+ },
+ async renderPdfPage(index) {
+ const canvas = this.canvasRef(index);
+ if (!canvas || !this._pdf) return;
+ const pdfPage = await this._pdf.getPage(index + 1);
+ const viewport = pdfPage.getViewport({ scale: 1.5 });
+ const dpr = window.devicePixelRatio || 1;
+ canvas.width = Math.floor(viewport.width * dpr);
+ canvas.height = Math.floor(viewport.height * dpr);
+ canvas.style.width = '100%';
+ canvas.style.height = 'auto';
+ const ctx = canvas.getContext('2d', { alpha: false });
+ ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+ ctx.fillStyle = '#fff';
+ ctx.fillRect(0, 0, viewport.width, viewport.height);
+ await pdfPage.render({ canvasContext: ctx, viewport }).promise;
+ await pdfPage.cleanup();
+ this.pages = this.pages.map(page =>
+ page.index === index ? { ...page, width: viewport.width, height: viewport.height } : page
+ );
+ },
+ pageRect(index) {
+ return this.$refs[`page-${index}`]?.[0]?.getBoundingClientRect?.()
+ || this.$refs[`page-${index}`]?.getBoundingClientRect?.();
+ },
+ normalizedPoint(index, event) {
+ const rect = this.pageRect(index);
+ const x = Math.min(Math.max((event.clientX - rect.left) / rect.width, 0), 1);
+ const y = Math.min(Math.max((event.clientY - rect.top) / rect.height, 0), 1);
+ return { x, y };
+ },
+ startBox(index, event) {
+ if (event.button !== 0 || this.spaceDown) return;
+ const point = this.normalizedPoint(index, event);
+ this.draft = { page: index, startX: point.x, startY: point.y, x: point.x, y: point.y, w: 0, h: 0 };
+ },
+ startDrag(pageIndex, boxIndex, event) {
+ if (event.button !== 0) return;
+ event.stopPropagation();
+ this.activeBox = { page: pageIndex, box: boxIndex };
+ const point = this.normalizedPoint(pageIndex, event);
+ const box = this.boxes[pageIndex][boxIndex];
+ this.drag = { page: pageIndex, boxIndex, startMouseX: point.x, startMouseY: point.y, origX: box.x, origY: box.y };
+ },
+ // corner: 'tl' | 'tr' | 'bl' | 'br' — the corner being dragged; opposite corner is the anchor
+ startResize(pageIndex, boxIndex, corner, event) {
+ if (event.button !== 0) return;
+ event.stopPropagation();
+ this.activeBox = { page: pageIndex, box: boxIndex };
+ const box = this.boxes[pageIndex][boxIndex];
+ const anchorX = corner.includes('l') ? box.x + box.w : box.x;
+ const anchorY = corner.includes('t') ? box.y + box.h : box.y;
+ this.resize = { page: pageIndex, boxIndex, anchorX, anchorY };
+ },
+ moveBox(index, event) {
+ if (this.resize && this.resize.page === index) {
+ const point = this.normalizedPoint(index, event);
+ const { anchorX, anchorY, boxIndex } = this.resize;
+ const x = Math.min(Math.max(Math.min(point.x, anchorX), 0), 1);
+ const y = Math.min(Math.max(Math.min(point.y, anchorY), 0), 1);
+ const w = Math.min(Math.abs(point.x - anchorX), 1 - x);
+ const h = Math.min(Math.abs(point.y - anchorY), 1 - y);
+ const pageBoxes = [...(this.boxes[index] || [])];
+ pageBoxes[boxIndex] = { x, y, w, h };
+ this.boxes = { ...this.boxes, [index]: pageBoxes };
+ return;
+ }
+ if (this.drag && this.drag.page === index) {
+ const point = this.normalizedPoint(index, event);
+ const dx = point.x - this.drag.startMouseX;
+ const dy = point.y - this.drag.startMouseY;
+ const pageBoxes = [...(this.boxes[index] || [])];
+ const box = pageBoxes[this.drag.boxIndex];
+ pageBoxes[this.drag.boxIndex] = {
+ ...box,
+ x: Math.min(Math.max(this.drag.origX + dx, 0), 1 - box.w),
+ y: Math.min(Math.max(this.drag.origY + dy, 0), 1 - box.h),
+ };
+ this.boxes = { ...this.boxes, [index]: pageBoxes };
+ return;
+ }
+ if (!this.draft || this.draft.page !== index) return;
