Merge branch 'feature/set-management'

backend/app/Controllers/SetController.php

@@ -4,10 +4,15 @@ namespace App\Controllers;
 
 use App\Element\ElementRepository;
 use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
 use App\Set\Set as DomainSet;
 use App\Set\SetRepository;
 use App\Set\UseCases\CreateSetWithRoot\CreateSetWithRoot;
 use App\Set\UseCases\CreateSetWithRoot\CreateSetWithRootRequest;
+use App\Set\UseCases\DeleteSet\DeleteSet;
+use App\Set\UseCases\DeleteSet\DeleteSetRequest;
+use App\Set\UseCases\UpdateSet\UpdateSet;
+use App\Set\UseCases\UpdateSet\UpdateSetRequest;
 use App\Shared\Files\Filesystem;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -19,6 +24,8 @@ class SetController
         private SetRepository $setRepository,
         private ElementRepository $elementRepository,
         private CreateSetWithRoot $createSetWithRoot,
+        private UpdateSet $updateSet,
+        private DeleteSet $deleteSet,
         private Filesystem $filesystem,
     ) {
     }
@@ -61,6 +68,54 @@ class SetController
         ], 201);
     }
 
+    public function update(Request $request, ?int $id): JsonResponse
+    {
+        $iconImage = $this->uploadedFileInput($request, 'iconImage');
+
+        try {
+            $set = $this->updateSet->execute(
+                new UpdateSetRequest(
+                    id: $id,
+                    name: $this->stringInput($request, 'name'),
+                    description: $this->stringInput($request, 'description'),
+                    iconImageContents: $iconImage['contents'],
+                    iconImageOriginalName: $iconImage['originalName'],
+                    iconImageMimeType: $iconImage['mimeType'],
+                    iconImageSizeBytes: $iconImage['sizeBytes'],
+                )
+            );
+        } catch (BadRequestException $exception) {
+            return new JsonResponse([
+                'error' => $exception->getMessage(),
+            ], 400);
+        } catch (NotFoundException $exception) {
+            return new JsonResponse([
+                'error' => $exception->getMessage(),
+            ], 404);
+        }
+
+        return new JsonResponse([
+            'set' => $this->buildSetPayload($set),
+        ], 200);
+    }
+
+    public function delete(?int $id): JsonResponse
+    {
+        try {
+            $this->deleteSet->execute(new DeleteSetRequest(id: $id));
+        } catch (BadRequestException $exception) {
+            return new JsonResponse([
+                'error' => $exception->getMessage(),
+            ], 400);
+        } catch (NotFoundException $exception) {
+            return new JsonResponse([
+                'error' => $exception->getMessage(),
+            ], 404);
+        }
+
+        return new JsonResponse(null, 204);
+    }
+
     /**
      * @return array{
      *     id: int,

backend/app/Set/EloquentSetRepository.php

@@ -2,6 +2,8 @@
 
 namespace App\Set;
 
+use DomainException;
+
 class EloquentSetRepository implements SetRepository
 {
     public function create(CreateSetDto $dto): Set
@@ -15,6 +17,35 @@ class EloquentSetRepository implements SetRepository
         return $this->toDomain($model);
     }
 
+    public function update(Set $set): Set
+    {
+        $model = SetModel::find($set->getId());
+        if ($model === null) {
+            throw new DomainException(
+                "Set with id: {$set->getId()} doesnt exist"
+            );
+        }
+
+        $model->name = $set->getName();
+        $model->description = $set->getDescription();
+        $model->icon_image_url = $set->getIconImageUrl();
+        $model->save();
+
+        return $this->toDomain($model);
+    }
+
+    public function delete(Set $set): void
+    {
+        $model = SetModel::find($set->getId());
+        if ($model === null) {
+            throw new DomainException(
+                "Set with id: {$set->getId()} doesnt exist"
+            );
+        }
+
+        $model->delete();
+    }
+
     public function find(int $id): ?Set
     {
         $model = SetModel::find($id);

backend/app/Set/Set.php

@@ -22,13 +22,28 @@ class Set
         return $this->name;
     }
 
+    public function setName(string $name): void
+    {
+        $this->name = $name;
+    }
+
     public function getDescription(): string
     {
         return $this->description;
     }
 
+    public function setDescription(string $description): void
+    {
+        $this->description = $description;
+    }
+
     public function getIconImageUrl(): string
     {
         return $this->iconImageUrl;
     }
+
+    public function setIconImageUrl(string $iconImageUrl): void
+    {
+        $this->iconImageUrl = $iconImageUrl;
+    }
 }

backend/app/Set/SetRepository.php

@@ -6,6 +6,10 @@ interface SetRepository
 {
     public function create(CreateSetDto $dto): Set;
 
+    public function update(Set $set): Set;
+
+    public function delete(Set $set): void;
+
     public function find(int $id): ?Set;
 
     /**

backend/app/Set/UseCases/DeleteSet/DeleteSet.php

@@ -0,0 +1,115 @@
+<?php
+
+namespace App\Set\UseCases\DeleteSet;
+
+use App\Element\Element;
+use App\Element\ElementRepository;
+use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
+use App\Set\SetRepository;
+use App\Shared\Files\Filesystem;
+
+class DeleteSet
+{
+    /**
+     * @var array<string, true>
+     */
+    private array $managedFilePaths = [];
+
+    public function __construct(
+        private SetRepository $setRepository,
+        private ElementRepository $elementRepository,
+        private Filesystem $filesystem,
+    ) {
+    }
+
+    /**
+     * @throws BadRequestException
+     * @throws NotFoundException
+     */
+    public function execute(DeleteSetRequest $request): void
+    {
+        if ($request->id === null) {
+            throw new BadRequestException('setId is required');
+        }
+
+        $set = $this->setRepository->find($request->id);
+        if ($set === null) {
+            throw new NotFoundException('Set not found');
+        }
+
+        $this->managedFilePaths = [];
+        $this->rememberManagedFile($set->getIconImageUrl());
+
+        $elements = $this->elementRepository->findBySet($set);
+        foreach ($elements as $element) {
+            $this->rememberManagedFile($element->getIconImageUrl());
+            $this->rememberManagedFile($element->getShortPdfPath());
+            $this->rememberManagedFile($element->getLongPdfPath());
+        }
+
+        foreach ($this->deepestElementsFirst($elements) as $element) {
+            $this->elementRepository->delete($element);
+        }
+
+        $this->setRepository->delete($set);
+        foreach (array_keys($this->managedFilePaths) as $path) {
+            $this->filesystem->delete($path);
+        }
+    }
+
+    /**
+     * @param Element[] $elements
+     * @return Element[]
+     */
+    private function deepestElementsFirst(array $elements): array
+    {
+        usort($elements, function (
+            Element $firstElement,
+            Element $secondElement,
+        ): int {
+            $firstDepth = $this->elementDepth($firstElement);
+            $secondDepth = $this->elementDepth($secondElement);
+            if ($firstDepth === $secondDepth) {
+                return $secondElement->getId() <=> $firstElement->getId();
+            }
+
+            return $secondDepth <=> $firstDepth;
+        });
+
+        return $elements;
+    }
+
+    private function elementDepth(Element $element): int
+    {
+        $depth = 0;
+        $parentElement = $element->getParentElement();
+        while ($parentElement !== null) {
+            $depth++;
+            $parentElement = $parentElement->getParentElement();
+        }
+
+        return $depth;
+    }
+
+    private function rememberManagedFile(?string $path): void
+    {
+        if ($path === null) {
+            return;
+        }
+
+        if (! $this->isManagedFilePath($path)) {
+            return;
+        }
+
+        $this->managedFilePaths[$path] = true;
+    }
+
+    private function isManagedFilePath(string $path): bool
+    {
+        return str_starts_with($path, 'set-icons/')
+            || str_starts_with($path, 'element-icons/')
+            || str_starts_with($path, 'element-pdfs/short/')
+            || str_starts_with($path, 'element-pdfs/long/');
+    }
+}

