perf: eliminate N+1 hot-path queries, cache immutable lookups, stop re-compressing compressed bytes

Every change is benchmark-verified (harness + before/after numbers in
benches/, measured on this branch; reproduction commands in each doc):

DAV / sync-client hot paths
- PROPFIND dead-properties: one = ANY($1) query per 500-child page instead
  of one sequential query per child, and indexable `=` predicates instead
  of IS NOT DISTINCT FROM (seq scans). 2,000-child folder: 1.07-4.54 s of
  DB chatter -> 4-6 ms (258-773x). Applied to native + NC PROPFIND and
  both NC REPORT handlers. [benches/DEAD-PROPS.md]
- Folder paging: keyset cursor (name > $last) + new partial index
  (folder_id, name) replaces LIMIT/OFFSET full-folder rescan per page.
  Full 20k-file walk: 1266 ms -> 77 ms (16.5x). New migration
  20260917000000. [benches/PROPFIND-PAGING.md]
- NC chroot / default-drive resolution: moka caches (30 s TTL, explicit
  invalidation on drive mutations) for find_default_for_user and the
  markerless chroot FolderDto. 2 uncached queries + 2 pool checkouts per
  NC/WebDAV/WOPI request -> sub-us moka hit (p50 0.7-3.6 ms -> ~1 us).
  [benches/CHROOT-CACHE.md]
- Quota: PROPFINDs whose prop list never names a quota prop skip the
  2-query resolution entirely (wants_quota()); the remaining lookups read
  2 columns instead of the full auth.users row with its <=512 KiB avatar
  (11-16x, p50 3.4 ms -> 0.29 ms). Same narrow read now gates every
  upload quota check. [benches/QUOTA-PATH.md]

CPU on the request path
- ZIP exports (folder download, share ZIP, batch download): entries whose
  MIME says already-compressed (JPEG/MP4/zip/pdf/...) are Stored instead
  of Deflate - deflate ran inline on the tokio writer task at ~41 MB/s
  for ~0% size gain. Mixed media corpus: 4.31x wall and CPU, archive size
  unchanged. Shared predicate in common::mime_detect. [benches/ZIP-MEDIA.md]
- Compression layers: tower-http's default maps to Brotli QUALITY 11
  (verified in brotli-8.0.2 source and empirically: 90 ms per 64 KiB JSON
  response, 1.3 s per 700 KiB bundle). Both layers pinned to Precise(4):
  99x less CPU for ~15% more bytes. SPA assets are now precompressed at
  build time (scripts/precompress.mjs, 77% smaller) and served via
  ServeDir::precompressed_br/gzip: 2016x less per-request work, and
  clients get the better q11 bytes. [benches/STATIC-PRECOMPRESSED.md]

Batched / cached backend paths [benches/NPLUS1-AND-CACHES.md]
- Content-search ReBAC re-verification: new
  AuthorizationEngine::check_files_read_batch (default = old loop;
  PgAclEngine override batches drive resolution + reuses role cache).
  200 sequential point SELECTs per search -> 1-2 queries.
- Batch-ZIP subtree downloads: drop per-file re-authz + per-file Recent
  recording (2 writes/file) for subtree entries already authorized at the
  root - mirrors the native folder-download path. ~6,000 statements
  removed from a 2,000-file archive.
- CDC chunk manifests: immutable by content address, now moka-cached
  (weight-bounded 32 MiB, 60 s TTL, positive-only, invalidated on delete)
  - removes one manifest query (p50 0.44-4.4 ms) from every stream,
  range and full blob read.
- People tab: grouped COUNT + batched cover lookup instead of dragging
  every face row with its 2 KiB embedding (10k faces: 30.4 ms & 21 MB ->
  3.8 ms & 1.3 KB, 8.1x); merge() is one set-based UPDATE.
  [benches/PEOPLE-LIST.md]
- Photos timeline cursor: raw timestamptz comparison instead of
  EXTRACT(EPOCH ...) wrapper + IS NULL OR disjunction - cursor is an
  index boundary again, deep scroll stops re-scanning skipped rows.
- Public share landing: one atomic UPDATE ... access_count + 1 (was
  SELECT + full-row write-back: racy, lost updates, clobbered concurrent
  owner edits) - 3 round-trips -> 2 per visit.
- move_to_trash: dead full-entity SELECT feeding a documented no-op
  removed from both branches; dead fields dropped from TrashService.
- NFC normalization: is_nfc_quick fast path skips the decompose/recompose
  state machine for the ~100% already-NFC case (every row loaded from PG).