+ const point = this.normalizedPoint(index, event);
+ const x0 = Math.min(this.draft.startX, point.x);
+ const y0 = Math.min(this.draft.startY, point.y);
+ const x1 = Math.max(this.draft.startX, point.x);
+ const y1 = Math.max(this.draft.startY, point.y);
+ this.draft = { ...this.draft, x: x0, y: y0, w: x1 - x0, h: y1 - y0 };
+ },
+ finishBox() {
+ if (this.resize) { this.resize = null; return; }
+ if (this.drag) { this.drag = null; return; }
+ if (!this.draft) return;
+ if (this.draft.w > 0.005 && this.draft.h > 0.005) {
+ const pageBoxes = this.boxes[this.draft.page] || [];
+ pageBoxes.push({ x: this.draft.x, y: this.draft.y, w: this.draft.w, h: this.draft.h });
+ this.boxes = { ...this.boxes, [this.draft.page]: pageBoxes };
+ }
+ this.draft = null;
+ },
+ deleteBox(pageIndex, boxIndex) {
+ const pageBoxes = [...(this.boxes[pageIndex] || [])];
+ pageBoxes.splice(boxIndex, 1);
+ this.boxes = { ...this.boxes, [pageIndex]: pageBoxes };
+ if (this.hoveredBox?.page === pageIndex && this.hoveredBox?.box === boxIndex) this.hoveredBox = null;
+ if (this.activeBox?.page === pageIndex && this.activeBox?.box === boxIndex) this.activeBox = null;
+ },
+ onKeydown(event) {
+ if (event.target.tagName === 'INPUT' || event.target.tagName === 'TEXTAREA') return;
+ if (event.code === 'Space' && !this.spaceDown) {
+ event.preventDefault();
+ this.spaceDown = true;
+ return;
+ }
+ if (event.key !== 'Backspace' && event.key !== 'Delete') return;
+ const target = this.activeBox || this.hoveredBox;
+ if (!target) return;
+ event.preventDefault();
+ this.deleteBox(target.page, target.box);
+ },
+ onKeyup(event) {
+ if (event.code === 'Space') {
+ this.spaceDown = false;
+ this.panning = null;
+ }
+ },
+ onPanStart(event) {
+ if (!this.spaceDown || event.button !== 0) return;
+ event.preventDefault();
+ event.stopPropagation();
+ const pane = this._scrollPane;
+ if (!pane) return;
+ this.panning = { startX: event.clientX, startY: event.clientY, scrollLeft: pane.scrollLeft, scrollTop: pane.scrollTop };
+ },
+ onPanMove(event) {
+ if (!this.panning) return;
+ event.preventDefault();
+ const pane = this._scrollPane;
+ if (!pane) return;
+ pane.scrollLeft = this.panning.scrollLeft - (event.clientX - this.panning.startX);
+ pane.scrollTop = this.panning.scrollTop - (event.clientY - this.panning.startY);
+ },
+ onPanEnd() {
+ this.panning = null;
+ },
+ visibleBoxes(pageIndex) {
+ const boxes = [...(this.boxes[pageIndex] || [])];
+ if (this.draft?.page === pageIndex) boxes.push(this.draft);
+ return boxes;
+ },
+ zoomIn() {
+ this.zoom = Math.min(+(this.zoom + 0.25).toFixed(2), REDACTOR_MAX_ZOOM);
+ },
+ zoomOut() {
+ this.zoom = Math.max(+(this.zoom - 0.25).toFixed(2), 1);
+ },
+ zoomFit() {
+ this.zoom = 1;
+ },
+ pinchDistance(touches) {
+ const dx = touches[0].clientX - touches[1].clientX;
+ const dy = touches[0].clientY - touches[1].clientY;
+ return Math.sqrt(dx * dx + dy * dy);
+ },
+ onTouchStart(event) {
+ if (event.touches.length === 2) {
+ this.pinchStartDistance = this.pinchDistance(event.touches);
+ this.pinchStartZoom = this.zoom;
+ }
+ },
+ onTouchMove(event) {
+ if (event.touches.length === 2 && this.pinchStartDistance) {
+ event.preventDefault();
+ const scale = this.pinchDistance(event.touches) / this.pinchStartDistance;
+ const next = Math.min(Math.max(this.pinchStartZoom * scale, 1), REDACTOR_MAX_ZOOM);
+ const midX = (event.touches[0].clientX + event.touches[1].clientX) / 2;
+ const midY = (event.touches[0].clientY + event.touches[1].clientY) / 2;
+ this.applyZoom(next, midX, midY);
+ }
+ },
+ onTouchEnd() {