backend/app/Set/UseCases/DeleteSet/DeleteSetRequest.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Set\UseCases\DeleteSet;
+
+class DeleteSetRequest
+{
+    public function __construct(public ?int $id)
+    {
+    }
+}

backend/app/Set/UseCases/UpdateSet/UpdateDescription.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Set\UseCases\UpdateSet;
+
+use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
+use App\Set\Set;
+use App\Set\SetRepository;
+
+class UpdateDescription
+{
+    public function __construct(private SetRepository $setRepository)
+    {
+    }
+
+    /**
+     * @throws BadRequestException
+     * @throws NotFoundException
+     */
+    public function execute(UpdateDescriptionRequest $request): Set
+    {
+        if ($request->id === null) {
+            throw new BadRequestException('setId is required');
+        }
+
+        if (
+            $request->description === null
+            || trim($request->description) === ''
+        ) {
+            throw new BadRequestException('description is required');
+        }
+
+        $set = $this->setRepository->find($request->id);
+        if ($set === null) {
+            throw new NotFoundException('Set not found');
+        }
+
+        $set->setDescription($request->description);
+
+        return $this->setRepository->update($set);
+    }
+}

backend/app/Set/UseCases/UpdateSet/UpdateDescriptionRequest.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace App\Set\UseCases\UpdateSet;
+
+class UpdateDescriptionRequest
+{
+    public function __construct(
+        public ?int $id,
+        public ?string $description,
+    ) {
+    }
+}

backend/app/Set/UseCases/UpdateSet/UpdateIconImage.php

@@ -0,0 +1,93 @@
+<?php
+
+namespace App\Set\UseCases\UpdateSet;
+
+use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
+use App\Set\Set;
+use App\Set\SetRepository;
+use App\Shared\Files\FileToUpload;
+use App\Shared\Files\Filesystem;
+
+class UpdateIconImage
+{
+    private const ALLOWED_MIME_TYPES = [
+        'image/jpeg',
+        'image/png',
+        'image/webp',
+    ];
+
+    private const MAX_SIZE_BYTES = 5 * 1024 * 1024;
+
+    public function __construct(
+        private SetRepository $setRepository,
+        private Filesystem $filesystem,
+    ) {
+    }
+
+    /**
+     * @throws BadRequestException
+     * @throws NotFoundException
+     */
+    public function execute(UpdateIconImageRequest $request): Set
+    {
+        if ($request->id === null) {
+            throw new BadRequestException('setId is required');
+        }
+
+        if (
+            $request->fileContents === null
+            || $request->fileOriginalName === null
+            || $request->fileMimeType === null
+            || $request->fileSizeBytes === null
+        ) {
+            throw new BadRequestException('icon image is required');
+        }
+
+        if (
+            ! in_array(
+                $request->fileMimeType,
+                self::ALLOWED_MIME_TYPES,
+                true,
+            )
+        ) {
+            throw new BadRequestException(
+                'icon image must be a jpeg, png or webp image',
+            );
+        }
+
+        if ($request->fileSizeBytes > self::MAX_SIZE_BYTES) {
+            throw new BadRequestException(
+                'icon image must be 5MB or smaller',
+            );
+        }
+
+        $set = $this->setRepository->find($request->id);
+        if ($set === null) {
+            throw new NotFoundException('Set not found');
+        }
+
+        $oldIconImageUrl = $set->getIconImageUrl();
+        $iconImage = new FileToUpload(
+            contents: $request->fileContents,
+            originalName: $request->fileOriginalName,
+            mimeType: $request->fileMimeType,
+            sizeBytes: $request->fileSizeBytes,
+        );
+        $path = $this->filesystem->upload($iconImage, 'set-icons');
+        $set->setIconImageUrl($path);
+        $updatedSet = $this->setRepository->update($set);
+        $this->deleteManagedSetIcon($oldIconImageUrl);
+
+        return $updatedSet;
+    }
+
+    private function deleteManagedSetIcon(string $path): void
+    {
+        if (! str_starts_with($path, 'set-icons/')) {
+            return;
+        }
+
+        $this->filesystem->delete($path);
+    }
+}

backend/app/Set/UseCases/UpdateSet/UpdateIconImageRequest.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Set\UseCases\UpdateSet;
+
+class UpdateIconImageRequest
+{
+    public function __construct(
+        public ?int $id,
+        public ?string $fileContents,
+        public ?string $fileOriginalName,
+        public ?string $fileMimeType,
+        public ?int $fileSizeBytes,
+    ) {
+    }
+}

backend/app/Set/UseCases/UpdateSet/UpdateName.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Set\UseCases\UpdateSet;
+
+use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
+use App\Set\Set;
+use App\Set\SetRepository;
+
+class UpdateName
+{
+    public function __construct(private SetRepository $setRepository)
+    {
+    }
+
+    /**
+     * @throws BadRequestException
+     * @throws NotFoundException
+     */
+    public function execute(UpdateNameRequest $request): Set
+    {
+        if ($request->id === null) {
+            throw new BadRequestException('setId is required');
+        }
+
+        if ($request->name === null || trim($request->name) === '') {
+            throw new BadRequestException('name is required');
+        }
+
+        $set = $this->setRepository->find($request->id);
+        if ($set === null) {
+            throw new NotFoundException('Set not found');
+        }
+
+        $set->setName(trim($request->name));
+
+        return $this->setRepository->update($set);
+    }
+}

backend/app/Set/UseCases/UpdateSet/UpdateNameRequest.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace App\Set\UseCases\UpdateSet;
+
+class UpdateNameRequest
+{
+    public function __construct(
+        public ?int $id,
+        public ?string $name,
+    ) {
+    }
+}

backend/app/Set/UseCases/UpdateSet/UpdateSet.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Set\UseCases\UpdateSet;
+
+use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
+use App\Set\Set;
+use App\Set\SetRepository;
+
+class UpdateSet
+{
+    public function __construct(
+        private UpdateName $updateName,
+        private UpdateDescription $updateDescription,
+        private UpdateIconImage $updateIconImage,
+        private SetRepository $setRepository,
+    ) {
+    }
+
+    /**
+     * @throws BadRequestException
+     * @throws NotFoundException
+     */
+    public function execute(UpdateSetRequest $request): Set
+    {
+        if ($request->id === null) {
+            throw new BadRequestException('setId is required');
+        }
+
+        if ($this->hasNoFields($request)) {
+            throw new BadRequestException('nothing to update');
+        }
+
+        if ($request->name !== null) {
+            $this->updateName->execute(new UpdateNameRequest(
+                id: $request->id,
+                name: $request->name,
+            ));
+        }
+        if ($request->description !== null) {
+            $this->updateDescription->execute(new UpdateDescriptionRequest(
+                id: $request->id,
+                description: $request->description,
+            ));
+        }
+        if ($this->hasIconImageInput($request)) {
+            $this->updateIconImage->execute(new UpdateIconImageRequest(
+                id: $request->id,
+                fileContents: $request->iconImageContents,
+                fileOriginalName: $request->iconImageOriginalName,
+                fileMimeType: $request->iconImageMimeType,
+                fileSizeBytes: $request->iconImageSizeBytes,
+            ));
+        }
+
+        $set = $this->setRepository->find($request->id);
+        if ($set === null) {
+            throw new NotFoundException('Set not found');
+        }
+
+        return $set;
+    }
+
+    private function hasNoFields(UpdateSetRequest $request): bool
+    {
+        return $request->name === null
+            && $request->description === null
+            && ! $this->hasIconImageInput($request);
+    }
+
+    private function hasIconImageInput(UpdateSetRequest $request): bool
+    {
+        return $request->iconImageContents !== null
+            || $request->iconImageOriginalName !== null
+            || $request->iconImageMimeType !== null
+            || $request->iconImageSizeBytes !== null;
+    }
+}

backend/app/Set/UseCases/UpdateSet/UpdateSetRequest.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Set\UseCases\UpdateSet;
+
+class UpdateSetRequest
+{
+    public function __construct(
+        public ?int $id,
+        public ?string $name,
+        public ?string $description,
+        public ?string $iconImageContents,
+        public ?string $iconImageOriginalName,
+        public ?string $iconImageMimeType,
+        public ?int $iconImageSizeBytes,
+    ) {
+    }
+}

backend/routes/api.php

@@ -13,6 +13,10 @@ Route::get('/me', [AuthController::class, 'me'])
 Route::get('/sets', [SetController::class, 'index']);
 Route::post('/sets', [SetController::class, 'create'])
     ->middleware(AuthMiddleware::class);
+Route::post('/sets/{id}/update', [SetController::class, 'update'])
+    ->middleware(AuthMiddleware::class);
+Route::delete('/sets/{id}', [SetController::class, 'delete'])
+    ->middleware(AuthMiddleware::class);
 Route::get('/elements/{id}', [ElementController::class, 'show']);
 Route::get('/element-pdfs/{folder}/{fileName}', [
     ElementController::class,

backend/tests/Fakes/FakeSetRepository.php

@@ -27,6 +27,19 @@ class FakeSetRepository implements SetRepository
         return $set;
     }
 
