fix(quota): protect local files from deletion when quota blocked upload

If a file failed to upload because the server quota was exceeded,
it was never actually stored on the server — but the sync client
could still delete the local copy when the remote parent folder was
later moved or deleted via the web interface.

checkNewDeleteConflict() now checks the error blacklist before issuing
a local REMOVE. If the file carries an InsufficientRemoteStorage entry,
it is kept locally and reported as a soft error instead. Setting
_childIgnored also prevents the parent folder from being wiped, so the
file remains reachable until the user resolves the quota situation.

Signed-off-by: Camila Ayres <hello@camilasan.com>

Author: camilasan

src/libsync/discovery.cpp

@@ -2505,18 +2505,38 @@ bool ProcessDirectoryJob::maybeRenameForWindowsCompatibility(const QString &abso
     return result;
 }
 
-bool ProcessDirectoryJob::checkNewDeleteConflict(const SyncFileItemPtr &item) const
+bool ProcessDirectoryJob::checkNewDeleteConflict(const SyncFileItemPtr &item)
 {
-    if (_discoveryData->recursiveCheckForDeletedParents(item->_file)) {
-        qCWarning(lcDisco) << "Removing local file inside a remotely deleted folder" << item->_file;
-        item->_instruction = CSYNC_INSTRUCTION_REMOVE;
-        item->_direction = SyncFileItem::Down;
-        item->_wantsSpecificActions = SyncFileItem::SynchronizationOptions::MoveToClientTrashBin;
+    if (!_discoveryData->recursiveCheckForDeletedParents(item->_file)) {
+        return false;
+    }
+
+    // If the file was blocked from uploading by a remote storage quota error it was never on the
+    // server, so deleting the local copy would be permanent data loss. Protect it instead and let
+    // the user resolve the situation (fix quota, then sync or move the file).
+    if (const auto blacklistEntry = _discoveryData->_statedb->errorBlacklistEntry(item->_file);
+        blacklistEntry.isValid()
+        && blacklistEntry._errorCategory == SyncJournalErrorBlacklistRecord::InsufficientRemoteStorage) {
+        qCWarning(lcDisco) << "Not removing local file inside a remotely deleted folder: "
+                              "file was never uploaded due to storage quota —"
+                           << item->_file;
+        item->_instruction = CSYNC_INSTRUCTION_ERROR;
+        item->_status = SyncFileItem::SoftError;
+        item->_errorString = tr("\"%1\" was not deleted because its latest changes were not synced and your server quota was exceeded."
+                                "Please manage your storage and try syncing again.")
+                                 .arg(item->_file);
+        // Prevent the parent directory from being deleted while a quota blocked child exists.
+        _childIgnored = true;
         emit _discoveryData->itemDiscovered(item);
         return true;
     }
 
-    return false;
+    qCWarning(lcDisco) << "Removing local file inside a remotely deleted folder" << item->_file;
+    item->_instruction = CSYNC_INSTRUCTION_REMOVE;
+    item->_direction = SyncFileItem::Down;
+    item->_wantsSpecificActions = SyncFileItem::SynchronizationOptions::MoveToClientTrashBin;
+    emit _discoveryData->itemDiscovered(item);
+    return true;
 }
 
 }

src/libsync/discovery.h

@@ -252,7 +252,7 @@ class ProcessDirectoryJob : public QObject
     bool maybeRenameForWindowsCompatibility(const QString &absoluteFileName,
                                             CSYNC_EXCLUDE_TYPE excludeReason);
 
-    [[nodiscard]] bool checkNewDeleteConflict(const SyncFileItemPtr &item) const;
+    [[nodiscard]] bool checkNewDeleteConflict(const SyncFileItemPtr &item);
 
     qint64 _lastSyncTimestamp = 0;