updated state fix (#181)

.dockerignore

@@ -1,6 +1,4 @@
 backend/**.db
-backend/tmp
-backend/backend*
 backend/vendor/**
 frontend/dist/**
 frontend/node_modules/**

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,10 +1,20 @@
 **Description**
+<!--
+Please explain the changes you made here.
+If the feature changes current behaviour, explain why your solution is better.
+-->
 
-According to the [contributing guide](https://github.com/gtsteffaniak/filebrowser/wiki/Contributing#contributing-as-an-unofficial-contributor), A PR should contain:
+:rotating_light: Before submitting your PR, please read [community](https://github.com/filebrowser/community), and indicate which issues (in any of the repos) are either fixed or closed by this PR. See [GitHub Help: Closing issues using keywords](https://help.github.com/articles/closing-issues-via-commit-messages/).
 
-- [ ] A clear description of why it was opened.
-- [ ] A short title that best describes the change.
-- [ ] Must pass unit and integration tests, which can be run checked locally prior to opening a PR.
-- [ ] Any additional details for functionality not covered by tests.
+- [ ] DO make sure you are requesting to **pull a topic/feature/bugfix branch** (right side). Don't request your master!
+- [ ] DO make sure you are making a pull request against the **master branch** (left side). Also you should start *your branch* off *our master*.
+- [ ] DO make sure that File Browser can be successfully built. See [builds](https://github.com/filebrowser/community/blob/master/builds.md) and [development](https://github.com/filebrowser/community/blob/master/development.md).
+- [ ] DO make sure that related issues are opened in other repositories. I.e., the frontend, caddy plugins or the web page need to be updated accordingly.
+- [ ] AVOID breaking the continuous integration build.
 
-**Additional Details**
+**Further comments**
+<!--
+If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did, what alternatives you considered, etc.
+
+:heart: Thank you!
+-->

.github/workflows/create-dev-branch.yaml

@@ -1,58 +0,0 @@
-name: Create Dev Version
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to create (format: 0.0.0)"
-        required: true
-        type: string
-
-jobs:
-  create-dev-branch:
-    name: Create Dev Branch
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.PAT }} # Uses the Personal Access Token
-
-      - name: Validate version format
-        id: validate_version
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "❌ ERROR: Version must be in '0.0.0' format."
-            exit 1
-          fi
-          echo "✅ Version format validated: $VERSION"
-
-      - name: Check if branch already exists
-        id: check_branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          DEV_BRANCH="dev/v$VERSION"
-
-          if git ls-remote --exit-code origin "$DEV_BRANCH"; then
-            echo "❌ ERROR: Branch '$DEV_BRANCH' already exists!"
-            exit 1
-          fi
-          echo "✅ Branch '$DEV_BRANCH' does not exist."
-
-      - name: Create and push new dev branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          DEV_BRANCH="dev/v$VERSION"
-
-          # Fetch latest changes
-          git fetch origin main
-
-          # Create new branch from main
-          git checkout -b "$DEV_BRANCH" origin/main
-
-          # Push branch to remote
-          git push origin "$DEV_BRANCH"
-
-          echo "✅ Successfully created branch '$DEV_BRANCH'!"

.github/workflows/main.yaml

@@ -1,4 +1,4 @@
-name: main release
+name: main job
 
 on:
   push:
@@ -6,8 +6,8 @@ on:
       - "main"
 
 jobs:
-  test_playwright:
-    name: Test Playwright
+  push_latest_to_registry:
+    name: Push latest
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -16,17 +16,28 @@ jobs:
         uses: docker/setup-qemu-action@v3.0.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3.0.0
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run build
-      - uses: actions/setup-go@v5
+        # Workaround to fix error:
+        # failed to push: failed to copy: io: read/write on closed pipe
+        # See https://github.com/docker/build-push-action/issues/761
         with:
-          go-version: 'stable'
-      - working-directory: backend
-        run: go build -o filebrowser .
-      - name: Build
-        uses: docker/build-push-action@v6
+          driver-opts: |
+            image=moby/buildkit:v0.10.6
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: gtstef/filebrowser
+      - name: Build and push
+        uses: docker/build-push-action@v5
         with:
           context: .
-          file: ./_docker/Dockerfile.playwright-general
-          push: false
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          file: ./Dockerfile
+          push: true
+          tags: 'gtstef/filebrowser:latest'
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/pr.yaml

@@ -1,119 +1,15 @@
-name: PR Request
+name: pr-merge
 
 on:
   pull_request:
     branches:
       - "main"
-      - "dev/v*.*.*"
-      - "beta/v*.*.*"
-      - "stable/v*.*.*"
+      - "v[0-9]+.[0-9]+.[0-9]+"
+      - "dev_*"
+
 jobs:
-  prime_docker_cache:
-    name: Prime docker cache
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Prime Cache
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: _docker/Dockerfile.primecache
-          push: false
-          load: false
-          cache-to: |
-            type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
-  build_frontend:
-    name: Build frontend
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-      - name: Build frontend
-        working-directory: frontend
-        run: npm i && npm run build
-      - name: Upload frontend build artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist
-          path: backend/http/dist
-  build_backend:
-    name: Build backend
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - name: Build backend
-        working-directory: backend
-        run: go build -o filebrowser .
-      - name: Upload backend build artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: filebrowser
-          path: backend/filebrowser
-  test_playwright:
-    needs: [build_backend, build_frontend, prime_docker_cache]
-    name: Test Playwright - ${{ matrix.name }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: general
-            dockerfile: ./_docker/Dockerfile.playwright-general
-          - name: proxy
-            dockerfile: ./_docker/Dockerfile.playwright-proxy
-          - name: noauth
-            dockerfile: ./_docker/Dockerfile.playwright-noauth
-          - name: oidc
-            dockerfile: ./_docker/Dockerfile.playwright-oidc
-          - name: sharing
-            dockerfile: ./_docker/Dockerfile.playwright-sharing
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Download frontend build
-        uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: frontend/dist
-      - name: Download backend build
-        uses: actions/download-artifact@v4
-        with:
-          name: filebrowser
-          path: backend/
-      - name: Make backend executable
-        run: chmod +x backend/filebrowser
-      - name: Copy frontend build to backend
-        run: |
-          mkdir -p backend/http/embed
-          cp -r frontend/dist/* backend/http/embed
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Build and Test
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ${{ matrix.dockerfile }}
-          push: false
-          load: true
-          cache-from: |
-            type=gha,scope=${{ github.ref_name }}-playwright-base
-            type=gha,scope=main-playwright-base
-          cache-to: |
-            type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
   push_pr_to_registry:
-    if: github.event.pull_request.head.repo.fork == false
-    name: Build docker image
+    name: Push PR
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -122,6 +18,12 @@ jobs:
         uses: docker/setup-qemu-action@v3.0.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3.0.0
+        # Workaround to fix error:
+        # failed to push: failed to copy: io: read/write on closed pipe
+        # See https://github.com/docker/build-push-action/issues/761
+        with:
+          driver-opts: |
+            image=moby/buildkit:v0.10.6
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -133,15 +35,10 @@ jobs:
         with:
           images: gtstef/filebrowser
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v5
         with:
           context: .
-          file: ./_docker/Dockerfile.slim
-          push: false # Do not push the image for now
+          file: ./Dockerfile
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            VERSION=${{ steps.meta.outputs.version }}
-            REVISION=${{ steps.meta.outputs.revision }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/promote-beta-to-stable.yaml

@@ -1,110 +0,0 @@
-name: Promote Beta to Stable
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to promote (format: 0.0.0)"
-        required: true
-        type: string
-
-jobs:
-  promote-beta-to-stable:
-    name: Promote Beta to Stable
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.PAT }} # Uses Personal Access Token for branch operations
-
-      - name: Validate version format
-        id: validate_version
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "❌ ERROR: Version must be in '0.0.0' format."
-            exit 1
-          fi
-          echo "✅ Version format validated: $VERSION"
-
-      - name: Check if beta branch exists
-        id: check_beta_branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          BETA_BRANCH="beta/v$VERSION"
-
-          if ! git ls-remote --exit-code origin "$BETA_BRANCH"; then
-            echo "❌ ERROR: Beta branch '$BETA_BRANCH' does not exist!"
-            exit 1
-          fi
-          echo "✅ Beta branch '$BETA_BRANCH' exists."
-
-      - name: Check if stable branch already exists
-        id: check_stable_branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          STABLE_BRANCH="stable/v$VERSION"
-
-          if git ls-remote --exit-code origin "$STABLE_BRANCH"; then
-            echo "❌ ERROR: Stable branch '$STABLE_BRANCH' already exists!"
-            exit 1
-          fi
-          echo "✅ Stable branch '$STABLE_BRANCH' does not exist."
-
-      - name: Create and push new stable branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          BETA_BRANCH="beta/v$VERSION"
-          STABLE_BRANCH="stable/v$VERSION"
-
-          # Fetch latest changes
-          git fetch origin "$BETA_BRANCH"
-
-          # Create new stable branch from beta branch
-          git checkout -b "$STABLE_BRANCH" origin/"$BETA_BRANCH"
-
-          # Push new stable branch to remote
-          git push origin "$STABLE_BRANCH"
-
-          echo "✅ Successfully created stable branch '$STABLE_BRANCH' from '$BETA_BRANCH'."
-
-      - name: Merge beta into stable
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          BETA_BRANCH="beta/v$VERSION"
-          STABLE_BRANCH="stable/v$VERSION"
-
-          # Checkout stable branch
-          git checkout "$STABLE_BRANCH"
-
-          # Merge beta into stable
-          git merge --no-ff "origin/$BETA_BRANCH" -m "Merge $BETA_BRANCH into $STABLE_BRANCH"
-
-          # Push merge changes
-          git push origin "$STABLE_BRANCH"
-
-          echo "✅ Successfully merged '$BETA_BRANCH' into '$STABLE_BRANCH'."
-
-#      - name: Delete beta branch after successful merge
-#        run: |
-#          VERSION="${{ github.event.inputs.version }}"
-#          BETA_BRANCH="beta/v$VERSION"
-#
-#          # Delete beta branch locally and remotely
-#          git branch -d "$BETA_BRANCH"
-#          git push origin --delete "$BETA_BRANCH"
-#
-#          echo "✅ Successfully deleted '$BETA_BRANCH'."
-
-      - name: Create Pull Request to Main
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.PAT }}
-          commit-message: "Promote stable/v${{ github.event.inputs.version }} to main"
-          title: "Promote stable/v${{ github.event.inputs.version }} to main"
-          body: "This PR promotes stable/v${{ github.event.inputs.version }} to the main branch."
-          base: main
-          branch: stable/v${{ github.event.inputs.version }}
-          delete-branch: false

.github/workflows/promote-dev-to-beta.yaml

@@ -1,99 +0,0 @@
-name: Promote Dev to Beta
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to promote (format: 0.0.0)"
-        required: true
-        type: string
-
-jobs:
-  promote-dev-to-beta:
-    name: Promote Dev to Beta
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.PAT }} # Uses the Personal Access Token
-
-      - name: Validate version format
-        id: validate_version
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "❌ ERROR: Version must be in 'v0.0.0' format."
-            exit 1
-          fi
-          echo "✅ Version format validated: $VERSION"
-
-      - name: Check if dev branch exists
-        id: check_dev_branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          DEV_BRANCH="dev/v$VERSION"
-
-          if ! git ls-remote --exit-code origin "$DEV_BRANCH"; then
-            echo "❌ ERROR: Dev branch '$DEV_BRANCH' does not exist!"
-            exit 1
-          fi
-          echo "✅ Dev branch '$DEV_BRANCH' exists."
-
-      - name: Check if beta branch already exists
-        id: check_beta_branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          BETA_BRANCH="beta/v$VERSION"
-
-          if git ls-remote --exit-code origin "$BETA_BRANCH"; then
-            echo "❌ ERROR: Beta branch '$BETA_BRANCH' already exists!"
-            exit 1
-          fi
-          echo "✅ Beta branch '$BETA_BRANCH' does not exist."
-
-      - name: Create and push new beta branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          DEV_BRANCH="dev/v$VERSION"
-          BETA_BRANCH="beta/v$VERSION"
-
-          # Fetch latest changes
-          git fetch origin "$DEV_BRANCH"
-
-          # Create new beta branch from dev branch
-          git checkout -b "$BETA_BRANCH" origin/"$DEV_BRANCH"
-
-          # Push new beta branch to remote
-          git push origin "$BETA_BRANCH"
-
-          echo "✅ Successfully created beta branch '$BETA_BRANCH' from '$DEV_BRANCH'."
-
-      - name: Merge dev into beta
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          DEV_BRANCH="dev/v$VERSION"
-          BETA_BRANCH="beta/v$VERSION"
-
-          # Checkout beta branch
-          git checkout "$BETA_BRANCH"
-
-          # Merge dev into beta
-          git merge --no-ff "origin/$DEV_BRANCH" -m "Merge $DEV_BRANCH into $BETA_BRANCH"
-
-          # Push merge changes
-          git push origin "$BETA_BRANCH"
-
-          echo "✅ Successfully merged '$DEV_BRANCH' into '$BETA_BRANCH'."
-
-#      - name: Delete dev branch after successful merge
-#        run: |
-#          VERSION="${{ github.event.inputs.version }}"
-#          DEV_BRANCH="dev/v$VERSION"
-#
-#          # Delete dev branch locally and remotely
-#          git branch -d "$DEV_BRANCH"
-#          git push origin --delete "$DEV_BRANCH"
-#
-#          echo "✅ Successfully deleted '$DEV_BRANCH'."

.github/workflows/regular-tests.yaml

@@ -1,9 +1,9 @@
-name: regular tests
+name: dev
 
 on:
-  pull_request:
+  push:
     branches:
-      - "**"
+      - "*"
 
 jobs:
   test-backend:
@@ -22,11 +22,10 @@ jobs:
       - uses: actions/setup-go@v5
         with:
             go-version: 'stable'
-      - uses: golangci/golangci-lint-action@v7
+      - uses: golangci/golangci-lint-action@v6
         with:
-          version: 'v2.1.6'
+          version: v1.59
           working-directory: backend
-          install-mode: goinstall
   format-backend:
     runs-on: ubuntu-latest
     steps:
@@ -42,11 +41,4 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
       - working-directory: frontend
-        run: npm i && npm run lint
-  test-frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run test
+        run: npm i eslint && npm run lint

.github/workflows/release.yaml

@@ -0,0 +1,79 @@
+name: release
+
+on:
+  push:
+    branches:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  create_release:
+    name: Create Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }}
+      - name: Extract branch name
+        shell: bash
+        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
+        id: extract_branch
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 1.22.2
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          target_commitish: ${{ steps.extract_branch.outputs.branch }}
+          token: ${{ secrets.PAT }}
+          tag_name: ${{ steps.extract_branch.outputs.branch }}
+          prerelease: false
+          draft: false
+          generate_release_notes: true
+          name: ${{ steps.extract_branch.outputs.branch }}
+  push_release_to_registry:
+    name: Push release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+        # Workaround to fix error:
+        # failed to push: failed to copy: io: read/write on closed pipe
+        # See https://github.com/docker/build-push-action/issues/761
+        with:
+          driver-opts: |
+            image=moby/buildkit:v0.10.6
+      - name: Login to Docker Hub
+        # Only push to Docker Hub when making a release
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: gtstef/filebrowser
+      - name: Strip v from version number
+        id: modify-json
+        run: |
+          JSON="${{ steps.meta.outputs.tags }}"
+          # Use jq to remove 'v' from the version field
+          JSON=$(echo "$JSON" | sed 's/filebrowser:v/filebrowser:/')
+          echo "cleaned_tag=$JSON" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_beta.yaml

@@ -1,66 +0,0 @@
-name: beta release
-
-on:
-  push:
-    branches:
-      - "beta/v[0-9]+.[0-9]+.[0-9]+"
-
-permissions:
-  contents: write
-
-jobs:
-  test_playwright:
-    name: Test Playwright - regular
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run build
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - working-directory: backend
-        run: go build -o filebrowser .
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./_docker/Dockerfile.playwright-general
-          push: false
-  create_release_tag:
-    needs: [ test_playwright ]
-    name: Create Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.PAT }}
-      - name: Extract branch name
-        shell: bash
-        run: |
-          original_branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
-          echo "branch_name=$transformed_branch" >> $GITHUB_OUTPUT
-          tag_name=$(echo "$original_branch" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')-beta
-          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
-        id: extract_branch
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - name: Create Release
-        uses: softprops/action-gh-release@v2
-        with:
-          target_commitish: ${{ github.sha }}
-          token: ${{ secrets.PAT }}
-          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
-          prerelease: false # change this to false when stable gets released
-          make_latest: true # change this to false when stable gets released
-          draft: false
-          generate_release_notes: true
-          name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/release_dev.yaml

@@ -1,62 +0,0 @@
-name: dev release
-
-on:
-  push:
-    branches:
-      - "dev/v[0-9]+.[0-9]+.[0-9]+"
-
-permissions:
-  contents: write
-
-jobs:
-  push_release_to_registry:
-    name: Push release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{ secrets.PAT }}
-      - name: Extract metadata (tags, labels) for Docker and GHCR
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            gtstef/filebrowser
-            ghcr.io/gtsteffaniak/filebrowser
-      - name: Modify version names
-        id: modify-json
-        run: |
-          TAGS="${{ steps.meta.outputs.tags }}"
-          # Apply modifications to both docker.io and ghcr.io tags
-          CLEANED_TAGS=$(echo "$TAGS" | sed 's/filebrowser:dev-v/filebrowser:/g' | sed -E 's/(filebrowser:[0-9]+\.[0-9]+\.[0-9]+)/\1-dev/g')
-          # Add dev tag to both registries
-          CLEANED_TAGS="$CLEANED_TAGS,gtstef/filebrowser:dev,ghcr.io/gtsteffaniak/filebrowser:dev"
-          echo "cleaned_tag<<EOF" >> $GITHUB_OUTPUT
-          echo "$CLEANED_TAGS" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64
-          file: ./_docker/Dockerfile
-          push: true
-          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_stable.yaml

@@ -1,65 +0,0 @@
-name: stable release
-
-on:
-  push:
-    branches:
-      - "stable/v[0-9]+.[0-9]+.[0-9]+"
-
-permissions:
-  contents: write
-
-jobs:
-  test_playwright:
-    name: Test Playwright
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run build
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - working-directory: backend
-        run: go build -o filebrowser .
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./_docker/Dockerfile.playwright-general
-          push: false
-  create_release_tag:
-    needs: [ test_playwright ]
-    name: Create Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.PAT }}
-      - name: Extract branch name
-        shell: bash
-        run: |
-          original_branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
-          echo "branch_name=$transformed_branch" >> $GITHUB_OUTPUT
-          tag_name=$(echo "$original_branch" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')-stable
-          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
-        id: extract_branch
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - name: Create Release
-        uses: softprops/action-gh-release@v2
-        with:
-          target_commitish: ${{ github.sha }}
-          token: ${{ secrets.PAT }}
-          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
-          prerelease: false
-          draft: false
-          generate_release_notes: true
-          name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/stale.yaml

@@ -0,0 +1,24 @@
+name: 'Close stale issues and PRs'
+permissions:
+  issues: write
+  pull-requests: write
+
+on:
+  schedule:
+    - cron: '30 1 * * *'
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v5
+        with:
+          stale-pr-message: 'This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
+          close-pr-message: 'This PR was closed because it has been stalled for 5 days with no activity.'
+          stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
+          close-issue-message: 'This issue was closed because it has been stalled for 30 days with no activity.'
+          days-before-stale: 30
+          days-before-close: 30
+          exempt-issue-labels: 'feature ☘,enhancement ⚙,bug 🐞'
+          exempt-pr-labels: 'need-help,wip'
+          operations-per-run: 100

.github/workflows/tag.yaml

@@ -1,9 +1,9 @@
-name: tag update
+name: tag
 
 on:
   push:
     tags:
-      - "v[0-9]+.[0-9]+.[0-9]+*"
+      - "v*"
 
 permissions:
   contents: write
@@ -20,9 +20,8 @@ jobs:
       - name: Install dependencies and build frontend
         run: npm i && npm run build
         working-directory: frontend
-      - name: Install OS Requirements
-        run: sudo apt update && sudo apt install -y upx build-essential musl-tools
-      - uses: goto-bus-stop/setup-zig@v2
+      - name: Install UPX
+        run: sudo apt-get install -y upx
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
@@ -30,138 +29,3 @@ jobs:
           workdir: backend
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  push_release_to_registry:
-    name: Push release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{ secrets.PAT }}
-      - name: Extract metadata (tags, labels) for Docker and GHCR
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            gtstef/filebrowser
-            ghcr.io/gtsteffaniak/filebrowser
-      - name: Modify tags (strip 'v' and add 'beta'/'stable' if needed)
-        id: modify-json
-        run: |
-          JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq '
-            .tags |= map(
-              sub(":v"; ":")      # Strip the 'v'
-              | select(test(":latest") | not)
-            ) |
-            if any(.tags[]; test("beta")) then
-              .tags += [
-                "gtstef/filebrowser:beta",
-                "ghcr.io/gtsteffaniak/filebrowser:beta",
-                "gtstef/filebrowser:latest",
-                "ghcr.io/gtsteffaniak/filebrowser:latest"
-              ]
-            else . end |
-            if any(.tags[]; test("stable")) then
-              .tags += [
-                "gtstef/filebrowser:stable",
-                "ghcr.io/gtsteffaniak/filebrowser:stable",
-                "gtstef/filebrowser:latest",
-                "ghcr.io/gtsteffaniak/filebrowser:latest"
-              ]
-            else . end
-          ')
-          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
-          echo "$TAGS_CSV" > modified_tags.txt  # Optional debug output
-          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64
-          file: ./_docker/Dockerfile
-          push: true
-          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}
-  push_slim_release_to_registry:
-    name: Push slim release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{ secrets.PAT }}
-      - name: Extract metadata (tags, labels) for Docker and GHCR
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            gtstef/filebrowser
-            ghcr.io/gtsteffaniak/filebrowser
-      - name: Modify tags (strip 'v' and add 'slim' if needed)
-        id: modify-json-slim
-        run: |
-          JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq '
-            .tags |= map(
-              sub(":v"; ":")                 # Strip the 'v'
-              | select(test(":latest") | not) # Remove the "latest" tag
-              | . + "-slim"                   # Append "-slim" to the versioned tag
-            ) |
-            if any(.tags[]; test("beta")) then
-              .tags += [
-                "gtstef/filebrowser:beta-slim",
-                "ghcr.io/gtsteffaniak/filebrowser:beta-slim"
-              ]
-            else . end |
-            if any(.tags[]; test("stable")) then
-              .tags += [
-                "gtstef/filebrowser:stable-slim",
-                "ghcr.io/gtsteffaniak/filebrowser:stable-slim"
-              ]
-            else . end
-          ')
-          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
-          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
-      - name: Build and push slim image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./_docker/Dockerfile.slim
-          push: true
-          tags: ${{ steps.modify-json-slim.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -1,29 +1,16 @@
 *.db
 *.bak
-*.log
-*.mjs
 _old
 rice-box.go
 .idea/
-/backend/backend
-/backend/filebrowser
-/backend/filebrowser.exe
-/backend/backend.exe
-/backend/tmp
-/backend/dist
+/filebrowser
+/filebrowser.exe
 /frontend/dist
 /frontend/pkg
-/frontend/test-results
-/frontend/tests/playwright-files/demo*
-/frontend/loginAuth.json
 /frontend/package-lock.json
 /backend/vendor
 /backend/*.cov
 /backend/test_config.yaml
-/backend/generated.yaml
-/backend/srv
-/backend/http/dist
-/backend/http/embed/*
 
 .DS_Store
 node_modules
@@ -47,5 +34,3 @@ yarn-error.log*
 *.sw*
 bin/
 build/
-*__debug*
-backend/custom.css