+    public function update(DomainSet $set): DomainSet
+    {
+        $updatedSet = $this->cloneSet($set);
+        $this->setsById[$updatedSet->getId()] = $updatedSet;
+
+        return $this->cloneSet($updatedSet);
+    }
+
+    public function delete(DomainSet $set): void
+    {
+        unset($this->setsById[$set->getId()]);
+    }
+
     public function find(int $id): ?DomainSet
     {
         if (! isset($this->setsById[$id])) {

backend/tests/Feature/SetsEndpointTest.php

@@ -140,6 +140,153 @@ class SetsEndpointTest extends TestCase
         );
     }
 
+    public function testUpdateSetRequiresAuthentication(): void
+    {
+        $setRepository = app(SetRepository::class);
+        $set = $setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: '/assets/original-icon.png',
+        ));
+
+        $response = $this->postJson(
+            "/api/sets/{$set->getId()}/update",
+            [
+                'name' => 'Updated Set',
+                'description' => 'Updated set description',
+            ],
+        );
+
+        $response->assertUnauthorized();
+        $response->assertExactJson([
+            'error' => 'unauthenticated',
+        ]);
+    }
+
+    public function testAuthenticatedUpdateSetUpdatesMediaPayloadOnly(): void
+    {
+        $setRepository = app(SetRepository::class);
+        $elementRepository = app(ElementRepository::class);
+        $this->createSession('valid-token');
+        $set = $setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: '/assets/original-icon.png',
+        ));
+        $rootElement = $elementRepository->create(new CreateElementDto(
+            set: $set,
+            title: 'Original Root',
+            description: 'Original root description',
+            iconImageUrl: '/assets/original-icon.png',
+            richText: '',
+            shortPdfPath: null,
+            longPdfPath: null,
+            youtubeUrl: null,
+            parentElement: null,
+        ));
+
+        $response = $this->withCredentials()
+            ->withUnencryptedCookie('auth_token', 'valid-token')
+            ->postJson("/api/sets/{$set->getId()}/update", [
+                'name' => 'Updated Set',
+                'description' => 'Updated set description',
+            ]);
+
+        $response->assertOk();
+        $response->assertExactJson([
+            'set' => [
+                'id' => $set->getId(),
+                'name' => 'Updated Set',
+                'description' => 'Updated set description',
+                'iconImageUrl' => '/assets/original-icon.png',
+                'rootElementId' => $rootElement->getId(),
+            ],
+        ]);
+
+        $updatedSet = $setRepository->find($set->getId());
+        $this->assertNotNull($updatedSet);
+        $this->assertSame('Updated Set', $updatedSet->getName());
+        $this->assertSame(
+            'Updated set description',
+            $updatedSet->getDescription(),
+        );
+
+        $unchangedRootElement = $elementRepository->find(
+            $rootElement->getId(),
+        );
+        $this->assertNotNull($unchangedRootElement);
+        $this->assertSame('Original Root', $unchangedRootElement->getTitle());
+        $this->assertSame(
+            'Original root description',
+            $unchangedRootElement->getDescription(),
+        );
+    }
+
+    public function testDeleteSetRequiresAuthentication(): void
+    {
+        $setRepository = app(SetRepository::class);
+        $set = $setRepository->create(new CreateSetDto(
+            name: 'Set to delete',
+            description: 'Set deletion description',
+            iconImageUrl: '/assets/delete-icon.png',
+        ));
+
+        $response = $this->deleteJson("/api/sets/{$set->getId()}");
+
+        $response->assertUnauthorized();
+        $response->assertExactJson([
+            'error' => 'unauthenticated',
+        ]);
+    }
+
+    public function testAuthenticatedDeleteSetRemovesSetAndElements(): void
+    {
+        $setRepository = app(SetRepository::class);
+        $elementRepository = app(ElementRepository::class);
+        $this->createSession('valid-token');
+        $set = $setRepository->create(new CreateSetDto(
+            name: 'Set to delete',
+            description: 'Set deletion description',
+            iconImageUrl: 'set-icons/delete-icon.png',
+        ));
+        $rootElement = $elementRepository->create(new CreateElementDto(
+            set: $set,
+            title: 'Root to delete',
+            description: 'Root deletion description',
+            iconImageUrl: 'set-icons/delete-icon.png',
+            richText: '',
+            shortPdfPath: null,
+            longPdfPath: null,
+            youtubeUrl: null,
+            parentElement: null,
+        ));
+        $childElement = $elementRepository->create(new CreateElementDto(
+            set: $set,
+            title: 'Child to delete',
+            description: 'Child deletion description',
+            iconImageUrl: 'element-icons/delete-child.png',
+            richText: '',
+            shortPdfPath: 'element-pdfs/short/delete-child.pdf',
+            longPdfPath: 'element-pdfs/long/delete-child.pdf',
+            youtubeUrl: null,
+            parentElement: $rootElement,
+        ));
+
+        $response = $this->withCredentials()
+            ->withUnencryptedCookie('auth_token', 'valid-token')
+            ->deleteJson("/api/sets/{$set->getId()}");
+
+        $response->assertNoContent();
+        $this->assertNull($setRepository->find($set->getId()));
+        $this->assertNull($elementRepository->find($rootElement->getId()));
+        $this->assertNull($elementRepository->find($childElement->getId()));
+        $setsResponse = $this->getJson('/api/sets');
+        $setsResponse->assertOk();
+        $setsResponse->assertJsonMissing([
+            'id' => $set->getId(),
+        ]);
+    }
+
     public function testCreateSetRequiresIconImage(): void
     {
         $this->createSession('valid-token');