Frontend
- Large folders paint after page one (~200 items) via fetchFolderListing's
  new onPage hook instead of waiting for every sequential page.
- Tested-and-reverted (kept for the record): cached Intl.Collator for name
  sorts - vitest showed it 2x SLOWER than V8's argument-less localeCompare
  fast path (5.6 ms vs 12.1 ms / 5k names). Sort order untouched.

New bench harnesses under examples/ (bench feature): zip_media,
dead_props, chroot_cache, quota_path, people_list, propfind_paging,
static_precompress.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CBK1RdtzyP6759Muqe1K1w

src/application/adapters/webdav_adapter.rs

@@ -129,6 +129,30 @@ pub struct PropFindRequest {
     pub prop_find_type: PropFindType,
 }
 
+impl PropFindRequest {
+    /// Whether answering this PROPFIND requires resolving the account /
+    /// drive quota at all.
+    ///
+    /// `resolve_webdav_quota` costs two DB round-trips per request; sync
+    /// clients poll folders with an explicit `<D:prop>` list that most of
+    /// the time names only etag/length/type props — computing quota there
+    /// is pure waste (the response never mentions it). `AllProp` and
+    /// `PropName` keep quota: the writers emit RFC 4331 props for both.
+    /// Measured in `benches/QUOTA-PATH.md`.
+    pub fn wants_quota(&self) -> bool {
+        match &self.prop_find_type {
+            PropFindType::AllProp | PropFindType::PropName => true,
+            PropFindType::Prop(props) => props.iter().any(|p| {
+                p.namespace == "DAV:"
+                    && matches!(
+                        p.name.as_str(),
+                        "quota-used-bytes" | "quota-available-bytes"
+                    )
+            }),
+        }
+    }
+}
+
 /// WebDAV property value
 #[derive(Debug, Clone)]
 pub struct PropValue {

src/application/ports/authorization_ports.rs

@@ -29,6 +29,30 @@ pub trait AuthorizationEngine: Send + Sync + 'static {
         resource: Resource,
     ) -> Result<bool, DomainError>;
 
+    /// Batched `check(subject, Read, File(id))` over a result page: returns
+    /// the subset of `file_ids` the subject may read. Semantically identical
+    /// to looping [`Self::check`] (the default does exactly that); the
+    /// `PgAclEngine` override resolves every file's drive in ONE query and
+    /// reuses the per-drive role cache, so verifying a 200-hit search page
+    /// costs 1 SQL round-trip instead of up to 200 sequential ones
+    /// (benches/SEARCH-REBAC.md).
+    async fn check_files_read_batch(
+        &self,
+        subject: Subject,
+        file_ids: &[Uuid],
+    ) -> Result<std::collections::HashSet<Uuid>, DomainError> {
+        let mut allowed = std::collections::HashSet::with_capacity(file_ids.len());
+        for id in file_ids {
+            if self
+                .check(subject, Permission::Read, Resource::File(*id))
+                .await?
+            {
+                allowed.insert(*id);
+            }
+        }
+        Ok(allowed)
+    }
+
     /// Convenience wrapper around `check`: returns `Ok(())` when allowed and
     /// `DomainError::not_found` when denied (anti-enumeration — same error as
     /// "resource doesn't exist" so attackers can't probe IDs by error shape).

src/application/ports/face_ports.rs

@@ -39,6 +39,23 @@ pub trait FaceRepository: Send + Sync + 'static {
         user_id: Uuid,
         blob_hash: &str,
     ) -> Result<Vec<Face>, DomainError>;
+    /// `(person_id, face_count)` per non-empty cluster — a grouped COUNT
+    /// instead of dragging every face row (each with a 2 KiB embedding
+    /// BYTEA) across the wire just to count them. See benches/PEOPLE-LIST.md.
+    async fn person_face_stats(&self, user_id: Uuid) -> Result<Vec<(Uuid, i64)>, DomainError>;
+    /// face id → file id for the given faces (cover-photo resolution).
+    async fn file_ids_for_faces(
+        &self,
+        user_id: Uuid,
+        face_ids: &[Uuid],
+    ) -> Result<std::collections::HashMap<Uuid, Uuid>, DomainError>;
+    /// Reassign every face of `from` to `into` in one statement (merge).
+    async fn reassign_person_faces(
+        &self,
+        user_id: Uuid,
+        from: Uuid,
+        into: Uuid,
+    ) -> Result<u64, DomainError>;
     async fn assign_person(
         &self,
         face_id: Uuid,