CONTRIBUTING.md

@@ -1,208 +0,0 @@
-# Contributing to FileBrowser Quantum
-
-Thank you for your interest in contributing to FileBrowser Quantum! This guide will help you get started with development.
-
-## Prerequisites
-
-- **Go 1.25+** (see `backend/go.mod`)
-- **Node.js 18.0.0+** with npm 7.0.0+ (see `frontend/package.json`)
-- **Docker** (optional, for containerized development)
-- **Git**
-
-### Required Tools
-
-- **ffmpeg**: Required for video thumbnail generation
-  - Ubuntu/Debian: `sudo apt-get install ffmpeg`
-  - macOS: `brew install ffmpeg`
-  - Windows: Download from [ffmpeg.org](https://ffmpeg.org/download.html)
-
-- **mupdf-tools**: Required for PDF preview generation
-  - Ubuntu/Debian: `sudo apt-get install mupdf-tools`
-  - macOS: `brew install mupdf-tools`
-  - Windows: Download from [mupdf.com](https://mupdf.com/downloads/)
-
-## Quick Start
-
-```bash
-# 1. Clone the repository
-git clone https://github.com/gtsteffaniak/filebrowser.git
-cd filebrowser
-
-# 2. Initial setup - installs dependencies and creates test config
-make setup
-
-# 3. Run in development mode with hot-reloading
-make dev
-```
-
-`make setup` installs all dependencies and creates a test configuration file.
-`make run` starts the development server. Note: changes require ctrl+c and re-run.
-
-## Project Architecture
-
-### Backend (Go)
-- **Entry Point**: `backend/main.go` → `backend/cmd/`
-- **HTTP Server**: `backend/http/` - API routes, middleware, auth
-- **Storage**: BoltDB via `backend/database/storage/`
-- **Authentication**: Multiple providers in `backend/auth/`
-- **Indexing**: Real-time search in `backend/indexing/`
-- **Previews**: Image/video/document generation in `backend/preview/`
-
-### Frontend (Vue.js + TypeScript)
-- **Framework**: Vue 3 + Vite + TypeScript
-- **State**: Custom store in `frontend/src/store/`
-- **API Client**: Axios-based in `frontend/src/api/`
-- **i18n**: 25+ languages with English as main
-- **Components**: Feature-based organization
-
-## Development Commands
-
-### Essential Commands
-```bash
-make dev          # Start development server with hot-reloading
-make test         # Run all tests
-make lint         # Check code quality
-make check-all    # Lint + tests
-
-make build-frontend  # Build frontend only
-make build-backend   # Build backend only
-make build          # Build Docker image
-```
-
-### Frontend Development
-
-Note: consider using make commands above instead.
-```bash
-cd frontend
-npm run lint:fix  # Auto-fix linting issues
-npm run i18n:sync # Sync translations changes
-```
-
-## Testing
-
-### Running Tests
-```bash
-make test              # All tests
-make test-backend      # Go tests with race detection
-make test-frontend     # Frontend unit tests
-make test-playwright   # E2E tests in Docker
-```
-
-E2E tests run with three authentication modes: standard auth, no auth, and proxy auth.
-
-### Coverage & Performance
-```bash
-cd backend
-./run_check_coverage.sh  # Coverage report with HTML output
-./run_benchmark.sh       # Benchmarks
-```
-
-**Code Coverage:**
-- View report: Open `backend/coverage.html` after running coverage script
-- CI enforces coverage for critical packages
-- Use `go test -cover` for quick package coverage
-
-## Code Standards
-
-### Backend (Go)
-- **Linting**: `backend/.golangci.yml` with 30+ checks
-- **Format**: Use `gofmt` (automated in CI)
-- **Testing**: Maintain 80%+ coverage
-- **Errors**: Handle all errors explicitly
-
-### Frontend (Vue.js)
-- **Linting**: ESLint with Vue 3 + TypeScript rules
-- **i18n**: English is master locale, all text must use `$t('key')`
-- **Types**: Use TypeScript everywhere
-- **Fix**: Run `npm run lint:fix` before committing
-
-## Build & Deployment
-
-### Single Binary Build
-The project builds into a single binary with embedded frontend:
-
-```bash
-make build-frontend  # Build Vue.js app
-make build-backend   # Build Go binary with embedded assets
-```
-
-### Docker
-```bash
-make build       # Full image with ffmpeg and muPDF
-```
-
-### Configuration
-- **Test Config**: `backend/test_config.yaml` Auto-generated after running `make setup`
-
-## Contributing
-
-### Pull Request Process
-
-1. Fork and create a feature branch
-2. Make your changes following the code standards
-3. Run `make dev` to build and run with your changes. Supports hot-reloading frontend and backend changes.
-4. When ready, run `make check-all` to verify tests and linting
-5. Submit PR with a clear description
-
-### PR Requirements
-- Clear description of changes
-- All tests must pass
-- Follow existing code patterns
-- Update documentation if needed
-
-### Commit Format
-```
-type(scope): description
-
-Types: feat, fix, docs, refactor, test, chore
-```
-
-## Roadmap
-
-Check the [Project Roadmap](https://github.com/users/gtsteffaniak/projects/4/views/2) to see issues sorted by priority. This helps you understand what features are planned and where you can contribute most effectively.
-
-## Troubleshooting
-
-### Common Issues
-
-**Build failures:**
-```bash
-# Frontend
-cd frontend && rm -rf node_modules && npm install
-
-# Backend
-cd backend && go mod tidy && go clean -modcache
-```
-
-**Authentication Issues:**
-
-Always first enable debug logging in your config file if you have issues.
-
-1. **OIDC Login Fails:**
-   - Check redirect URLs match your config
-   - Verify OIDC provider settings
-   - Enable debug logs to see auth flow
-   - Common issue: mismatched callback URLs
-
-2. **Proxy Auth Not Working:**
-   - Verify header names match config
-   - Check nginx/reverse proxy passes headers
-   - Test with: `curl -H "X-Auth: username" localhost:8080`
-   - Enable `--log-level debug` to see headers
-
-3. **TOTP Issues:**
-   - Ensure server time is synchronized
-   - Check QR code generation in logs
-   - Test with authenticator app time settings
-   - Database might have stale TOTP secrets
-
-4. **Session/Cookie Problems:**
-   - Clear browser cookies and localStorage
-   - Verify cookie domain settings
-   - Try incognito/private browsing mode
-
-### Getting Help
-
-- **Wiki**: [Project Wiki](https://github.com/gtsteffaniak/filebrowser/wiki)
-- **Issues**: [GitHub Issues](https://github.com/gtsteffaniak/filebrowser/issues)
-- **PR Template**: See `.github/PULL_REQUEST_TEMPLATE.md`

Dockerfile

@@ -0,0 +1,19 @@
+FROM node:slim as nbuild
+WORKDIR /app
+COPY ./frontend/package*.json ./
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
+RUN npm run build-docker
+
+FROM golang:1.22-alpine as base
+WORKDIR /app
+COPY ./backend ./
+RUN go build -ldflags="-w -s" -o filebrowser .
+
+FROM alpine:latest
+ENV FILEBROWSER_NO_EMBEDED="true"
+ARG app="/app/filebrowser"
+RUN apk --no-cache add ca-certificates mailcap
+COPY --from=base /app/filebrowser* ./
+COPY --from=nbuild /app/dist/ ./frontend/dist/
+ENTRYPOINT [ "./filebrowser" ]

LICENSE

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2018 File Browser contributors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

README.md

@@ -1,165 +1,166 @@
-<div align="center">
-
-  [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
-  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
-  [![latest version](https://img.shields.io/github/release/gtsteffaniak/filebrowser/all.svg)](https://github.com/gtsteffaniak/filebrowser/releases)
-  [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
-  [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
-
-  [![Donate](https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif)](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A#is-there-a-way-to-donate-or-support-this-project)
-
-  <img width="150" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" title="Logo">
-  <h3>FileBrowser Quantum</h3>
-  The best free self-hosted web-based file manager.
-  <br/><br/>
-  <img width="800" src="https://github.com/user-attachments/assets/95af22fa-7760-4f7b-9c20-51fdcfe8f4ea" title="Main Screenshot">
-</div>
+<p align="center">
+  <a href="https://opensource.org/license/apache-2-0/"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License: Apache-2.0"></a>
+</p>
+<p align="center">
+  <img src="frontend/public/img/icons/favicon-256x256.png" width="100" title="Login With Custom URL">
+</p>
+<h3 align="center">Filebrowser - A modern web-based file manager</h3>
+<p align="center">
+  <img width="800" src="https://github.com/user-attachments/assets/8ba93582-aba2-4996-8ac3-25f763a2e596" title="Main Screenshot">
+</p>
 
 > [!WARNING]
-> There is no stable version -- :construction: planned for 2025. ([Read more](https://github.com/gtsteffaniak/filebrowser/discussions/628))
+> Starting with v0.2.0, *ALL* configuration is done via `filebrowser.yaml`
+> Configuration file.
+> Starting with v0.2.4 *ALL* share links need to be re-created (due to
+> security fix).
 
-[FYI: how much RAM does it require?](https://github.com/gtsteffaniak/filebrowser/discussions/787)
+This fork makes the following significant changes to filebrowser for
+origin:
+
+  1. [x] Better search
+     - Lightning fast
+     - real-time results as you type
+     - Works with more type filters
+     - interactive results page.
+  2. [x] Revamped and simplified GUI navbar and sidebar menu.
+     - Additional compact view mode as well as refreshed view mode
+       styles.
+  3. [x] Revamped configuration via `filebrowser.yml` config file.
+     - More configurations possible at a per-user level
 
 ## About
 
-FileBrowser Quantum provides an easy way to access and manage your files from the web. It has has a modern responsive interface that has many advanced features to manage users, access, sharing, and file preview and editing.
+Filebrowser provides a file managing interface within a specified directory
+and can be used to upload, delete, preview, rename, and edit your files.
+It allows the creation of multiple users and each user can have its 
+directory.
 
-This version is called "Quantum" because it packs tons of advanced features into a tiny easy to run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
+This repository is a fork, a collection of changes that make this program
+work better in terms of aesthetics and performance. Improved search,
+simplified ui (without removing features) and more secure and up-to-date
+build are just a few examples.
 
-The goal for this repo is to become the best open-source self-hosted file browsing application that exists -- **all for free**. This repo will always be free and open-source.
+This Implementation of filebrowser differs significantly to the original.
+There are hundreds of thousands of lines changed and they are generally
+no longer compatible with each other. This has been intentional -- the
+focus of this fork is on a few key principles:
+  - Simplicity and improved user experience
+  - Efficiency of operations and performance
+  - Minimize external dependencies and standard library usage.
+  - Of course -- adding much-needed features.
 
-Ready to try it out? See [Getting Started Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Getting-Started).
+## Look
 
-## How its different
+One way you can observe the improved user experience is how I changed
+the UI. The Navbar is simplified to a three-component system :
 
-FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:
-
-  1. ✅ Multiple sources support
-  2. ✅ Login support for OIDC, password + 2FA, and proxy.
-  3. ✅ Beautiful, Responsive, and Customizable user interface.
-  4. ✅ Simplified configuration via `config.yaml` config file.
-  5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
-     - Real-time search results as you type.
-     - Real-time monitoring and updates in the UI.
-     - Search supports file and folder sizes, along with various filters.
-  6. ✅ Better listing browsing
-     - More file type previews, such as **office** and **video** file previews
-     - Instantly switches view modes and sort order without reloading data.
-     - Folder sizes are displayed.
-     - Navigating remembers the last scroll position.
-  7. ✅ Highly configurable and customizable sharing options, incuding:
-     - share expiration time
-     - users who can access share (including anonymous)
-     - styling and themes
-     - file viewing, editing, and uploading permissions
-  8. ✅ Directory-level access control that can be scoped to user or group.
-  8. ✅ Developer API support
-     - Ability to create long-lived API Tokens.
-     - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.
-
-Notable features that this fork *does not* have (removed):
-
- - :construction: jobs are not supported yet.
- - ❌ shell commands are completely removed and will not be returned.
-
-> [!WARNING]
-> Every file and directory in the source gets indexed (by default). This enables powerful features such as instant search, but large source filesystems can increase your system requirements. [See indexing wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) for more info.
-
-FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.
-
-## The UI
-
-The UI has a simple three-component navigation system:
-
-  1. (Left) Multi-action button with slide-out panel.
+  1. (Left) The slide-out action panel button
   2. (Middle) The powerful search bar.
   3. (Right) The view change toggle.
 
-All other functions are moved either into the action menu or pop-up menus.
+All other functions are moved either into the action menu or popup menus.
 If the action does not depend on context, it will exist in the slide-out
 action panel. If the action is available based on context, it will show up as
-a pop-up menu.
+a popup menu.
 
 <p align="center">
-  <img width="1000" src="https://github.com/user-attachments/assets/aa32b05c-f917-47bb-b07f-857edc5e47f7" title="Search GIF">
+  <img width="800" src="https://github.com/gtsteffaniak/filebrowser/assets/42989099/899152cf-3e69-4179-aa82-752af2df3fc6" title="Main Screenshot">
+    <img width="800" src="https://github.com/user-attachments/assets/18c02d03-5c60-4e15-9c32-3cfe058a0c49" title="Main Screenshot">
+      <img width="800" src="https://github.com/user-attachments/assets/75226dc4-9802-46f0-9e3c-e4403d3275da" title="Main Screenshot">
+
 </p>
 
-## Install and Configuration
+## Install
 
-Check out the [Getting Started Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Getting-Started)
+Using docker:
 
-For help configuring your filebrowser see [Configuration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration-And-Examples)
+1. docker run (no persistent db):
 
-## Command Line Usage
+```
+docker run -it -v /path/to/folder:/srv -p 80:80 gtstef/filebrowser
+```
 
-See the [CLI Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/CLI)
+1. docker-compose:
 
-## API Usage
+  - with local storage
 
-See the [API Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/API)
+```
+version: '3.7'
+services:
+  filebrowser:
+    volumes:
+      - '/path/to/folder:/srv' # required (for now not configurable)
+      - './database:/database'  # optional if you want db to persist - configure a path under "database" dir in config file.
+      - './filebrowser.yaml:/filebrowser.yaml' # required
+    ports:
+      - '80:80'
+    image: gtstef/filebrowser
+    restart: always
+```
 
-## Office File Support
+  - with network share
 
-See [Office Support Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Office-Support#adding-open-office-integration-for-docker) on how to enable office file editing and office-related features.
+```
+version: '3.7'
+services:
+  filebrowser:
+    volumes:
+      - 'storage:/srv' # required (for now not configurable)
+      - './database:/database'  # optional if you want db to persist - configure a path under "database" dir in config file.
+      - './filebrowser.yaml:/filebrowser.yaml' # required
+    ports:
+      - '80:80'
+    image: gtstef/filebrowser
+    restart: always
+volumes:
+  storage:
+    driver_opts:
+      type: cifs
+      o: "username=admin,password=password,rw" # enter valid info here
+      device: "//192.168.1.100/share/"         # enter valid hinfo here
 
-## Migration from the original filebrowser
+```
 
-See the [Migration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Migration)
+Not using docker (not recommended), download your binary from releases and run with your custom config file:
 
-## Other Questions
+```
+./filebrowser -c <filebrowser.yml or other /path/to/config.yaml>
+```
 
-For more, see the [Q&A Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A)
+## Configuration
 
-## Comparison Chart
+All configuration is now done via a single configuration file:
+`filebrowser.yaml`, here is an example of minimal [configuration
+file](./backend/filebrowser.yaml).
 
- Application Name | <img width="48" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
---- | --- | --- | --- | --- | --- | --- |
-Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Windows                       | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-Self hostable                 | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Has Stable Release?           | :construction: | ✅ | ✅ | ✅ | ✅ | ✅ |
-S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
-webdav support                | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
-FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Dedicated docs site?          | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
-Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Docker image size             | 180 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
-Min. Memory Requirements      | 256 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
-has standalone binary         | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
-price                         | free | free | free | free tier | free tier | $99+ |
-rich media preview            | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Advanced Search?              | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
-Indexed Search?               | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
-Content-aware search?         | ❌ | ❌ | ❌ | configurable | ✅ | ✅ |
-Custom job support            | :construction: | ✅ | ❌ | ✅ | ❌ | ✅ |
-Multiple users                | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Single sign-on support        | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
-LDAP sign-on support          | :construction: | ❌ | ❌ | ✅ | ❌ | ✅ |
-Long-live API key support     | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-API documentation page        | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Mobile App                    | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ |
-open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
-tags support                  | :construction: | ❌ | ❌ | ✅ | ❌ | ✅ |
-shareable web links?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Event-based notifications     | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Metrics                       | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
-file space quotas             | :construction: | ❌ | ❌ | ❌ | ✅ | ✅ |
-text-based files editor       | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
-Themes                        | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
-Branding support              | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
-activity log                  | :construction: | ❌ | ❌ | ✅ | ✅ | ✅ |
-Comments support              | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
-trash support                 | :construction: | ❌ | ❌ | ✅ | ✅ | ✅ |
-Starred/pinned files          | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
-Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
-Share collections of files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can archive selected files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can browse archive files      | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can convert documents         | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can convert videos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
-Can convert photos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
+View the [Configuration Help Page](./configuration.md) for available
+configuration options and other help.
+
+
+## Migration from filebrowser/filebrowser
+
+If you currently use filebrowser from the filebrowser/filebrowser
+repo but want to try using this. I recommend you start fresh without
+reusing the database, but there are a few things you'll need to do if you
+must migrate:
+
+1. Create a configuration file as mentioned above.
+2. Copy your database file from the original filebrowser to the path of
+   the new one.
+3. Update the configuration file to use the database (under server in
+   filebrowser.yml)
+4. If you are using docker, update the docker-compose file or docker run
+   command to use the config file as described in the install section
+   above.
+5. If you are not using docker, just make sure you run filebrowser -c
+   filebrowser.yml and have a valid filebrowser config.
+
+
+The filebrowser application should run with the same user and rules that
+you have from the original. But keep in mind the differences that are
+mentioned at the top of this readme.
+
+## Roadmap
+
+see [Roadmap Page](./roadmap.md)

_docker/Dockerfile

@@ -1,47 +0,0 @@
-FROM gtstef/ffmpeg:8.0-decode AS ffmpeg
-FROM golang:alpine AS base
-ARG VERSION
-ARG REVISION
-WORKDIR /app
-COPY ./backend ./
-RUN apk update && apk add --no-cache gcc musl-dev upx
-ENV CGO_ENABLED=1
-ENV GOEXPERIMENT=greenteagc
-RUN go build -tags mupdf,musl -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
-  -o filebrowser .
-RUN upx filebrowser
-
-FROM node:lts-slim AS nbuild
-WORKDIR /app
-COPY ./frontend/package.json ./
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
-    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
-    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN npm i --maxsockets 1
-COPY  ./frontend/ ./
-RUN npm run build-docker
-
-FROM alpine:latest
-COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
-ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
-ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
-ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata
-RUN adduser -D -s /bin/true -u 1000 filebrowser
-USER filebrowser
-WORKDIR /home/filebrowser
-# copy config to two locations for compatibility
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "/app/config.yaml", "./" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
-## sanity checks
-RUN [ "filebrowser", "version" ]
-RUN [ "ffmpeg", "-version" ]
-RUN [ "ffprobe", "-version" ]
-USER root
-# exposing default port for auto discovery.
-EXPOSE 80
-ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-base

@@ -1,4 +0,0 @@
-FROM node:22-slim
-WORKDIR /app/frontend
-RUN npm i @playwright/test oauth2-mock-server @types/node
-RUN npx playwright install --with-deps firefox

_docker/Dockerfile.playwright-general

@@ -1,18 +0,0 @@
-FROM gtstef/playwright-base
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/general/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/general/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-RUN ./filebrowser set -u testuser1,testuser1
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-noauth

@@ -1,16 +0,0 @@
-FROM gtstef/playwright-base
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/noauth/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-oidc

@@ -1,13 +0,0 @@
-FROM gtstef/playwright-base
-
-COPY [ "./_docker/src/oidc/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-RUN mkdir -p ./http/dist
-COPY [ "./_docker/src/oidc/backend/", "./"]
-COPY ["./backend/filebrowser", "./"]
-COPY [ "./backend/http/embed/", "./http/dist/"]
-# Run tests
-WORKDIR /app/frontend
-RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-proxy

@@ -1,14 +0,0 @@
-FROM gtstef/playwright-base
-WORKDIR /app
-COPY [ "./_docker/src/proxy/", "./" ]
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-RUN apt update && apt install nginx -y
-RUN mv default.conf /etc/nginx/conf.d/default.conf
-RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
-RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
-RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-sharing

@@ -1,17 +0,0 @@
-FROM gtstef/playwright-base
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/sharing/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/sharing/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.primecache

@@ -1 +0,0 @@
-FROM gtstef/playwright-base

_docker/Dockerfile.slim

@@ -1,40 +0,0 @@
-FROM golang:alpine AS base
-ARG VERSION
-ARG REVISION
-WORKDIR /app
-COPY ./backend ./
-RUN apk update && apk add upx
-ENV GOEXPERIMENT=greenteagc
-RUN go build -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
-  -o filebrowser .
-RUN upx filebrowser
-
-FROM node:lts-slim AS nbuild
-WORKDIR /app
-COPY ./frontend/package.json ./
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
-    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
-    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN npm i --maxsockets 1
-COPY  ./frontend/ ./
-RUN npm run build-docker
-
-FROM alpine:latest
-ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
-ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata
-RUN adduser -D -s /bin/true -u 1000 filebrowser
-USER filebrowser
-WORKDIR /home/filebrowser
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
-## sanity checks
-RUN [ "filebrowser", "version" ]
-USER root
-# exposing default port for auto discovery.
-EXPOSE 80
-ENTRYPOINT [ "./filebrowser" ]

_docker/docker-compose.yaml

@@ -1,17 +0,0 @@
-services:
-  nginx-proxy-auth:
-    image: nginx
-    container_name: nginx-proxy-auth
-    ports:
-      - "80:80"
-    volumes:
-      - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
-      - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
-  filebrowser:
-    hostname: filebrowser
-    volumes:
-      - '../frontend:/home/frontend'
-      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
-    build:
-      context: ../
-      dockerfile: ./_docker/Dockerfile.slim

_docker/src/general/backend/config.yaml

@@ -1,21 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        defaultEnabled: true
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"

_docker/src/general/frontend/playwright.config.ts

@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/global-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/general",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

_docker/src/noauth/backend/config.yaml

@@ -1,26 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/files/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        exclude:
-          folderPaths:
-            - "excluded"
-
-auth:
-  methods:
-    noauth: true
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-userDefaults:
-  permissions:
-   realtime: true

_docker/src/noauth/frontend/playwright.config.ts

@@ -1,48 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/noauth-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/noauth",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    storageState: "noauth.json",
-    actionTimeout: 5000,
-    //storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

_docker/src/oidc/backend/config.yaml

@@ -1,38 +0,0 @@
-server:
-  logging:
-    - levels: "info|error|warning|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        createUserDir: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-
-auth:
-  methods:
-    password:
-      enabled: false
-    oidc:
-      enabled: true
-      createUser: true
-      clientId: "vyBrzOmcrU3OokiWEZoObdGBscw0eYPNJauBtOJr"
-      clientSecret: "gIMKbkEcckUhlGrnE2Vxi8eZhEcfxQqfwFgM0ATzk4DciHGrW2YRtQfqcpRTsmzrxEETkKvZ8yeK3sfoXnUV1IQTzqK7wxw3lEMtmeXi5clj0h7nH1rVGFq2Q3HL8zUe"
-      issuerUrl: "http://localhost:8080"
-      adminGroup: "Admins"
-
-userDefaults:
-  darkMode: true
-  disableSettings: false
-  singleClick: false
-  permissions:
-    admin: false
-    modify: true
-    share: false
-    api: false

_docker/src/oidc/frontend/mock-oidc-server.js

@@ -1,60 +0,0 @@
-
-import { OAuth2Server } from 'oauth2-mock-server';
-
-// This is a list of pre-defined users. You can add more users here.
-// The filebrowser application will use this data when a user logs in.
-const users = {
-  // Default user
-  johndoe: {
-    sub: 'johndoe',
-    preferred_username: 'johndoe',
-    email: 'johndoe@example.com',
-    groups: ['Admins', 'Users'],
-  },
-  // Another example user
-  testuser: {
-    sub: 'testuser',
-    preferred_username: 'testuser',
-    email: 'testuser@example.com',
-    groups: ['Users'],
-  },
-};
-
-const server = new OAuth2Server();
-
-// Generate a new RSA key for the server.
-await server.issuer.keys.generate('RS256');
-
-/**
- * This hook is called before the ID token is signed.
- * We're using it to add claims to the ID token.
- * This is the primary way the application will get user information.
- */
-server.service.on('beforeIdTokenSigning', (token, req) => {
-  // By default, the mock server uses 'johndoe' as the subject.
-  const user = users[token.payload.sub] || users.johndoe;
-  console.log(`[ID Token] Customizing token for user: ${user.sub}`);
-  Object.assign(token.payload, user);
-});
-
-
-/**
- * This hook is called before the userinfo response is sent.
- * We're using it to provide user claims when the application calls the /userinfo endpoint.
- */
-server.service.on('beforeUserinfo', (userInfoResponse, req) => {
-    const user = users.johndoe;
-    console.log(`[UserInfo] Customizing userinfo for user: ${user.sub}`);
-    userInfoResponse.body = user;
-});
-
-
-const port = 8080;
-const host = '0.0.0.0'; // Bind to 0.0.0.0 to be accessible within Docker
-await server.start(port, host);
-console.log(`OAuth 2 Mock Server listening on http://${host}:${port}`);
-console.log(`Issuer URL: ${server.issuer.url}`);
-console.log('---');
-console.log('Pre-defined users:');
-console.log(JSON.stringify(users, null, 2));
-console.log('---');

_docker/src/oidc/frontend/playwright.config.ts

@@ -1,48 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/oidc-setup",
-  timeout: 5000,
-  testDir: "./tests/playwright/oidc",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    storageState: "loginAuth.json",
-    actionTimeout: 5000,
-    //storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

