feat(frontend): admin "Import from server" panel in Settings

Surfaces the previously UI-less POST /files/import: an admin-only Settings
card with an optional subfolder field, an Import button, and a result
summary (imported / skipped / per-file errors). Notes that imported files
are drained from the folder and that mtime is kept as the date when EXIF
is absent. Also documents the endpoint's drain + mtime behaviour in the
OpenAPI spec.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/internal/integration/server_test.go

@@ -50,9 +50,10 @@ const defaultAdminDSN = "host=/var/run/postgresql port=5434 user=h1k0 dbname=pos
 // ---------------------------------------------------------------------------
 
 type harness struct {
-	t      *testing.T
-	server *httptest.Server
-	client *http.Client
+	t         *testing.T
+	server    *httptest.Server
+	client    *http.Client
+	importDir string
 }
 
 // setupSuite creates an ephemeral database, runs migrations, wires the full
@@ -106,6 +107,7 @@ func setupSuite(t *testing.T) *harness {
 	// --- Temp directories for storage ----------------------------------------
 	filesDir := t.TempDir()
 	thumbsDir := t.TempDir()
+	importDir := t.TempDir()
 
 	diskStorage, err := storage.NewDiskStorage(filesDir, thumbsDir, 160, 160, 1920, 1080)
 	require.NoError(t, err)
@@ -130,7 +132,7 @@ func setupSuite(t *testing.T) *harness {
 	tagSvc := service.NewTagService(tagRepo, tagRuleRepo, aclSvc, auditSvc, transactor)
 	categorySvc := service.NewCategoryService(categoryRepo, tagRepo, aclSvc, auditSvc)
 	poolSvc := service.NewPoolService(poolRepo, aclSvc, auditSvc)
-	fileSvc := service.NewFileService(fileRepo, mimeRepo, diskStorage, aclSvc, auditSvc, tagSvc, transactor, filesDir)
+	fileSvc := service.NewFileService(fileRepo, mimeRepo, diskStorage, aclSvc, auditSvc, tagSvc, transactor, importDir)
 	userSvc := service.NewUserService(userRepo, sessionRepo, auditSvc)
 
 	// Bootstrap the admin account the suite logs in with (replaces the old
@@ -159,9 +161,10 @@ func setupSuite(t *testing.T) *harness {
 	t.Cleanup(srv.Close)
 
 	return &harness{
-		t:      t,
-		server: srv,
-		client: srv.Client(),
+		t:         t,
+		server:    srv,
+		client:    srv.Client(),
+		importDir: importDir,
 	}
 }
 
@@ -899,6 +902,59 @@ func TestNonOwnerAccessControl(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.StatusCode, resp.String())
 }
 
+// TestImportFromFolder verifies the admin server-side import: supported files
+// are ingested, subdirectories are skipped, the source is removed from the
+// import folder afterwards, and a file without EXIF takes the source's mtime as
+// its content_datetime.
+func TestImportFromFolder(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+	h := setupSuite(t)
+	adminToken := h.login("admin", "admin")
+
+	// Drop a non-EXIF JPEG into the import folder with a known mtime, plus a
+	// subdirectory that must be skipped.
+	srcPath := filepath.Join(h.importDir, "scan.jpg")
+	require.NoError(t, os.WriteFile(srcPath, minimalJPEG(), 0o644))
+	mtime := time.Date(2021, 3, 4, 5, 6, 7, 0, time.UTC)
+	require.NoError(t, os.Chtimes(srcPath, mtime, mtime))
+	require.NoError(t, os.Mkdir(filepath.Join(h.importDir, "nested"), 0o755))
+
+	resp := h.doJSON("POST", "/files/import", map[string]any{}, adminToken)
+	require.Equal(t, http.StatusOK, resp.StatusCode, resp.String())
+	var res struct {
+		Imported int `json:"imported"`
+		Skipped  int `json:"skipped"`
+		Errors   []struct {
+			Filename string `json:"filename"`
+			Reason   string `json:"reason"`
+		} `json:"errors"`
+	}
+	resp.decode(t, &res)
+	assert.Equal(t, 1, res.Imported, resp.String())
+	assert.Equal(t, 1, res.Skipped, resp.String()) // the nested directory
+	assert.Empty(t, res.Errors, resp.String())
+
+	// Source file is gone from the import folder after a successful import.
+	_, statErr := os.Stat(srcPath)
+	assert.True(t, os.IsNotExist(statErr), "source should be removed after import")
+
+	// The imported file took the mtime as content_datetime (no EXIF present).
+	listResp := h.doJSON("GET", "/files?limit=10", nil, adminToken)
+	require.Equal(t, http.StatusOK, listResp.StatusCode, listResp.String())
+	var list struct {
+		Items []struct {
+			ContentDatetime string `json:"content_datetime"`
+		} `json:"items"`
+	}
+	listResp.decode(t, &list)
+	require.Len(t, list.Items, 1, listResp.String())
+	ct, err := time.Parse(time.RFC3339, list.Items[0].ContentDatetime)
+	require.NoError(t, err)
+	assert.True(t, ct.Equal(mtime), "content_datetime %v should equal mtime %v", ct, mtime)
+}
+
 // TestBlockRevokesActiveSessions verifies that blocking a user immediately
 // invalidates their outstanding access tokens.
 func TestBlockRevokesActiveSessions(t *testing.T) {