src/application/ports/file_ports.rs

@@ -235,13 +235,14 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
     async fn list_files_batch(
         &self,
         folder_id: Option<&str>,
-        offset: i64,
+        after_name: Option<&str>,
         limit: i64,
     ) -> Result<Vec<FileDto>, DomainError> {
-        let all = self.list_files(folder_id).await?;
+        let mut all = self.list_files(folder_id).await?;
+        all.sort_by(|a, b| a.name.cmp(&b.name));
         Ok(all
             .into_iter()
-            .skip(offset as usize)
+            .filter(|f| after_name.is_none_or(|a| f.name.as_str() > a))
             .take(limit as usize)
             .collect())
     }
@@ -257,10 +258,10 @@ pub trait FileRetrievalUseCase: Send + Sync + 'static {
         &self,
         folder_id: Option<&str>,
         _owner_id: Uuid,
-        offset: i64,
+        after_name: Option<&str>,
         limit: i64,
     ) -> Result<Vec<FileDto>, DomainError> {
-        self.list_files_batch(folder_id, offset, limit).await
+        self.list_files_batch(folder_id, after_name, limit).await
     }
 }
 

src/application/ports/share_ports.rs

@@ -99,6 +99,28 @@ pub trait ShareStoragePort: Send + Sync + 'static {
         share: &crate::domain::entities::share::Share,
     ) -> Result<crate::domain::entities::share::Share, DomainError>;
 
+    /// Atomically bump a link's access counter (public share landing).
+    /// Returns the number of rows updated — 0 means "no live share for
+    /// this token" (missing OR expired).
+    ///
+    /// The default is the legacy read-modify-write (kept for test mocks);
+    /// `SharePgRepository` overrides it with a single `UPDATE … SET
+    /// access_count = access_count + 1`, replacing 2 correlated-subquery
+    /// round-trips per anonymous visit with 1 and removing the lost-update
+    /// race between concurrent visitors (benches/SHARE-ACCESS.md).
+    async fn increment_access_count(&self, token: &str) -> Result<u64, DomainError> {
+        let share = match self.find_share_by_token(token).await {
+            Ok(s) => s,
+            Err(e) if e.kind == crate::common::errors::ErrorKind::NotFound => return Ok(0),
+            Err(e) => return Err(e),
+        };
+        if share.is_expired() {
+            return Ok(0);
+        }
+        self.update_share(&share.increment_access_count()).await?;
+        Ok(1)
+    }
+
     async fn find_shares_by_user(
         &self,
         user_id: Uuid,

src/application/ports/storage_ports.rs

@@ -107,20 +107,30 @@ pub trait FileReadPort: Send + Sync + 'static {
         Ok(None)
     }
 
-    /// Lists files in a folder with LIMIT/OFFSET pagination.
+    /// Lists files in a folder in name order, keyset-paginated.
     ///
     /// Used by streaming WebDAV PROPFIND to avoid loading all files at once.
+    /// `after_name` is the last name of the previous page (`None` = first
+    /// page); names are unique within a folder (unique index on
+    /// `(drive_id, folder_id, name)`), so `name > after_name` is a total,
+    /// stable cursor. Unlike LIMIT/OFFSET, every page is O(page) — the old
+    /// offset shape re-scanned and re-sorted the whole folder per page
+    /// (benches/PROPFIND-PAGING.md).
+    ///
     /// Default: falls back to `list_files` (loads all, then slices in memory).
     async fn list_files_batch(
         &self,
         folder_id: Option<&str>,
-        offset: i64,
+        after_name: Option<&str>,
         limit: i64,
     ) -> Result<Vec<File>, DomainError> {
-        let all = self.list_files(folder_id).await?;
-        let start = (offset as usize).min(all.len());
-        let end = (start + limit as usize).min(all.len());
-        Ok(all.into_iter().skip(start).take(end - start).collect())
+        let mut all = self.list_files(folder_id).await?;
+        all.sort_by(|a, b| a.name().cmp(b.name()));
+        Ok(all
+            .into_iter()
+            .filter(|f| after_name.is_none_or(|a| f.name() > a))
+            .take(limit as usize)
+            .collect())
     }
 
     /// Streams every file in the subtree rooted at `folder_id`.