_docker/src/proxy/backend/.htpasswd

@@ -1 +0,0 @@
-demo-127.0.0.1:$apr1$j5FRA4Bc$RYdNFuM7YAAo9Qtie8w4b/

_docker/src/proxy/backend/config.yaml

@@ -1,36 +0,0 @@
-server:
-  port: 8080
-  baseURL:  "/subpath"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        createUserDir: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-
-auth:
-  methods:
-    proxy:
-      enabled: true
-      header: "X-Username"
-      createUser: true
-      logoutRedirectUrl: "https://localhost/api/auth/logout2"
-
-userDefaults:
-  darkMode: true
-  disableSettings: false
-  singleClick: false
-  permissions:
-    admin: false
-    modify: true
-    share: true
-    api: false

_docker/src/proxy/backend/default.conf

@@ -1,31 +0,0 @@
-
-map $remote_addr $uuid {
-    default "demo-${remote_addr}";
-}
-
-server {
-    listen 80;
-    server_name localhost 127.0.0.1;
-
-    location /subpath/public/ {
-        proxy_pass http://filebrowser:8080/subpath/public/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    } 
-
-    # requires basic auth demo-127.0.0.1:SecurePass123!
-    location /subpath {
-        auth_basic "Restricted Access";
-        auth_basic_user_file /etc/nginx/conf.d/.htpasswd;
-        proxy_set_header X-Username $uuid;
-        add_header X-Username $uuid;
-        proxy_pass http://filebrowser:8080/subpath;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-}

_docker/src/proxy/frontend/playwright.config.ts

@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/proxy-setup.ts",
-  timeout: 5000,
-  testDir: "./tests/playwright/proxy",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

_docker/src/sharing/backend/config.yaml

@@ -1,22 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        private: true
-        defaultEnabled: true
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"

_docker/src/sharing/frontend/playwright.config.ts

@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/global-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/sharing",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

backend/.air.toml

@@ -1,17 +0,0 @@
-root = "."
-tmp_dir = "tmp"
-
-[build]
-  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/version.CommitSHA=testingCommit' -X 'github.com/gtsteffaniak/filebrowser/backend/version.Version=testing'\" ."
-  bin = "tmp/filebrowser"
-  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser -c test_config.yaml"
-  include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "http/dist", "http/embed", "swagger/docs"]
-  log = "air.log"
-  delay = 1000 # ms
-
-[log]
-  time = true
-
-[misc]
-  clean_on_exit = true

backend/.gitignore

@@ -1,5 +0,0 @@
-tmp/
-air.log
-filebrowser
-generated.yaml
-test_config.yaml

backend/.golangci.yml

@@ -1,146 +0,0 @@
-version: "2"
-linters:
-  settings:
-    staticcheck:
-      checks:
-        - all
-        - '-QF1001'
-        - '-ST1003'
-        - '-ST1016'
-        - '-QF1004'
-        - '-QF1003'
-    cyclop:
-      max-complexity: 30
-      package-average: 10
-    errcheck:
-      check-type-assertions: true
-    exhaustive:
-      check:
-        - switch
-        - map
-    exhaustruct:
-      exclude:
-        - ^net/http.Client$
-        - ^net/http.Cookie$
-        - ^net/http.Request$
-        - ^net/http.Response$
-        - ^net/http.Server$
-        - ^net/http.Transport$
-        - ^net/url.URL$
-        - ^os/exec.Cmd$
-        - ^reflect.StructField$
-        - ^github.com/Shopify/sarama.Config$
-        - ^github.com/Shopify/sarama.ProducerMessage$
-        - ^github.com/mitchellh/mapstructure.DecoderConfig$
-        - ^github.com/prometheus/client_golang/.+Opts$
-        - ^github.com/spf13/cobra.Command$
-        - ^github.com/spf13/cobra.CompletionOptions$
-        - ^github.com/stretchr/testify/mock.Mock$
-        - ^github.com/testcontainers/testcontainers-go.+Request$
-        - ^github.com/testcontainers/testcontainers-go.FromDockerfile$
-        - ^golang.org/x/tools/go/analysis.Analyzer$
-        - ^google.golang.org/protobuf/.+Options$
-        - ^gopkg.in/yaml.v3.Node$
-    funlen:
-      lines: 100
-      statements: 50
-      ignore-comments: true
-    gocognit:
-      min-complexity: 20
-    gocritic:
-      settings:
-        captLocal:
-          paramsOnly: false
-        underef:
-          skipRecvDeref: false
-    gomodguard:
-      blocked:
-        modules:
-          - github.com/golang/protobuf:
-              recommendations:
-                - google.golang.org/protobuf
-              reason: see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules
-          - github.com/satori/go.uuid:
-              recommendations:
-                - github.com/google/uuid
-              reason: satori's package is not maintained
-          - github.com/gofrs/uuid:
-              recommendations:
-                - github.com/gofrs/uuid/v5
-              reason: gofrs' package was not go module before v5
-    govet:
-      disable:
-        - fieldalignment
-      enable-all: true
-      settings:
-        shadow:
-          strict: false
-    inamedparam:
-      skip-single-param: true
-    mnd:
-      ignored-functions:
-        - args.Error
-        - flag.Arg
-        - flag.Duration.*
-        - flag.Float.*
-        - flag.Int.*
-        - flag.Uint.*
-        - os.Chmod
-        - os.Mkdir.*
-        - os.OpenFile
-        - os.WriteFile
-        - prometheus.ExponentialBuckets.*
-        - prometheus.LinearBuckets
-    nakedret:
-      max-func-lines: 0
-    nolintlint:
-      require-explanation: true
-      require-specific: true
-      allow-no-explanation:
-        - funlen
-        - gocognit
-        - lll
-    perfsprint:
-      strconcat: false
-    rowserrcheck:
-      packages:
-        - github.com/jmoiron/sqlx
-    sloglint:
-      no-global: all
-      context: scope
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    rules:
-      - linters:
-          - godot
-        source: (noinspection|TODO)
-      - linters:
-          - gocritic
-        source: //noinspection
-      - linters:
-          - bodyclose
-          - dupl
-          - funlen
-          - goconst
-          - gosec
-          - noctx
-          - wrapcheck
-        path: _test\.go
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
-issues:
-  max-same-issues: 50
-formatters:
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$

backend/.goreleaser.yaml

@@ -3,108 +3,42 @@ project_name: filebrowser
 version: 2
 
 builds:
-  # Build configuration for linux amd64
-  - id: linux-amd64
-    env:
-      - CGO_ENABLED=1
-      - CC=zig cc -target x86_64-linux-musl
-    tags:
-      - mupdf
-      - musl
-    ldflags: &ldflags
-      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/common/version.Version=v{{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA={{ .ShortCommit }}
+  # Build configuration for darwin and linux
+  - id: default
+    ldflags:
+      - -s -w
     main: main.go
     binary: filebrowser
     goos:
+      - darwin
       - linux
     goarch:
       - amd64
-    hooks:
-      post:
-        - upx {{ .Path }}
-
-  # Build configuration for linux arm64
-  - id: linux-arm64
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    env:
-      - CGO_ENABLED=1
-      - CC=zig cc -target aarch64-linux-musl
-    tags:
-      - mupdf
-      - musl
-    goos:
-      - linux
-    goarch:
-      - arm64
-    hooks:
-      post:
-        - upx {{ .Path }}
-
-  # Build configuration for linux
-  - id: linux-arm32
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    goos:
-      - linux
-    goarch:
       - arm
+      - arm64
     goarm:
-      - "6"
-      - "7"
+      - 6
+      - 7
     hooks:
-      post:
+      post: 
         - upx {{ .Path }}  # Compress the binary with UPX
 
   # Build configuration for windows without arm
   - id: windows
-    env:
-      - CGO_ENABLED=1
-      - CC=zig cc -target x86_64-windows
-    tags:
-      - mupdf
-    ldflags: *ldflags
+    ldflags:
+      - -s -w
     main: main.go
     binary: filebrowser
     goos:
       - windows
     goarch:
       - amd64
-    hooks:
-      post:
-        - upx {{ .Path }}  # Compress the binary with UPX
-
-  # Build configuration for freebsd without arm & upx
-  - id: freeBSD and freebsd-arm
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    goos:
-      - freebsd
-    goarch:
-      - amd64
-
-  # Build configuration for macos without upx
-  - id: macos
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    goos:
-      - darwin
-    goarch:
       - arm64
-      - amd64
 
 archives:
-  - name_template: >
-      {{- if eq .Os "windows" -}}
-      {{.ProjectName}}
-      {{- else -}}
-      {{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{.ProjectName}}
-      {{- end -}}
+  - name_template: "{{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{ .ProjectName }}"
     format: binary
 
 checksum:
   disable: true
+

backend/adapters/fs/files/file_test.go

@@ -1,179 +0,0 @@
-package files
-
-import (
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
-)
-
-func Test_GetRealPath(t *testing.T) {
-	cwd, err := os.Getwd()
-	if err != nil {
-		return
-	}
-	trimPrefix := filepath.Dir(filepath.Dir(cwd))
-	tests := []struct {
-		name  string
-		paths []string
-		want  struct {
-			path  string
-			isDir bool
-		}
-	}{
-		{
-			name: "current directory",
-			paths: []string{
-				"./",
-			},
-			want: struct {
-				path  string
-				isDir bool
-			}{
-				path:  "",
-				isDir: true,
-			},
-		},
-		{
-			name: "current directory",
-			paths: []string{
-				"./files/file.go",
-			},
-			want: struct {
-				path  string
-				isDir bool
-			}{
-				path:  "/files/file.go",
-				isDir: false,
-			},
-		},
-		{
-			name: "other test case",
-			paths: []string{
-				"/mnt/doesnt/exist",
-			},
-			want: struct {
-				path  string
-				isDir bool
-			}{
-				path:  "/mnt/doesnt/exist",
-				isDir: false,
-			},
-		},
-	}
-	idx := indexing.Index{
-		Source: settings.Source{
-			Path: trimPrefix,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			realPath, isDir, _ := idx.GetRealPath(tt.paths...)
-			adjustedRealPath := strings.TrimPrefix(realPath, trimPrefix)
-			if tt.want.path != adjustedRealPath || tt.want.isDir != isDir {
-				t.Errorf("expected %v:%v but got: %v:%v", tt.want.path, tt.want.isDir, adjustedRealPath, isDir)
-			}
-		})
-	}
-}
-
-func TestSortItems(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    iteminfo.FileInfo
-		expected iteminfo.FileInfo
-	}{
-		{
-			name: "Numeric and Lexicographical Sorting",
-			input: iteminfo.FileInfo{
-				Folders: []iteminfo.ItemInfo{
-					{Name: "10.txt"},
-					{Name: "2.txt"},
-					{Name: "apple"},
-					{Name: "Banana"},
-				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "File2.txt"},
-					{Name: "File10.txt"},
-					{Name: "File1"},
-					{Name: "banana"},
-				},
-			},
-			expected: iteminfo.FileInfo{
-				Folders: []iteminfo.ItemInfo{
-					{Name: "2.txt"},
-					{Name: "10.txt"},
-					{Name: "apple"},
-					{Name: "Banana"},
-				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "banana"},
-					{Name: "File1"},
-					{Name: "File10.txt"},
-					{Name: "File2.txt"},
-				},
-			},
-		},
-		{
-			name: "Only Lexicographical Sorting",
-			input: iteminfo.FileInfo{
-				Folders: []iteminfo.ItemInfo{
-					{Name: "dog.txt"},
-					{Name: "Cat.txt"},
-					{Name: "apple"},
-				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "Zebra"},
-					{Name: "apple"},
-					{Name: "cat"},
-				},
-			},
-			expected: iteminfo.FileInfo{
-				Folders: []iteminfo.ItemInfo{
-					{Name: "apple"},
-					{Name: "Cat.txt"},
-					{Name: "dog.txt"},
-				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "apple"},
-					{Name: "cat"},
-					{Name: "Zebra"},
-				},
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			test.input.SortItems()
-
-			getNames := func(items []iteminfo.ItemInfo) []string {
-				names := []string{}
-				for _, folder := range items {
-					names = append(names, folder.Name)
-				}
-				return names
-			}
-
-			actualFolderNames := getNames(test.input.Folders)
-			expectedFolderNames := getNames(test.expected.Folders)
-
-			if !reflect.DeepEqual(actualFolderNames, expectedFolderNames) {
-				t.Errorf("Folders not sorted correctly.\nGot: %v\nExpected: %v", actualFolderNames, expectedFolderNames)
-			}
-
-			actualFileNames := getNames(test.input.Files)
-			expectedFileNames := getNames(test.expected.Files)
-
-			if !reflect.DeepEqual(actualFileNames, expectedFileNames) {
-				t.Errorf("Files not sorted correctly.\nGot: %v\nExpected: %v", actualFileNames, expectedFileNames)
-			}
-		})
-	}
-}

backend/adapters/fs/files/files.go

@@ -1,453 +0,0 @@
-package files
-
-import (
-	"crypto/md5"
-	"crypto/sha1"
-	"crypto/sha256"
-	"crypto/sha512"
-	"encoding/hex"
-	"fmt"
-	"hash"
-	"io"
-	"unicode"
-	"unicode/utf8"
-
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/share"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-func FileInfoFaster(opts iteminfo.FileOptions) (*iteminfo.ExtendedFileInfo, error) {
-	response := &iteminfo.ExtendedFileInfo{}
-	index := indexing.GetIndex(opts.Source)
-	if index == nil {
-		return response, fmt.Errorf("could not get index: %v ", opts.Source)
-	}
-
-	realPath, isDir, err := index.GetRealPath(opts.Path)
-	if err != nil {
-		return response, fmt.Errorf("could not get real path for requested path: %v", opts.Path)
-	}
-	opts.IsDir = isDir
-	var info *iteminfo.FileInfo
-	var exists bool
-	err = index.RefreshFileInfo(opts)
-	if err != nil {
-		if err == errors.ErrNotIndexed && index.Config.DisableIndexing {
-			info, err = index.GetFsDirInfo(opts.Path)
-			if err != nil {
-				return response, err
-			}
-		} else if err == errors.ErrNotIndexed {
-			return response, fmt.Errorf("could not refresh file info: %v", err)
-		}
-	} else {
-		info, exists = index.GetReducedMetadata(opts.Path, opts.IsDir)
-		if !exists {
-			return response, fmt.Errorf("could not get metadata for path: %v", opts.Path)
-		}
-	}
-	response.FileInfo = *info
-	response.RealPath = realPath
-	response.Source = opts.Source
-
-	if opts.Access != nil && !opts.Access.Permitted(index.Path, opts.Path, opts.Username) {
-		// check if any subpath is permitted
-		// keep track of permitted paths and only show them at the end
-		subFolders := info.Folders
-		subFiles := info.Files
-		response.Folders = make([]iteminfo.ItemInfo, 0)
-		response.Files = make([]iteminfo.ItemInfo, 0)
-		hasPermittedPaths := false
-		for _, subFolder := range subFolders {
-			indexPath := info.Path + subFolder.Name
-			if opts.Access.Permitted(index.Path, indexPath, opts.Username) {
-				hasPermittedPaths = true
-				response.Folders = append(response.Folders, subFolder)
-			}
-		}
-		for _, subFile := range subFiles {
-			indexPath := info.Path + subFile.Name
-			if opts.Access.Permitted(index.Path, indexPath, opts.Username) {
-				hasPermittedPaths = true
-				response.Files = append(response.Files, subFile)
-			}
-		}
-		if !hasPermittedPaths {
-			return response, errors.ErrPermissionDenied
-		}
-	}
-	if opts.Content {
-		processContent(response, index)
-	}
-	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
-		response.OnlyOfficeId = generateOfficeId(realPath)
-	}
-
-	return response, nil
-}
-
-func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index) {
-	isVideo := strings.HasPrefix(info.Type, "video")
-	if isVideo {
-		parentInfo, exists := idx.GetReducedMetadata(filepath.Dir(info.Path), true)
-		if exists {
-			info.DetectSubtitles(parentInfo)
-			err := info.LoadSubtitleContent()
-			if err != nil {
-				logger.Debug("failed to load subtitle content: " + err.Error())
-			}
-		}
-		return
-	}
-	if info.Size < 20*1024*1024 { // 20 megabytes in bytes
-		content, err := getContent(info.RealPath)
-		if err != nil {
-			logger.Debugf("could not get content for file: "+info.RealPath, info.Name, err)
-			return
-		}
-		info.Content = content
-	} else {
-		logger.Debug("skipping large text file contents (20MB limit): "+info.Path, info.Name)
-	}
-}
-
-func generateOfficeId(realPath string) string {
-	key, ok := utils.OnlyOfficeCache.Get(realPath).(string)
-	if !ok {
-		timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)
-		documentKey := utils.HashSHA256(realPath + timestamp)
-		utils.OnlyOfficeCache.Set(realPath, documentKey)
-		return documentKey
-	}
-	return key
-}
-
-// Checksum checksums a given File for a given User, using a specific
-// algorithm. The checksums data is saved on File object.
-func GetChecksum(fullPath, algo string) (map[string]string, error) {
-	subs := map[string]string{}
-	reader, err := os.Open(fullPath)
-	if err != nil {
-		return subs, err
-	}
-	defer reader.Close()
-
-	hashFuncs := map[string]hash.Hash{
-		"md5":    md5.New(),
-		"sha1":   sha1.New(),
-		"sha256": sha256.New(),
-		"sha512": sha512.New(),
-	}
-
-	h, ok := hashFuncs[algo]
-	if !ok {
-		return subs, errors.ErrInvalidOption
-	}
-
-	_, err = io.Copy(h, reader)
-	if err != nil {
-		return subs, err
-	}
-	subs[algo] = hex.EncodeToString(h.Sum(nil))
-	return subs, nil
-}
-
-func DeleteFiles(source, absPath string, absDirPath string) error {
-	err := os.RemoveAll(absPath)
-	if err != nil {
-		return err
-	}
-	index := indexing.GetIndex(source)
-	if index == nil {
-		return fmt.Errorf("could not get index: %v ", source)
-	}
-	if index.Config.DisableIndexing {
-		return nil
-	}
-	refreshConfig := iteminfo.FileOptions{Path: index.MakeIndexPath(absDirPath), IsDir: true}
-	err = index.RefreshFileInfo(refreshConfig)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func RefreshIndex(source string, path string, isDir bool) error {
-	idx := indexing.GetIndex(source)
-	if idx == nil {
-		return fmt.Errorf("could not get index: %v ", source)
-	}
-	if idx.Config.DisableIndexing {
-		return nil
-	}
-	path = idx.MakeIndexPath(path)
-	return idx.RefreshFileInfo(iteminfo.FileOptions{Path: path, IsDir: isDir})
-}
-
-// validateMoveDestination checks if a move/rename operation is valid
-// It prevents moving a directory into itself or its subdirectories
-func validateMoveDestination(src, dst string, isSrcDir bool) error {
-	// Clean and normalize paths
-	src = filepath.Clean(src)
-	dst = filepath.Clean(dst)
-
-	// If source is a directory, check if destination is within source
-	if isSrcDir {
-		// Get the parent directory of the destination
-		dstParent := filepath.Dir(dst)
-
-		// Check if destination parent is the source directory or a subdirectory of it
-		if strings.HasPrefix(dstParent+string(filepath.Separator), src+string(filepath.Separator)) || dstParent == src {
-			return fmt.Errorf("cannot move directory '%s' to a location within itself: '%s'", src, dst)
-		}
-	}
-
-	// Check if destination parent directory exists
-	dstParent := filepath.Dir(dst)
-	if dstParent != "." && dstParent != "/" {
-		if _, err := os.Stat(dstParent); os.IsNotExist(err) {
-			return fmt.Errorf("destination directory does not exist: '%s'", dstParent)
-		}
-	}
-
-	return nil
-}
-
-func MoveResource(isSrcDir, isDestDir bool, sourceIndex, destIndex, realsrc, realdst string, s *share.Storage) error {
-	// Validate the move operation before executing
-	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
-		return err
-	}
-
-	err := fileutils.MoveFile(realsrc, realdst)
-	if err != nil {
-		return err
-	}
-	go RefreshIndex(sourceIndex, realsrc, isSrcDir) //nolint:errcheck
-	go RefreshIndex(destIndex, realdst, isDestDir)  //nolint:errcheck
-
-	// update shares
-	idx := indexing.GetIndex(sourceIndex)
-	if idx == nil {
-		return fmt.Errorf("could not get index: %v ", sourceIndex)
-	}
-	idx2 := indexing.GetIndex(destIndex)
-	if idx2 == nil {
-		return fmt.Errorf("could not get index: %v ", destIndex)
-	}
-
-	// Use backend source paths to match how shares are stored
-	go s.UpdateShares(idx.Path, idx.MakeIndexPath(realsrc), idx2.Path, idx2.MakeIndexPath(realdst)) //nolint:errcheck
-	return nil
-}
-
-func CopyResource(isSrcDir, isDestDir bool, sourceIndex, destIndex, realsrc, realdst string) error {
-	// Validate the copy operation before executing
-	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
-		return err
-	}
-
-	err := fileutils.CopyFile(realsrc, realdst)
-	if err != nil {
-		return err
-	}
-	go RefreshIndex(sourceIndex, realsrc, isSrcDir) //nolint:errcheck
-	go RefreshIndex(destIndex, realdst, isDestDir)  //nolint:errcheck
-	// update shares
-	return nil
-}
-
-func WriteDirectory(opts iteminfo.FileOptions) error {
-	idx := indexing.GetIndex(opts.Source)
-	if idx == nil {
-		return fmt.Errorf("could not get index: %v ", opts.Source)
-	}
-	realPath, _, _ := idx.GetRealPath(opts.Path)
-	// Ensure the parent directories exist
-	err := os.MkdirAll(realPath, fileutils.PermDir)
-	if err != nil {
-		return err
-	}
-	return RefreshIndex(idx.Name, opts.Path, true)
-}
-
-func WriteFile(opts iteminfo.FileOptions, in io.Reader) error {
-	idx := indexing.GetIndex(opts.Source)
-	if idx == nil {
-		return fmt.Errorf("could not get index: %v ", opts.Source)
-	}
-	dst, _, _ := idx.GetRealPath(opts.Path)
-	// Ensure the parent directories exist
-	err := os.MkdirAll(filepath.Dir(dst), fileutils.PermDir)
-	if err != nil {
-		return err
-	}
-	// Open the file for writing (create if it doesn't exist, truncate if it does)
-	file, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileutils.PermFile)
-	if err != nil {
-		return err
-	}
-	defer file.Close()
-
-	// Copy the contents from the reader to the file
-	_, err = io.Copy(file, in)
-	if err != nil {
-		return err
-	}
-	return RefreshIndex(opts.Source, opts.Path, false)
-}
-
-// getContent reads and returns the file content if it's considered an editable text file.
-func getContent(realPath string) (string, error) {
-	const headerSize = 4096
-	// Thresholds for detecting binary-like content (these can be tuned)
-	const maxNullBytesInHeaderAbs = 10    // Max absolute null bytes in header
-	const maxNullByteRatioInHeader = 0.1  // Max 10% null bytes in header
-	const maxNullByteRatioInFile = 0.05   // Max 5% null bytes in the entire file
-	const maxNonPrintableRuneRatio = 0.05 // Max 5% non-printable runes in the entire file
-
-	// Open file
-	f, err := os.Open(realPath)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-
-	// Read header
-	headerBytes := make([]byte, headerSize)
-	n, err := f.Read(headerBytes)
-	if err != nil && err != io.EOF {
-		return "", err
-	}
-	actualHeader := headerBytes[:n]
-
-	// --- Start of new heuristic checks ---
-
-	if n > 0 {
-		// 1. Basic Check: Is the header valid UTF-8?
-		// If not, it's unlikely an editable UTF-8 text file.
-		if !utf8.Valid(actualHeader) {
-			return "", nil // Not an error, just not the text file we want
-		}
-
-		// 2. Check for excessive null bytes in the header
-		nullCountInHeader := 0
-		for _, b := range actualHeader {
-			if b == 0x00 {
-				nullCountInHeader++
-			}
-		}
-		// Reject if too many nulls absolutely or relatively in the header
-		if nullCountInHeader > 0 { // Only perform check if there are any nulls
-			if nullCountInHeader > maxNullBytesInHeaderAbs ||
-				(float64(nullCountInHeader)/float64(n) > maxNullByteRatioInHeader) {
-				return "", nil // Too many nulls in header
-			}
-		}
-
-		// 3. Check for other non-text ASCII control characters in the header
-		// (C0 controls excluding \t, \n, \r)
-		for _, b := range actualHeader {
-			if b < 0x20 && b != '\t' && b != '\n' && b != '\r' {
-				return "", nil // Found problematic control character
-			}
-			// C1 control characters (0x80-0x9F) would be caught by utf8.Valid if part of invalid sequences,
-			// or by the non-printable rune check later if they form valid (but undesirable) codepoints.
-		}
-
-		// Optional: Use http.DetectContentType for an additional check on the header
-		// contentType := http.DetectContentType(actualHeader)
-		// if !strings.HasPrefix(contentType, "text/") && contentType != "application/octet-stream" {
-		//     // If it's clearly a non-text MIME type (e.g., "image/jpeg"), reject it.
-		//     // "application/octet-stream" is ambiguous, so we rely on other heuristics.
-		//     return "", nil
-		// }
-	}
-	// --- End of new heuristic checks for header ---
-
-	// Now read the full file (original logic)
-	content, err := os.ReadFile(realPath)
-	if err != nil {
-		return "", err
-	}
-	// Handle empty file (original logic - returns specific string)
-	if len(content) == 0 {
-		return "empty-file-x6OlSil", nil
-	}
-
-	stringContent := string(content)
-
-	// 4. Final UTF-8 validation for the entire file
-	// (This is crucial as the header might be fine, but the rest of the file isn't)
-	if !utf8.ValidString(stringContent) {
-		return "", nil
-	}
-
-	// 5. Check for excessive null bytes in the entire file content
-	if len(content) > 0 { // Check only for non-empty files
-		totalNullCount := 0
-		for _, b := range content {
-			if b == 0x00 {
-				totalNullCount++
-			}
-		}
-		if float64(totalNullCount)/float64(len(content)) > maxNullByteRatioInFile {
-			return "", nil // Too many nulls in the entire file
-		}
-	}
-
-	// 6. Check for excessive non-printable runes in the entire file content
-	// (Excluding tab, newline, carriage return, which are common in text files)
-	if len(stringContent) > 0 { // Check only for non-empty strings
-		nonPrintableRuneCount := 0
-		totalRuneCount := 0
-		for _, r := range stringContent {
-			totalRuneCount++
-			// unicode.IsPrint includes letters, numbers, punctuation, symbols, and spaces.
-			// It excludes control characters. We explicitly allow \t, \n, \r.
-			if !unicode.IsPrint(r) && r != '\t' && r != '\n' && r != '\r' {
-				nonPrintableRuneCount++
-			}
-		}
-
-		if totalRuneCount > 0 { // Avoid division by zero
-			if float64(nonPrintableRuneCount)/float64(totalRuneCount) > maxNonPrintableRuneRatio {
-				return "", nil // Too many non-printable runes
-			}
-		}
-	}
-
-	// The file has passed all checks and is considered editable text.
-	return stringContent, nil
-}
-
-func IsNamedPipe(mode os.FileMode) bool {
-	return mode&os.ModeNamedPipe != 0
-}
-
-func IsSymlink(mode os.FileMode) bool {
-	return mode&os.ModeSymlink != 0
-}
-
-func Exists(path string) bool {
-	_, err := os.Stat(path)
-	if err == nil {
-		return true
-	}
-	if os.IsNotExist(err) {
-		return false
-	}
-	return false
-}

