Creating a media via REST with the same filename as an existing file overwrites the existing file URI

[mjordan]

As described over at mjordan/islandora_workbench#251, and with detailed investigation by @jordandukart in the #decoupled Slack channel, using Islandora's REST interface to create media and files as documented in the "Files and Media" section of https://islandora.github.io/documentation/technical-documentation/rest-create/ will create file URIs without checking whether they already exist. This results in existing file URIs being overwritten.

This happens with all tested Drupal filesystems, e.g. fedora:// and public://.

[jordandukart]

For context (tl;dring the Slack conversation):

Both REST's and JSON:API's implementation utilizes getDestinationFilename where as the MediaSourceService uses a naive stream_copy_to_stream without ensuring that a URI by that name doesn't already exist.

There is an attempt to unify these services but who knows when that'll land.

[seth-shaw-unlv]

For derivative generation, I think this would be the preferred behavior, allowing me to adjust my image settings and replace the existing file with an updated on.

[jordandukart]

That function gets called even when creating a new file unrelated to an object being updated via derivatives.

This scenario is presently really only producible if using the REST calls directly but consider the following:

• You create a node and attach a media with a file called "test.jpg", it gets stored in "public://test.jpg".
• You go to create another node and attach a media with the same filename also called "test.jpg", it also gets stored in "public://test.jpg" and overwrites the other file that was already there.

Can provide PHP code that shows off the above if wanted I guess.

Agree that this would be preferable in the derivative context but realistically these requests should be POST for create vs PUT/PATCH for an update imo.