src/application/services/batch_operations.rs

@@ -734,7 +734,13 @@ impl BatchOperationService {
             {
                 Ok(file_dto) => {
                     match self
-                        .add_file_entry_streamed(&mut zip, file_id, &file_dto.name, user_id)
+                        .add_file_entry_streamed(
+                            &mut zip,
+                            file_id,
+                            &file_dto.name,
+                            &file_dto.mime_type,
+                            Some(user_id),
+                        )
                         .await
                     {
                         Ok(_) => items_added += 1,
@@ -758,7 +764,7 @@ impl BatchOperationService {
             {
                 Ok(root_folder) => {
                     match self
-                        .add_folder_subtree_to_zip(&mut zip, folder_id, &root_folder, user_id)
+                        .add_folder_subtree_to_zip(&mut zip, folder_id, &root_folder)
                         .await
                     {
                         Ok(_) => items_added += 1,
@@ -803,24 +809,44 @@ impl BatchOperationService {
     }
 
     /// Streams a single file into an async ZIP entry (~64 KB peak RAM per file).
+    ///
+    /// Already-compressed content (per its MIME type) is `Stored` — deflating
+    /// JPEG/MP4/… burns ~a CPU core per download for ~0 % size gain.
+    ///
+    /// `caller_id = Some(uid)` enforces the per-file Read check and records
+    /// the access in Recents (explicitly-selected top-level files).
+    /// `None` = the file was enumerated from a folder subtree whose ROOT the
+    /// caller already passed `get_folder_with_perms` for — per-file
+    /// re-authorization and per-file Recent spam (2 writes/file via the
+    /// recent hook) are skipped, mirroring `ZipService::create_folder_zip`
+    /// on the native folder-download path (benches/ZIP-BATCH-AUTHZ.md).
     async fn add_file_entry_streamed(
         &self,
         zip: &mut ZipFileWriter<tokio_util::compat::Compat<BufWriter<tokio::fs::File>>>,
         file_id: &str,
         entry_name: &str,
-        caller_id: Uuid,
+        mime_type: &str,
+        caller_id: Option<Uuid>,
     ) -> Result<(), BatchOperationError> {
-        let entry = ZipEntryBuilder::new(entry_name.to_string().into(), Compression::Deflate);
+        let compression = crate::common::mime_detect::zip_entry_compression(mime_type);
+        let entry = ZipEntryBuilder::new(entry_name.to_string().into(), compression);
         let mut writer = zip
             .write_entry_stream(entry)
             .await
             .map_err(|e| BatchOperationError::Internal(format!("zip entry start: {}", e)))?;
 
-        let stream = self
-            .file_retrieval
-            .get_file_stream_with_perms(file_id, caller_id)
-            .await
-            .map_err(BatchOperationError::Domain)?;
+        let stream = match caller_id {
+            Some(uid) => self
+                .file_retrieval
+                .get_file_stream_with_perms(file_id, uid)
+                .await
+                .map_err(BatchOperationError::Domain)?,
+            None => self
+                .file_retrieval
+                .get_file_stream(file_id)
+                .await
+                .map_err(BatchOperationError::Domain)?,
+        };
         let mut stream = std::pin::Pin::from(stream);
 
         while let Some(chunk) = stream.next().await {
@@ -849,7 +875,6 @@ impl BatchOperationService {
         zip: &mut ZipFileWriter<tokio_util::compat::Compat<BufWriter<tokio::fs::File>>>,
         folder_id: &str,
         root_folder: &FolderDto,
-        caller_id: Uuid,
     ) -> Result<(), BatchOperationError> {
         // Bulk-fetch folder tree (small — one entry per folder)
         let all_folders = self
@@ -903,8 +928,10 @@ impl BatchOperationService {
             if let Some(files) = files_by_folder.get(&folder.id) {
                 for file in files {
                     let file_path = format!("{}{}", zip_dir, file.name);
+                    // Subtree pre-authorized at the root folder — see
+                    // `add_file_entry_streamed` docs for why `None`.
                     if let Err(e) = self
-                        .add_file_entry_streamed(zip, &file.id, &file_path, caller_id)
+                        .add_file_entry_streamed(zip, &file.id, &file_path, &file.mime_type, None)
                         .await
                     {
                         info!("Could not add file {} to ZIP: {}", file.name, e);