backend/tests/Unit/Set/UseCases/DeleteSetTest.php

@@ -0,0 +1,140 @@
+<?php
+
+namespace Tests\Unit\Set\UseCases;
+
+use App\Element\CreateElementDto;
+use App\Element\Element;
+use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
+use App\Set\CreateSetDto;
+use App\Set\Set as DomainSet;
+use App\Set\UseCases\DeleteSet\DeleteSet;
+use App\Set\UseCases\DeleteSet\DeleteSetRequest;
+use Tests\Fakes\FakeElementRepository;
+use Tests\Fakes\FakeFilesystem;
+use Tests\Fakes\FakeSetRepository;
+use Tests\TestCase;
+
+class DeleteSetTest extends TestCase
+{
+    private FakeSetRepository $setRepository;
+
+    private FakeElementRepository $elementRepository;
+
+    private FakeFilesystem $filesystem;
+
+    private DeleteSet $deleteSet;
+
+    protected function setUp(): void
+    {
+        $this->setRepository = new FakeSetRepository();
+        $this->elementRepository = new FakeElementRepository();
+        $this->filesystem = new FakeFilesystem();
+        $this->deleteSet = new DeleteSet(
+            $this->setRepository,
+            $this->elementRepository,
+            $this->filesystem,
+        );
+    }
+
+    public function testDeletesSetElementTreeAndManagedFiles(): void
+    {
+        $set = $this->createSet('set-icons/set.png');
+        $rootElement = $this->createElement(
+            set: $set,
+            parentElement: null,
+            title: 'Root',
+            iconImageUrl: 'set-icons/set.png',
+            shortPdfPath: null,
+            longPdfPath: null,
+        );
+        $childElement = $this->createElement(
+            set: $set,
+            parentElement: $rootElement,
+            title: 'Child',
+            iconImageUrl: 'element-icons/child.png',
+            shortPdfPath: 'element-pdfs/short/child.pdf',
+            longPdfPath: 'element-pdfs/long/child.pdf',
+        );
+        $grandchildElement = $this->createElement(
+            set: $set,
+            parentElement: $childElement,
+            title: 'Grandchild',
+            iconImageUrl: 'element-icons/grandchild.png',
+            shortPdfPath: 'element-pdfs/short/grandchild.pdf',
+            longPdfPath: 'element-pdfs/long/grandchild.pdf',
+        );
+
+        $this->deleteSet->execute(new DeleteSetRequest(id: $set->getId()));
+
+        $this->assertNull($this->setRepository->find($set->getId()));
+        $this->assertNull(
+            $this->elementRepository->find($rootElement->getId()),
+        );
+        $this->assertNull(
+            $this->elementRepository->find($childElement->getId()),
+        );
+        $this->assertNull(
+            $this->elementRepository->find($grandchildElement->getId()),
+        );
+        $this->assertEqualsCanonicalizing([
+            'set-icons/set.png',
+            'element-icons/child.png',
+            'element-pdfs/short/child.pdf',
+            'element-pdfs/long/child.pdf',
+            'element-icons/grandchild.png',
+            'element-pdfs/short/grandchild.pdf',
+            'element-pdfs/long/grandchild.pdf',
+        ], $this->filesystem->deletedPaths);
+        $this->assertSame(
+            count($this->filesystem->deletedPaths),
+            count(array_unique($this->filesystem->deletedPaths)),
+        );
+    }
+
+    public function testRequiresSetId(): void
+    {
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('setId is required');
+
+        $this->deleteSet->execute(new DeleteSetRequest(id: null));
+    }
+
+    public function testThrowsWhenSetIsMissing(): void
+    {
+        $this->expectException(NotFoundException::class);
+        $this->expectExceptionMessage('Set not found');
+
+        $this->deleteSet->execute(new DeleteSetRequest(id: 999));
+    }
+
+    private function createSet(string $iconImageUrl): DomainSet
+    {
+        return $this->setRepository->create(new CreateSetDto(
+            name: 'Set',
+            description: 'Set description',
+            iconImageUrl: $iconImageUrl,
+        ));
+    }
+
+    private function createElement(
+        DomainSet $set,
+        ?Element $parentElement,
+        string $title,
+        ?string $iconImageUrl,
+        ?string $shortPdfPath,
+        ?string $longPdfPath,
+    ): Element {
+        return $this->elementRepository->create(new CreateElementDto(
+            set: $set,
+            title: $title,
+            description: "$title description",
+            iconImageUrl: $iconImageUrl,
+            richText: '',
+            shortPdfPath: $shortPdfPath,
+            longPdfPath: $longPdfPath,
+            youtubeUrl: null,
+            parentElement: $parentElement,
+        ));
+    }
+}

backend/tests/Unit/Set/UseCases/UpdateDescriptionTest.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace Tests\Unit\Set\UseCases;
+
+use App\Exceptions\BadRequestException;
+use App\Set\CreateSetDto;
+use App\Set\Set as DomainSet;
+use App\Set\UseCases\UpdateSet\UpdateDescription;
+use App\Set\UseCases\UpdateSet\UpdateDescriptionRequest;
+use Tests\Fakes\FakeSetRepository;
+use Tests\TestCase;
+
+class UpdateDescriptionTest extends TestCase
+{
+    private FakeSetRepository $setRepository;
+
+    protected function setUp(): void
+    {
+        $this->setRepository = new FakeSetRepository();
+    }
+
+    public function testUpdatesOnlyDescription(): void
+    {
+        $set = $this->createSet();
+        $updateDescription = new UpdateDescription($this->setRepository);
+
+        $updatedSet = $updateDescription->execute(
+            new UpdateDescriptionRequest(
+                id: $set->getId(),
+                description: 'Updated set description',
+            )
+        );
+
+        $this->assertSame(
+            'Updated set description',
+            $updatedSet->getDescription(),
+        );
+        $this->assertSame($set->getName(), $updatedSet->getName());
+        $this->assertSame(
+            $set->getIconImageUrl(),
+            $updatedSet->getIconImageUrl(),
+        );
+    }
+
+    public function testRejectsBlankDescription(): void
+    {
+        $set = $this->createSet();
+        $updateDescription = new UpdateDescription($this->setRepository);
+
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('description is required');
+
+        $updateDescription->execute(new UpdateDescriptionRequest(
+            id: $set->getId(),
+            description: '',
+        ));
+    }
+
+    private function createSet(): DomainSet
+    {
+        return $this->setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: 'set-icons/original.png',
+        ));
+    }
+}

backend/tests/Unit/Set/UseCases/UpdateIconImageTest.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace Tests\Unit\Set\UseCases;
+
+use App\Exceptions\BadRequestException;
+use App\Set\CreateSetDto;
+use App\Set\Set as DomainSet;
+use App\Set\UseCases\UpdateSet\UpdateIconImage;
+use App\Set\UseCases\UpdateSet\UpdateIconImageRequest;
+use Tests\Fakes\FakeFilesystem;
+use Tests\Fakes\FakeSetRepository;
+use Tests\TestCase;
+
+class UpdateIconImageTest extends TestCase
+{
+    private FakeSetRepository $setRepository;
+
+    private FakeFilesystem $filesystem;
+
+    protected function setUp(): void
+    {
+        $this->setRepository = new FakeSetRepository();
+        $this->filesystem = new FakeFilesystem();
+    }
+
+    public function testUpdatesOnlyIconAndDeletesOldIcon(): void
+    {
+        $set = $this->createSet();
+        $updateIconImage = new UpdateIconImage(
+            $this->setRepository,
+            $this->filesystem,
+        );
+
+        $updatedSet = $updateIconImage->execute(new UpdateIconImageRequest(
+            id: $set->getId(),
+            fileContents: 'image contents',
+            fileOriginalName: 'updated.png',
+            fileMimeType: 'image/png',
+            fileSizeBytes: 13,
+        ));
+
+        $this->assertSame($set->getName(), $updatedSet->getName());
+        $this->assertSame(
+            $set->getDescription(),
+            $updatedSet->getDescription(),
+        );
+        $this->assertSame(
+            'set-icons/fake-updated.png',
+            $updatedSet->getIconImageUrl(),
+        );
+        $this->assertCount(1, $this->filesystem->uploads);
+        $this->assertSame('set-icons', $this->filesystem->uploads[0]['folder']);
+        $this->assertSame([
+            'set-icons/original.png',
+        ], $this->filesystem->deletedPaths);
+    }
+
+    public function testRejectsMissingFile(): void
+    {
+        $set = $this->createSet();
+        $updateIconImage = new UpdateIconImage(
+            $this->setRepository,
+            $this->filesystem,
+        );
+
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('icon image is required');
+
+        $updateIconImage->execute(new UpdateIconImageRequest(
+            id: $set->getId(),
+            fileContents: null,
+            fileOriginalName: null,
+            fileMimeType: null,
+            fileSizeBytes: null,
+        ));
+    }
+
+    public function testRejectsInvalidMimeType(): void
+    {
+        $set = $this->createSet();
+        $updateIconImage = new UpdateIconImage(
+            $this->setRepository,
+            $this->filesystem,
+        );
+
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage(
+            'icon image must be a jpeg, png or webp image',
+        );
+
+        $updateIconImage->execute(new UpdateIconImageRequest(
+            id: $set->getId(),
+            fileContents: 'image contents',
+            fileOriginalName: 'updated.gif',
+            fileMimeType: 'image/gif',
+            fileSizeBytes: 13,
+        ));
+    }
+
+    private function createSet(): DomainSet
+    {
+        return $this->setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: 'set-icons/original.png',
+        ));
+    }
+}