+ this.pinchStartDistance = null;
+ },
+ applyZoom(nextZoom, anchorX, anchorY) {
+ const pane = this._scrollPane;
+ if (!pane) { this.zoom = nextZoom; return; }
+ if (!this.baseWidth) {
+ const wrapper = pane.querySelector('.redactor-pages');
+ this.baseWidth = wrapper ? wrapper.getBoundingClientRect().width : pane.clientWidth;
+ }
+ const rect = pane.getBoundingClientRect();
+ const localX = anchorX !== undefined ? anchorX - rect.left : pane.clientWidth / 2;
+ const localY = anchorY !== undefined ? anchorY - rect.top : pane.clientHeight / 2;
+ const worldX = pane.scrollLeft + localX;
+ const worldY = pane.scrollTop + localY;
+ const ratio = nextZoom / this.zoom;
+ this.zoom = nextZoom;
+ this.$nextTick(() => {
+ pane.scrollLeft = worldX * ratio - localX;
+ pane.scrollTop = worldY * ratio - localY;
+ });
+ },
+ onWheel(event) {
+ if (!event.ctrlKey) return;
+ event.preventDefault();
+ const factor = Math.exp(-event.deltaY * 0.005);
+ const next = Math.min(Math.max(this.zoom * factor, 1), REDACTOR_MAX_ZOOM);
+ this.applyZoom(next, event.clientX, event.clientY);
+ },
+ async submit(overwrite = false) {
+ if (!this.canSubmit) return;
+ this.saving = true;
+ const pages = Object.entries(this.boxes)
+ .filter(([, rects]) => rects.length)
+ .map(([page, rects]) => ({ page: Number(page), rects }));
+ try {
+ const response = await api.post(`/admin/api/media/${this.media.id}/redact`, { pages, title: this.label.trim(), overwrite });
+ this.$emit('redacted', response.data.data);
+ this.show = false;
+ } catch (e) {
+ this.error = e.response?.data?.message || 'Failed to save redaction';
+ } finally {
+ this.saving = false;
+ }
+ },
+ },
+
+ template: /*html*/`
+
+ Save changes
+ {{ isRedactedCopy ? 'Save as new copy' : 'Save redacted copy' }}
+
+
+ Draw at least one black box on the document to save
+
+
+
+
+
+
+ ![]()
+
+
+
+
+
+
+ mdi-close
+
+
+
+
+
+
+
+
+
+
+
mdi-magnify-plus
@@ -360,12 +365,11 @@ const MediaThumbnail = Vue.defineComponent({
style="z-index: 2;">
- ![]()
1 or y + h > 1:
+ raise RedactionError("Redaction coordinates must be normalized within the page")
+
+
+def _absolute_rect(rect: dict, width: float, height: float) -> fitz.Rect:
+ _validate_rect(rect)
+ return fitz.Rect(
+ rect["x"] * width,
+ rect["y"] * height,
+ (rect["x"] + rect["w"]) * width,
+ (rect["y"] + rect["h"]) * height,
+ )
+
+
+def _page_specs_by_index(doc: fitz.Document, pages: list[dict]) -> dict[int, list[dict]]:
+ specs = {}
+ for spec in pages:
+ page_index = spec.get("page")
+ if not isinstance(page_index, int) or page_index < 0 or page_index >= doc.page_count:
+ raise RedactionError("Redaction page index is invalid")
+ rects = spec.get("rects", [])
+ if not isinstance(rects, list) or not rects:
+ raise RedactionError("Redaction page must contain at least one rectangle")
+ specs.setdefault(page_index, []).extend(rects)
+ if not specs:
+ raise RedactionError("No redaction regions provided")
+ return specs
+
+
+def redact_pdf_bytes(src: bytes, pages: list[dict]) -> bytes:
+ doc = fitz.open(stream=src, filetype="pdf")
+ try:
+ for page_index, rects in _page_specs_by_index(doc, pages).items():
+ page = doc[page_index]
+ for rect in rects:
+ page.add_redact_annot(
+ _absolute_rect(rect, page.rect.width, page.rect.height),
+ fill=(0, 0, 0),
+ )
+ page.apply_redactions()
+
+ doc.scrub()
+ return doc.tobytes(garbage=4, deflate=True)
+ finally:
+ doc.close()
+
+
+def rotate_rect_to_original(rect: dict, orientation: int) -> dict:
+ """Map a normalized rect drawn on a rotated image back to the original image's coordinate space."""