src/application/services/file_retrieval_service.rs

@@ -451,12 +451,12 @@ impl FileRetrievalUseCase for FileRetrievalService {
     async fn list_files_batch(
         &self,
         folder_id: Option<&str>,
-        offset: i64,
+        after_name: Option<&str>,
         limit: i64,
     ) -> Result<Vec<FileDto>, DomainError> {
         let files = self
             .file_read
-            .list_files_batch(folder_id, offset, limit)
+            .list_files_batch(folder_id, after_name, limit)
             .await?;
         Ok(files.into_iter().map(FileDto::from).collect())
     }
@@ -465,7 +465,7 @@ impl FileRetrievalUseCase for FileRetrievalService {
         &self,
         folder_id: Option<&str>,
         owner_id: Uuid,
-        offset: i64,
+        after_name: Option<&str>,
         limit: i64,
     ) -> Result<Vec<FileDto>, DomainError> {
         // Post-D0: every file lives in a folder — `storage.files.folder_id`
@@ -482,7 +482,7 @@ impl FileRetrievalUseCase for FileRetrievalService {
             .await?;
         let files = self
             .file_read
-            .list_files_batch(folder_id, offset, limit)
+            .list_files_batch(folder_id, after_name, limit)
             .await?;
         Ok(files.into_iter().map(FileDto::from).collect())
     }

src/application/services/people_service.rs

@@ -166,18 +166,23 @@ impl PeopleService {
     }
 
     /// People (non-empty clusters), most-photographed first.
+    ///
+    /// Counts come from a grouped-COUNT query and cover photos from one
+    /// batched lookup of just the cover face ids — the previous
+    /// `faces_for_user` shipped every face row (2 KiB embedding included)
+    /// only to count them: ~20 MB of BYTEA per request on a 10k-face
+    /// library (benches/PEOPLE-LIST.md).
     pub async fn list_people(&self, caller_id: Uuid) -> Result<Vec<PersonDto>, DomainError> {
         let persons = self.repo.persons_for_user(caller_id).await?;
-        let faces = self.repo.faces_for_user(caller_id).await?;
-
-        let mut count: HashMap<Uuid, i64> = HashMap::new();
-        let mut face_file: HashMap<Uuid, Uuid> = HashMap::new();
-        for f in &faces {
-            if let Some(pid) = f.person_id {
-                *count.entry(pid).or_default() += 1;
-            }
-            face_file.insert(f.id, f.file_id);
-        }
+        let count: HashMap<Uuid, i64> = self
+            .repo
+            .person_face_stats(caller_id)
+            .await?
+            .into_iter()
+            .collect();
+        let cover_ids: Vec<Uuid> = persons.iter().filter_map(|p| p.cover_face_id).collect();
+        let face_file: HashMap<Uuid, Uuid> =
+            self.repo.file_ids_for_faces(caller_id, &cover_ids).await?;
 
         let mut out: Vec<PersonDto> = persons
             .into_iter()
@@ -245,11 +250,13 @@ impl PeopleService {
 
     /// Merge `from` into `into` by reassigning all of `from`'s faces. The
     /// now-empty `from` person is hidden by `list_people`.
+    ///
+    /// One set-based UPDATE — the previous shape loaded every face row
+    /// (embeddings included) and issued one UPDATE per matching face.
     pub async fn merge(&self, caller_id: Uuid, into: Uuid, from: Uuid) -> Result<(), DomainError> {
-        let faces = self.repo.faces_for_user(caller_id).await?;
-        for f in faces.into_iter().filter(|f| f.person_id == Some(from)) {
-            self.repo.assign_person(f.id, Some(into)).await?;
-        }
+        self.repo
+            .reassign_person_faces(caller_id, from, into)
+            .await?;
         Ok(())
     }
 

src/application/services/search_service.rs

@@ -260,7 +260,7 @@ impl SearchService {
         user_id: Uuid,
     ) -> Vec<ContentHitDto> {
         use crate::application::ports::authorization_ports::AuthorizationEngine;
-        use crate::domain::services::authorization::{Permission, Resource, Subject};
+        use crate::domain::services::authorization::Subject;
 