backend/tests/Unit/Set/UseCases/UpdateNameTest.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace Tests\Unit\Set\UseCases;
+
+use App\Exceptions\BadRequestException;
+use App\Set\CreateSetDto;
+use App\Set\Set as DomainSet;
+use App\Set\UseCases\UpdateSet\UpdateName;
+use App\Set\UseCases\UpdateSet\UpdateNameRequest;
+use Tests\Fakes\FakeSetRepository;
+use Tests\TestCase;
+
+class UpdateNameTest extends TestCase
+{
+    private FakeSetRepository $setRepository;
+
+    protected function setUp(): void
+    {
+        $this->setRepository = new FakeSetRepository();
+    }
+
+    public function testUpdatesOnlyName(): void
+    {
+        $set = $this->createSet();
+        $updateName = new UpdateName($this->setRepository);
+
+        $updatedSet = $updateName->execute(new UpdateNameRequest(
+            id: $set->getId(),
+            name: 'Updated Set',
+        ));
+
+        $this->assertSame('Updated Set', $updatedSet->getName());
+        $this->assertSame(
+            $set->getDescription(),
+            $updatedSet->getDescription(),
+        );
+        $this->assertSame(
+            $set->getIconImageUrl(),
+            $updatedSet->getIconImageUrl(),
+        );
+    }
+
+    public function testRejectsBlankName(): void
+    {
+        $set = $this->createSet();
+        $updateName = new UpdateName($this->setRepository);
+
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('name is required');
+
+        $updateName->execute(new UpdateNameRequest(
+            id: $set->getId(),
+            name: '',
+        ));
+    }
+
+    private function createSet(): DomainSet
+    {
+        return $this->setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: 'set-icons/original.png',
+        ));
+    }
+}

backend/tests/Unit/Set/UseCases/UpdateSetTest.php

@@ -0,0 +1,236 @@
+<?php
+
+namespace Tests\Unit\Set\UseCases;
+
+use App\Element\CreateElementDto;
+use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
+use App\Set\CreateSetDto;
+use App\Set\Set as DomainSet;
+use App\Set\UseCases\UpdateSet\UpdateDescription;
+use App\Set\UseCases\UpdateSet\UpdateIconImage;
+use App\Set\UseCases\UpdateSet\UpdateName;
+use App\Set\UseCases\UpdateSet\UpdateSet;
+use App\Set\UseCases\UpdateSet\UpdateSetRequest;
+use Tests\Fakes\FakeElementRepository;
+use Tests\Fakes\FakeFilesystem;
+use Tests\Fakes\FakeSetRepository;
+use Tests\TestCase;
+
+class UpdateSetTest extends TestCase
+{
+    private FakeSetRepository $setRepository;
+
+    private FakeElementRepository $elementRepository;
+
+    private FakeFilesystem $filesystem;
+
+    private UpdateSet $updateSet;
+
+    protected function setUp(): void
+    {
+        $this->setRepository = new FakeSetRepository();
+        $this->elementRepository = new FakeElementRepository();
+        $this->filesystem = new FakeFilesystem();
+        $this->updateSet = new UpdateSet(
+            new UpdateName($this->setRepository),
+            new UpdateDescription($this->setRepository),
+            new UpdateIconImage(
+                $this->setRepository,
+                $this->filesystem,
+            ),
+            $this->setRepository,
+        );
+    }
+
+    public function testUpdatesSetWithoutChangingRootElement(): void
+    {
+        $set = $this->setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: 'set-icons/original.png',
+        ));
+        $rootElement = $this->elementRepository->create(new CreateElementDto(
+            set: $set,
+            title: 'Original Root',
+            description: 'Original root description',
+            iconImageUrl: 'set-icons/original.png',
+            richText: '',
+            shortPdfPath: null,
+            longPdfPath: null,
+            youtubeUrl: null,
+            parentElement: null,
+        ));
+
+        $updatedSet = $this->updateSet->execute(new UpdateSetRequest(
+            id: $set->getId(),
+            name: 'Updated Set',
+            description: 'Updated set description',
+            iconImageContents: null,
+            iconImageOriginalName: null,
+            iconImageMimeType: null,
+            iconImageSizeBytes: null,
+        ));
+
+        $this->assertSame('Updated Set', $updatedSet->getName());
+        $this->assertSame(
+            'Updated set description',
+            $updatedSet->getDescription(),
+        );
+        $this->assertSame(
+            'set-icons/original.png',
+            $updatedSet->getIconImageUrl(),
+        );
+
+        $unchangedRootElement = $this->elementRepository->find(
+            $rootElement->getId(),
+        );
+        $this->assertNotNull($unchangedRootElement);
+        $this->assertSame('Original Root', $unchangedRootElement->getTitle());
+        $this->assertSame(
+            'Original root description',
+            $unchangedRootElement->getDescription(),
+        );
+        $this->assertSame(
+            'set-icons/original.png',
+            $unchangedRootElement->getIconImageUrl(),
+        );
+    }
+
+    public function testUpdatesOnlySuppliedFields(): void
+    {
+        $set = $this->setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: 'set-icons/original.png',
+        ));
+
+        $updatedSet = $this->updateSet->execute(new UpdateSetRequest(
+            id: $set->getId(),
+            name: 'Updated Set',
+            description: null,
+            iconImageContents: null,
+            iconImageOriginalName: null,
+            iconImageMimeType: null,
+            iconImageSizeBytes: null,
+        ));
+
+        $this->assertSame('Updated Set', $updatedSet->getName());
+        $this->assertSame(
+            'Original set description',
+            $updatedSet->getDescription(),
+        );
+        $this->assertSame(
+            'set-icons/original.png',
+            $updatedSet->getIconImageUrl(),
+        );
+    }
+
+    public function testReplacesSetIconAndDeletesOldManagedIcon(): void
+    {
+        $set = $this->setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: 'set-icons/original.png',
+        ));
+
+        $updatedSet = $this->updateSet->execute(new UpdateSetRequest(
+            id: $set->getId(),
+            name: 'Updated Set',
+            description: 'Updated set description',
+            iconImageContents: 'image contents',
+            iconImageOriginalName: 'updated.png',
+            iconImageMimeType: 'image/png',
+            iconImageSizeBytes: 13,
+        ));
+
+        $this->assertSame(
+            'set-icons/fake-updated.png',
+            $updatedSet->getIconImageUrl(),
+        );
+        $this->assertCount(1, $this->filesystem->uploads);
+        $this->assertSame('set-icons', $this->filesystem->uploads[0]['folder']);
+        $this->assertSame([
+            'set-icons/original.png',
+        ], $this->filesystem->deletedPaths);
+    }
+
+    public function testRejectsNothingToUpdate(): void
+    {
+        $set = $this->createSet();
+
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('nothing to update');
+
+        $this->updateSet->execute(new UpdateSetRequest(
+            id: $set->getId(),
+            name: null,
+            description: null,
+            iconImageContents: null,
+            iconImageOriginalName: null,
+            iconImageMimeType: null,
+            iconImageSizeBytes: null,
+        ));
+    }
+
+    public function testRequiresName(): void
+    {
+        $set = $this->createSet();
+
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('name is required');
+
+        $this->updateSet->execute(new UpdateSetRequest(
+            id: $set->getId(),
+            name: '',
+            description: null,
+            iconImageContents: null,
+            iconImageOriginalName: null,
+            iconImageMimeType: null,
+            iconImageSizeBytes: null,
+        ));
+    }
+
+    public function testRequiresDescription(): void
+    {
+        $set = $this->createSet();
+
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('description is required');
+
+        $this->updateSet->execute(new UpdateSetRequest(
+            id: $set->getId(),
+            name: null,
+            description: '',
+            iconImageContents: null,
+            iconImageOriginalName: null,
+            iconImageMimeType: null,
+            iconImageSizeBytes: null,
+        ));
+    }
+
+    public function testThrowsWhenSetIsMissing(): void
+    {
+        $this->expectException(NotFoundException::class);
+        $this->expectExceptionMessage('Set not found');
+
+        $this->updateSet->execute(new UpdateSetRequest(
+            id: 999,
+            name: 'Updated Set',
+            description: 'Updated set description',
+            iconImageContents: null,
+            iconImageOriginalName: null,
+            iconImageMimeType: null,
+            iconImageSizeBytes: null,
+        ));
+    }
+
+    private function createSet(): DomainSet
+    {
+        return $this->setRepository->create(new CreateSetDto(
+            name: 'Original Set',
+            description: 'Original set description',
+            iconImageUrl: 'set-icons/original.png',
+        ));
+    }
+}

frontend/rabbi_gerzi/cypress/e2e/media.cy.ts

@@ -181,6 +181,13 @@ describe('media page sets', () => {
     cy.get('[data-cy="media-create-set-card"]').should('not.exist')
   })
 