+ x, y, w, h = rect["x"], rect["y"], rect["w"], rect["h"]
+ if orientation == 90:
+ return {"x": y, "y": 1 - x - w, "w": h, "h": w}
+ if orientation == 180:
+ return {"x": 1 - x - w, "y": 1 - y - h, "w": w, "h": h}
+ if orientation == 270:
+ return {"x": 1 - y - h, "y": x, "w": h, "h": w}
+ return rect
+
+
+def redact_image_bytes(src: bytes, rects: list[dict]) -> bytes:
+ if not rects:
+ raise RedactionError("No redaction regions provided")
+
+ img = Image.open(io.BytesIO(src)).convert("RGB")
+ draw = ImageDraw.Draw(img)
+ width, height = img.size
+ for rect in rects:
+ box = _absolute_rect(rect, width, height)
+ draw.rectangle([box.x0, box.y0, box.x1, box.y1], fill=(0, 0, 0))
+
+ out = io.BytesIO()
+ img.save(out, format="JPEG", quality=90)
+ return out.getvalue()
diff --git a/enferno/utils/soft_delete.py b/enferno/utils/soft_delete.py
new file mode 100644
index 000000000..2dd189aae
--- /dev/null
+++ b/enferno/utils/soft_delete.py
@@ -0,0 +1,35 @@
+"""Global soft-delete filter for Media.
+
+`deleted` lives on BaseMixin so every model carries it, but only Media is
+actually soft-deleted in practice. Rather than remembering a manual
+`.filter(deleted == False)` at every read site (the source of recurring
+"deleted media still shows up" bugs), this injects the predicate into every
+ORM SELECT that touches Media, including lazy relationship loads such as
+`bulletin.medias`.
+
+Opt out for the rare route that must reach an already-deleted row by id:
+
+ Media.query.execution_options(include_deleted=True).get(id)
+"""
+
+from sqlalchemy import event
+from sqlalchemy.orm import Session, with_loader_criteria
+
+from enferno.admin.models import Media
+
+
+def _filter_soft_deleted_media(state):
+ if (
+ state.is_select
+ and not state.is_column_load
+ and not state.execution_options.get("include_deleted", False)
+ ):
+ state.statement = state.statement.options(
+ with_loader_criteria(Media, Media.deleted.is_(False), include_aliases=True)
+ )
+
+
+def register_soft_delete(db):
+ """Attach the soft-delete filter to the session. Idempotent."""