         let Some(index) = &self.content_index else {
             return Vec::new();
@@ -316,36 +316,42 @@ impl SearchService {
         //     drive the caller doesn't otherwise have. The Tantivy
         //     filter is drive-only; this re-check restores per-file
         //     resolution.
-        // Failures degrade conservatively (drop the hit, log it) —
-        // never leak.
-        let mut verified = Vec::with_capacity(hits.len());
-        for hit in hits {
-            let file_uuid = match Uuid::parse_str(&hit.file_id) {
-                Ok(u) => u,
+        // Failures degrade conservatively (drop the hit / the page,
+        // log it) — never leak. Batched: one drive-resolution query for
+        // the whole page instead of up to CONTENT_HITS_LIMIT sequential
+        // point SELECTs (benches/SEARCH-REBAC.md).
+        let mut hit_ids = Vec::with_capacity(hits.len());
+        for hit in &hits {
+            match Uuid::parse_str(&hit.file_id) {
+                Ok(u) => hit_ids.push(u),
                 Err(_) => {
                     tracing::warn!("Content-index hit had non-UUID file_id: {}", hit.file_id);
-                    continue;
                 }
+            }
+        }
+        let allowed = match authz
+            .check_files_read_batch(Subject::User(user_id), &hit_ids)
+            .await
+        {
+            Ok(set) => set,
+            Err(e) => {
+                tracing::warn!("ReBAC re-check failed for content hits: {e}");
+                return Vec::new();
+            }
+        };
+        let mut verified = Vec::with_capacity(hits.len());
+        for hit in hits {
+            let Ok(file_uuid) = Uuid::parse_str(&hit.file_id) else {
+                continue; // already warned above
             };
-            match authz
-                .check(
-                    Subject::User(user_id),
-                    Permission::Read,
-                    Resource::File(file_uuid),
-                )
-                .await
-            {
-                Ok(true) => verified.push(hit),
-                Ok(false) => {
-                    tracing::debug!(
-                        target: "oxicloud::search",
-                        file_id = %file_uuid,
-                        "dropping content-index hit: ReBAC denies Read after Tantivy filter",
-                    );
-                }
-                Err(e) => {
-                    tracing::warn!("ReBAC re-check failed for {file_uuid}: {e}");
-                }
+            if allowed.contains(&file_uuid) {
+                verified.push(hit);
+            } else {
+                tracing::debug!(
+                    target: "oxicloud::search",
+                    file_id = %file_uuid,
+                    "dropping content-index hit: ReBAC denies Read after Tantivy filter",
+                );
             }
         }
         verified

src/application/services/share_service.rs

@@ -510,29 +510,18 @@ impl ShareUseCase for ShareService {
     }
 
     async fn register_shared_link_access(&self, token: &str) -> Result<(), DomainError> {
-        // Find the shared link by its token
-        let share = self
-            .share_repository
-            .find_share_by_token(token)
-            .await
-            .map_err(|e| {
-                ShareServiceError::NotFound(format!("Share with token {} not found: {}", token, e))
-            })?;
-
-        // Check if it has expired
-        if share.is_expired() {
-            return Err(ShareServiceError::Expired.into());
+        // One atomic UPDATE (see `ShareStoragePort::increment_access_count`).
+        // 0 rows = missing or expired — collapsed into NotFound, same
+        // response shape either way (anti-enumeration; the landing handler
+        // discards this result regardless).
+        let updated = self.share_repository.increment_access_count(token).await?;
+        if updated == 0 {
+            return Err(ShareServiceError::NotFound(format!(
+                "Share with token {} not found or expired",
+                token
+            ))
+            .into());
         }
-
-        // Increment the access counter
-        let updated_share = share.increment_access_count();
-
-        // Save the changes
-        self.share_repository
-            .update_share(&updated_share)
-            .await
-            .map_err(|e| ShareServiceError::Repository(e.to_string()))?;
-
         Ok(())
     }
 }

src/application/services/storage_usage_service.rs

@@ -1,4 +1,3 @@
-use crate::application::ports::auth_ports::UserStoragePort;
 use crate::application::ports::storage_ports::StorageUsagePort;
 use crate::common::errors::DomainError;
 use crate::infrastructure::repositories::pg::UserPgRepository;
@@ -512,9 +511,9 @@ impl StorageUsagePort for StorageUsageService {
         user_id: Uuid,
         additional_bytes: u64,
     ) -> Result<(), DomainError> {
-        let user = self.user_repository.get_user_by_id(user_id).await?;
-        let quota = user.storage_quota_bytes();
-        let used = user.storage_used_bytes();
+        // Narrow 2-column read — the full user row carries the up-to-512 KiB
+        // avatar `image` column, paid on every upload quota check otherwise.
+        let (used, quota) = self.user_repository.get_storage_usage(user_id).await?;
 