backend/adapters/fs/files/mime.go

@@ -1,612 +0,0 @@
-package files
-
-// This file contains code primarily sourced from::
-// github.com/kataras/iris
-
-import (
-	"mime"
-)
-
-const (
-	// ContentBinaryHeaderValue header value for binary data.
-	ContentBinaryHeaderValue = "application/octet-stream"
-	// ContentWebassemblyHeaderValue header value for web assembly files.
-	ContentWebassemblyHeaderValue = "application/wasm"
-	// ContentHTMLHeaderValue is the  string of text/html response header's content type value.
-	ContentHTMLHeaderValue = "text/html"
-	// ContentJSONHeaderValue header value for JSON data.
-	ContentJSONHeaderValue = "application/json"
-	// ContentJSONProblemHeaderValue header value for JSON API problem error.
-	// Read more at: https://tools.ietf.org/html/rfc7807
-	ContentJSONProblemHeaderValue = "application/problem+json"
-	// ContentXMLProblemHeaderValue header value for XML API problem error.
-	// Read more at: https://tools.ietf.org/html/rfc7807
-	ContentXMLProblemHeaderValue = "application/problem+xml"
-	// ContentJavascriptHeaderValue header value for JSONP & Javascript data.
-	ContentJavascriptHeaderValue = "text/javascript"
-	// ContentTextHeaderValue header value for Text data.
-	ContentTextHeaderValue = "text/plain"
-	// ContentXMLHeaderValue header value for XML data.
-	ContentXMLHeaderValue = "text/xml"
-	// ContentXMLUnreadableHeaderValue obsolete header value for XML.
-	ContentXMLUnreadableHeaderValue = "application/xml"
-	// ContentMarkdownHeaderValue custom key/content type, the real is the text/html.
-	ContentMarkdownHeaderValue = "text/markdown"
-	// ContentYAMLHeaderValue header value for YAML data.
-	ContentYAMLHeaderValue = "application/x-yaml"
-	// ContentYAMLTextHeaderValue header value for YAML plain text.
-	ContentYAMLTextHeaderValue = "text/yaml"
-	// ContentProtobufHeaderValue header value for Protobuf messages data.
-	ContentProtobufHeaderValue = "application/x-protobuf"
-	// ContentMsgPackHeaderValue header value for MsgPack data.
-	ContentMsgPackHeaderValue = "application/msgpack"
-	// ContentMsgPack2HeaderValue alternative header value for MsgPack data.
-	ContentMsgPack2HeaderValue = "application/x-msgpack"
-	// ContentFormHeaderValue header value for post form data.
-	ContentFormHeaderValue = "application/x-www-form-urlencoded"
-	// ContentFormMultipartHeaderValue header value for post multipart form data.
-	ContentFormMultipartHeaderValue = "multipart/form-data"
-	// ContentMultipartRelatedHeaderValue header value for multipart related data.
-	ContentMultipartRelatedHeaderValue = "multipart/related"
-	// ContentGRPCHeaderValue Content-Type header value for gRPC.
-	ContentGRPCHeaderValue = "application/grpc"
-)
-
-var types = map[string]string{
-	".3dm":       "x-world/x-3dmf",
-	".3dmf":      "x-world/x-3dmf",
-	".7z":        "application/x-7z-compressed",
-	".a":         "application/octet-stream",
-	".aab":       "application/x-authorware-bin",
-	".aam":       "application/x-authorware-map",
-	".aas":       "application/x-authorware-seg",
-	".abc":       "text/vndabc",
-	".ace":       "application/x-ace-compressed",
-	".acgi":      "text/html",
-	".afl":       "video/animaflex",
-	".ai":        "application/postscript",
-	".aif":       "audio/aiff",
-	".aifc":      "audio/aiff",
-	".aiff":      "audio/aiff",
-	".aim":       "application/x-aim",
-	".aip":       "text/x-audiosoft-intra",
-	".alz":       "application/x-alz-compressed",
-	".ani":       "application/x-navi-animation",
-	".aos":       "application/x-nokia-9000-communicator-add-on-software",
-	".aps":       "application/mime",
-	".apk":       "application/vnd.android.package-archive",
-	".arc":       "application/x-arc-compressed",
-	".arj":       "application/arj",
-	".art":       "image/x-jg",
-	".asf":       "video/x-ms-asf",
-	".asm":       "text/x-asm",
-	".asp":       "text/asp",
-	".asx":       "application/x-mplayer2",
-	".au":        "audio/basic",
-	".avi":       "video/x-msvideo",
-	".avs":       "video/avs-video",
-	".bcpio":     "application/x-bcpio",
-	".bin":       "application/mac-binary",
-	".bmp":       "image/bmp",
-	".boo":       "application/book",
-	".book":      "application/book",
-	".boz":       "application/x-bzip2",
-	".bsh":       "application/x-bsh",
-	".bz2":       "application/x-bzip2",
-	".bz":        "application/x-bzip",
-	".c++":       ContentTextHeaderValue,
-	".c":         "text/x-c",
-	".cab":       "application/vnd.ms-cab-compressed",
-	".cat":       "application/vndms-pkiseccat",
-	".cc":        "text/x-c",
-	".ccad":      "application/clariscad",
-	".cco":       "application/x-cocoa",
-	".cdf":       "application/cdf",
-	".cer":       "application/pkix-cert",
-	".cha":       "application/x-chat",
-	".chat":      "application/x-chat",
-	".chrt":      "application/vnd.kde.kchart",
-	".class":     "application/java",
-	".com":       ContentTextHeaderValue,
-	".conf":      ContentTextHeaderValue,
-	".cpio":      "application/x-cpio",
-	".cpp":       "text/x-c",
-	".cpt":       "application/mac-compactpro",
-	".crl":       "application/pkcs-crl",
-	".crt":       "application/pkix-cert",
-	".crx":       "application/x-chrome-extension",
-	".csh":       "text/x-scriptcsh",
-	".css":       "text/css",
-	".csv":       "text/csv",
-	".cxx":       ContentTextHeaderValue,
-	".dar":       "application/x-dar",
-	".dcr":       "application/x-director",
-	".deb":       "application/x-debian-package",
-	".deepv":     "application/x-deepv",
-	".def":       ContentTextHeaderValue,
-	".der":       "application/x-x509-ca-cert",
-	".dif":       "video/x-dv",
-	".dir":       "application/x-director",
-	".divx":      "video/divx",
-	".dl":        "video/dl",
-	".dmg":       "application/x-apple-diskimage",
-	".doc":       "application/msword",
-	".dot":       "application/msword",
-	".dp":        "application/commonground",
-	".drw":       "application/drafting",
-	".dump":      "application/octet-stream",
-	".dv":        "video/x-dv",
-	".dvi":       "application/x-dvi",
-	".dwf":       "drawing/x-dwf=(old)",
-	".dwg":       "application/acad",
-	".dxf":       "application/dxf",
-	".dxr":       "application/x-director",
-	".el":        "text/x-scriptelisp",
-	".elc":       "application/x-bytecodeelisp=(compiled=elisp)",
-	".eml":       "message/rfc822",
-	".env":       "application/x-envoy",
-	".eps":       "application/postscript",
-	".es":        "application/x-esrehber",
-	".etx":       "text/x-setext",
-	".evy":       "application/envoy",
-	".exe":       "application/octet-stream",
-	".f77":       "text/x-fortran",
-	".f90":       "text/x-fortran",
-	".f":         "text/x-fortran",
-	".fdf":       "application/vndfdf",
-	".fif":       "application/fractals",
-	".fli":       "video/fli",
-	".flo":       "image/florian",
-	".flv":       "video/x-flv",
-	".flx":       "text/vndfmiflexstor",
-	".fmf":       "video/x-atomic3d-feature",
-	".for":       "text/x-fortran",
-	".fpx":       "image/vndfpx",
-	".frl":       "application/freeloader",
-	".funk":      "audio/make",
-	".g3":        "image/g3fax",
-	".g":         ContentTextHeaderValue,
-	".gif":       "image/gif",
-	".gl":        "video/gl",
-	".gsd":       "audio/x-gsm",
-	".gsm":       "audio/x-gsm",
-	".gsp":       "application/x-gsp",
-	".gss":       "application/x-gss",
-	".gtar":      "application/x-gtar",
-	".gz":        "application/x-compressed",
-	".gzip":      "application/x-gzip",
-	".h":         "text/x-h",
-	".hdf":       "application/x-hdf",
-	".help":      "application/x-helpfile",
-	".hgl":       "application/vndhp-hpgl",
-	".hh":        "text/x-h",
-	".hlb":       "text/x-script",
-	".hlp":       "application/hlp",
-	".hpg":       "application/vndhp-hpgl",
-	".hpgl":      "application/vndhp-hpgl",
-	".hqx":       "application/binhex",
-	".hta":       "application/hta",
-	".htc":       "text/x-component",
-	".htm":       "text/html",
-	".html":      "text/html",
-	".htmls":     "text/html",
-	".htt":       "text/webviewhtml",
-	".htx":       "text/html",
-	".ice":       "x-conference/x-cooltalk",
-	".ico":       "image/x-icon",
-	".ics":       "text/calendar",
-	".icz":       "text/calendar",
-	".idc":       ContentTextHeaderValue,
-	".ief":       "image/ief",
-	".iefs":      "image/ief",
-	".iges":      "application/iges",
-	".igs":       "application/iges",
-	".ima":       "application/x-ima",
-	".imap":      "application/x-httpd-imap",
-	".inf":       "application/inf",
-	".ins":       "application/x-internett-signup",
-	".ip":        "application/x-ip2",
-	".isu":       "video/x-isvideo",
-	".it":        "audio/it",
-	".iv":        "application/x-inventor",
-	".ivr":       "i-world/i-vrml",
-	".ivy":       "application/x-livescreen",
-	".jam":       "audio/x-jam",
-	".jav":       "text/x-java-source",
-	".java":      "text/x-java-source",
-	".jcm":       "application/x-java-commerce",
-	".jfif-tbnl": "image/jpeg",
-	".jfif":      "image/jpeg",
-	".jnlp":      "application/x-java-jnlp-file",
-	".jpe":       "image/jpeg",
-	".jpeg":      "image/jpeg",
-	".jpg":       "image/jpeg",
-	".jps":       "image/x-jps",
-	".js":        ContentJavascriptHeaderValue,
-	".mjs":       ContentJavascriptHeaderValue,
-	".json":      ContentJSONHeaderValue,
-	".vue":       ContentJavascriptHeaderValue,
-	".jut":       "image/jutvision",
-	".kar":       "audio/midi",
-	".karbon":    "application/vnd.kde.karbon",
-	".kfo":       "application/vnd.kde.kformula",
-	".flw":       "application/vnd.kde.kivio",
-	".kml":       "application/vnd.google-earth.kml+xml",
-	".kmz":       "application/vnd.google-earth.kmz",
-	".kon":       "application/vnd.kde.kontour",
-	".kpr":       "application/vnd.kde.kpresenter",
-	".kpt":       "application/vnd.kde.kpresenter",
-	".ksp":       "application/vnd.kde.kspread",
-	".kwd":       "application/vnd.kde.kword",
-	".kwt":       "application/vnd.kde.kword",
-	".ksh":       "text/x-scriptksh",
-	".la":        "audio/nspaudio",
-	".lam":       "audio/x-liveaudio",
-	".latex":     "application/x-latex",
-	".lha":       "application/lha",
-	".lhx":       "application/octet-stream",
-	".list":      ContentTextHeaderValue,
-	".lma":       "audio/nspaudio",
-	".log":       ContentTextHeaderValue,
-	".lsp":       "text/x-scriptlisp",
-	".lst":       ContentTextHeaderValue,
-	".lsx":       "text/x-la-asf",
-	".ltx":       "application/x-latex",
-	".lzh":       "application/octet-stream",
-	".lzx":       "application/lzx",
-	".m1v":       "video/mpeg",
-	".m2a":       "audio/mpeg",
-	".m2v":       "video/mpeg",
-	".m3u":       "audio/x-mpegurl",
-	".m":         "text/x-m",
-	".man":       "application/x-troff-man",
-	".manifest":  "text/cache-manifest",
-	".map":       "application/x-navimap",
-	".mar":       ContentTextHeaderValue,
-	".mbd":       "application/mbedlet",
-	".mc$":       "application/x-magic-cap-package-10",
-	".mcd":       "application/mcad",
-	".mcf":       "text/mcf",
-	".mcp":       "application/netmc",
-	".me":        "application/x-troff-me",
-	".mht":       "message/rfc822",
-	".mhtml":     "message/rfc822",
-	".mid":       "application/x-midi",
-	".midi":      "application/x-midi",
-	".mif":       "application/x-frame",
-	".mime":      "message/rfc822",
-	".mjf":       "audio/x-vndaudioexplosionmjuicemediafile",
-	".mjpg":      "video/x-motion-jpeg",
-	".mm":        "application/base64",
-	".mme":       "application/base64",
-	".mod":       "audio/mod",
-	".moov":      "video/quicktime",
-	".mov":       "video/quicktime",
-	".movie":     "video/x-sgi-movie",
-	".mp2":       "audio/mpeg",
-	".mp3":       "audio/mpeg",
-	".mp4":       "video/mp4",
-	".mpa":       "audio/mpeg",
-	".mpc":       "application/x-project",
-	".mpe":       "video/mpeg",
-	".mpeg":      "video/mpeg",
-	".mpg":       "video/mpeg",
-	".mpga":      "audio/mpeg",
-	".mpp":       "application/vndms-project",
-	".mpt":       "application/x-project",
-	".mpv":       "application/x-project",
-	".mpx":       "application/x-project",
-	".mrc":       "application/marc",
-	".ms":        "application/x-troff-ms",
-	".mv":        "video/x-sgi-movie",
-	".my":        "audio/make",
-	".mzz":       "application/x-vndaudioexplosionmzz",
-	".nap":       "image/naplps",
-	".naplps":    "image/naplps",
-	".nc":        "application/x-netcdf",
-	".ncm":       "application/vndnokiaconfiguration-message",
-	".nif":       "image/x-niff",
-	".niff":      "image/x-niff",
-	".nix":       "application/x-mix-transfer",
-	".nsc":       "application/x-conference",
-	".nvd":       "application/x-navidoc",
-	".o":         "application/octet-stream",
-	".oda":       "application/oda",
-	".odb":       "application/vnd.oasis.opendocument.database",
-	".odc":       "application/vnd.oasis.opendocument.chart",
-	".odf":       "application/vnd.oasis.opendocument.formula",
-	".odg":       "application/vnd.oasis.opendocument.graphics",
-	".odi":       "application/vnd.oasis.opendocument.image",
-	".odm":       "application/vnd.oasis.opendocument.text-master",
-	".odp":       "application/vnd.oasis.opendocument.presentation",
-	".ods":       "application/vnd.oasis.opendocument.spreadsheet",
-	".odt":       "application/vnd.oasis.opendocument.text",
-	".oga":       "audio/ogg",
-	".ogg":       "audio/ogg",
-	".ogv":       "video/ogg",
-	".omc":       "application/x-omc",
-	".omcd":      "application/x-omcdatamaker",
-	".omcr":      "application/x-omcregerator",
-	".otc":       "application/vnd.oasis.opendocument.chart-template",
-	".otf":       "application/vnd.oasis.opendocument.formula-template",
-	".otg":       "application/vnd.oasis.opendocument.graphics-template",
-	".oth":       "application/vnd.oasis.opendocument.text-web",
-	".oti":       "application/vnd.oasis.opendocument.image-template",
-	".otm":       "application/vnd.oasis.opendocument.text-master",
-	".otp":       "application/vnd.oasis.opendocument.presentation-template",
-	".ots":       "application/vnd.oasis.opendocument.spreadsheet-template",
-	".ott":       "application/vnd.oasis.opendocument.text-template",
-	".p10":       "application/pkcs10",
-	".p12":       "application/pkcs-12",
-	".p7a":       "application/x-pkcs7-signature",
-	".p7c":       "application/pkcs7-mime",
-	".p7m":       "application/pkcs7-mime",
-	".p7r":       "application/x-pkcs7-certreqresp",
-	".p7s":       "application/pkcs7-signature",
-	".p":         "text/x-pascal",
-	".part":      "application/pro_eng",
-	".pas":       "text/pascal",
-	".pbm":       "image/x-portable-bitmap",
-	".pcl":       "application/vndhp-pcl",
-	".pct":       "image/x-pict",
-	".pcx":       "image/x-pcx",
-	".pdb":       "chemical/x-pdb",
-	".pdf":       "application/pdf",
-	".pfunk":     "audio/make",
-	".pgm":       "image/x-portable-graymap",
-	".pic":       "image/pict",
-	".pict":      "image/pict",
-	".pkg":       "application/x-newton-compatible-pkg",
-	".pko":       "application/vndms-pkipko",
-	".pl":        "text/x-scriptperl",
-	".plx":       "application/x-pixclscript",
-	".pm4":       "application/x-pagemaker",
-	".pm5":       "application/x-pagemaker",
-	".pm":        "text/x-scriptperl-module",
-	".png":       "image/png",
-	".pnm":       "application/x-portable-anymap",
-	".pot":       "application/mspowerpoint",
-	".pov":       "model/x-pov",
-	".ppa":       "application/vndms-powerpoint",
-	".ppm":       "image/x-portable-pixmap",
-	".pps":       "application/mspowerpoint",
-	".ppt":       "application/mspowerpoint",
-	".ppz":       "application/mspowerpoint",
-	".pre":       "application/x-freelance",
-	".prt":       "application/pro_eng",
-	".ps":        "application/postscript",
-	".psd":       "application/octet-stream",
-	".pvu":       "paleovu/x-pv",
-	".pwz":       "application/vndms-powerpoint",
-	".py":        "text/x-scriptphyton",
-	".pyc":       "application/x-bytecodepython",
-	".qcp":       "audio/vndqcelp",
-	".qd3":       "x-world/x-3dmf",
-	".qd3d":      "x-world/x-3dmf",
-	".qif":       "image/x-quicktime",
-	".qt":        "video/quicktime",
-	".qtc":       "video/x-qtc",
-	".qti":       "image/x-quicktime",
-	".qtif":      "image/x-quicktime",
-	".ra":        "audio/x-pn-realaudio",
-	".ram":       "audio/x-pn-realaudio",
-	".rar":       "application/x-rar-compressed",
-	".ras":       "application/x-cmu-raster",
-	".rast":      "image/cmu-raster",
-	".rexx":      "text/x-scriptrexx",
-	".rf":        "image/vndrn-realflash",
-	".rgb":       "image/x-rgb",
-	".rm":        "application/vndrn-realmedia",
-	".rmi":       "audio/mid",
-	".rmm":       "audio/x-pn-realaudio",
-	".rmp":       "audio/x-pn-realaudio",
-	".rng":       "application/ringing-tones",
-	".rnx":       "application/vndrn-realplayer",
-	".roff":      "application/x-troff",
-	".rp":        "image/vndrn-realpix",
-	".rpm":       "audio/x-pn-realaudio-plugin",
-	".rt":        "text/vndrn-realtext",
-	".rtf":       "text/richtext",
-	".rtx":       "text/richtext",
-	".rv":        "video/vndrn-realvideo",
-	".s":         "text/x-asm",
-	".s3m":       "audio/s3m",
-	".s7z":       "application/x-7z-compressed",
-	".saveme":    "application/octet-stream",
-	".sbk":       "application/x-tbook",
-	".scm":       "text/x-scriptscheme",
-	".sdml":      ContentTextHeaderValue,
-	".sdp":       "application/sdp",
-	".sdr":       "application/sounder",
-	".sea":       "application/sea",
-	".set":       "application/set",
-	".sgm":       "text/x-sgml",
-	".sgml":      "text/x-sgml",
-	".sh":        "text/x-scriptsh",
-	".shar":      "application/x-bsh",
-	".shtml":     "text/x-server-parsed-html",
-	".sid":       "audio/x-psid",
-	".skd":       "application/x-koan",
-	".skm":       "application/x-koan",
-	".skp":       "application/x-koan",
-	".skt":       "application/x-koan",
-	".sit":       "application/x-stuffit",
-	".sitx":      "application/x-stuffitx",
-	".sl":        "application/x-seelogo",
-	".smi":       "application/smil",
-	".smil":      "application/smil",
-	".snd":       "audio/basic",
-	".sol":       "application/solids",
-	".spc":       "text/x-speech",
-	".spl":       "application/futuresplash",
-	".spr":       "application/x-sprite",
-	".sprite":    "application/x-sprite",
-	".spx":       "audio/ogg",
-	".src":       "application/x-wais-source",
-	".srt":       "text/plain",
-	".sbv":       "text/plain",
-	".ssa":       "text/plain",
-	".ssi":       "text/x-server-parsed-html",
-	".ssm":       "application/streamingmedia",
-	".sst":       "application/vndms-pkicertstore",
-	".step":      "application/step",
-	".stl":       "application/sla",
-	".stp":       "application/step",
-	".sv4cpio":   "application/x-sv4cpio",
-	".sv4crc":    "application/x-sv4crc",
-	".svf":       "image/vnddwg",
-	".svg":       "image/svg+xml",
-	".svr":       "application/x-world",
-	".swf":       "application/x-shockwave-flash",
-	".t":         "application/x-troff",
-	".talk":      "text/x-speech",
-	".tar":       "application/x-tar",
-	".tbk":       "application/toolbook",
-	".tcl":       "text/x-scripttcl",
-	".tcsh":      "text/x-scripttcsh",
-	".tex":       "application/x-tex",
-	".texi":      "application/x-texinfo",
-	".texinfo":   "application/x-texinfo",
-	".text":      ContentTextHeaderValue,
-	".tgz":       "application/gnutar",
-	".tif":       "image/tiff",
-	".tiff":      "image/tiff",
-	".tr":        "application/x-troff",
-	".tsi":       "audio/tsp-audio",
-	".tsp":       "application/dsptype",
-	".tsv":       "text/tab-separated-values",
-	".turbot":    "image/florian",
-	".txt":       ContentTextHeaderValue,
-	".uil":       "text/x-uil",
-	".uni":       "text/uri-list",
-	".unis":      "text/uri-list",
-	".unv":       "application/i-deas",
-	".uri":       "text/uri-list",
-	".uris":      "text/uri-list",
-	".ustar":     "application/x-ustar",
-	".uu":        "text/x-uuencode",
-	".uue":       "text/x-uuencode",
-	".vcd":       "application/x-cdlink",
-	".vcf":       "text/x-vcard",
-	".vcard":     "text/x-vcard",
-	".vcs":       "text/x-vcalendar",
-	".vda":       "application/vda",
-	".vdo":       "video/vdo",
-	".vew":       "application/groupwise",
-	".viv":       "video/vivo",
-	".vivo":      "video/vivo",
-	".vmd":       "application/vocaltec-media-desc",
-	".vmf":       "application/vocaltec-media-file",
-	".voc":       "audio/voc",
-	".vos":       "video/vosaic",
-	".vox":       "audio/voxware",
-	".vqe":       "audio/x-twinvq-plugin",
-	".vqf":       "audio/x-twinvq",
-	".vql":       "audio/x-twinvq-plugin",
-	".vrml":      "application/x-vrml",
-	".vrt":       "x-world/x-vrt",
-	".vsd":       "application/x-visio",
-	".vst":       "application/x-visio",
-	".vsw":       "application/x-visio",
-	".w60":       "application/wordperfect60",
-	".w61":       "application/wordperfect61",
-	".w6w":       "application/msword",
-	".wav":       "audio/wav",
-	".wb1":       "application/x-qpro",
-	".wbmp":      "image/vnd.wap.wbmp",
-	".web":       "application/vndxara",
-	".wiz":       "application/msword",
-	".wk1":       "application/x-123",
-	".wmf":       "windows/metafile",
-	".wml":       "text/vnd.wap.wml",
-	".wmlc":      "application/vnd.wap.wmlc",
-	".wmls":      "text/vnd.wap.wmlscript",
-	".wmlsc":     "application/vnd.wap.wmlscriptc",
-	".word":      "application/msword",
-	".wp5":       "application/wordperfect",
-	".wp6":       "application/wordperfect",
-	".wp":        "application/wordperfect",
-	".wpd":       "application/wordperfect",
-	".wq1":       "application/x-lotus",
-	".wri":       "application/mswrite",
-	".wrl":       "application/x-world",
-	".wrz":       "model/vrml",
-	".wsc":       "text/scriplet",
-	".wsrc":      "application/x-wais-source",
-	".wtk":       "application/x-wintalk",
-	".x-png":     "image/png",
-	".xbm":       "image/x-xbitmap",
-	".xdr":       "video/x-amt-demorun",
-	".xgz":       "xgl/drawing",
-	".xif":       "image/vndxiff",
-	".xl":        "application/excel",
-	".xla":       "application/excel",
-	".xlb":       "application/excel",
-	".xlc":       "application/excel",
-	".xld":       "application/excel",
-	".xlk":       "application/excel",
-	".xll":       "application/excel",
-	".xlm":       "application/excel",
-	".xls":       "application/excel",
-	".xlt":       "application/excel",
-	".xlv":       "application/excel",
-	".xlw":       "application/excel",
-	".xm":        "audio/xm",
-	".xml":       ContentXMLHeaderValue,
-	".xmz":       "xgl/movie",
-	".xpix":      "application/x-vndls-xpix",
-	".xpm":       "image/x-xpixmap",
-	".xsr":       "video/x-amt-showrun",
-	".xwd":       "image/x-xwd",
-	".xyz":       "chemical/x-pdb",
-	".z":         "application/x-compress",
-	".zip":       "application/zip",
-	".zoo":       "application/octet-stream",
-	".zsh":       "text/x-scriptzsh",
-	".docx":      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-	".docm":      "application/vnd.ms-word.document.macroEnabled.12",
-	".dotx":      "application/vnd.openxmlformats-officedocument.wordprocessingml.template",
-	".dotm":      "application/vnd.ms-word.template.macroEnabled.12",
-	".xlsx":      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-	".xlsm":      "application/vnd.ms-excel.sheet.macroEnabled.12",
-	".xltx":      "application/vnd.openxmlformats-officedocument.spreadsheetml.template",
-	".xltm":      "application/vnd.ms-excel.template.macroEnabled.12",
-	".xlsb":      "application/vnd.ms-excel.sheet.binary.macroEnabled.12",
-	".xlam":      "application/vnd.ms-excel.addin.macroEnabled.12",
-	".pptx":      "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-	".pptm":      "application/vnd.ms-powerpoint.presentation.macroEnabled.12",
-	".ppsx":      "application/vnd.openxmlformats-officedocument.presentationml.slideshow",
-	".ppsm":      "application/vnd.ms-powerpoint.slideshow.macroEnabled.12",
-	".potx":      "application/vnd.openxmlformats-officedocument.presentationml.template",
-	".potm":      "application/vnd.ms-powerpoint.template.macroEnabled.12",
-	".ppam":      "application/vnd.ms-powerpoint.addin.macroEnabled.12",
-	".sldx":      "application/vnd.openxmlformats-officedocument.presentationml.slide",
-	".sldm":      "application/vnd.ms-powerpoint.slide.macroEnabled.12",
-	".thmx":      "application/vnd.ms-officetheme",
-	".onetoc":    "application/onenote",
-	".onetoc2":   "application/onenote",
-	".onetmp":    "application/onenote",
-	".onepkg":    "application/onenote",
-	".xpi":       "application/x-xpinstall",
-	".wasm":      "application/wasm",
-	".m4a":       "audio/mp4",
-	".flac":      "audio/x-flac",
-	".amr":       "audio/amr",
-	".aac":       "audio/aac",
-	".opus":      "video/ogg",
-	".m4v":       "video/mp4",
-	".mkv":       "video/x-matroska",
-	".caf":       "audio/x-caf",
-	".m3u8":      "application/x-mpegURL",
-	".mpd":       "application/dash+xml",
-	".webp":      "image/webp",
-	".epub":      "application/epub+zip",
-}
-
-//nolint:gochecknoinits
-func init() {
-	for ext, typ := range types {
-		// skip errors
-		_ = mime.AddExtensionType(ext, typ)
-	}
-}