+  it('does not show set management actions to logged-out users', () => {
+    cy.visit('/media')
+
+    cy.get('[data-cy="media-set-edit"]').should('not.exist')
+    cy.get('[data-cy="media-set-delete"]').should('not.exist')
+  })
+
   it('creates a set from the logged-in media page modal', () => {
     loginAsAdmin()
     cy.visit('/media')
@@ -205,4 +212,67 @@ describe('media page sets', () => {
     cy.get('[data-cy="admin-element-description"]')
       .should('have.value', 'Created through the media page modal')
   })
+
+  it('edits a set from the logged-in media page modal', () => {
+    cy.resetDb()
+    loginAsAdmin()
+    cy.visit('/media')
+    cy.intercept('POST', /\/api\/sets\/1\/update$/).as('updateSet')
+
+    cy.contains('[data-cy="media-set-card"]', 'Baderech HaAvodah')
+      .within(() => {
+        cy.get('[data-cy="media-set-edit"]').click()
+      })
+    cy.get('[data-cy="edit-set-modal"]').should('be.visible')
+    cy.get('[data-cy="edit-set-name"]')
+      .clear()
+      .type('Edited Cypress Set')
+    cy.get('[data-cy="edit-set-description"]')
+      .clear()
+      .type('Edited through the set modal')
+    cy.get('[data-cy="edit-set-submit"]').click()
+    cy.wait('@updateSet')
+
+    cy.get('[data-cy="edit-set-modal"]').should('not.exist')
+    cy.contains('[data-cy="media-set-card"]', 'Edited Cypress Set')
+      .should('be.visible')
+      .and('contain.text', 'Edited through the set modal')
+      .click()
+    cy.location('pathname').should('eq', '/element/1')
+    cy.contains('h1', 'Baderech HaAvodah').should('be.visible')
+
+    cy.resetDb()
+  })
+
+  it('warns before deleting a set from the logged-in media page', () => {
+    cy.resetDb()
+    loginAsAdmin()
+    cy.visit('/media')
+    cy.intercept('DELETE', /\/api\/sets\/2$/).as('deleteSet')
+
+    cy.contains('[data-cy="media-set-card"]', 'Daily Learning')
+      .within(() => {
+        cy.get('[data-cy="media-set-delete"]').click()
+      })
+    cy.get('[data-cy="delete-set-modal"]')
+      .should('be.visible')
+      .and('contain.text', 'Daily Learning')
+      .and('contain.text', 'all elements and uploaded files')
+    cy.get('[data-cy="delete-set-cancel"]').click()
+    cy.get('[data-cy="delete-set-modal"]').should('not.exist')
+    cy.contains('[data-cy="media-set-card"]', 'Daily Learning')
+      .should('be.visible')
+
+    cy.contains('[data-cy="media-set-card"]', 'Daily Learning')
+      .within(() => {
+        cy.get('[data-cy="media-set-delete"]').click()
+      })
+    cy.get('[data-cy="delete-set-confirm"]').click()
+    cy.wait('@deleteSet')
+    cy.get('[data-cy="delete-set-modal"]').should('not.exist')
+    cy.contains('[data-cy="media-set-card"]', 'Daily Learning')
+      .should('not.exist')
+
+    cy.resetDb()
+  })
 })

frontend/rabbi_gerzi/src/stores/mediaSets.ts

@@ -15,11 +15,18 @@ export interface CreateMediaSetInput {
   iconImage: File
 }
 
+export interface UpdateMediaSetInput {
+  id: number
+  name: string
+  description: string
+  iconImage: File | null
+}
+
 interface SetsResponse {
   sets: MediaSet[]
 }
 
-interface CreateSetResponse {
+interface SetResponse {
   set: MediaSet
 }
 
@@ -34,7 +41,11 @@ export const useMediaSetsStore = defineStore('mediaSets', () => {
   const isLoading = ref(false)
   const error = ref<string | null>(null)
   const isCreating = ref(false)
+  const isUpdating = ref(false)
+  const isDeleting = ref(false)
   const createError = ref<string | null>(null)
+  const updateError = ref<string | null>(null)
+  const deleteError = ref<string | null>(null)
 
   async function fetchSets(): Promise<void> {
     error.value = null
@@ -83,7 +94,7 @@ export const useMediaSetsStore = defineStore('mediaSets', () => {
         return null
       }
 
-      const data: CreateSetResponse = await response.json()
+      const data: SetResponse = await response.json()
       sets.value = [...sets.value, data.set]
 
       return data.set
@@ -95,13 +106,112 @@ export const useMediaSetsStore = defineStore('mediaSets', () => {
     }
   }
 
+  async function updateSet(
+    input: UpdateMediaSetInput,
+  ): Promise<MediaSet | null> {
+    updateError.value = null
+    isUpdating.value = true
+
+    const formData = new FormData()
+    formData.append('name', input.name)
+    formData.append('description', input.description)
+    if (input.iconImage !== null) {
+      formData.append('iconImage', input.iconImage)
+    }
+
+    try {
+      const encodedSetId = encodeURIComponent(input.id.toString())
+      const response = await fetch(
+        `${API_BASE_URL}/api/sets/${encodedSetId}/update`,
+        {
+          method: 'POST',
+          credentials: 'include',
+          body: formData,
+        },
+      )
+
+      if (!response.ok) {
+        updateError.value = await errorMessage(
+          response,
+          'Could not update media set',
+        )
+        return null
+      }
+
+      const data: SetResponse = await response.json()
+      sets.value = sets.value.map((mediaSet) => {
+        if (mediaSet.id === data.set.id) {
+          return data.set
+        }
+
+        return mediaSet
+      })
+
+      return data.set
+    } catch {
+      updateError.value = 'Network error - could not update media set'
+      return null
+    } finally {
+      isUpdating.value = false
+    }
+  }
+
+  async function deleteSet(setId: number): Promise<boolean> {
+    deleteError.value = null
+    isDeleting.value = true
+
+    try {
+      const encodedSetId = encodeURIComponent(setId.toString())
+      const response = await fetch(`${API_BASE_URL}/api/sets/${encodedSetId}`, {
+        method: 'DELETE',
+        credentials: 'include',
+      })
+
+      if (!response.ok) {
+        deleteError.value = await errorMessage(
+          response,
+          'Could not delete media set',
+        )
+        return false
+      }
+
+      sets.value = sets.value.filter((mediaSet) => {
+        return mediaSet.id !== setId
+      })
+      return true
+    } catch {
+      deleteError.value = 'Network error - could not delete media set'
+      return false
+    } finally {
+      isDeleting.value = false
+    }
+  }
+
+  async function errorMessage(
+    response: Response,
+    fallbackMessage: string,
+  ): Promise<string> {
+    try {
+      const data: ErrorResponse = await response.json()
+      return data.error ?? fallbackMessage
+    } catch {
+      return fallbackMessage
+    }
+  }
+
   return {
     sets,
     isLoading,
     error,
     isCreating,
+    isUpdating,
+    isDeleting,
     createError,
+    updateError,
+    deleteError,
     fetchSets,
     createSet,
+    updateSet,
+    deleteSet,
   }
 })