backend/internal/service/file_service.go

@@ -33,8 +33,12 @@ type UploadParams struct {
 	Notes           *string
 	Metadata        json.RawMessage
 	ContentDatetime *time.Time
-	IsPublic        bool
-	TagIDs          []uuid.UUID
+	// ContentDatetimeFallback is used for content_datetime only when neither an
+	// explicit ContentDatetime nor an EXIF date is available (e.g. the source
+	// file's mtime on a server-side import).
+	ContentDatetimeFallback *time.Time
+	IsPublic                bool
+	TagIDs                  []uuid.UUID
 }
 
 // UpdateParams holds the parameters for updating file metadata.
@@ -128,12 +132,14 @@ func (s *FileService) Upload(ctx context.Context, p UploadParams) (*domain.File,
 	// Extract EXIF metadata (best-effort; non-image files will error silently).
 	exifData, exifDatetime := extractEXIFWithDatetime(data)
 
-	// Resolve content datetime: explicit > EXIF > zero value.
+	// Resolve content datetime: explicit > EXIF > fallback (e.g. import mtime) > zero.
 	var contentDatetime time.Time
 	if p.ContentDatetime != nil {
 		contentDatetime = *p.ContentDatetime
 	} else if exifDatetime != nil {
 		contentDatetime = *exifDatetime
+	} else if p.ContentDatetimeFallback != nil {
+		contentDatetime = *p.ContentDatetimeFallback
 	}
 
 	// Assign UUID v7 so CreatedAt can be derived from it later.
@@ -584,11 +590,21 @@ func (s *FileService) Import(ctx context.Context, path string) (*ImportResult, e
 			continue
 		}
 
+		// Preserve the file's mtime as a content_datetime fallback (used only when
+		// the file has no EXIF date) — once the source is removed below it's the
+		// only date left for non-photo files.
+		var mtime *time.Time
+		if info, statErr := entry.Info(); statErr == nil {
+			t := info.ModTime()
+			mtime = &t
+		}
+
 		name := entry.Name()
 		_, uploadErr := s.Upload(ctx, UploadParams{
-			Reader:       f,
-			MIMEType:     mimeStr,
-			OriginalName: &name,
+			Reader:                  f,
+			MIMEType:                mimeStr,
+			OriginalName:            &name,
+			ContentDatetimeFallback: mtime,
 		})
 		f.Close()
 