backend/adapters/fs/files/user.go

@@ -1,64 +0,0 @@
-package files
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-// MakeUserDir makes the user directory according to settings.
-func MakeUserDir(fullPath string) error {
-	if err := os.MkdirAll(fullPath, os.ModePerm); err != nil {
-		return err
-	}
-	return nil
-}
-
-func MakeUserDirs(u *users.User, disableScopeChange bool) error {
-	cleanedUserName := users.CleanUsername(u.Username)
-	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
-		return fmt.Errorf("MakeUserDirs: invalid user for home dir creation: [%s]", u.Username)
-	}
-	for i, scope := range u.Scopes {
-		source, ok := settings.Config.Server.SourceMap[scope.Name]
-		if !ok {
-			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
-		}
-		// create directory and append user name
-		if filepath.Base(scope.Scope) != cleanedUserName && source.Config.CreateUserDir && !disableScopeChange {
-			fullPath := filepath.Join(source.Path, scope.Scope, cleanedUserName)
-			parentDir := filepath.Join(source.Path, scope.Scope)
-			// validate that scope path exists
-			if !Exists(parentDir) {
-				return fmt.Errorf("MakeUserDirs: scope path does not exist: %s", scope.Scope)
-			}
-			scope.Scope = filepath.Join(scope.Scope, cleanedUserName)
-			err := MakeUserDir(fullPath)
-			if err != nil {
-				return fmt.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
-			}
-		} else if filepath.Base(scope.Scope) == cleanedUserName && source.Config.CreateUserDir {
-			// create directory exactly as specified
-			fullPath := filepath.Join(source.Path, scope.Scope)
-			parentDir := filepath.Dir(fullPath)
-			if !Exists(parentDir) {
-				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", parentDir)
-			}
-			err := MakeUserDir(fullPath)
-			if err != nil {
-				return fmt.Errorf("create user: failed to create user home dir: %s", err)
-			}
-		} else {
-			// just assigning scope to path provided, so just check that it exists
-			path := filepath.Join(source.Path, scope.Scope)
-			if !Exists(path) {
-				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", path)
-			}
-		}
-		u.Scopes[i] = scope
-	}
-	return nil
-}

backend/adapters/fs/fileutils/copy.go

@@ -1,39 +0,0 @@
-package fileutils
-
-import (
-	"os"
-	"path/filepath"
-)
-
-// Copy copies a file or folder from one place to another.
-func CopyHelper(src, dst string) error {
-	src = filepath.Clean(src)
-	if src == "" {
-		return os.ErrNotExist
-	}
-
-	dst = filepath.Clean(dst)
-	if dst == "" {
-		return os.ErrNotExist
-	}
-
-	if src == "/" || dst == "/" {
-		// Prohibit copying from or to the root directory.
-		return os.ErrInvalid
-	}
-
-	if dst == src {
-		return os.ErrInvalid
-	}
-
-	info, err := os.Stat(src)
-	if err != nil {
-		return err
-	}
-
-	if info.IsDir() {
-		return CopyDir(src, dst)
-	}
-
-	return CopyFile(src, dst)
-}

backend/adapters/fs/fileutils/file.go

@@ -1,197 +0,0 @@
-package fileutils
-
-import (
-	"io"
-	"os"
-	"path"
-	"path/filepath"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-const PermFile = 0644
-const PermDir = 0755
-
-// MoveFile moves a file from src to dst.
-// By default, the rename system call is used. If src and dst point to different volumes,
-// the file copy is used as a fallback.
-func MoveFile(src, dst string) error {
-	err := os.Rename(src, dst)
-	if err == nil {
-		return nil
-	}
-
-	// fallback
-	err = CopyFile(src, dst)
-	if err != nil {
-		logger.Errorf("CopyFile failed %v %v %v ", src, dst, err)
-		return err
-	}
-
-	go func() {
-		err = os.RemoveAll(src)
-		if err != nil {
-			logger.Errorf("os.Remove failed %v %v ", src, err)
-		}
-	}()
-
-	return nil
-}
-
-// CopyFile copies a file or directory from source to dest and returns an error if any.
-func CopyFile(source, dest string) error {
-	// Check if the source exists and whether it's a file or directory.
-	info, err := os.Stat(source)
-	if err != nil {
-		return err
-	}
-
-	if info.IsDir() {
-		// If the source is a directory, copy it recursively.
-		return copyDirectory(source, dest)
-	}
-
-	// If the source is a file, copy the file.
-	return copySingleFile(source, dest)
-}
-
-// copySingleFile handles copying a single file.
-func copySingleFile(source, dest string) error {
-	// Open the source file.
-	src, err := os.Open(source)
-	if err != nil {
-		return err
-	}
-	defer src.Close()
-
-	// Create the destination directory if needed.
-	err = os.MkdirAll(filepath.Dir(dest), PermDir)
-	if err != nil {
-		return err
-	}
-
-	// Create the destination file.
-	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, PermFile)
-	if err != nil {
-		return err
-	}
-	defer dst.Close()
-
-	// Copy the contents of the file.
-	_, err = io.Copy(dst, src)
-	if err != nil {
-		return err
-	}
-
-	// Copy the mode.
-	info, err := os.Stat(source)
-	if err != nil {
-		return err
-	}
-	err = os.Chmod(dest, info.Mode())
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// copyDirectory handles copying directories recursively.
-func copyDirectory(source, dest string) error {
-	// Create the destination directory.
-	err := os.MkdirAll(dest, PermDir)
-	if err != nil {
-		return err
-	}
-
-	// Read the contents of the source directory.
-	entries, err := os.ReadDir(source)
-	if err != nil {
-		return err
-	}
-
-	// Iterate over each entry in the directory.
-	for _, entry := range entries {
-		srcPath := filepath.Join(source, entry.Name())
-		destPath := filepath.Join(dest, entry.Name())
-
-		if entry.IsDir() {
-			// Recursively copy subdirectories.
-			err = copyDirectory(srcPath, destPath)
-			if err != nil {
-				return err
-			}
-		} else {
-			// Copy files.
-			err = copySingleFile(srcPath, destPath)
-			if err != nil {
-				return err
-			}
-		}
-	}
-
-	return nil
-}
-
-// CommonPrefix returns the common directory path of provided files.
-func CommonPrefix(sep byte, paths ...string) string {
-	// Handle special cases.
-	switch len(paths) {
-	case 0:
-		return ""
-	case 1:
-		return path.Clean(paths[0])
-	}
-
-	// Treat string as []byte, not []rune as is often done in Go.
-	c := []byte(path.Clean(paths[0]))
-
-	// Add a trailing sep to handle the case where the common prefix directory
-	// is included in the path list.
-	c = append(c, sep)
-
-	// Ignore the first path since it's already in c.
-	for _, v := range paths[1:] {
-		// Clean up each path before testing it.
-		v = path.Clean(v) + string(sep)
-
-		// Find the first non-common byte and truncate c.
-		if len(v) < len(c) {
-			c = c[:len(v)]
-		}
-		for i := 0; i < len(c); i++ {
-			if v[i] != c[i] {
-				c = c[:i]
-				break
-			}
-		}
-	}
-
-	// Remove trailing non-separator characters and the final separator.
-	for i := len(c) - 1; i >= 0; i-- {
-		if c[i] == sep {
-			c = c[:i]
-			break
-		}
-	}
-
-	return string(c)
-}
-
-func ClearCacheDir() {
-	cacheDir := settings.Config.Server.CacheDir
-	entries, err := os.ReadDir(cacheDir)
-	if err != nil {
-		logger.Errorf("failed clear cache dir: %v", err)
-	}
-
-	for _, entry := range entries {
-		path := filepath.Join(cacheDir, entry.Name())
-		err = os.RemoveAll(path)
-		if err != nil {
-			logger.Errorf("failed clear cache dir: %v", err)
-		}
-	}
-
-}

backend/auth/auth.go

@@ -2,35 +2,14 @@ package auth
 
 import (
 	"net/http"
-	"sync"
 
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/users"
 )
 
-var (
-	revokedApiKeyList map[string]struct{}
-	revokeMu          sync.Mutex
-)
-
-func init() {
-	revokedApiKeyList = make(map[string]struct{})
-}
-
 // Auther is the authentication interface.
 type Auther interface {
 	// Auth is called to authenticate a request.
-	Auth(r *http.Request, userStore *users.Storage) (*users.User, error)
+	Auth(r *http.Request, usr users.Store) (*users.User, error)
 	// LoginPage indicates if this auther needs a login page.
 	LoginPage() bool
 }
-
-func IsRevokedApiKey(key string) bool {
-	_, exists := revokedApiKeyList[key]
-	return exists
-}
-
-func RevokeAPIKey(key string) {
-	revokeMu.Lock()
-	defer revokeMu.Unlock()
-	revokedApiKeyList[key] = struct{}{}
-}

backend/auth/hook.go

@@ -0,0 +1,283 @@
+package auth
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/errors"
+	"github.com/gtsteffaniak/filebrowser/settings"
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+type hookCred struct {
+	Password string `json:"password"`
+	Username string `json:"username"`
+}
+
+// HookAuth is a hook implementation of an Auther.
+type HookAuth struct {
+	Users    users.Store        `json:"-"`
+	Settings *settings.Settings `json:"-"`
+	Server   *settings.Server   `json:"-"`
+	Cred     hookCred           `json:"-"`
+	Fields   hookFields         `json:"-"`
+	Command  string             `json:"command"`
+}
+
+// Auth authenticates the user via a json in content body.
+func (a *HookAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
+	var cred hookCred
+
+	if r.Body == nil {
+		return nil, os.ErrPermission
+	}
+
+	err := json.NewDecoder(r.Body).Decode(&cred)
+	if err != nil {
+		return nil, os.ErrPermission
+	}
+
+	a.Users = usr
+	a.Settings = &settings.Config
+	a.Server = &settings.Config.Server
+	a.Cred = cred
+
+	action, err := a.RunCommand()
+	if err != nil {
+		return nil, err
+	}
+
+	switch action {
+	case "auth":
+		u, err := a.SaveUser()
+		if err != nil {
+			return nil, err
+		}
+		return u, nil
+	case "block":
+		return nil, os.ErrPermission
+	case "pass":
+		u, err := a.Users.Get(a.Server.Root, a.Cred.Username)
+		if err != nil || !users.CheckPwd(a.Cred.Password, u.Password) {
+			return nil, os.ErrPermission
+		}
+		return u, nil
+	default:
+		return nil, fmt.Errorf("invalid hook action: %s", action)
+	}
+}
+
+// LoginPage tells that hook auth requires a login page.
+func (a *HookAuth) LoginPage() bool {
+	return true
+}
+
+// RunCommand starts the hook command and returns the action
+func (a *HookAuth) RunCommand() (string, error) {
+	command := strings.Split(a.Command, " ")
+	envMapping := func(key string) string {
+		switch key {
+		case "USERNAME":
+			return a.Cred.Username
+		case "PASSWORD":
+			return a.Cred.Password
+		default:
+			return os.Getenv(key)
+		}
+	}
+	for i, arg := range command {
+		if i == 0 {
+			continue
+		}
+		command[i] = os.Expand(arg, envMapping)
+	}
+
+	cmd := exec.Command(command[0], command[1:]...) //nolint:gosec
+	cmd.Env = append(os.Environ(), fmt.Sprintf("USERNAME=%s", a.Cred.Username))
+	cmd.Env = append(cmd.Env, fmt.Sprintf("PASSWORD=%s", a.Cred.Password))
+	out, err := cmd.Output()
+	if err != nil {
+		return "", err
+	}
+
+	a.GetValues(string(out))
+
+	return a.Fields.Values["hook.action"], nil
+}
+
+// GetValues creates a map with values from the key-value format string
+func (a *HookAuth) GetValues(s string) {
+	m := map[string]string{}
+
+	// make line breaks consistent on Windows platform
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+
+	// iterate input lines
+	for _, val := range strings.Split(s, "\n") {
+		v := strings.SplitN(val, "=", 2) //nolint: gomnd
+
+		// skips non key and value format
+		if len(v) != 2 { //nolint: gomnd
+			continue
+		}
+
+		fieldKey := strings.TrimSpace(v[0])
+		fieldValue := strings.TrimSpace(v[1])
+
+		if a.Fields.IsValid(fieldKey) {
+			m[fieldKey] = fieldValue
+		}
+	}
+
+	a.Fields.Values = m
+}
+
+// SaveUser updates the existing user or creates a new one when not found
+func (a *HookAuth) SaveUser() (*users.User, error) {
+	u, err := a.Users.Get(a.Server.Root, a.Cred.Username)
+	if err != nil && err != errors.ErrNotExist {
+		return nil, err
+	}
+
+	if u == nil {
+		// create user with the provided credentials
+		d := &users.User{
+			Username:     a.Cred.Username,
+			Password:     a.Cred.Password,
+			Scope:        a.Settings.UserDefaults.Scope,
+			Locale:       a.Settings.UserDefaults.Locale,
+			ViewMode:     a.Settings.UserDefaults.ViewMode,
+			SingleClick:  a.Settings.UserDefaults.SingleClick,
+			Sorting:      a.Settings.UserDefaults.Sorting,
+			Perm:         a.Settings.UserDefaults.Perm,
+			Commands:     a.Settings.UserDefaults.Commands,
+			HideDotfiles: a.Settings.UserDefaults.HideDotfiles,
+		}
+		u = a.GetUser(d)
+
+		userHome, err := a.Settings.MakeUserDir(u.Username, u.Scope, a.Server.Root)
+		if err != nil {
+			return nil, fmt.Errorf("user: failed to mkdir user home dir: [%s]", userHome)
+		}
+		u.Scope = userHome
+		log.Printf("user: %s, home dir: [%s].", u.Username, userHome)
+
+		err = a.Users.Save(u)
+		if err != nil {
+			return nil, err
+		}
+	} else if p := !users.CheckPwd(a.Cred.Password, u.Password); len(a.Fields.Values) > 1 || p {
+		u = a.GetUser(u)
+		// update user with provided fields
+		err := a.Users.Update(u)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return u, nil
+}
+
+// GetUser returns a User filled with hook values or provided defaults
+func (a *HookAuth) GetUser(d *users.User) *users.User {
+	// adds all permissions when user is admin
+	isAdmin := d.Perm.Admin
+	perms := users.Permissions{
+		Admin:    isAdmin,
+		Execute:  isAdmin || d.Perm.Execute,
+		Create:   isAdmin || d.Perm.Create,
+		Rename:   isAdmin || d.Perm.Rename,
+		Modify:   isAdmin || d.Perm.Modify,
+		Delete:   isAdmin || d.Perm.Delete,
+		Share:    isAdmin || d.Perm.Share,
+		Download: isAdmin || d.Perm.Download,
+	}
+	user := users.User{
+		ID:          d.ID,
+		Username:    d.Username,
+		Password:    d.Password,
+		Scope:       d.Scope,
+		Locale:      d.Locale,
+		ViewMode:    d.ViewMode,
+		SingleClick: d.SingleClick,
+		Sorting: users.Sorting{
+			Asc: d.Sorting.Asc,
+			By:  d.Sorting.By,
+		},
+		Commands:     d.Commands,
+		HideDotfiles: d.HideDotfiles,
+		Perm:         perms,
+		LockPassword: true,
+	}
+
+	return &user
+}
+
+// hookFields is used to access fields from the hook
+type hookFields struct {
+	Values map[string]string
+}
+
+// validHookFields contains names of the fields that can be used
+var validHookFields = []string{
+	"hook.action",
+	"user.scope",
+	"user.locale",
+	"user.viewMode",
+	"user.singleClick",
+	"user.sorting.by",
+	"user.sorting.asc",
+	"user.commands",
+	"user.hideDotfiles",
+	"user.perm.admin",
+	"user.perm.execute",
+	"user.perm.create",
+	"user.perm.rename",
+	"user.perm.modify",
+	"user.perm.delete",
+	"user.perm.share",
+	"user.perm.download",
+}
+
+// IsValid checks if the provided field is on the valid fields list
+func (hf *hookFields) IsValid(field string) bool {
+	for _, val := range validHookFields {
+		if field == val {
+			return true
+		}
+	}
+
+	return false
+}
+
+// GetString returns the string value or provided default
+func (hf *hookFields) GetString(k, dv string) string {
+	val, ok := hf.Values[k]
+	if ok {
+		return val
+	}
+	return dv
+}
+
+// GetBoolean returns the bool value or provided default
+func (hf *hookFields) GetBoolean(k string, dv bool) bool {
+	val, ok := hf.Values[k]
+	if ok {
+		return val == "true"
+	}
+	return dv
+}
+
+// GetArray returns the array value or provided default
+func (hf *hookFields) GetArray(k string, dv []string) []string {
+	val, ok := hf.Values[k]
+	if ok && strings.TrimSpace(val) != "" {
+		return strings.Split(val, " ")
+	}
+	return dv
+}

backend/auth/json.go

@@ -2,31 +2,42 @@ package auth
 
 import (
 	"encoding/json"
-	"fmt"
 	"net/http"
 	"net/url"
 	"os"
 	"strings"
 
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/settings"
+	"github.com/gtsteffaniak/filebrowser/users"
 )
 
+type jsonCred struct {
+	Password  string `json:"password"`
+	Username  string `json:"username"`
+	ReCaptcha string `json:"recaptcha"`
+}
+
 // JSONAuth is a json implementation of an Auther.
 type JSONAuth struct {
 	ReCaptcha *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
 }
 
 // Auth authenticates the user via a json in content body.
-func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.User, error) {
-	username := r.URL.Query().Get("username")
-	recaptcha := r.URL.Query().Get("recaptcha")
-	password := r.Header.Get("X-Password")
-	totpCode := r.Header.Get("X-Secret")
+func (a JSONAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
+	config := &settings.Config
+	var cred jsonCred
+
+	if r.Body == nil {
+		return nil, os.ErrPermission
+	}
+	err := json.NewDecoder(r.Body).Decode(&cred)
+	if err != nil {
+		return nil, os.ErrPermission
+	}
 
 	// If ReCaptcha is enabled, check the code.
-	if auther.ReCaptcha != nil && len(auther.ReCaptcha.Secret) > 0 {
-		ok, err := auther.ReCaptcha.Ok(recaptcha) //nolint:govet
+	if a.ReCaptcha != nil && len(a.ReCaptcha.Secret) > 0 {
+		ok, err := a.ReCaptcha.Ok(cred.ReCaptcha) //nolint:govet
 
 		if err != nil {
 			return nil, err
@@ -37,32 +48,12 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 		}
 	}
 
-	user, err := userStore.Get(username)
-	if err != nil {
-		return nil, fmt.Errorf("unable to get user from store: %v", err)
-	}
-	err = users.CheckPwd(password, user.Password)
-	if err != nil {
-		return nil, err
+	u, err := usr.Get(config.Server.Root, cred.Username)
+	if err != nil || !users.CheckPwd(cred.Password, u.Password) {
+		return nil, os.ErrPermission
 	}
 
-	// check for OTP for password
-	if user.TOTPSecret != "" {
-		if totpCode == "" {
-			return nil, errors.ErrNoTotpProvided
-		}
-		err = VerifyTotpCode(user, totpCode, userStore)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	if user.LoginMethod != users.LoginMethodPassword {
-		return nil, errors.ErrWrongLoginMethod
-	}
-
-	return user, nil
-
+	return u, nil
 }
 