frontend/rabbi_gerzi/src/views/MediaPage.vue

@@ -1,11 +1,17 @@
 <script setup lang="ts">
 import { storeToRefs } from 'pinia'
 import { computed, onMounted, reactive, ref } from 'vue'
-import { Plus as PlusIcon, X as XIcon } from 'lucide-vue-next'
+import {
+  AlertTriangle as AlertTriangleIcon,
+  Pencil as PencilIcon,
+  Plus as PlusIcon,
+  Trash2 as TrashIcon,
+  X as XIcon,
+} from 'lucide-vue-next'
 import { useRouter } from 'vue-router'
 import SiteHeader from '@/components/SiteHeader.vue'
 import { useAuthStore } from '@/stores/auth'
-import { useMediaSetsStore } from '@/stores/mediaSets'
+import { type MediaSet, useMediaSetsStore } from '@/stores/mediaSets'
 
 interface CreateSetForm {
   name: string
@@ -15,26 +21,54 @@ interface CreateSetForm {
 const router = useRouter()
 const authStore = useAuthStore()
 const mediaSetsStore = useMediaSetsStore()
-const { sets, isLoading, error, isCreating, createError } =
+const {
-  storeToRefs(mediaSetsStore)
+  sets,
+  isLoading,
+  error,
+  isCreating,
+  isUpdating,
+  isDeleting,
+  createError,
+  updateError,
+  deleteError,
+} = storeToRefs(mediaSetsStore)
 const isCreateModalOpen = ref(false)
+const isEditModalOpen = ref(false)
 const iconImageFile = ref<File | null>(null)
+const editIconImageFile = ref<File | null>(null)
 const iconImageInput = ref<HTMLInputElement | null>(null)
+const editIconImageInput = ref<HTMLInputElement | null>(null)
 const localCreateError = ref<string | null>(null)
+const localEditError = ref<string | null>(null)
+const editingSet = ref<MediaSet | null>(null)
+const deletingSet = ref<MediaSet | null>(null)
 
 const createSetForm = reactive<CreateSetForm>({
   name: '',
   description: '',
 })
 
+const editSetForm = reactive<CreateSetForm>({
+  name: '',
+  description: '',
+})
+
 const createSetError = computed(() => {
   return createError.value ?? localCreateError.value
 })
 
+const editSetError = computed(() => {
+  return updateError.value ?? localEditError.value
+})
+
 const selectedIconName = computed(() => {
   return iconImageFile.value?.name ?? 'No icon selected'
 })
 
+const selectedEditIconName = computed(() => {
+  return editIconImageFile.value?.name ?? 'No new icon selected'
+})
+
 onMounted(() => {
   void mediaSetsStore.fetchSets()
   if (!authStore.isAuthenticated) {
@@ -56,6 +90,42 @@ function closeCreateModal(): void {
   resetCreateSetForm()
 }
 
+function openEditModal(mediaSet: MediaSet): void {
+  editingSet.value = mediaSet
+  editSetForm.name = mediaSet.name
+  editSetForm.description = mediaSet.description
+  editIconImageFile.value = null
+  localEditError.value = null
+  updateError.value = null
+  if (editIconImageInput.value !== null) {
+    editIconImageInput.value.value = ''
+  }
+  isEditModalOpen.value = true
+}
+
+function closeEditModal(): void {
+  if (isUpdating.value) {
+    return
+  }
+
+  isEditModalOpen.value = false
+  resetEditSetForm()
+}
+
+function openDeleteModal(mediaSet: MediaSet): void {
+  deletingSet.value = mediaSet
+  deleteError.value = null
+}
+
+function closeDeleteModal(): void {
+  if (isDeleting.value) {
+    return
+  }
+
+  deletingSet.value = null
+  deleteError.value = null
+}
+
 function handleIconImageChange(changeEvent: Event): void {
   const input = changeEvent.target
   if (!(input instanceof HTMLInputElement)) {
@@ -65,6 +135,15 @@ function handleIconImageChange(changeEvent: Event): void {
   iconImageFile.value = input.files?.[0] ?? null
 }
 
+function handleEditIconImageChange(changeEvent: Event): void {
+  const input = changeEvent.target
+  if (!(input instanceof HTMLInputElement)) {
+    return
+  }
+
+  editIconImageFile.value = input.files?.[0] ?? null
+}
+
 async function handleCreateSet(): Promise<void> {
   const setName = createSetForm.name.trim()
   const setDescription = createSetForm.description.trim()
@@ -106,6 +185,75 @@ async function handleCreateSet(): Promise<void> {
   })
 }
 
+async function handleUpdateSet(): Promise<void> {
+  if (editingSet.value === null) {
+    return
+  }
+
+  const setName = editSetForm.name.trim()
+  const setDescription = editSetForm.description.trim()
+
+  localEditError.value = null
+  if (setName === '') {
+    localEditError.value = 'Name is required'
+    return
+  }
+  if (setDescription === '') {
+    localEditError.value = 'Description is required'
+    return
+  }
+
+  const updatedSet = await mediaSetsStore.updateSet({
+    id: editingSet.value.id,
+    name: setName,
+    description: setDescription,
+    iconImage: editIconImageFile.value,
+  })
+
+  if (updatedSet === null) {
+    return
+  }
+
+  isEditModalOpen.value = false
+  resetEditSetForm()
+}
+
+async function handleDeleteSet(): Promise<void> {
+  if (deletingSet.value === null) {
+    return
+  }
+
+  const deleted = await mediaSetsStore.deleteSet(deletingSet.value.id)
+  if (!deleted) {
+    return
+  }
+
+  deletingSet.value = null
+}
+
+function openSet(mediaSet: MediaSet): void {
+  if (mediaSet.rootElementId === null) {
+    return
+  }
+
+  void router.push({
+    name: 'element',
+    params: { id: mediaSet.rootElementId.toString() },
+  })
+}
+
+function handleManagedCardKeydown(
+  keyboardEvent: KeyboardEvent,
+  mediaSet: MediaSet,
+): void {
+  if (keyboardEvent.key !== 'Enter' && keyboardEvent.key !== ' ') {
+    return
+  }
+
+  keyboardEvent.preventDefault()
+  openSet(mediaSet)
+}
+
 function resetCreateSetForm(): void {
   createSetForm.name = ''
   createSetForm.description = ''
@@ -116,6 +264,18 @@ function resetCreateSetForm(): void {
     iconImageInput.value.value = ''
   }
 }
+
+function resetEditSetForm(): void {
+  editSetForm.name = ''
+  editSetForm.description = ''
+  editIconImageFile.value = null
+  localEditError.value = null
+  updateError.value = null
+  editingSet.value = null
+  if (editIconImageInput.value !== null) {
+    editIconImageInput.value.value = ''
+  }
+}
 </script>
 
