feat(preview): Expire previews

[provokateurin]

Closes #45962

This is disabled by default, to avoid potentially heavy load for servers which need to regenerate previews. Admins should only enable this is if storage usage is a concern and they know which expiration threshold is good for their use-case.

[tcitworld]

How are the actual preview files deleted?

[provokateurin]

Right, I forgot something, unless this is somehow done already 😂

[provokateurin]

Now :)

[tcitworld]

Why do everything at once? If an admin suddenly sets preview_expiration_days to a very low value, there will need a lot of work to delete everything, so the cron might timeout at some point.

The fact that the background job runs regularly should be enough to lower the number of previews little by little. And we can also add a command to cleanup everything that won't be limited if needed.

[provokateurin]

Sure, but if it is limited to some value per run, then the job might not be able to catch up with deleting all expired previews.

[tcitworld]

Sensitive defaults should be acceptable. Maybe increase the job frequency to make sure this works?

[CarlSchwan]

A common pattern we have elsewhere is to limit by time. e.g. max 1 hour running

$startTime = time();
		while (true) {
			$done = $this->doTheStuffWithLimit(1000);

                        if ($done) {
                            break;
                        }

			// Stop if execution time is more than one hour.
			if (time() - $startTime > 3600) {
				return;
			}

[CarlSchwan]

It might make sense to wrap this in a transation and delete by chunk to speed up a bit the process

[provokateurin]

You're right, I just copied from the deleteAll method which doesn't have that (probably because it will only be used by tests?)

[CarlSchwan]

Yes, it's currently only used in tests

[provokateurin]

Hm but with a transaction the DB and storage could get out of sync and I don't know how that is handled. What happens if the files are deleted, but the entries are still in the DB?

(Ok they can get out of sync without a transaction as well, but it would be limited to a single preview and not all expired ones)

[CarlSchwan]

Don't call rollback but just commit if something fails in the middle while removing a preview from the storage?