Files created with REST API are only temporary

File entities created by POSTing a base64-encoded image using the REST API are created as temporary files and cannot then be attached to another entity, and worse, are deleted after 6 hours.

This seems to be related to https://www.drupal.org/node/618654 or https://www.drupal.org/node/1028092 which are issues dating back 7 years, but surely this can't still be an unsolved problem.

I'm still getting to grips with D8 so I'm only tentatively poking around, but as far as I can tell the issue seems to be that FileEntityNormalizer.php is responsible for saving the POSTED file data in the denormalize method:

  public function denormalize($data, $class, $format = NULL, array $context = array()) {
    // Avoid 'data' being treated as a field.
    $file_data = $data['data'][0]['value'];
    unset($data['data']);
    // Decode and save to file.
    $file_contents = base64_decode($file_data);
    $entity = parent::denormalize($data, $class, $format, $context);
    $dirname = drupal_dirname($entity->getFileUri());
    file_prepare_directory($dirname, FILE_CREATE_DIRECTORY);
    if ($uri = file_unmanaged_save_data($file_contents, $entity->getFileUri())) {
      $entity->setFileUri($uri);
    }
    else {
      throw new \RuntimeException(SafeMarkup::format('Failed to write @filename.', array('@filename' => $entity->getFilename())));
    }
    return $entity;
  }

If I understand correctly, using file_unmanaged_save_data is ensuring the created file is temporary. I tried switching out that function for file_save_data which should make it a normal Drupal file, but that results in a 500 error:

Recoverable fatal error: Object of class Drupal\\file_entity\\Entity\\FileEntity could not be converted to string in /core/lib/Drupal/Core/Database/Statement.php on line 59

...and I'm not sure what that means, or how to fix that.

Looking at the code in file_save_data the relevant part that saves a permanent file looks like this:

if ($uri = file_unmanaged_save_data($data, $destination, $replace)) {
    // Create a file entity.
    $file = File::create([
      'uri' => $uri,
      'uid' => $user->id(),
      'status' => FILE_STATUS_PERMANENT,
    ]);
   ...
   file->save();

But the denormalize method doesn't seem to deal with file entities, so I can't modify it to set the status to FILE_STATUS_PERMANENT. I tried injecting this code into what looked like the appropriate place in the denormalize method, but I get the same error as when I switched file_unmanaged_save_data for file_save_data.

I'll keep poking around, but it seems like saving a file permanently using the REST API should be doable?