 <template>
@@ -143,8 +303,56 @@ function resetCreateSetForm(): void {
         </p>
         <div v-else class="media-page__grid" data-cy="media-set-grid">
           <template v-for="mediaSet in sets" :key="mediaSet.id">
+            <article
+              v-if="authStore.isAuthenticated"
+              class="media-page__card media-page__card--managed"
+              :class="{
+                'media-page__card--disabled': mediaSet.rootElementId === null,
+              }"
+              data-cy="media-set-card"
+              :tabindex="mediaSet.rootElementId !== null ? 0 : undefined"
+              @click="openSet(mediaSet)"
+              @keydown="handleManagedCardKeydown($event, mediaSet)"
+            >
+              <img
+                :src="mediaSet.iconImageUrl"
+                :alt="`${mediaSet.name} icon`"
+                class="media-page__card-icon"
+                data-cy="media-set-icon"
+              />
+              <h2 class="media-page__card-title">{{ mediaSet.name }}</h2>
+              <p class="media-page__card-description">
+                {{ mediaSet.description }}
+              </p>
+              <div
+                class="media-page__card-actions"
+                aria-label="Set actions"
+                @click.stop
+              >
+                <button
+                  type="button"
+                  class="media-page__card-action"
+                  data-cy="media-set-edit"
+                  :aria-label="`Edit ${mediaSet.name}`"
+                  :title="`Edit ${mediaSet.name}`"
+                  @click="openEditModal(mediaSet)"
+                >
+                  <PencilIcon :size="18" aria-hidden="true" />
+                </button>
+                <button
+                  type="button"
+                  class="media-page__card-action media-page__card-action--danger"
+                  data-cy="media-set-delete"
+                  :aria-label="`Delete ${mediaSet.name}`"
+                  :title="`Delete ${mediaSet.name}`"
+                  @click="openDeleteModal(mediaSet)"
+                >
+                  <TrashIcon :size="18" aria-hidden="true" />
+                </button>
+              </div>
+            </article>
             <RouterLink
-              v-if="mediaSet.rootElementId !== null"
+              v-else-if="mediaSet.rootElementId !== null"
               :to="{ name: 'element', params: { id: mediaSet.rootElementId } }"
               class="media-page__card"
               data-cy="media-set-card"
@@ -286,6 +494,162 @@ function resetCreateSetForm(): void {
         </form>
       </section>
     </div>
+    <div
+      v-if="isEditModalOpen && editingSet !== null"
+      class="create-set-modal"
+      data-cy="edit-set-modal"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="edit-set-modal-title"
+      @click.self="closeEditModal"
+    >
+      <section class="create-set-modal__panel">
+        <header class="create-set-modal__header">
+          <h2 id="edit-set-modal-title" class="create-set-modal__title">
+            Edit set
+          </h2>
+          <button
+            type="button"
+            class="create-set-modal__close"
+            aria-label="Close edit set modal"
+            :disabled="isUpdating"
+            @click="closeEditModal"
+          >
+            <XIcon :size="20" aria-hidden="true" />
+          </button>
+        </header>
+
+        <form class="create-set-modal__form" @submit.prevent="handleUpdateSet">
+          <label class="create-set-modal__field">
+            <span class="create-set-modal__label">Name</span>
+            <input
+              v-model="editSetForm.name"
+              data-cy="edit-set-name"
+              type="text"
+              class="create-set-modal__input"
+              autocomplete="off"
+            />
+          </label>
+
+          <label class="create-set-modal__field">
+            <span class="create-set-modal__label">Description</span>
+            <textarea
+              v-model="editSetForm.description"
+              data-cy="edit-set-description"
+              class="create-set-modal__textarea"
+              rows="4"
+            ></textarea>
+          </label>
+
+          <label class="create-set-modal__field">
+            <span class="create-set-modal__label">Replace icon image</span>
+            <input
+              ref="editIconImageInput"
+              data-cy="edit-set-icon"
+              type="file"
+              class="create-set-modal__file"
+              accept="image/jpeg,image/png,image/webp"
+              @change="handleEditIconImageChange"
+            />
+            <span class="create-set-modal__file-name">
+              {{ selectedEditIconName }}
+            </span>
+          </label>
+
+          <p
+            v-if="editSetError !== null"
+            class="create-set-modal__error"
+            data-cy="edit-set-error"
+          >
+            {{ editSetError }}
+          </p>
+
+          <div class="create-set-modal__actions">
+            <button
+              type="button"
+              class="create-set-modal__secondary"
+              :disabled="isUpdating"
+              @click="closeEditModal"
+            >
+              Cancel
+            </button>
+            <button
+              type="submit"
+              class="create-set-modal__submit"
+              data-cy="edit-set-submit"
+              :disabled="isUpdating"
+            >
+              {{ isUpdating ? 'Saving...' : 'Save set' }}
+            </button>
+          </div>
+        </form>
+      </section>
+    </div>
+    <div
+      v-if="deletingSet !== null"
+      class="create-set-modal"
+      data-cy="delete-set-modal"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="delete-set-modal-title"
+      @click.self="closeDeleteModal"
+    >
+      <section class="create-set-modal__panel">
+        <header class="create-set-modal__header">
+          <h2 id="delete-set-modal-title" class="create-set-modal__title">
+            Delete set
+          </h2>
+          <button
+            type="button"
+            class="create-set-modal__close"
+            aria-label="Close delete set modal"
+            :disabled="isDeleting"
+            @click="closeDeleteModal"
+          >
+            <XIcon :size="20" aria-hidden="true" />
+          </button>
+        </header>
+
+        <div class="delete-set-modal__body">
+          <span class="delete-set-modal__icon">
+            <AlertTriangleIcon :size="28" aria-hidden="true" />
+          </span>
+          <p class="delete-set-modal__warning">
+            Delete "{{ deletingSet.name }}"? This will permanently delete this
+            set and all elements and uploaded files inside it.
+          </p>
+        </div>
+
+        <p
+          v-if="deleteError !== null"
+          class="create-set-modal__error"
+          data-cy="delete-set-error"
+        >
+          {{ deleteError }}
+        </p>
+
+        <div class="create-set-modal__actions">
+          <button
+            type="button"
+            class="create-set-modal__secondary"
+            data-cy="delete-set-cancel"
+            :disabled="isDeleting"
+            @click="closeDeleteModal"
+          >
+            Cancel
+          </button>
+          <button
+            type="button"
+            class="create-set-modal__submit create-set-modal__submit--danger"
+            data-cy="delete-set-confirm"
+            :disabled="isDeleting"
+            @click="handleDeleteSet"
+          >
+            {{ isDeleting ? 'Deleting...' : 'Delete set' }}
+          </button>
+        </div>
+      </section>
+    </div>
   </div>
 </template>
 
@@ -368,10 +732,65 @@ a.media-page__card:focus-visible {
   outline-offset: 4px;
 }
 
+.media-page__card--managed {
+  position: relative;
+  cursor: pointer;
+}
+
+.media-page__card--managed:hover:not(.media-page__card--disabled),
+.media-page__card--managed:focus-visible:not(.media-page__card--disabled) {
+  border-color: #d4ad5f;
+  box-shadow: 0 14px 35px rgb(44 44 44 / 10%);
+  transform: translateY(-2px);
+}
+
+.media-page__card--managed:focus-visible {
+  outline: 3px solid rgb(212 173 95 / 45%);
+  outline-offset: 4px;
+}
+
 .media-page__card--disabled {
+  cursor: default;
   opacity: 0.72;
 }
 
+.media-page__card-actions {
+  position: absolute;
+  top: 1rem;
+  right: 1rem;
+  display: flex;
+  gap: 0.5rem;
+}
+
+.media-page__card-action {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2.4rem;
+  height: 2.4rem;
+  padding: 0;
+  color: var(--color-slate);
+  background: var(--color-white);
+  border: 1px solid #e5cf9f;
+  border-radius: 9999px;
+  box-shadow: 0 8px 18px rgb(44 44 44 / 8%);
+}
+
+.media-page__card-action:hover,
+.media-page__card-action:focus-visible {
+  color: var(--color-olive);
+  border-color: #d4ad5f;
+  outline: 3px solid rgb(212 173 95 / 24%);
+  outline-offset: 2px;
+}
+
+.media-page__card-action--danger:hover,
+.media-page__card-action--danger:focus-visible {
+  color: #9f2d2d;
+  border-color: #d9a3a3;
+  outline-color: rgb(159 45 45 / 18%);
+}
+
 .media-page__card-icon {
   display: block;
   width: 140px;
@@ -590,6 +1009,11 @@ a.media-page__card:focus-visible {
   border: 1px solid var(--color-olive);
 }
 
+.create-set-modal__submit--danger {
+  background: #9f2d2d;
+  border-color: #9f2d2d;
+}
+
 .create-set-modal__secondary:disabled,
 .create-set-modal__submit:disabled,
 .create-set-modal__close:disabled {
@@ -597,6 +1021,33 @@ a.media-page__card:focus-visible {
   opacity: 0.65;
 }
 
+.delete-set-modal__body {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.85rem;
+  margin-top: 1.5rem;
+}
+
+.delete-set-modal__icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2.75rem;
+  height: 2.75rem;
+  flex: 0 0 auto;
+  color: #9f2d2d;
+  background: #fef2f2;
+  border: 1px solid #fecaca;
+  border-radius: 9999px;
+}
+
+.delete-set-modal__warning {
+  margin: 0;
+  color: var(--color-text);
+  font-size: 0.98rem;
+  line-height: 1.55;
+}
+
 @media (max-width: 768px) {
   .media-page__main {
     padding: 3rem 1rem;