 // LoginPage tells that json auth doesn't require a login page.

backend/auth/none.go

@@ -3,7 +3,8 @@ package auth
 import (
 	"net/http"
 
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/settings"
+	"github.com/gtsteffaniak/filebrowser/users"
 )
 
 // MethodNoAuth is used to identify no auth.
@@ -13,8 +14,8 @@ const MethodNoAuth = "noauth"
 type NoAuth struct{}
 
 // Auth uses authenticates user 1.
-func (a NoAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
-	return usr.Get(uint(1))
+func (a NoAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
+	return usr.Get(settings.Config.Server.Root, uint(1))
 }
 
 // LoginPage tells that no auth doesn't require a login page.

backend/auth/proxy.go

@@ -4,8 +4,10 @@ import (
 	"net/http"
 	"os"
 
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/settings"
+
+	"github.com/gtsteffaniak/filebrowser/errors"
+	"github.com/gtsteffaniak/filebrowser/users"
 )
 
 // MethodProxyAuth is used to identify no auth.
@@ -17,9 +19,9 @@ type ProxyAuth struct {
 }
 
 // Auth authenticates the user via an HTTP header.
-func (a ProxyAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
+func (a ProxyAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
 	username := r.Header.Get(a.Header)
-	user, err := usr.Get(username)
+	user, err := usr.Get(settings.Config.Server.Root, username)
 	if err == errors.ErrNotExist {
 		return nil, os.ErrPermission
 	}

backend/auth/storage.go

@@ -1,14 +1,7 @@
 package auth
 
 import (
-	"encoding/base64"
-	"log"
-
-	"crypto/sha256"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"golang.org/x/crypto/pbkdf2"
+	"github.com/gtsteffaniak/filebrowser/users"
 )
 
 // StorageBackend is a storage backend for auth storage.
@@ -24,35 +17,8 @@ type Storage struct {
 }
 
 // NewStorage creates a auth storage from a backend.
-func NewStorage(back StorageBackend, userStore *users.Storage) (*Storage, error) {
-	store := &Storage{back: back, users: userStore}
-	err := store.Save(&JSONAuth{})
-	if err != nil {
-		return nil, err
-	}
-	err = store.Save(&ProxyAuth{})
-	if err != nil {
-		return nil, err
-	}
-	err = store.Save(&NoAuth{})
-	if err != nil {
-		return nil, err
-	}
-	if settings.Config.Auth.TotpSecret != "" {
-		key, err := base64.StdEncoding.DecodeString(settings.Config.Auth.TotpSecret)
-		keyLen := len(key)
-
-		if err == nil && (keyLen == 16 || keyLen == 24 || keyLen == 25) {
-			// Use the user-provided key if it's valid
-			encryptionKey = key
-		} else {
-			// Otherwise, derive the key from the provided secret string
-			log.Println("[WARN] totpSecret is not a valid Base64 encoded key. Deriving a key from it. For better security, generate a secret with 'openssl rand -base64 32'.")
-			salt := []byte{0xda, 0x90, 0x45, 0xc3, 0x06, 0xb5, 0x99, 0x9f, 0xb6, 0xae, 0xfc, 0x14, 0xef, 0x27, 0x6e, 0x6a}
-			encryptionKey = pbkdf2.Key([]byte(settings.Config.Auth.TotpSecret), salt, 4096, 32, sha256.New)
-		}
-	}
-	return store, nil
+func NewStorage(back StorageBackend, userStore *users.Storage) *Storage {
+	return &Storage{back: back, users: userStore}
 }
 
 // Get wraps a StorageBackend.Get.

backend/auth/totp.go

@@ -1,203 +0,0 @@
-package auth
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
-	"encoding/base64"
-	"fmt"
-	"io"
-	"strings"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-cache/cache"
-	"github.com/gtsteffaniak/go-logger/logger"
-	"github.com/pquerna/otp"
-	"github.com/pquerna/otp/totp"
-)
-
-// Constants for TOTP (Time-based One-Time Password) configuration.
-const (
-	// IssuerName is the name of the application or service.
-	IssuerName = "FileBrowser Quantum"
-
-	// TokenValidTime defines the total duration a token is considered valid.
-	// Note: The actual validation window might be slightly longer depending on the period.
-	TokenValidTime = time.Minute * 2
-
-	// TOTPPeriod is the standard duration in seconds that a TOTP code is valid.
-	TOTPPeriod uint = 30
-
-	// TOTPSecretSize is the byte length of the shared secret.
-	TOTPSecretSize uint = 20
-
-	// TOTPDigits specifies the number of digits in the OTP code.
-	TOTPDigits = otp.DigitsSix
-
-	// TOTPAlgorithm is the hashing algorithm to use.
-	TOTPAlgorithm = otp.AlgorithmSHA1
-)
-
-var (
-	// TOTPSkew allows for a certain number of periods of clock drift.
-	// We calculate it to best match the TokenValidTime.
-	// (2 * Skew + 1) * Period >= TokenValidTime
-	// For a 2-minute (120s) window with a 30s period, we need a Skew of 2.
-	// (2*2 + 1) * 30s = 150s (2.5 minutes). This is the closest we can get.
-	TOTPSkew      uint = uint(TokenValidTime.Seconds()) / (2 * uint(TOTPPeriod))
-	encryptionKey []byte
-	TotpCache     = cache.NewCache(5 * time.Minute)
-)
-
-func GenerateOtpForUser(user *users.User, userStore *users.Storage) (string, error) {
-	// Generate a new TOTP key using the defined constants.
-	key, err := totp.Generate(totp.GenerateOpts{
-		Issuer:      IssuerName,
-		AccountName: user.Username,
-		Period:      TOTPPeriod,
-		SecretSize:  TOTPSecretSize,
-		Digits:      TOTPDigits,
-		Algorithm:   TOTPAlgorithm,
-	})
-	if err != nil {
-		return "", fmt.Errorf("error generating TOTP key: %w", err)
-	}
-
-	secretText := key.Secret()
-	nonce := ""
-	if settings.Config.Auth.TotpSecret != "" {
-		// If an encryption key is provided, encrypt the secret.
-		secretText, nonce, err = encryptSecret(secretText, encryptionKey)
-		if err != nil {
-			return "", fmt.Errorf("failed to encrypt TOTP secret: %w", err)
-		}
-	}
-	// set cache so verify can attempt to use it but not require it for user yet.
-	TotpCache.Set(user.Username, secretText+"||"+nonce)
-	url := fmt.Sprintf("otpauth://totp/%v?secret=%v", "FileBrowser Quantum: "+user.Username, secretText)
-	return url, nil
-}
-
-// encryptSecret uses AES-GCM to encrypt a plaintext secret.
-// It returns the base64-encoded ciphertext and nonce, or an error.
-func encryptSecret(secret string, key []byte) (string, string, error) {
-	if len(key) != 32 {
-		return "", "", fmt.Errorf("invalid encryption key length: must be 32 bytes")
-	}
-
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return "", "", err
-	}
-
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return "", "", err
-	}
-
-	nonce := make([]byte, gcm.NonceSize())
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-		return "", "", err
-	}
-
-	ciphertext := gcm.Seal(nil, nonce, []byte(secret), nil)
-
-	return base64.StdEncoding.EncodeToString(ciphertext), base64.StdEncoding.EncodeToString(nonce), nil
-}
-
-// decryptSecret uses AES-GCM to decrypt a ciphertext using its key and nonce.
-// It returns the plaintext secret or an error.
-func decryptSecret(b64Ciphertext, b64Nonce string) (string, error) {
-	if len(encryptionKey) != 32 {
-		return "", fmt.Errorf("invalid encryption key length: must be 32 bytes")
-	}
-
-	ciphertext, err := base64.StdEncoding.DecodeString(b64Ciphertext)
-	if err != nil {
-		return "", fmt.Errorf("failed to decode ciphertext: %w", err)
-	}
-
-	nonce, err := base64.StdEncoding.DecodeString(b64Nonce)
-	if err != nil {
-		return "", fmt.Errorf("failed to decode nonce: %w", err)
-	}
-
-	block, err := aes.NewCipher(encryptionKey)
-	if err != nil {
-		return "", err
-	}
-
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return "", err
-	}
-
-	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
-	if err != nil {
-		// This error often means the key is wrong or the data is corrupt
-		return "", fmt.Errorf("failed to decrypt secret: %w", err)
-	}
-
-	return string(plaintext), nil
-}
-
-func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) error {
-	// get data from cache
-	cachedSecret, found := TotpCache.Get(user.Username).(string)
-	if !found && user.TOTPSecret == "" {
-		return fmt.Errorf("OTP token not found in cache, please generate a new one")
-	}
-	totpSecret := user.TOTPSecret // The encrypted or plaintext secret
-	totpNonce := user.TOTPNonce   // The nonce if encrypted, or empty if plaintext
-	if found {
-		splitSecret := strings.Split(cachedSecret, "||")
-		if len(splitSecret) < 2 {
-			return fmt.Errorf("invalid cached OTP token format")
-		}
-		totpSecret = splitSecret[0]
-		totpNonce = splitSecret[1]
-	}
-	secretToValidate := totpSecret
-	if settings.Config.Auth.TotpSecret != "" {
-		// If an encryption key is configured, we must decrypt the secret first.
-		if totpNonce == "" {
-			return fmt.Errorf("secret is encrypted but nonce is missing")
-		}
-		decryptedSecret, err := decryptSecret(totpSecret, totpNonce)
-		if err != nil {
-			return fmt.Errorf("failed to decrypt TOTP secret: %w", err)
-		}
-		secretToValidate = decryptedSecret
-	}
-	// --- END: ADD THIS DECRYPTION LOGIC ---
-
-	// Validate the token using the (now plaintext) secret.
-	valid, err := totp.ValidateCustom(code, secretToValidate, time.Now().UTC(), totp.ValidateOpts{
-		Period:    TOTPPeriod,
-		Skew:      TOTPSkew,
-		Digits:    TOTPDigits,
-		Algorithm: TOTPAlgorithm,
-	})
-	if err != nil {
-		logger.Errorf("error during TOTP validation: %v", err)
-	}
-	if !valid {
-		return fmt.Errorf("invalid OTP token")
-	}
-	if totpSecret != "" {
-		user.TOTPSecret = totpSecret // The encrypted or plaintext secret
-		user.TOTPNonce = totpNonce   // The nonce if encrypted, or empty if plaintext
-		user.OtpEnabled = true       // Enable OTP for the user
-		// save user
-		if err := userStore.Update(user, true, "TOTPSecret", "TOTPNonce"); err != nil {
-			logger.Error("error updating user with OTP token:", err)
-			return fmt.Errorf("error updating user with OTP token: %w", err)
-		}
-	} else {
-		return fmt.Errorf("opt secret is empty, cannot enable TOTP")
-	}
-
-	return nil
-}

backend/benchmark_results.txt

@@ -1,83 +1,53 @@
 
  == Running benchmark == 
 /usr/local/go/bin/go
-?   	github.com/gtsteffaniak/filebrowser/backend	[no test files]
+?   	github.com/gtsteffaniak/filebrowser	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/auth	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/cmd	[no test files]
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/diskcache	0.004s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files	0.006s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils	0.003s
-?   	github.com/gtsteffaniak/filebrowser/backend/auth	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/cmd	[no test files]
-?   	github.com/gtsteffaniak/go-cache/cache	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/common/errors	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/common/logger	[no test files]
-2025/05/11 20:42:56 Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable
-2025/05/11 20:42:56 Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/common/settings	0.006s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/common/utils	0.003s
-?   	github.com/gtsteffaniak/filebrowser/backend/common/version	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/database/share	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/database/storage	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt	[no test files]
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/database/users	0.002s
-?   	github.com/gtsteffaniak/filebrowser/backend/events	[no test files]
-2025/05/11 20:42:56 [DEBUG]  Saving user [admin] changepass: true
-2025/05/11 20:42:56 [DEBUG]  Saving user [non-admin] changepass: true
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/http	0.197s
-2025/05/11 20:42:57 initializing index: [test]
-2025/05/11 20:42:57 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:57 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:57 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:57 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:57 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:57 [DEBUG]  Next scan in 1m0s
-2025/05/11 20:42:58 initializing index: [test]
-2025/05/11 20:42:58 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:58 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:58 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:58 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:58 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:58 [DEBUG]  Next scan in 1m0s
+ok  	github.com/gtsteffaniak/filebrowser/diskcache	0.003s
+?   	github.com/gtsteffaniak/filebrowser/errors	[no test files]
 goos: linux
 goarch: amd64
-pkg: github.com/gtsteffaniak/filebrowser/backend/indexing
+pkg: github.com/gtsteffaniak/filebrowser/files
 cpu: 11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz
-BenchmarkFillIndex-8                     	2025/05/11 20:42:59 initializing index: [test]
-2025/05/11 20:42:59 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:59 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:59 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:59 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:59 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:59 [DEBUG]  Next scan in 1m0s
-      10	   3548759 ns/op	   38032 B/op	     452 allocs/op
-BenchmarkCheckIndexExclude-8             	      10	       172.6 ns/op	       0 B/op	       0 allocs/op
-BenchmarkCheckIndexConditionsInclude-8   	      10	       118.2 ns/op	       0 B/op	       0 allocs/op
-2025/05/11 20:43:01 initializing index: [test]
-2025/05/11 20:43:01 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:01 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:43:01 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:43:01 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:43:01 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:01 [DEBUG]  Next scan in 1m0s
-BenchmarkSearchAllIndexes-8              	2025/05/11 20:43:02 initializing index: [test]
-2025/05/11 20:43:02 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:02 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:43:02 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:43:02 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:43:02 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:02 [DEBUG]  Next scan in 1m0s
-      10	    781119 ns/op	   38515 B/op	     900 allocs/op
+BenchmarkFillIndex-8          	      10	   3587120 ns/op	  273640 B/op	    2013 allocs/op
+BenchmarkSearchAllIndexes-8   	      10	  31291180 ns/op	19500700 B/op	  298636 allocs/op
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/indexing	5.097s
+ok  	github.com/gtsteffaniak/filebrowser/files	0.408s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo	0.005s
+ok  	github.com/gtsteffaniak/filebrowser/fileutils	0.003s
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 h: 401  <nil>
+2024/02/07 07:16:43 h: 401  <nil>
+2024/02/07 07:16:43 h: 401  <nil>
+2024/02/07 07:16:43 h: 401  <nil>
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 Saving new user: publicUser
+2024/02/07 07:16:43 h: 401  <nil>
+2024/02/07 07:16:43 h: 401  <nil>
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/preview	0.128s
-?   	github.com/gtsteffaniak/filebrowser/backend/swagger/docs	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/tools	[no test files]
+ok  	github.com/gtsteffaniak/filebrowser/http	0.202s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/img	0.125s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/rules	0.002s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/runner	0.003s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/settings	0.005s
+?   	github.com/gtsteffaniak/filebrowser/share	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/storage	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/storage/bolt	[no test files]
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/users	0.003s
+?   	github.com/gtsteffaniak/filebrowser/version	[no test files]

backend/cmd/cli.go

@@ -1,369 +0,0 @@
-package cmd
-
-import (
-	"bufio"
-	"flag"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/goccy/go-yaml"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/version"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-var (
-	configPath string
-)
-
-// return bool to indicate if the program should continue running
-func runCLI() bool {
-
-	generateYaml()
-
-	// Global flags
-	var help bool
-	// Override the default usage output to use generalUsage()
-	flag.Usage = generalUsage
-	flag.StringVar(&configPath, "c", "", "Path to the config file, default: config.yaml")
-	flag.BoolVar(&help, "h", false, "Get help about commands")
-
-	if configPath == "" {
-		configPath = os.Getenv("FILEBROWSER_CONFIG")
-		// backwards compatibility in docker, prefer config.yaml if it exists
-		if configPath != "" {
-			_, err := os.Stat(configPath)
-			if err != nil {
-				logger.Fatalf("config file %v does not exist, please create it or set the FILEBROWSER_CONFIG environment variable to a valid config file path", configPath)
-			}
-		} else {
-			configPath = "config.yaml"
-		}
-	}
-
-	// Parse global flags (before subcommands)
-	flag.Parse() // print generalUsage on error
-
-	// Show help if requested
-	if help {
-		generalUsage()
-		return false
-	}
-
-	// Create a new FlagSet for the 'set' subcommand
-	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
-	var user, dbConfig string
-	var asAdmin bool
-
-	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
-	setCmd.BoolVar(&asAdmin, "a", false, "Create a user as admin user, used in combination with -u")
-	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
-
-	// Parse subcommand flags only if a subcommand is specified
-	if len(os.Args) > 1 {
-		switch os.Args[1] {
-		case "setup":
-			createConfig(configPath)
-			return false
-		case "set":
-			err := setCmd.Parse(os.Args[2:])
-			if err != nil {
-				setCmd.PrintDefaults()
-				os.Exit(1)
-			}
-			userInfo := strings.Split(user, ",")
-			if len(userInfo) < 2 {
-				fmt.Printf("not enough info to create user: \"set -u username,password\", only provided %v\n", userInfo)
-				setCmd.PrintDefaults()
-				os.Exit(1)
-			}
-			username := userInfo[0]
-			password := userInfo[1]
-			_ = getStore(dbConfig) // ignore bool check
-			user, err := store.Users.Get(username)
-			if err != nil {
-				newUser := users.User{
-					Username:    username,
-					LoginMethod: users.LoginMethodPassword,
-					NonAdminEditable: users.NonAdminEditable{
-						Password: password,
-					},
-				}
-				for _, source := range settings.Config.Server.SourceMap {
-					if source.Config.DefaultEnabled {
-						newUser.Scopes = append(newUser.Scopes, users.SourceScope{
-							Name:  source.Name,
-							Scope: source.Config.DefaultUserScope,
-						})
-					}
-				}
-
-				// Create the user logic
-				if asAdmin {
-					logger.Infof("Creating user as admin: %s\n", username)
-				} else {
-					logger.Infof("Creating non-admin user: %s\n", username)
-				}
-				newUser.Permissions = settings.Config.UserDefaults.Permissions
-				newUser.Permissions.Admin = asAdmin
-				err = storage.CreateUser(newUser)
-				if err != nil {
-					logger.Errorf("could not create user: %v", err)
-				}
-				return false
-			}
-			if user.LoginMethod != users.LoginMethodPassword {
-				logger.Fatalf("user %s is not allowed to login with password authentication, cannot set password", username)
-			}
-			user.Password = password
-			user.TOTPSecret = "" // reset TOTP secret if it exists
-			user.TOTPNonce = ""  // reset TOTP nonce if it exists
-			user.LoginMethod = users.LoginMethodPassword
-			if asAdmin {
-				user.Permissions.Admin = true
-			}
-			err = store.Users.Save(user, true, false)
-			if err != nil {
-				logger.Errorf("could not update user: %v", err)
-			}
-			fmt.Printf("successfully updated user: %s\n", username)
-			return false
-
-		case "version":
-			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
-	Version 	 : %v
-	Commit 		 : %v
-	Release Info 	 : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
-	`, version.Version, version.CommitSHA, version.Version)
-			return false
-		}
-	}
-	return true
-}
-
-// UserDefaults defines default settings for new users.
-type UserDefaults struct {
-	Permissions users.Permissions `yaml:"permissions"`
-}
-
-// Frontend defines settings related to the web interface.
-type Frontend struct {
-	Name string `yaml:"name,omitempty"`
-}
-
-// Source defines a directory to be served.
-type Source struct {
-	Name string `yaml:"name,omitempty"`
-	Path string `yaml:"path"`
-}
-
-// Server defines server-specific configurations.
-type Server struct {
-	Port     int         `yaml:"port"`
-	Database string      `yaml:"database"`
-	Sources  []Source    `yaml:"sources"`
-	Logging  []LogConfig `json:"logging"`
-}
-
-type LogConfig struct {
-	Levels    string `json:"levels"`    // separated list of log levels to enable. (eg. "info|warning|error|debug")
-	ApiLevels string `json:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
-	Output    string `json:"output"`    // output location. (eg. "stdout" or "path/to/file.log")
-	NoColors  bool   `json:"noColors"`  // disable colors in the output
-	Utc       bool   `json:"utc"`       // use UTC time in the output instead of local time
-}
-
-type Auth struct {
-	AdminUsername string `yaml:"adminUsername"`
-	AdminPassword string `yaml:"adminPassword"`
-}
-
-// Settings is the top-level configuration structure.
-type Settings struct {
-	Server       Server       `yaml:"server"`
-	Frontend     Frontend     `yaml:"frontend,omitempty"`
-	Auth         Auth         `yaml:"auth"`
-	UserDefaults UserDefaults `yaml:"userDefaults"`
-}
-
-// askQuestion displays a prompt and reads a line of input from the user.
-// It returns the defaultValue if the user's input is empty.
-func askQuestion(reader *bufio.Reader, prompt string, defaultValue string) string {
-	fmt.Printf("%s (default: %s): ", prompt, defaultValue)
-	input, _ := reader.ReadString('\n')
-	input = strings.TrimSpace(input)
-	if input == "" {
-		return defaultValue
-	}
-	return input
-}
-
-// askYesNoQuestion prompts the user with a yes/no question and returns a boolean.
-// It retries until valid input ("yes", "y", "no", "n") is received.
-// The defaultValue must be "yes" or "no".
-func askYesNoQuestion(reader *bufio.Reader, prompt string, defaultValue string) bool {
-	for {
-		answer := askQuestion(reader, prompt, defaultValue)
-		answer = strings.ToLower(answer)
-		if answer == "yes" || answer == "y" {
-			return true
-		}
-		if answer == "no" || answer == "n" {
-			return false
-		}
-		fmt.Println("Error: Invalid input. Please enter 'yes' or 'no'.")
-	}
-}
-
-// createConfig orchestrates the configuration process by asking the user a series of questions.
-func createConfig(configpath string) {
-	// check if config file exists
-	if _, err := os.Stat("config.yaml"); err == nil {
-		fmt.Println("Config file 'config.yaml' already exists, skipping setup.")
-		return
-	}
-	reader := bufio.NewReader(os.Stdin)
-	config := Settings{
-		Server: Server{
-			Logging: []LogConfig{
-				{
-					Levels:    "info|warning|error",
-					ApiLevels: "info|warning|error",
-					Output:    "stdout",
-					NoColors:  false,
-					Utc:       false,
-				},
-			},
-			Sources: []Source{
-				{
-					Path: "",
-				},
-			},
-		},
-	}
-
-	fmt.Println("--- Starting Configuration Setup ---")
-	realPath := ""
-	// 1. Ask for the source filesystem path (with validation)
-	for {
-		config.Server.Sources[0].Path = askQuestion(reader, "What is the source filesystem path?", "./")
-		// Convert relative path to absolute path
-		absolutePath, err := filepath.Abs(config.Server.Sources[0].Path)
-		if err == nil {
-			var isDir bool
-			// Resolve symlinks and get the real path
-			realPath, isDir, _ = iteminfo.ResolveSymlinks(absolutePath)
-			if realPath != "" && isDir {
-				break // Valid path found, exit loop
-			}
-		}
-		fmt.Printf("Error: The path '%s' does not exist or isn't valid. Please try again.\n", config.Server.Sources[0].Path)
-	}
-	// 2. Ask for the source name
-	defaultSourceName := filepath.Base(realPath)
-	sourceName := askQuestion(reader, "What should the first source name be?", defaultSourceName)
-	if sourceName != defaultSourceName {
-		config.Server.Sources[0].Name = sourceName
-	}
-
-	// 3. Ask for server port (with validation)
-	for {
-		portStr := askQuestion(reader, "What port should the server listen on?", "80")
-		port, err := strconv.Atoi(portStr)
-		if err == nil && (port >= 1 && port <= 65535) {
-			config.Server.Port = port
-			break // Port is valid, exit loop
-		}
-		fmt.Printf("Error: '%s' is not a valid port. Please enter a number between 1 and 65535.\n", portStr)
-	}
-
-	for {
-		levels := askQuestion(reader, "What should the log levels be?", "info|warning|error")
-		checkLevels := SplitByMultiple(levels)
-		invalidOptions := []string{}
-		for _, level := range checkLevels {
-			if !(level == "info" || level == "warning" || level == "error" || level == "debug") {
-				invalidOptions = append(invalidOptions, level)
-			}
-		}
-		if len(invalidOptions) == 0 {
-			break
-		}
-		fmt.Printf("Error: invalid options given '%s'. valid options: 'info|warning|error|debug'.\n", invalidOptions)
-	}
-
-	for {
-		config.Server.Database = askQuestion(reader, "What should the file name and path be for the database?", "./database.db")
-		if strings.HasSuffix(config.Server.Database, ".db") {
-			break // Valid path found, exit loop
-		}
-		fmt.Printf("Error: '%s' is not a valid path. Please enter a path to a file ending in .db", config.Server.Database)
-	}
-	// 4. Ask for the application brand name
-	config.Frontend.Name = askQuestion(reader, "What should the application brand name be?", "FileBrowser Quantum")
-
-	// 5. Ask for admin username and password
-	config.Auth.AdminUsername = askQuestion(reader, "What should the default admin username be?", "admin")
-	config.Auth.AdminPassword = askQuestion(reader, "What should the default admin password be?", "admin")
-
-	// 6. Ask boolean (Yes/No) questions using the helper
-	config.UserDefaults.Permissions.Modify = askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
-	config.UserDefaults.Permissions.Share = askYesNoQuestion(reader, "Should a new user be able to create shares by default?", "no")
-
-	fmt.Println("--- 	Configuration Complete 	---")
-
-	// marshall yaml and write to file
-	// Marshal the struct to YAML bytes
-	yamlData, err := yaml.Marshal(&config)
-	if err != nil {
-		return
-	}
-
-	// Write the YAML data to the file
-	err = os.WriteFile("config.yaml", yamlData, 0644) // 0644 provides read/write for owner, read for others
-	if err != nil {
-		return
-	}
-	// cleanup database if it exists
-	if _, err := os.Stat(config.Server.Database); err == nil {
-		response := askYesNoQuestion(reader, "Database specified already exists. Move database file to backup to start fresh?", "no")
-		if !response {
-			return
-		}
-		// move database file to backup
-		backupPath := config.Server.Database + ".bak"
-		err = os.Rename(config.Server.Database, backupPath)
-		if err != nil {
-			fmt.Printf("Error moving database file to backup: %v\n", err)
-		} else {
-			fmt.Printf("Database file moved to backup: %s\n", backupPath)
-		}
-	}
-
-}
-
-func generateYaml() {
-	if os.Getenv("FILEBROWSER_GENERATE_CONFIG") != "" {
-		logger.Info("Generating config.yaml")
-		settings.GenerateYaml()
-		os.Exit(0)
-	}
-}
-
-func SplitByMultiple(str string) []string {
-	delimiters := []rune{'|', ',', ' '}
-	return strings.FieldsFunc(str, func(r rune) bool {
-		for _, d := range delimiters {
-			if r == d {
-				return true
-			}
-		}
-		return false
-	})
-}

backend/cmd/dist/.gitignore

@@ -0,0 +1,4 @@
+# Ignore everything in this directory
+*
+# Except this file
+!.gitignore

backend/cmd/office.go

@@ -1,21 +0,0 @@
-package cmd
-
-import (
-	"net/http"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// healthcheck attempt to save test file against configured url
-func validateOfficeIntegration() {
-	if settings.Config.Integrations.OnlyOffice.Url != "" {
-		// get url health
-		// get request against the url
-		_, err := http.NewRequest("GET", settings.Config.Integrations.OnlyOffice.Url, nil)
-		if err != nil {
-			logger.Warning("Could not create request to only office Url, make sure its valid and running")
-			return
-		}
-	}
-}

backend/cmd/root.go

@@ -1,139 +1,179 @@
 package cmd
 
 import (
-	"context"
+	"crypto/tls"
+	"flag"
 	"fmt"
+	"io/fs"
+	"log"
+	"net"
+	"net/http"
 	"os"
 	"os/signal"
+	"strconv"
 	"syscall"
 
-	_ "net/http/pprof"
+	"embed"
 
-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/common/version"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
-	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/preview"
-	"github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
-	"github.com/gtsteffaniak/go-logger/logger"
-	"github.com/swaggo/swag"
+	"github.com/spf13/pflag"
+
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/auth"
+	"github.com/gtsteffaniak/filebrowser/diskcache"
+	"github.com/gtsteffaniak/filebrowser/files"
+	fbhttp "github.com/gtsteffaniak/filebrowser/http"
+	"github.com/gtsteffaniak/filebrowser/img"
+	"github.com/gtsteffaniak/filebrowser/settings"
+	"github.com/gtsteffaniak/filebrowser/users"
 )
 
-var store *bolt.BoltStore
+//go:embed dist/*
+var assets embed.FS
 
-func getStore(configFile string) bool {
-	// Use the config file (global flag)
-	settings.Initialize(configFile)
-	s, hasDB, err := storage.InitializeDb(settings.Config.Server.Database)
-	if err != nil {
-		logger.Fatalf("could not load db info: %v", err)
-	}
-	store = s
-	return hasDB
+var nonEmbededFS = os.Getenv("FILEBROWSER_NO_EMBEDED") == "true"
+
+type dirFS struct {
+	http.Dir
 }
 
-func generalUsage() {
-	fmt.Printf(`usage: ./filebrowser <command> [options]
-commands:
-	-h    	Print help
-	-c    	Print the default config file
-	version Print version information
-	set -u	Username and password for the new user
-	set -a	Create user as admin
-	set -s	Specify a user scope
-	set -h	Print this help message
-`)
+func (d dirFS) Open(name string) (fs.File, error) {
+	return d.Dir.Open(name)
+}
+
+func init() {
+	// Define a flag for the config option (-c or --config)
+	configFlag := pflag.StringP("config", "c", "filebrowser.yaml", "Path to the config file")
+	// Bind the flags to the pflag command line parser
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+	log.Println("Initializing with config file:", *configFlag)
+	log.Println("Embeded Frontend:", !nonEmbededFS)
+	settings.Initialize(*configFlag)
+}
+
+var rootCmd = &cobra.Command{
+	Use: "filebrowser",
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		serverConfig := settings.Config.Server
+		if !d.hadDB {
+			quickSetup(d)
+		}
+		if serverConfig.NumImageProcessors < 1 {
+			log.Fatal("Image resize workers count could not be < 1")
+		}
+		imgSvc := img.New(serverConfig.NumImageProcessors)
+		var fileCache diskcache.Interface = diskcache.NewNoOp()
+		cacheDir := "/tmp"
+		if cacheDir != "" {
+			if err := os.MkdirAll(cacheDir, 0700); err != nil { //nolint:govet,gomnd
+				log.Fatalf("can't make directory %s: %s", cacheDir, err)
+			}
+			fileCache = diskcache.New(afero.NewOsFs(), cacheDir)
+		}
+		// initialize indexing and schedule indexing ever n minutes (default 5)
+		go files.InitializeIndex(serverConfig.IndexingInterval, serverConfig.Indexing)
+		_, err := os.Stat(serverConfig.Root)
+		checkErr(fmt.Sprint("cmd os.Stat ", serverConfig.Root), err)
+		var listener net.Listener
+		address := serverConfig.Address + ":" + strconv.Itoa(serverConfig.Port)
+		switch {
+		case serverConfig.Socket != "":
+			listener, err = net.Listen("unix", serverConfig.Socket)
+			checkErr("net.Listen", err)
+			socketPerm, err := cmd.Flags().GetUint32("socket-perm") //nolint:govet
+			checkErr("cmd.Flags().GetUint32", err)
+			err = os.Chmod(serverConfig.Socket, os.FileMode(socketPerm))
+			checkErr("os.Chmod", err)
+		case serverConfig.TLSKey != "" && serverConfig.TLSCert != "":
+			cer, err := tls.LoadX509KeyPair(serverConfig.TLSCert, serverConfig.TLSKey) //nolint:govet
+			checkErr("tls.LoadX509KeyPair", err)
+			listener, err = tls.Listen("tcp", address, &tls.Config{
+				MinVersion:   tls.VersionTLS12,
+				Certificates: []tls.Certificate{cer}},
+			)
+			checkErr("tls.Listen", err)
+		default:
+			listener, err = net.Listen("tcp", address)
+			checkErr("net.Listen", err)
+		}
+		sigc := make(chan os.Signal, 1)
+		signal.Notify(sigc, os.Interrupt, syscall.SIGTERM)
+		go cleanupHandler(listener, sigc)
+		if !nonEmbededFS {
+			assetsFs, err := fs.Sub(assets, "dist")
+			if err != nil {
+				log.Fatal("Could not embed frontend. Does backend/cmd/dist exist? Must be built and exist first")
+			}
+			handler, err := fbhttp.NewHandler(imgSvc, fileCache, d.store, &serverConfig, assetsFs)
+			checkErr("fbhttp.NewHandler", err)
+			defer listener.Close()
+			log.Println("Listening on", listener.Addr().String())
+			//nolint: gosec
+			if err := http.Serve(listener, handler); err != nil {
+				log.Fatalf("Could not start server on port %d: %v", serverConfig.Port, err)
+			}
+		} else {
+			assetsFs := dirFS{Dir: http.Dir("frontend/dist")}
+			handler, err := fbhttp.NewHandler(imgSvc, fileCache, d.store, &serverConfig, assetsFs)
+			checkErr("fbhttp.NewHandler", err)
+			defer listener.Close()
+			log.Println("Listening on", listener.Addr().String())
+			//nolint: gosec
+			if err := http.Serve(listener, handler); err != nil {
+				log.Fatalf("Could not start server on port %d: %v", serverConfig.Port, err)
+			}
+		}
+
+	}, pythonConfig{allowNoDB: true}),
 }
 
 func StartFilebrowser() {
-	keepGoing := runCLI()
-	if !keepGoing {
-		return
+	if err := rootCmd.Execute(); err != nil {
+		log.Fatal("Error starting filebrowser:", err)
 	}
-	if !settings.Config.Server.DisableUpdateCheck {
-		info, _ := utils.CheckForUpdates()
-		if info.LatestVersion != "" {
-			logger.Infof("A new version is available: %s (current: %s)", info.LatestVersion, info.CurrentVersion)
-			logger.Infof("Release notes: %s", info.ReleaseNotes)
-		}
-		go utils.StartCheckForUpdates()
-	}
-
-	// Create context and channels for graceful shutdown
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	signalChan := make(chan os.Signal, 1)
-	signal.Notify(signalChan, syscall.SIGINT, syscall.SIGTERM)
-
-	done := make(chan struct{})             // Signals server has stopped
-	shutdownComplete := make(chan struct{}) // Signals shutdown process is complete
-	dbExists := getStore(configPath)
-	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
-	if !dbExists {
-		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
-	}
-	sourceList := []string{}
-	for path, source := range settings.Config.Server.SourceMap {
-		sourceList = append(sourceList, fmt.Sprintf("%v: %v", source.Name, path))
-	}
-	logger.Infof("Initializing FileBrowser Quantum (%v)", version.Version)
-	logger.Infof("Using Config file        : %v", configPath)
-	logger.Infof("Auth Methods             : %v", settings.Config.Auth.AuthMethods)
-	logger.Info(database)
-	logger.Infof("Sources                  : %v", sourceList)
-
-	serverConfig := settings.Config.Server
-	swagInfo := docs.SwaggerInfo
-	swagInfo.BasePath = serverConfig.BaseURL
-	swag.Register(docs.SwaggerInfo.InstanceName(), swagInfo)
-	// initialize indexing and schedule indexing ever n minutes (default 5)
-	if len(settings.Config.Server.SourceMap) == 0 {
-		logger.Fatal("No sources configured, exiting...")
-	}
-	for _, source := range settings.Config.Server.SourceMap {
-		go indexing.Initialize(source, false)
-	}
-	validateUserInfo()
-	validateOfficeIntegration()
-	// Start the rootCMD in a goroutine
-	go func() {
-		if err := rootCMD(ctx, store, &serverConfig, shutdownComplete); err != nil {
-			logger.Fatalf("Error starting filebrowser: %v", err)
-		}
-		close(done) // Signal that the server has stopped
-	}()
-	// Wait for a shutdown signal or the server to stop
-	select {
-	case <-signalChan:
-		logger.Info("Received shutdown signal. Shutting down gracefully...")
-		cancel() // Trigger context cancellation
-	case <-done:
-		logger.Info("Server stopped unexpectedly. Shutting down...")
-	}
-	fileutils.ClearCacheDir()
-
-	<-shutdownComplete // Ensure we don't exit prematurely
-	// Wait for the server to stop
-	logger.Info("Shutdown complete.")
 }
 
-func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.Server, shutdownComplete chan struct{}) error {
-	if serverConfig.NumImageProcessors < 1 {
-		logger.Fatal("Image resize workers count could not be < 1")
-	}
-	cacheDir := settings.Config.Server.CacheDir
-	numWorkers := settings.Config.Server.NumImageProcessors
-	ffpmpegPath := settings.Config.Integrations.Media.FfmpegPath
-	// setup disk cache
-	err := preview.StartPreviewGenerator(numWorkers, ffpmpegPath, cacheDir)
-	if err != nil {
-		logger.Fatalf("Error starting preview service: %v", err)
-	}
-	fbhttp.StartHttp(ctx, store, shutdownComplete)
-	return nil
+func cleanupHandler(listener net.Listener, c chan os.Signal) { //nolint:interfacer
+	sig := <-c
+	log.Printf("Caught signal %s: shutting down.", sig)
+	listener.Close()
+	os.Exit(0)
+}
+
+func quickSetup(d pythonData) {
+	settings.Config.Auth.Key = generateKey()
+	if settings.Config.Auth.Method == "noauth" {
+		err := d.store.Auth.Save(&auth.NoAuth{})
+		checkErr("d.store.Auth.Save", err)
+	} else {
+		settings.Config.Auth.Method = "password"
+		err := d.store.Auth.Save(&auth.JSONAuth{})
+		checkErr("d.store.Auth.Save", err)
+	}
+	err := d.store.Settings.Save(&settings.Config)
+	checkErr("d.store.Settings.Save", err)
+	err = d.store.Settings.SaveServer(&settings.Config.Server)
+	checkErr("d.store.Settings.SaveServer", err)
+	user := &users.User{}
+	settings.Config.UserDefaults.Apply(user)
+	user.Username = settings.Config.Auth.AdminUsername
+	user.Password = settings.Config.Auth.AdminPassword
+	user.Perm.Admin = true
+	user.Scope = "./"
+	user.DarkMode = true
+	user.ViewMode = "normal"
+	user.LockPassword = false
+	user.Perm = users.Permissions{
+		Create:   true,
+		Rename:   true,
+		Modify:   true,
+		Delete:   true,
+		Share:    true,
+		Download: true,
+		Admin:    true,
+	}
+	err = d.store.Users.Save(user)
+	checkErr("d.store.Users.Save", err)
 }

backend/cmd/rule_rm.go

@@ -0,0 +1,66 @@
+package cmd
+
+import (
+	"strconv"
+
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/settings"
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+func init() {
+	rulesCmd.AddCommand(rulesRmCommand)
+	rulesRmCommand.Flags().Uint("index", 0, "index of rule to remove")
+	_ = rulesRmCommand.MarkFlagRequired("index")
+}
+
+var rulesRmCommand = &cobra.Command{
+	Use:   "rm <index> [index_end]",
+	Short: "Remove a global rule or user rule",
+	Long: `Remove a global rule or user rule. The provided index
+is the same that's printed when you run 'rules ls'. Note
+that after each removal/addition, the index of the
+commands change. So be careful when removing them after each
+other.
+
+You can also specify an optional parameter (index_end) so
+you can remove all commands from 'index' to 'index_end',
+including 'index_end'.`,
+	Args: func(cmd *cobra.Command, args []string) error {
+		if err := cobra.RangeArgs(1, 2)(cmd, args); err != nil { //nolint:gomnd
+			return err
+		}
+
+		for _, arg := range args {
+			if _, err := strconv.Atoi(arg); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	},
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		i, err := strconv.Atoi(args[0])
+		checkErr("strconv.Atoi", err)
+		f := i
+		if len(args) == 2 { //nolint:gomnd
+			f, err = strconv.Atoi(args[1])
+			checkErr("strconv.Atoi", err)
+		}
+
+		user := func(u *users.User) {
+			u.Rules = append(u.Rules[:i], u.Rules[f+1:]...)
+			err := d.store.Users.Save(u)
+			checkErr("d.store.Users.Save", err)
+		}
+
+		global := func(s *settings.Settings) {
+			s.Rules = append(s.Rules[:i], s.Rules[f+1:]...)
+			err := d.store.Settings.Save(s)
+			checkErr("d.store.Settings.Save", err)
+		}
+
+		runRules(d.store, cmd, user, global)
+	}, pythonConfig{}),
+}

backend/cmd/rules.go

@@ -0,0 +1,92 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+
+	"github.com/gtsteffaniak/filebrowser/rules"
+	"github.com/gtsteffaniak/filebrowser/settings"
+	"github.com/gtsteffaniak/filebrowser/storage"
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+func init() {
+	rootCmd.AddCommand(rulesCmd)
+	rulesCmd.PersistentFlags().StringP("username", "u", "", "username of user to which the rules apply")
+	rulesCmd.PersistentFlags().UintP("id", "i", 0, "id of user to which the rules apply")
+}
+
+var rulesCmd = &cobra.Command{
+	Use:   "rules",
+	Short: "Rules management utility",
+	Long: `On each subcommand you'll have available at least two flags:
+"username" and "id". You must either set only one of them
+or none. If you set one of them, the command will apply to
+an user, otherwise it will be applied to the global set or
+rules.`,
+	Args: cobra.NoArgs,
+}
+
+func runRules(st *storage.Storage, cmd *cobra.Command, usersFn func(*users.User), globalFn func(*settings.Settings)) {
+	id := getUserIdentifier(cmd.Flags())
+	if id != nil {
+		user, err := st.Users.Get("", id)
+		checkErr("st.Users.Get", err)
+
+		if usersFn != nil {
+			usersFn(user)
+		}
+
+		printRules(user.Rules, id)
+		return
+	}
+
+	s, err := st.Settings.Get()
+	checkErr("st.Settings.Get", err)
+
+	if globalFn != nil {
+		globalFn(s)
+	}
+
+	printRules(s.Rules, id)
+}
+
+func getUserIdentifier(flags *pflag.FlagSet) interface{} {
+	id := mustGetUint(flags, "id")
+	username := mustGetString(flags, "username")
+
+	if id != 0 {
+		return id
+	} else if username != "" {
+		return username
+	}
+
+	return nil
+}
+
+func printRules(rulez []rules.Rule, id interface{}) {
+	if id == nil {
+		fmt.Printf("Global Rules:\n\n")
+	} else {
+		fmt.Printf("Rules for user %v:\n\n", id)
+	}
+
+	for id, rule := range rulez {
+		fmt.Printf("(%d) ", id)
+		if rule.Regex {
+			if rule.Allow {
+				fmt.Printf("Allow Regex: \t%s\n", rule.Regexp.Raw)
+			} else {
+				fmt.Printf("Disallow Regex: \t%s\n", rule.Regexp.Raw)
+			}
+		} else {
+			if rule.Allow {
+				fmt.Printf("Allow Path: \t%s\n", rule.Path)
+			} else {
+				fmt.Printf("Disallow Path: \t%s\n", rule.Path)
+			}
+		}
+	}
+}

backend/cmd/rules_add.go

@@ -0,0 +1,58 @@
+package cmd
+
+import (
+	"regexp"
+
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/rules"
+	"github.com/gtsteffaniak/filebrowser/settings"
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+func init() {
+	rulesCmd.AddCommand(rulesAddCmd)
+	rulesAddCmd.Flags().BoolP("allow", "a", false, "indicates this is an allow rule")
+	rulesAddCmd.Flags().BoolP("regex", "r", false, "indicates this is a regex rule")
+}
+
+var rulesAddCmd = &cobra.Command{
+	Use:   "add <path|expression>",
+	Short: "Add a global rule or user rule",
+	Long:  `Add a global rule or user rule.`,
+	Args:  cobra.ExactArgs(1),
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		allow := mustGetBool(cmd.Flags(), "allow")
+		regex := mustGetBool(cmd.Flags(), "regex")
+		exp := args[0]
+
+		if regex {
+			regexp.MustCompile(exp)
+		}
+
+		rule := rules.Rule{
+			Allow: allow,
+			Regex: regex,
+		}
+
+		if regex {
+			rule.Regexp = &rules.Regexp{Raw: exp}
+		} else {
+			rule.Path = exp
+		}
+
+		user := func(u *users.User) {
+			u.Rules = append(u.Rules, rule)
+			err := d.store.Users.Save(u)
+			checkErr("d.store.Users.Save", err)
+		}
+
+		global := func(s *settings.Settings) {
+			s.Rules = append(s.Rules, rule)
+			err := d.store.Settings.Save(s)
+			checkErr("d.store.Settings.Save", err)
+		}
+
+		runRules(d.store, cmd, user, global)
+	}, pythonConfig{}),
+}

backend/cmd/rules_ls.go

@@ -0,0 +1,19 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rulesCmd.AddCommand(rulesLsCommand)
+}
+
+var rulesLsCommand = &cobra.Command{
+	Use:   "ls",
+	Short: "List global rules or user specific rules",
+	Long:  `List global rules or user specific rules.`,
+	Args:  cobra.NoArgs,
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		runRules(d.store, cmd, nil, nil)
+	}, pythonConfig{}),
+}

backend/cmd/user.go

@@ -1,154 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"reflect"
-
-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-var createBackup = []bool{}
-
-func validateUserInfo() {
-	// update source info for users if names/sources/paths might have changed
-	usersList, err := store.Users.Gets()
-	if err != nil {
-		logger.Fatalf("could not load users: %v", err)
-	}
-	for _, user := range usersList {
-		changePass := false
-		updateUser := false
-		if updateUserScopes(user) {
-			updateUser = true
-		}
-		if updatePermissions(user) {
-			updateUser = true
-		}
-		if updatePreviewSettings(user) {
-			updateUser = true
-		}
-		if updateLoginType(user) {
-			updateUser = true
-		}
-		adminUser := settings.Config.Auth.AdminUsername
-		adminPass := settings.Config.Auth.AdminPassword
-		passwordEnabled := settings.Config.Auth.Methods.PasswordAuth.Enabled
-		if user.Username == adminUser && adminPass != "" && passwordEnabled {
-			logger.Info("Resetting admin user to default username and password.")
-			user.Permissions.Admin = true
-			user.Password = settings.Config.Auth.AdminPassword
-			updateUser = true
-			changePass = true
-		}
-		if updateUser {
-			if len(createBackup) == 1 {
-				logger.Warning("Incompatible user settings detected, creating backup of database before converting.")
-				err = fileutils.CopyFile(settings.Config.Server.Database, fmt.Sprintf("%s.bak", settings.Config.Server.Database))
-				if err != nil {
-					logger.Fatalf("Unable to create automatic backup of database due to error: %v", err)
-				}
-			}
-			err := store.Users.Save(user, changePass, true)
-			if err != nil {
-				logger.Errorf("could not update user: %v", err)
-			}
-		}
-	}
-}
-
-func updateUserScopes(user *users.User) bool {
-	newScopes := []users.SourceScope{}
-	seen := make(map[string]struct{})
-
-	// Build map for existing scopes by Name
-	existing := make(map[string]users.SourceScope)
-	for _, s := range user.Scopes {
-		existing[s.Name] = s
-	}
-
-	// Preserve order by using Config.Server.Sources
-	for _, src := range settings.Config.Server.Sources {
-		realsource, ok := settings.Config.Server.NameToSource[src.Name]
-		if !ok {
-			continue
-		}
-		existingScope, ok := existing[realsource.Path]
-		if ok {
-			// If scope is empty and there's a default, apply default
-			if existingScope.Scope == "" {
-				existingScope.Scope = src.Config.DefaultUserScope
-			}
-		} else if realsource.Config.DefaultEnabled {
-			existingScope.Scope = realsource.Config.DefaultUserScope
-		} else {
-			continue
-		}
-
-		newScopes = append(newScopes, users.SourceScope{
-			Name:  realsource.Path,
-			Scope: existingScope.Scope,
-		})
-		seen[realsource.Path] = struct{}{}
-	}
-
-	// Preserve user-defined scopes not matching current sources, append to end
-	for _, s := range user.Scopes {
-		if _, ok := seen[s.Name]; !ok {
-			newScopes = append(newScopes, s)
-		}
-	}
-	changed := !reflect.DeepEqual(user.Scopes, newScopes)
-	user.Scopes = newScopes
-	return changed
-}
-
-// func to convert legacy user with perm key to permissions
-func updatePermissions(user *users.User) bool {
-	updateUser := false
-	// if any keys are true, set the permissions to true
-	if user.Perm.Api {
-		user.Permissions.Api = true
-		user.Perm.Api = false
-		updateUser = true
-	}
-	if user.Perm.Admin {
-		user.Permissions.Admin = true
-		user.Perm.Admin = false
-		updateUser = true
-	}
-	if user.Perm.Modify {
-		user.Permissions.Modify = true
-		user.Perm.Modify = false
-		updateUser = true
-	}
-	if user.Perm.Share {
-		user.Permissions.Share = true
-		user.Perm.Share = false
-		updateUser = true
-	}
-	if updateUser {
-		createBackup = append(createBackup, true)
-	}
-	return updateUser
-}
-
-func updateLoginType(user *users.User) bool {
-	if user.LoginMethod == "" {
-		user.LoginMethod = users.LoginMethodPassword
-		return true
-	}
-	return false
-}
-
-func updatePreviewSettings(user *users.User) bool {
-	// if user hasn't been updated yet
-	if user.LoginMethod == "" {
-		user.Preview.Image = true
-		user.Preview.PopUp = true
-		return true
-	}
-	return false
-}