+ if not event.contains(Session, "do_orm_execute", _filter_soft_deleted_media):
+ event.listen(Session, "do_orm_execute", _filter_soft_deleted_media)
diff --git a/migrations/versions/68396035f041_add_original_media_id_to_media_redaction.py b/migrations/versions/68396035f041_add_original_media_id_to_media_redaction.py
new file mode 100644
index 000000000..d2d09c244
--- /dev/null
+++ b/migrations/versions/68396035f041_add_original_media_id_to_media_redaction.py
@@ -0,0 +1,36 @@
+"""add original_media_id to media_redaction
+
+Revision ID: 68396035f041
+Revises: e4f2a9c8d7b1
+Create Date: 2026-06-10 14:16:17.368157
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = '68396035f041'
+down_revision = 'e4f2a9c8d7b1'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+ # ### commands auto generated by Alembic - please adjust! ###
+ with op.batch_alter_table('media_redaction', schema=None) as batch_op:
+ batch_op.add_column(sa.Column('original_media_id', sa.Integer(), nullable=True))
+ batch_op.create_index(batch_op.f('ix_media_redaction_original_media_id'), ['original_media_id'], unique=False)
+ batch_op.create_foreign_key(None, 'media', ['original_media_id'], ['id'])
+
+ # ### end Alembic commands ###
+
+
+def downgrade():
+ # ### commands auto generated by Alembic - please adjust! ###
+ with op.batch_alter_table('media_redaction', schema=None) as batch_op:
+ batch_op.drop_constraint('media_redaction_original_media_id_fkey', type_='foreignkey')
+ batch_op.drop_index(batch_op.f('ix_media_redaction_original_media_id'))
+ batch_op.drop_column('original_media_id')
+
+ # ### end Alembic commands ###
diff --git a/migrations/versions/e4f2a9c8d7b1_add_media_redaction_table.py b/migrations/versions/e4f2a9c8d7b1_add_media_redaction_table.py
new file mode 100644
index 000000000..9bdd232ea
--- /dev/null
+++ b/migrations/versions/e4f2a9c8d7b1_add_media_redaction_table.py
@@ -0,0 +1,58 @@
+"""add media redaction table
+
+Revision ID: e4f2a9c8d7b1
+Revises: b3f1c2a4d5e6
+Create Date: 2026-06-05 00:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "e4f2a9c8d7b1"
+down_revision = "b3f1c2a4d5e6"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+ op.create_table(
+ "media_redaction",
+ sa.Column("created_at", sa.DateTime(), nullable=True),
+ sa.Column("updated_at", sa.DateTime(), nullable=True),
+ sa.Column("deleted", sa.Boolean(), server_default="false", nullable=False),
+ sa.Column("id", sa.Integer(), nullable=False),
+ sa.Column("source_media_id", sa.Integer(), nullable=False),
+ sa.Column("result_media_id", sa.Integer(), nullable=False),
+ sa.Column("regions", sa.JSON(), nullable=False),
+ sa.Column("user_id", sa.Integer(), nullable=True),
+ sa.ForeignKeyConstraint(["result_media_id"], ["media.id"]),
+ sa.ForeignKeyConstraint(["source_media_id"], ["media.id"]),
+ sa.ForeignKeyConstraint(["user_id"], ["user.id"], ondelete="SET NULL"),
+ sa.PrimaryKeyConstraint("id"),
+ )
+ op.create_index(
+ op.f("ix_media_redaction_result_media_id"),
+ "media_redaction",
+ ["result_media_id"],
+ unique=False,
+ )
+ op.create_index(
+ op.f("ix_media_redaction_source_media_id"),
+ "media_redaction",
+ ["source_media_id"],
+ unique=False,
+ )
+ op.create_index(
+ op.f("ix_media_redaction_user_id"),
+ "media_redaction",
+ ["user_id"],
+ unique=False,
+ )
+
+
+def downgrade():
+ op.drop_index(op.f("ix_media_redaction_user_id"), table_name="media_redaction")
+ op.drop_index(op.f("ix_media_redaction_source_media_id"), table_name="media_redaction")
+ op.drop_index(op.f("ix_media_redaction_result_media_id"), table_name="media_redaction")
+ op.drop_table("media_redaction")
diff --git a/tests/admin/test_redaction.py b/tests/admin/test_redaction.py
new file mode 100644
index 000000000..b8451988e
--- /dev/null
+++ b/tests/admin/test_redaction.py
@@ -0,0 +1,229 @@
+import io
+
+import fitz
+import pytest
+from PIL import Image
+
+from enferno.admin.models import Bulletin, Media
+from enferno.utils.redaction_utils import RedactionError, redact_image_bytes, redact_pdf_bytes
+
+