@@ -600,6 +616,16 @@ func (s *FileService) Import(ctx context.Context, path string) (*ImportResult, e
 			continue
 		}
 		result.Imported++
+
+		// Remove the source on success so the import folder drains and re-running
+		// doesn't duplicate. The file is already safely copied into storage; a
+		// removal failure is reported but doesn't undo the import.
+		if rmErr := os.Remove(fullPath); rmErr != nil {
+			result.Errors = append(result.Errors, ImportFileError{
+				Filename: entry.Name(),
+				Reason:   fmt.Sprintf("imported, but failed to remove source: %s", rmErr),
+			})
+		}
 	}
 
 	return result, nil

frontend/src/routes/settings/+page.svelte

@@ -99,6 +99,31 @@
 		}
 	}
 
+	// ---- Server-side import (admin only) ----
+	interface ImportResult {
+		imported: number;
+		skipped: number;
+		errors: { filename: string; reason: string }[];
+	}
+	let importPath = $state('');
+	let importing = $state(false);
+	let importError = $state('');
+	let importResult = $state<ImportResult | null>(null);
+
+	async function runImport() {
+		importing = true;
+		importError = '';
+		importResult = null;
+		try {
+			const sub = importPath.trim();
+			importResult = await api.post<ImportResult>('/files/import', sub ? { path: sub } : {});
+		} catch (e) {
+			importError = e instanceof ApiError ? e.message : 'Import failed';
+		} finally {
+			importing = false;
+		}
+	}
+
 	// ---- Helpers ----
 	function formatDate(iso: string | null | undefined): string {
 		if (!iso) return '—';
@@ -292,6 +317,57 @@
 		</div>
 	</section>
 
+	<!-- ====== Server import (admin) ====== -->
+	{#if $authStore.user?.isAdmin}
+		<section class="card">
+			<h2 class="section-title">Import from server</h2>
+			<p class="hint-text">
+				Ingest supported files sitting in the server's import folder. Successfully imported files
+				are removed from that folder, and a file's modified time is kept as its date when it has no
+				EXIF. Admin only.
+			</p>
+
+			<div class="field">
+				<label class="label" for="import-path">Subfolder (optional)</label>
+				<input
+					id="import-path"
+					class="input"
+					type="text"
+					bind:value={importPath}
+					placeholder="Leave blank for the import root"
+					autocomplete="off"
+					spellcheck="false"
+				/>
+				<p class="hint-text">Relative to the server's configured import folder.</p>
+			</div>
+
+			{#if importError}
+				<p class="msg error" role="alert">{importError}</p>
+			{/if}
+			{#if importResult}
+				<p class="msg success" role="status">
+					Imported {importResult.imported}, skipped {importResult.skipped}{importResult.errors
+						.length
+						? `, ${importResult.errors.length} error${importResult.errors.length === 1 ? '' : 's'}`
+						: ''}.
+				</p>
+				{#if importResult.errors.length}
+					<ul class="import-errors">
+						{#each importResult.errors as err}
+							<li><span class="err-file">{err.filename}</span> — {err.reason}</li>
+						{/each}
+					</ul>
+				{/if}
+			{/if}
+
+			<div class="row-actions">
+				<button class="btn primary" onclick={runImport} disabled={importing}>
+					{importing ? 'Importing…' : 'Import files'}
+				</button>
+			</div>
+		</section>
+	{/if}
+
 	<!-- ====== Sessions ====== -->
 	<section class="card">
 		<h2 class="section-title">
@@ -535,6 +611,27 @@
 		line-height: 1.5;
 	}
 
+	/* ---- Server import ---- */
+	.import-errors {
+		list-style: none;
+		margin: 0;
+		padding: 8px 10px;
+		display: flex;
+		flex-direction: column;
+		gap: 4px;
+		border-radius: 7px;
+		background-color: color-mix(in srgb, var(--color-danger) 10%, transparent);
+		font-size: 0.8rem;
+		color: var(--color-text-muted);
+		max-height: 180px;
+		overflow-y: auto;
+	}
+
+	.import-errors .err-file {
+		color: var(--color-text-primary);
+		font-weight: 600;
+	}
+
 	/* ---- Sessions ---- */
 	.sessions-list {
 		list-style: none;

openapi.yaml

@@ -648,6 +648,12 @@ paths:
     post:
       tags: [Files]
       summary: Import files from a server directory
+      description: >
+        Admin only. Ingests supported files from the server's configured import
+        directory (optionally a subfolder of it). Subdirectories are skipped and
+        not recursed. A successfully imported file is removed from the import
+        folder. For files without an EXIF date, the source file's modified time
+        is used as content_datetime.
       requestBody:
         required: true
         content: