access management changes (#1158)

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
+## v0.8.4-beta
+
+ **New Features**:
+ - added embeded video subtitle support. @maxbin123 #1072 #1157
+
+ **Notes**:
+ - access management: specific folders/files with access are shown instead permission denied for parent folder
+
+ **BugFixes**:
+ - fixed search bar style bug in mobile #1147
+ - access management delay showing rule changes in the list fixed.
+
 ## v0.8.3-beta
 
  **BugFixes**:
@@ -18,7 +30,7 @@ All notable changes to this project will be documented in this file. For commit
  **Notes**:
  - 8.0 ffmpeg version bundled with docker
  - go 1.25 upgrade with green tea GC enabled
- - totp secrets accept non-secure strings, only throwing warning 
+ - totp secrets accept non-secure strings, only throwing warning
  - adjusted download limit so it also counts viewing text "content" of files (like in editor). You can also "disable file viewing" to stop the editor from showing. lower quality file image previews are not counted as downloads.
  - updated invalid share message to be more clear https://github.com/gtsteffaniak/filebrowser/issues/1120
 

backend/adapters/fs/files/files.go

@@ -34,12 +34,10 @@ func FileInfoFaster(opts iteminfo.FileOptions) (*iteminfo.ExtendedFileInfo, erro
 	if index == nil {
 		return response, fmt.Errorf("could not get index: %v ", opts.Source)
 	}
-	if opts.Access != nil && !opts.Access.Permitted(index.Path, opts.Path, opts.Username) {
-		return response, errors.ErrPermissionDenied
-	}
+
 	realPath, isDir, err := index.GetRealPath(opts.Path)
 	if err != nil {
-		return response, err
+		return response, fmt.Errorf("could not get real path for requested path: %v", opts.Path)
 	}
 	opts.IsDir = isDir
 	var info *iteminfo.FileInfo
@@ -63,6 +61,33 @@ func FileInfoFaster(opts iteminfo.FileOptions) (*iteminfo.ExtendedFileInfo, erro
 	response.FileInfo = *info
 	response.RealPath = realPath
 	response.Source = opts.Source
+
+	if opts.Access != nil && !opts.Access.Permitted(index.Path, opts.Path, opts.Username) {
+		// check if any subpath is permitted
+		// keep track of permitted paths and only show them at the end
+		subFolders := info.Folders
+		subFiles := info.Files
+		response.Folders = make([]iteminfo.ItemInfo, 0)
+		response.Files = make([]iteminfo.ItemInfo, 0)
+		hasPermittedPaths := false
+		for _, subFolder := range subFolders {
+			indexPath := info.Path + subFolder.Name
+			if opts.Access.Permitted(index.Path, indexPath, opts.Username) {
+				hasPermittedPaths = true
+				response.Folders = append(response.Folders, subFolder)
+			}
+		}
+		for _, subFile := range subFiles {
+			indexPath := info.Path + subFile.Name
+			if opts.Access.Permitted(index.Path, indexPath, opts.Username) {
+				hasPermittedPaths = true
+				response.Files = append(response.Files, subFile)
+			}
+		}
+		if !hasPermittedPaths {
+			return response, errors.ErrPermissionDenied
+		}
+	}
 	if opts.Content {
 		processContent(response, index)
 	}

backend/database/access/access.go

@@ -176,6 +176,7 @@ func (s *Storage) DenyUser(sourcePath, indexPath, username string) error {
 	}
 	rule.Deny.Users[username] = struct{}{}
 	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
 	return s.SaveToDB()
 }
 
@@ -195,6 +196,7 @@ func (s *Storage) AllowUser(sourcePath, indexPath, username string) error {
 	}
 	rule.Allow.Users[username] = struct{}{}
 	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
 	return s.SaveToDB()
 }
 
@@ -212,6 +214,7 @@ func (s *Storage) DenyGroup(sourcePath, indexPath, groupname string) error {
 	}
 	rule.Deny.Groups[groupname] = struct{}{}
 	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
 	return s.SaveToDB()
 }
 
@@ -229,6 +232,7 @@ func (s *Storage) AllowGroup(sourcePath, indexPath, groupname string) error {
 	}
 	rule.Allow.Groups[groupname] = struct{}{}
 	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
 	return s.SaveToDB()
 }
 
@@ -242,6 +246,7 @@ func (s *Storage) DenyAll(sourcePath, indexPath string) error {
 	}
 	rule.DenyAll = true
 	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
 	return s.SaveToDB()
 }