+def _one_page_pdf_with_text(text="SECRET NAME"):
+ doc = fitz.open()
+ page = doc.new_page(width=200, height=200)
+ page.insert_text((10, 100), text, fontsize=12)
+ data = doc.tobytes()
+ doc.close()
+ return data
+
+
+def test_redact_pdf_removes_text_under_box():
+ src = _one_page_pdf_with_text("SECRET NAME")
+ pages = [{"page": 0, "rects": [{"x": 0.0, "y": 0.45, "w": 1.0, "h": 0.10}]}]
+
+ out = redact_pdf_bytes(src, pages)
+
+ doc = fitz.open(stream=out, filetype="pdf")
+ remaining = doc[0].get_text()
+ doc.close()
+ assert "SECRET" not in remaining
+ assert "NAME" not in remaining
+
+
+def test_redact_pdf_blanks_image_pixels_not_whole_page():
+ img = Image.new("RGB", (200, 200), "white")
+ buf = io.BytesIO()
+ img.save(buf, format="PNG")
+ doc = fitz.open()
+ page = doc.new_page(width=200, height=200)
+ page.insert_image(page.rect, stream=buf.getvalue())
+ src = doc.tobytes()
+ doc.close()
+
+ pages = [{"page": 0, "rects": [{"x": 0.25, "y": 0.25, "w": 0.5, "h": 0.5}]}]
+ out = redact_pdf_bytes(src, pages)
+
+ doc = fitz.open(stream=out, filetype="pdf")
+ pix = doc[0].get_pixmap()
+ center = pix.pixel(100, 100)
+ corner = pix.pixel(5, 5)
+ doc.close()
+ assert center == (0, 0, 0)
+ assert corner == (255, 255, 255)
+
+
+def test_redact_image_bytes_burns_black_box():
+ img = Image.new("RGB", (100, 100), "white")
+ buf = io.BytesIO()
+ img.save(buf, format="JPEG")
+
+ out = redact_image_bytes(buf.getvalue(), [{"x": 0.0, "y": 0.0, "w": 0.5, "h": 0.5}])
+
+ result = Image.open(io.BytesIO(out)).convert("RGB")
+ assert result.getpixel((10, 10)) == (0, 0, 0)
+ assert result.getpixel((90, 90)) == (255, 255, 255)
+
+
+def test_redaction_rejects_out_of_bounds_coordinates():
+ src = _one_page_pdf_with_text()
+ pages = [{"page": 0, "rects": [{"x": -0.1, "y": 0, "w": 0.2, "h": 0.2}]}]
+
+ with pytest.raises(RedactionError):
+ redact_pdf_bytes(src, pages)
+
+
+def test_redact_endpoint_creates_new_media_and_audit_row(admin_client, session):
+ from enferno.admin.models import MediaRedaction
+
+ src = _one_page_pdf_with_text("SECRET NAME")
+ filename = Media.generate_file_name("source.pdf")
+ path = Media.media_dir / filename
+ path.write_bytes(src)
+
+ bulletin = Bulletin(title="Redaction test")
+ session.add(bulletin)
+ session.flush()
+ media = Media(
+ media_file=filename,
+ media_file_type="application/pdf",
+ etag="source-etag",
+ title="Source document",
+ bulletin_id=bulletin.id,
+ )
+ session.add(media)
+ session.commit()
+ media_id = media.id
+ redacted = None
+
+ try:
+ resp = admin_client.post(
+ f"/admin/api/media/{media_id}/redact",
+ json={"pages": [{"page": 0, "rects": [{"x": 0, "y": 0.45, "w": 1, "h": 0.1}]}]},
+ )
+
+ assert resp.status_code == 200
+ redacted = resp.get_json()["data"]
+ assert redacted["id"] != media_id
+ assert redacted["title"] == "Source document (redacted)"
+ audit = MediaRedaction.query.filter_by(
+ source_media_id=media_id,
+ result_media_id=redacted["id"],
+ ).one()
+ assert audit.user_id is not None
+ finally:
+ MediaRedaction.query.filter_by(source_media_id=media_id).delete()
+ session.commit()
+ path.unlink(missing_ok=True)
+ if redacted:
+ (Media.media_dir / redacted["filename"]).unlink(missing_ok=True)
+
+
+def test_delete_endpoint_soft_deletes_redacted_copy_only(admin_client, session):
+ from enferno.admin.models import MediaRedaction
+
+ bulletin = Bulletin(title="Soft-delete test")
+ session.add(bulletin)
+ session.flush()
+ original = Media(
+ media_file="orig.pdf",
+ media_file_type="application/pdf",
+ etag="orig",
+ bulletin_id=bulletin.id,
+ )
+ redacted = Media(
+ media_file="red.pdf", media_file_type="application/pdf", etag="red", bulletin_id=bulletin.id
+ )
+ session.add_all([original, redacted])
+ session.flush()
+ audit = MediaRedaction(
+ source_media_id=original.id,
+ original_media_id=original.id,
+ result_media_id=redacted.id,
+ regions=[],
+ )
+ session.add(audit)
+ session.commit()
+ original_id, redacted_id = original.id, redacted.id
+
+ try:
+ # Original (no redaction backref) is rejected.