         // Quota of 0 means unlimited
         if quota <= 0 {
@@ -548,8 +547,9 @@ impl StorageUsagePort for StorageUsageService {
     }
 
     async fn get_user_storage_info(&self, user_id: Uuid) -> Result<(i64, i64), DomainError> {
-        let user = self.user_repository.get_user_by_id(user_id).await?;
-        Ok((user.storage_used_bytes(), user.storage_quota_bytes()))
+        // Narrow 2-column read (avatar-free) — runs on every folder PROPFIND
+        // that reports quota. See benches/QUOTA-PATH.md.
+        Ok(self.user_repository.get_storage_usage(user_id).await?)
     }
 
     async fn add_drive_storage_usage_delta(

src/application/services/trash_service.rs

@@ -14,7 +14,7 @@ use crate::application::dtos::trash_dto::{
 };
 use crate::application::ports::authorization_ports::AuthorizationEngine;
 use crate::application::ports::file_lifecycle::FileLifecycleHook;
-use crate::application::ports::storage_ports::{FileReadPort, FileWritePort};
+use crate::application::ports::storage_ports::FileWritePort;
 use crate::application::ports::trash_ports::TrashUseCase;
 use crate::common::errors::{DomainError, ErrorKind, Result};
 use crate::domain::entities::file::File;
@@ -24,7 +24,6 @@ use crate::domain::repositories::folder_repository::FolderRepository;
 use crate::domain::repositories::trash_repository::TrashRepository;
 use crate::domain::services::authorization::ResourceKind;
 use crate::domain::services::authorization::{Permission, Resource, Subject};
-use crate::infrastructure::repositories::pg::file_blob_read_repository::FileBlobReadRepository;
 use crate::infrastructure::repositories::pg::file_blob_write_repository::FileBlobWriteRepository;
 use crate::infrastructure::repositories::pg::folder_db_repository::FolderDbRepository;
 use crate::infrastructure::repositories::pg::trash_db_repository::TrashDbRepository;
@@ -49,9 +48,6 @@ pub struct TrashService {
     /// Repository for trash-specific operations like listing and retrieving trashed items
     trash_repository: Arc<TrashDbRepository>,
 
-    /// Port for file read operations (get file metadata)
-    file_read_port: Arc<FileBlobReadRepository>,
-
     /// Port for file write operations (trash, restore, delete)
     file_write_port: Arc<FileBlobWriteRepository>,
 
@@ -75,19 +71,14 @@ pub struct TrashService {
     /// so trash listings filter by drive membership instead of the legacy
     /// per-user scope.
     drive_repo: Arc<crate::infrastructure::repositories::pg::DrivePgRepository>,
-
-    /// Number of days items should be kept in trash before automatic cleanup
-    retention_days: u32,
 }
 
 impl TrashService {
     #[allow(clippy::too_many_arguments)]
     pub fn new(
         trash_repository: Arc<TrashDbRepository>,
-        file_read_port: Arc<FileBlobReadRepository>,
         file_write_port: Arc<FileBlobWriteRepository>,
         folder_storage_port: Arc<FolderDbRepository>,
-        retention_days: u32,
         dedup_service: Arc<DedupService>,
         content_cache: Option<Arc<FileContentCache>>,
         authz: Arc<PgAclEngine>,
@@ -95,7 +86,6 @@ impl TrashService {
     ) -> Self {
         Self {
             trash_repository,
-            file_read_port,
             file_write_port,
             folder_storage_port,
             dedup_service,
@@ -103,7 +93,6 @@ impl TrashService {
             content_cache,
             authz,
             drive_repo,
-            retention_days,
         }
     }
 
@@ -177,23 +166,17 @@ impl TrashUseCase for TrashService {
         // Note: We now verify file/folder ownership BEFORE moving to trash.
         // This prevents users from trashing items they do not own (IDOR).
 
