Unpublished files should be in private storage

In theory I agree that this would make lots of sense. The problem is that idea of "published"/"unpublished" is not common among all entity types but specific to nodes. File handling on nodes is managed by the file field, though, which is entity-type agnostic.

Now node.module *could* alter the file field form and hook into the field behavior, but...

This idea comes up a lot in our D7 projects, but I'm not sure how feasible it actually is. Some of the moving parts are:

1. What do we do to the current (arguably broken) garbage collection that removes files on unpublished nodes?
2. Is it possible to move a file from private to public? (Let's assume that is technically feasible.)
3. How do field settings (e.g. default file field as public/private) affect this behavior?
4. What UI signals do we give to editors about file status?
5. Does that work with remote files (and do we care)?
6. In a scenario where a file can be attached to multiple entities, how do you enforce privacy?
7. When using a WYSIWYG, how is file usage tracked, especially if we have WYSIWYG in core?
8. How do we allow preview of files to the "right" users?

Given the state of D8 feature freeze, I would suggest that the best we can do is allow this behavior to be defined in contrib, which means attacking only the garbage collection and possibly the WYSIWYG in this issue.

Right, and I think a contrib workflow module can handle that if we solve problem 1 (bad garbage collection) and problem 2 (actually moving files from private:// to public://) and possibly problem 7 (WYSIWYG).

Any solution for this? I am looking for a solution in my D8 site.

Our working D8 solution for the mentioned problem:
1) Move public files to private - to be able to manage file access.
2) Add entity_usage module with "Track file/image fields" patch to track images, files too. It works for WYSIWYG files too.
3) Implement your custom file access management based on entity_usage data with hooks: hook_file_access() (hook_ENTITY_TYPE_access) for referenced files and hook_file_download() for WYSIWYG files.

In 3) we are checking entity (node) view access to nodes from which is the file referenced. If at least one node view access is granted, we return AccessResult::allowed(), otherwise AccessResult::forbidden().

If you need tracking non-linked images added with CKEditor Image plugin, add "Add plugin for tracking (non linked) images inserted with WYSIWYG Image" patch.

@szato, your solution works but files in the private file system are expensive. Each file download requires PHP processing. A public file is just served by the webserver or frontend cache and that's a relief for Drupal/PHP

You can combine that with moving files between private and public, so you only need to do access checks as long as there is no public content using them. Not saying it's trivial to do that, at least not in a generic way, but it's... possible.

@Berdir, yes, I was thinking on a solution which combines both. I'm wondering whether such a feature could be made generic enough to create a contrib module.

Maybe, if you check for access on any referenced entity for an anonymous user? And you probably also want to specifically handle media entities, so check the nodes/entities using the media, not just the media entity. Which means you need to depend on the entity_usage module as mentioned above (although possible a combination of both file usage and entity usage, to not require that patch).

@Berdir, it would be great if you have some time to review a first approach at https://www.drupal.org/project/unpublished_file

Not yet done: "check the nodes/entities using the media, not just the media entity" not implemented yet.

EDIT: See #26

OK, I have a complete solution but in an early stage of development, the File Visibility module.

Solution from #24 is abandoned.

Coming from #3087660: Automatically move files to public / private storage, depending on referencing entities' access and #2904842: Make private file access handling respect the full entity reference chain, which lived for quite some time as a dup of this issue.
Maybe the title of this issue is not really perfect. Updating it accordingly (ymmv).

@claudiu, kudos for the file_visibility module!
It looks far more feature-rich and elaborated than my file_access_fix that i created some time ago and roughly corresponds to your unpublished_file POC.

So i am deprecating my module in favor of yours.

Copying some info from #3087660: Automatically move files to public / private storage, depending on referencing entities' access.

I think the new issue title is a little bit blurry now. From a UX point of view a "file" can not be set "(un)published" in Drupal core yet in the same sense like content, but an entity holding a file, like media or nodes with image fields, or nodes with body embedded images can.

There is another issue with unpublished (media) entities holding files not being 100% unpublished in references. Which is another issue in core, but out of the scope of this issue.

From my understanding this issue here is about the file accessibility in connection with unpublished entities referencing the file, where files (not media) keep being accessible even if unused or being part of unpublished content (references). The title should follow this a little bit clearer to distinguish between these both issues. The later isn't probably even not documented yet (I will take a look next days).

Another contrib project not mentioned yet in this scope: https://www.drupal.org/project/file_unpublish