+ resp = admin_client.delete(f"/admin/api/media/{original_id}/redact")
+ assert resp.status_code == 400
+ assert Media.query.get(original_id).deleted is False
+
+ # Redacted copy is soft-deleted: hidden from normal queries, still
+ # reachable via the include_deleted opt-out with deleted set.
+ resp = admin_client.delete(f"/admin/api/media/{redacted_id}/redact")
+ assert resp.status_code == 200
+ assert resp.get_json()["data"] == {"id": redacted_id, "deleted": True}
+ assert Media.query.get(redacted_id) is None
+ row = Media.query.execution_options(include_deleted=True).get(redacted_id)
+ assert row.deleted is True
+ finally:
+ MediaRedaction.query.filter_by(source_media_id=original_id).delete()
+ Media.query.filter(Media.id.in_([original_id, redacted_id])).delete(
+ synchronize_session=False
+ )
+ session.commit()
+
+
+def test_bulletin_to_dict_excludes_deleted_media(session):
+ bulletin = Bulletin(title="Deleted media exclusion")
+ session.add(bulletin)
+ session.flush()
+ live = Media(
+ media_file="live.pdf",
+ media_file_type="application/pdf",
+ etag="live",
+ bulletin_id=bulletin.id,
+ )
+ gone = Media(
+ media_file="gone.pdf",
+ media_file_type="application/pdf",
+ etag="gone",
+ bulletin_id=bulletin.id,
+ deleted=True,
+ )
+ session.add_all([live, gone])
+ session.commit()
+ live_id, gone_id = live.id, gone.id
+
+ try:
+ media_ids = {m["id"] for m in bulletin.to_dict()["medias"]}
+ assert live_id in media_ids
+ assert gone_id not in media_ids
+ finally:
+ Media.query.filter(Media.id.in_([live_id, gone_id])).delete(synchronize_session=False)
+ session.commit()
+
+
+def test_media_dashboard_excludes_deleted(admin_client, session):
+ bulletin = Bulletin(title="Dashboard exclusion")
+ session.add(bulletin)
+ session.flush()
+ live = Media(
+ media_file="dlive.pdf",
+ media_file_type="application/pdf",
+ etag="dlive",
+ bulletin_id=bulletin.id,
+ )
+ gone = Media(
+ media_file="dgone.pdf",
+ media_file_type="application/pdf",
+ etag="dgone",
+ bulletin_id=bulletin.id,
+ deleted=True,
+ )
+ session.add_all([live, gone])
+ session.commit()
+ live_id, gone_id = live.id, gone.id
+
+ try:
+ resp = admin_client.get(f"/admin/api/media/dashboard?bulletin_id={bulletin.id}")
+ assert resp.status_code == 200
+ ids = {m["id"] for m in resp.get_json()["items"]}
+ assert live_id in ids
+ assert gone_id not in ids
+ finally:
+ Media.query.filter(Media.id.in_([live_id, gone_id])).delete(synchronize_session=False)
+ session.commit()