-        // Parse UUIDs with detailed error handling
+        // Parse UUIDs with detailed error handling. The parsed value is
+        // re-derived per branch below; this early check preserves the 400
+        // (validation) error shape for malformed ids.
         debug!("Validating item UUID: {}", item_id);
-        let item_uuid = match Uuid::parse_str(item_id) {
-            Ok(uuid) => {
-                debug!("Valid item UUID: {}", uuid);
-                uuid
-            }
-            Err(e) => {
-                error!("Invalid item UUID: {} - Error: {}", item_id, e);
-                return Err(DomainError::validation_error(format!(
-                    "Invalid item ID: {}",
-                    e
-                )));
-            }
-        };
-
-        let user_uuid = user_id;
+        if let Err(e) = Uuid::parse_str(item_id) {
+            error!("Invalid item UUID: {} - Error: {}", item_id, e);
+            return Err(DomainError::validation_error(format!(
+                "Invalid item ID: {}",
+                e
+            )));
+        }
 
         match item_type {
             "file" => {
@@ -209,59 +192,13 @@ impl TrashUseCase for TrashService {
                     )
                     .await?;
 
-                // Authz already passed — use the non-owner-scoped read so that
-                // grantees with Delete permission can trash files they don't own.
-                // The file's user_id in storage.files is unchanged, so the item
-                // will appear in the original owner's trash view.
-                let file = match self.file_read_port.get_file(item_id).await {
-                    Ok(file) => {
-                        debug!("File found: {} ({})", file.name(), item_id);
-                        file
-                    }
-                    Err(e) => {
-                        error!("Error getting file: {} - {}", item_id, e);
-                        return Err(DomainError::new(
-                            ErrorKind::NotFound,
-                            "File",
-                            format!("Error retrieving file {}: {}", item_id, e),
-                        ));
-                    }
-                };
-
-                let original_path = file.storage_path().to_string();
-                debug!("Original file path: {}", original_path);
-
-                debug!("Creating TrashedItem object for the file");
-                let trashed_item = TrashedItem::new(
-                    item_uuid,
-                    user_uuid,
-                    TrashedItemType::File,
-                    file.name().to_string(),
-                    original_path,
-                    self.retention_days,
-                );
-                debug!(
-                    "TrashedItem created successfully: {} -> {}",
-                    file.name(),
-                    trashed_item.id()
-                );
-
-                // First add to trash index to register the item
-                info!("Adding file {} to trash index", item_id);
-                match self.trash_repository.add_to_trash(&trashed_item).await {
-                    Ok(_) => {
-                        debug!("File added to trash index successfully");
-                    }
-                    Err(e) => {
-                        error!("Error adding file to trash index: {}", e);
-                        return Err(DomainError::internal_error(
-                            "TrashRepository",
-                            format!("Failed to add file to trash: {}", e),
-                        ));
-                    }
-                };
-
-                // Then physically move the file to trash.
+                // Soft-delete model: the is_trashed flag on the row IS the
+                // trash membership — there is no separate trash index to
+                // register into (`TrashRepository::add_to_trash` is a
+                // documented no-op). The previous shape still fetched the
+                // full file entity and built a `TrashedItem` only to feed
+                // that no-op: one wasted SELECT per trash operation.
+                //
                 // §14: caller_id stamps `updated_by` on the trashed row.
                 info!("Physically moving file to trash: {}", item_id);
                 match self.file_write_port.move_to_trash(item_id, user_id).await {
@@ -293,43 +230,10 @@ impl TrashUseCase for TrashService {
                     )
                     .await?;
 
-                let folder = self
-                    .folder_storage_port
-                    .get_folder(item_id)
-                    .await
-                    .map_err(|e| {
-                        DomainError::new(
-                            ErrorKind::NotFound,
-                            "Folder",
-                            format!("Error retrieving folder {}: {}", item_id, e),
-                        )
-                    })?;
-
-                let original_path = folder.storage_path().to_string();
-
-                let trashed_item = TrashedItem::new(
-                    item_uuid,
-                    user_uuid,
-                    TrashedItemType::Folder,
-                    folder.name().to_string(),
-                    original_path,
-                    self.retention_days,
-                );
-
-                // First add to trash index to register the item
-                debug!("Adding folder {} to trash repository", item_id);
-                match self.trash_repository.add_to_trash(&trashed_item).await {
-                    Ok(_) => debug!("Successfully added folder to trash repository"),
-                    Err(e) => {
-                        error!("Failed to add folder to trash repository: {}", e);
-                        return Err(DomainError::internal_error(
-                            "TrashRepository",
-                            format!("Failed to add folder to trash: {}", e),
-                        ));
-                    }
-                };
-
-                // Then physically move the folder to trash.
+                // Soft-delete model — same as the file branch above: the
+                // cascade UPDATE below is the whole operation; no folder
+                // fetch or trash-index write needed.
+                //
                 // §14: caller_id stamps `updated_by` on every cascade-trashed row.
                 self.folder_storage_port
                     .move_to_trash(item_id, user_id)