backend/cmd/user_test.go

@@ -1,182 +0,0 @@
-package cmd
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUpdateUserScopes_Phases(t *testing.T) {
-
-	sourceA := settings.Source{Path: "/pathA", Name: "sourceA", Config: settings.SourceConfig{
-		DefaultEnabled:   false,
-		DefaultUserScope: "/defaultA",
-	}}
-	sourceB := settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
-	settings.Config.Server.Sources = []settings.Source{sourceA, sourceB}
-	settings.Config.Server.SourceMap = map[string]settings.Source{
-		"/pathA": sourceA,
-		"/pathB": sourceB,
-	}
-	settings.Config.Server.NameToSource = map[string]settings.Source{
-		"sourceA": sourceA,
-		"sourceB": sourceB,
-	}
-
-	// ---------------------
-	// Test Cases Definition
-	// ---------------------
-	testCases := []struct {
-		name           string
-		user           *users.User
-		expectedPhase1 []users.SourceScope
-		expectedPhase2 []users.SourceScope
-	}{
-		{
-			name: "Single valid scope",
-			user: &users.User{
-				Scopes: []users.SourceScope{
-					{Scope: "/home", Name: "/pathA"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/home", Name: "/pathA"},
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/home", Name: "/pathA"},
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-		},
-		{
-			name: "Single empty scope path",
-			user: &users.User{
-				Scopes: []users.SourceScope{
-					{Scope: "", Name: "/pathB"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/defaultA", Name: "/pathA"},
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-		},
-		{
-			name: "Two scopes, one includes username in path",
-			user: &users.User{
-				Username: "user123",
-				Scopes: []users.SourceScope{
-					{Scope: "/home/user123", Name: "/pathA"},
-					{Scope: "/data", Name: "/pathB"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/home/user123", Name: "/pathA"},
-				{Scope: "/data", Name: "/pathB"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/home/user123", Name: "/pathA"},
-				{Scope: "/data", Name: "/pathB"},
-			},
-		},
-		{
-			name: "Two scopes, one with empty name",
-			user: &users.User{
-				Scopes: []users.SourceScope{
-					{Scope: "/home", Name: "/pathB"},
-					{Scope: "/data", Name: "/somethingElse"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/home", Name: "/pathB"},
-				{Scope: "/data", Name: "/somethingElse"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/defaultA", Name: "/pathA"},
-				{Scope: "/home", Name: "/pathB"},
-				{Scope: "/data", Name: "/somethingElse"},
-			},
-		},
-		{
-			name: "No scopes at all",
-			user: &users.User{
-				Scopes: []users.SourceScope{},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/defaultA", Name: "/pathA"},
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-		},
-		{
-			name: "All user Scope and source change",
-			user: &users.User{
-				Username: "user123",
-				Scopes: []users.SourceScope{
-					{Scope: "/defaultC/user123", Name: "/pathC"},
-					{Scope: "/defaultA/user123", Name: "/pathA"},
-					{Scope: "/defaultB/user123", Name: "/pathB"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/defaultA/user123", Name: "/pathA"},
-				{Scope: "/defaultB/user123", Name: "/pathB"},
-				{Scope: "/defaultC/user123", Name: "/pathC"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/defaultA/user123", Name: "/pathA"},
-				{Scope: "/defaultB/user123", Name: "/pathB"},
-				{Scope: "/defaultC/user123", Name: "/pathC"},
-			},
-		},
-	}
-
-	// ---------------------
-	// Phase 1 Tests
-	// ---------------------
-	for _, tc := range testCases {
-		t.Run(tc.name+"_Phase1", func(t *testing.T) {
-			originalScopes := tc.user.Scopes
-			updated := updateUserScopes(tc.user)
-			assert.Equal(t, tc.expectedPhase1, tc.user.Scopes, "Phase1 scope mismatch for test case: %s", tc.name)
-			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.Scopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.Scopes, tc.expectedPhase1)
-		})
-	}
-
-	// ---------------------
-	// Phase 2: rename sources but keep same paths
-	// ---------------------
-	sourceA = settings.Source{Path: "/pathA", Name: "sourceA", Config: settings.SourceConfig{
-		DefaultEnabled:   true,
-		DefaultUserScope: "/defaultA",
-		CreateUserDir:    true,
-	}}
-	sourceB = settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
-	settings.Config.Server.Sources = []settings.Source{sourceA, sourceB}
-	settings.Config.Server.SourceMap = map[string]settings.Source{
-		"/pathA": sourceA,
-		"/pathB": sourceB,
-	}
-	settings.Config.Server.NameToSource = map[string]settings.Source{
-		"sourceA": sourceA,
-		"sourceB": sourceB,
-	}
-
-	// Run again without resetting user objects to test idempotency + renaming
-	for _, tc := range testCases {
-		t.Run(tc.name+"_Phase2", func(t *testing.T) {
-			originalScopes := tc.user.Scopes
-			updated := updateUserScopes(tc.user)
-			assert.Equal(t, tc.expectedPhase2, tc.user.Scopes, "Phase2 scope mismatch for test case: %s", tc.name)
-			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.Scopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.Scopes, tc.expectedPhase1)
-
-		})
-	}
-}

backend/cmd/users.go

@@ -0,0 +1,58 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"text/tabwriter"
+
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+func init() {
+	rootCmd.AddCommand(usersCmd)
+}
+
+var usersCmd = &cobra.Command{
+	Use:   "users",
+	Short: "Users management utility",
+	Long:  `Users management utility.`,
+	Args:  cobra.NoArgs,
+}
+
+func printUsers(usrs []*users.User) {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0) //nolint:gomnd
+	fmt.Fprintln(w, "ID\tUsername\tScope\tLocale\tV. Mode\tS.Click\tAdmin\tExecute\tCreate\tRename\tModify\tDelete\tShare\tDownload\tPwd Lock")
+
+	for _, u := range usrs {
+		fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t\n",
+			u.ID,
+			u.Username,
+			u.Scope,
+			u.Locale,
+			u.ViewMode,
+			u.SingleClick,
+			u.Perm.Admin,
+			u.Perm.Execute,
+			u.Perm.Create,
+			u.Perm.Rename,
+			u.Perm.Modify,
+			u.Perm.Delete,
+			u.Perm.Share,
+			u.Perm.Download,
+			u.LockPassword,
+		)
+	}
+
+	w.Flush()
+}
+
+func parseUsernameOrID(arg string) (username string, id uint) {
+	id64, err := strconv.ParseUint(arg, 10, 64)
+	if err != nil {
+		return arg, 0
+	}
+	return "", uint(id64)
+}

backend/cmd/users_add.go

@@ -0,0 +1,40 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+func init() {
+	usersCmd.AddCommand(usersAddCmd)
+}
+
+var usersAddCmd = &cobra.Command{
+	Use:   "add <username> <password>",
+	Short: "Create a new user",
+	Long:  `Create a new user and add it to the database.`,
+	Args:  cobra.ExactArgs(2), //nolint:gomnd
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		user := &users.User{
+			Username:     args[0],
+			Password:     args[1],
+			LockPassword: mustGetBool(cmd.Flags(), "lockPassword"),
+		}
+		servSettings, err := d.store.Settings.GetServer()
+		checkErr("d.store.Settings.GetServer()", err)
+		// since getUserDefaults() polluted s.Defaults.Scope
+		// which makes the Scope not the one saved in the db
+		// we need the right s.Defaults.Scope here
+		s2, err := d.store.Settings.Get()
+		checkErr("d.store.Settings.Get()", err)
+
+		userHome, err := s2.MakeUserDir(user.Username, user.Scope, servSettings.Root)
+		checkErr("s2.MakeUserDir", err)
+		user.Scope = userHome
+
+		err = d.store.Users.Save(user)
+		checkErr("d.store.Users.Save", err)
+		printUsers([]*users.User{user})
+	}, pythonConfig{}),
+}

backend/cmd/users_export.go

@@ -0,0 +1,24 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	usersCmd.AddCommand(usersExportCmd)
+}
+
+var usersExportCmd = &cobra.Command{
+	Use:   "export <path>",
+	Short: "Export all users to a file.",
+	Long: `Export all users to a json or yaml file. Please indicate the
+path to the file where you want to write the users.`,
+	Args: jsonYamlArg,
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		list, err := d.store.Users.Gets("")
+		checkErr("d.store.Users.Gets", err)
+
+		err = marshal(args[0], list)
+		checkErr("marshal", err)
+	}, pythonConfig{}),
+}

backend/cmd/users_find.go

@@ -0,0 +1,51 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+func init() {
+	usersCmd.AddCommand(usersFindCmd)
+	usersCmd.AddCommand(usersLsCmd)
+}
+
+var usersFindCmd = &cobra.Command{
+	Use:   "find <id|username>",
+	Short: "Find a user by username or id",
+	Long:  `Find a user by username or id. If no flag is set, all users will be printed.`,
+	Args:  cobra.ExactArgs(1),
+	Run:   findUsers,
+}
+
+var usersLsCmd = &cobra.Command{
+	Use:   "ls",
+	Short: "List all users.",
+	Args:  cobra.NoArgs,
+	Run:   findUsers,
+}
+
+var findUsers = python(func(cmd *cobra.Command, args []string, d pythonData) {
+	var (
+		list []*users.User
+		user *users.User
+		err  error
+	)
+
+	if len(args) == 1 {
+		username, id := parseUsernameOrID(args[0])
+		if username != "" {
+			user, err = d.store.Users.Get("", username)
+		} else {
+			user, err = d.store.Users.Get("", id)
+		}
+
+		list = []*users.User{user}
+	} else {
+		list, err = d.store.Users.Gets("")
+	}
+
+	checkErr("findUsers", err)
+	printUsers(list)
+}, pythonConfig{})

backend/cmd/users_import.go

@@ -0,0 +1,91 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+func init() {
+	usersCmd.AddCommand(usersImportCmd)
+	usersImportCmd.Flags().Bool("overwrite", false, "overwrite users with the same id/username combo")
+	usersImportCmd.Flags().Bool("replace", false, "replace the entire user base")
+}
+
+var usersImportCmd = &cobra.Command{
+	Use:   "import <path>",
+	Short: "Import users from a file",
+	Long: `Import users from a file. The path must be for a json or yaml
+file. You can use this command to import new users to your
+installation. For that, just don't place their ID on the files
+list or set it to 0.`,
+	Args: jsonYamlArg,
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		fd, err := os.Open(args[0])
+		checkErr("os.Open", err)
+		defer fd.Close()
+
+		list := []*users.User{}
+		err = unmarshal(args[0], &list)
+		checkErr("unmarshal", err)
+
+		for _, user := range list {
+			err = user.Clean("")
+			checkErr("Clean", err)
+		}
+
+		if mustGetBool(cmd.Flags(), "replace") {
+			oldUsers, err := d.store.Users.Gets("")
+			checkErr("d.store.Users.Gets", err)
+
+			err = marshal("users.backup.json", list)
+			checkErr("marshal users.backup.json", err)
+
+			for _, user := range oldUsers {
+				err = d.store.Users.Delete(user.ID)
+				checkErr("d.store.Users.Delete", err)
+			}
+		}
+
+		overwrite := mustGetBool(cmd.Flags(), "overwrite")
+
+		for _, user := range list {
+			onDB, err := d.store.Users.Get("", user.ID)
+
+			// User exists in DB.
+			if err == nil {
+				if !overwrite {
+					newErr := errors.New("user " + strconv.Itoa(int(user.ID)) + " is already registered")
+					checkErr("", newErr)
+				}
+
+				// If the usernames mismatch, check if there is another one in the DB
+				// with the new username. If there is, print an error and cancel the
+				// operation
+				if user.Username != onDB.Username {
+					if conflictuous, err := d.store.Users.Get("", user.Username); err == nil { //nolint:govet
+						newErr := usernameConflictError(user.Username, conflictuous.ID, user.ID)
+						checkErr("usernameConflictError", newErr)
+					}
+				}
+			} else {
+				// If it doesn't exist, set the ID to 0 to automatically get a new
+				// one that make sense in this DB.
+				user.ID = 0
+			}
+
+			err = d.store.Users.Save(user)
+			checkErr("d.store.Users.Save", err)
+		}
+	}, pythonConfig{}),
+}
+
+func usernameConflictError(username string, originalID, newID uint) error {
+	return fmt.Errorf(`can't import user with ID %d and username "%s" because the username is already registred with the user %d`,
+		newID, username, originalID)
+}

backend/cmd/users_rm.go

@@ -0,0 +1,31 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	usersCmd.AddCommand(usersRmCmd)
+}
+
+var usersRmCmd = &cobra.Command{
+	Use:   "rm <id|username>",
+	Short: "Delete a user by username or id",
+	Long:  `Delete a user by username or id`,
+	Args:  cobra.ExactArgs(1),
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		username, id := parseUsernameOrID(args[0])
+		var err error
+
+		if username != "" {
+			err = d.store.Users.Delete(username)
+		} else {
+			err = d.store.Users.Delete(id)
+		}
+
+		checkErr("usersRmCmd", err)
+		fmt.Println("user deleted successfully")
+	}, pythonConfig{}),
+}

backend/cmd/users_update.go

@@ -0,0 +1,38 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/users"
+)
+
+func init() {
+	usersCmd.AddCommand(usersUpdateCmd)
+}
+
+var usersUpdateCmd = &cobra.Command{
+	Use:   "update <id|username>",
+	Short: "Updates an existing user",
+	Long: `Updates an existing user. Set the flags for the
+options you want to change.`,
+	Args: cobra.ExactArgs(1),
+	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
+		username, id := parseUsernameOrID(args[0])
+
+		var (
+			err  error
+			user *users.User
+		)
+
+		if id != 0 {
+			user, err = d.store.Users.Get("", id)
+		} else {
+			user, err = d.store.Users.Get("", username)
+		}
+		checkErr("d.store.Users.Get", err)
+
+		err = d.store.Users.Update(user)
+		checkErr("d.store.Users.Update", err)
+		printUsers([]*users.User{user})
+	}, pythonConfig{}),
+}

backend/cmd/utils.go

@@ -0,0 +1,154 @@
+package cmd
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+
+	"github.com/asdine/storm/v3"
+	"github.com/goccy/go-yaml"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+
+	"github.com/gtsteffaniak/filebrowser/settings"
+	"github.com/gtsteffaniak/filebrowser/storage"
+	"github.com/gtsteffaniak/filebrowser/storage/bolt"
+)
+
+func checkErr(source string, err error) {
+	if err != nil {
+		log.Fatalf("%s: %v", source, err)
+	}
+}
+
+func mustGetString(flags *pflag.FlagSet, flag string) string {
+	s, err := flags.GetString(flag)
+	checkErr("mustGetString", err)
+	return s
+}
+
+func mustGetBool(flags *pflag.FlagSet, flag string) bool {
+	b, err := flags.GetBool(flag)
+	checkErr("mustGetBool", err)
+	return b
+}
+
+func mustGetUint(flags *pflag.FlagSet, flag string) uint {
+	b, err := flags.GetUint(flag)
+	checkErr("mustGetUint", err)
+	return b
+}
+
+func generateKey() []byte {
+	k, err := settings.GenerateKey()
+	checkErr("generateKey", err)
+	return k
+}
+
+type cobraFunc func(cmd *cobra.Command, args []string)
+type pythonFunc func(cmd *cobra.Command, args []string, data pythonData)
+
+type pythonConfig struct {
+	noDB      bool
+	allowNoDB bool
+}
+
+type pythonData struct {
+	hadDB bool
+	store *storage.Storage
+}
+
+func dbExists(path string) (bool, error) {
+	stat, err := os.Stat(path)
+	if err == nil {
+		return stat.Size() != 0, nil
+	}
+
+	if os.IsNotExist(err) {
+		d := filepath.Dir(path)
+		_, err = os.Stat(d)
+		if os.IsNotExist(err) {
+			if err := os.MkdirAll(d, 0700); err != nil { //nolint:govet,gomnd
+				return false, err
+			}
+			return false, nil
+		}
+	}
+
+	return false, err
+}
+
+func python(fn pythonFunc, cfg pythonConfig) cobraFunc {
+	return func(cmd *cobra.Command, args []string) {
+		data := pythonData{hadDB: true}
+		path := settings.Config.Server.Database
+		exists, err := dbExists(path)
+
+		if err != nil {
+			panic(err)
+		} else if exists && cfg.noDB {
+			log.Fatal(path + " already exists")
+		} else if !exists && !cfg.noDB && !cfg.allowNoDB {
+			log.Fatal(path + " does not exist. Please run 'filebrowser config init' first.")
+		}
+
+		data.hadDB = exists
+		db, err := storm.Open(path)
+		checkErr(fmt.Sprintf("storm.Open path %v", path), err)
+
+		defer db.Close()
+		data.store, err = bolt.NewStorage(db)
+		checkErr("bolt.NewStorage", err)
+		fn(cmd, args, data)
+	}
+}
+
+func marshal(filename string, data interface{}) error {
+	fd, err := os.Create(filename)
+
+	checkErr("os.Create", err)
+	defer fd.Close()
+
+	switch ext := filepath.Ext(filename); ext {
+	case ".json":
+		encoder := json.NewEncoder(fd)
+		encoder.SetIndent("", "    ")
+		return encoder.Encode(data)
+	case ".yml", ".yaml": //nolint:goconst
+		_, err := yaml.Marshal(fd)
+		return err
+	default:
+		return errors.New("invalid format: " + ext)
+	}
+}
+
+func unmarshal(filename string, data interface{}) error {
+	fd, err := os.Open(filename)
+	checkErr("os.Open", err)
+	defer fd.Close()
+
+	switch ext := filepath.Ext(filename); ext {
+	case ".json":
+		return json.NewDecoder(fd).Decode(data)
+	case ".yml", ".yaml":
+		return yaml.NewDecoder(fd).Decode(data)
+	default:
+		return errors.New("invalid format: " + ext)
+	}
+}
+
+func jsonYamlArg(cmd *cobra.Command, args []string) error {
+	if err := cobra.ExactArgs(1)(cmd, args); err != nil {
+		return err
+	}
+
+	switch ext := filepath.Ext(args[0]); ext {
+	case ".json", ".yml", ".yaml":
+		return nil
+	default:
+		return errors.New("invalid format: " + ext)
+	}
+}

backend/cmd/version.go

@@ -0,0 +1,21 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/gtsteffaniak/filebrowser/version"
+)
+
+func init() {
+	rootCmd.AddCommand(versionCmd)
+}
+
+var versionCmd = &cobra.Command{
+	Use:   "version",
+	Short: "Print the version number",
+	Run: func(cmd *cobra.Command, args []string) {
+		fmt.Println("File Browser v" + version.Version + "/" + version.CommitSHA)
+	},
+}

backend/common/settings/auth.go

@@ -1,111 +0,0 @@
-package settings
-
-import (
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"github.com/coreos/go-oidc/v3/oidc"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-type Auth struct {
-	TokenExpirationHours int          `json:"tokenExpirationHours"` // time in hours each web UI session token is valid for. Default is 2 hours.
-	Methods              LoginMethods `json:"methods"`
-	Key                  string       `json:"key"`           // secret: the key used to sign the JWT tokens. If not set, a random key will be generated.
-	AdminUsername        string       `json:"adminUsername"` // secret: the username of the admin user. If not set, the default is "admin".
-	AdminPassword        string       `json:"adminPassword"` // secret: the password of the admin user. If not set, the default is "admin".
-	TotpSecret           string       `json:"totpSecret"`    // secret: secret used to encrypt TOTP secrets
-	AuthMethods          []string     `json:"-"`
-}
-
-type LoginMethods struct {
-	ProxyAuth    ProxyAuthConfig    `json:"proxy" validate:"omitempty"`
-	NoAuth       bool               `json:"noauth"` // if set to true, overrides all other auth methods and disables authentication
-	PasswordAuth PasswordAuthConfig `json:"password" validate:"omitempty"`
-	OidcAuth     OidcConfig         `json:"oidc" validate:"omitempty"`
-}
-
-type PasswordAuthConfig struct {
-	Enabled     bool      `json:"enabled"`
-	MinLength   int       `json:"minLength" validate:"omitempty"` // minimum pasword length required, default is 5.
-	Signup      bool      `json:"signup" validate:"omitempty"`    // allow signups on login page if enabled -- not secure.
-	Recaptcha   Recaptcha `json:"recaptcha" validate:"omitempty"` // recaptcha config, only used if signup is enabled
-	EnforcedOtp bool      `json:"enforcedOtp"`                    // if set to true, TOTP is enforced for all password users users. Otherwise, users can choose to enable TOTP.
-}
-
-type ProxyAuthConfig struct {
-	Enabled           bool   `json:"enabled"`
-	CreateUser        bool   `json:"createUser"`        // create user if not exists
-	Header            string `json:"header"`            // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
-	LogoutRedirectUrl string `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
-}
-
-type Recaptcha struct {
-	Host   string `json:"host" validate:"required"`
-	Key    string `json:"key" validate:"required"`
-	Secret string `json:"secret" validate:"required"`
-}
-
-// OpenID OAuth2.0
-type OidcConfig struct {
-	Enabled           bool                  `json:"enabled"`           // whether to enable OIDC authentication
-	ClientID          string                `json:"clientId"`          // secret: client id of the OIDC application
-	ClientSecret      string                `json:"clientSecret"`      // secret: client secret of the OIDC application
-	IssuerUrl         string                `json:"issuerUrl"`         // authorization URL of the OIDC provider
-	Scopes            string                `json:"scopes"`            // scopes to request from the OIDC provider
-	UserIdentifier    string                `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username", can also be "email" or "username", or "phone"
-	DisableVerifyTLS  bool                  `json:"disableVerifyTLS"`  // disable TLS verification for the OIDC provider. This is insecure and should only be used for testing.
-	LogoutRedirectUrl string                `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
-	CreateUser        bool                  `json:"createUser"`        // create user if not exists
-	AdminGroup        string                `json:"adminGroup"`        // if set, users in this group will be granted admin privileges.
-	GroupsClaim       string                `json:"groupsClaim"`       // the JSON field name to read groups from. Default is "groups"
-	Provider          *oidc.Provider        `json:"-"`                 // OIDC provider
-	Verifier          *oidc.IDTokenVerifier `json:"-"`                 // OIDC verifier
-}
-
-// ValidateOidcAuth processes the OIDC callback and retrieves user identity
-func validateOidcAuth() error {
-	oidcCfg := &Config.Auth.Methods.OidcAuth // Use a pointer to modify the original config
-	if oidcCfg.GroupsClaim == "" {
-		oidcCfg.GroupsClaim = "groups"
-	}
-	if oidcCfg.UserIdentifier == "" {
-		oidcCfg.UserIdentifier = "preferred_username"
-	}
-	if oidcCfg.Scopes == "" {
-		oidcCfg.Scopes = "openid email profile"
-	}
-
-	if !oidcCfg.Enabled {
-		return errors.New("OIDC is not enabled")
-	}
-	ctx := context.Background()
-
-	// If disableVerifyTLS is true, create a custom HTTP client
-	// and set it in the context for the OIDC provider.
-	if oidcCfg.DisableVerifyTLS {
-		// Create a custom transport with InsecureSkipVerify set to true
-		transport := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		}
-		customClient := &http.Client{
-			Transport: transport,
-		}
-		// Use oidc.ClientContext to pass the custom client to the OIDC library
-		ctx = oidc.ClientContext(ctx, customClient)
-		// Log that TLS verification is disabled (important for security awareness)
-		logger.Warning("OIDC TLS verification is disabled.")
-	}
-
-	provider, err := oidc.NewProvider(ctx, oidcCfg.IssuerUrl)
-	if err != nil {
-		return fmt.Errorf("url '%v' failed to create OIDC provider: %w", oidcCfg.IssuerUrl, err)
-	}
-	oidcCfg.Provider = provider
-	oidcCfg.Verifier = provider.Verifier(&oidc.Config{ClientID: oidcCfg.ClientID})
-
-	return nil
-}

backend/common/settings/config.go

@@ -1,594 +0,0 @@
-package settings
-
-import (
-	"fmt"
-	"log"
-	"os"
-	"path/filepath"
-	"runtime"
-	"slices"
-	"strings"
-	"time"
-
-	"github.com/go-playground/validator/v10"
-	"github.com/goccy/go-yaml"
-	"github.com/gtsteffaniak/filebrowser/backend/common/version"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-var Config Settings
-
-const (
-	generatorPath = "/relative/or/absolute/path"
-)
-
-func Initialize(configFile string) {
-	err := loadConfigWithDefaults(configFile, false)
-	if err != nil {
-		logger.Error("unable to load config, waiting 5 seconds before exiting...")
-		time.Sleep(5 * time.Second) // allow sleep time before exiting to give docker/kubernetes time before restarting
-		logger.Fatal(err.Error())
-	}
-	err = ValidateConfig(Config)
-	if err != nil {
-		errmsg := "The provided config file failed validation. "
-		errmsg += "If you are seeing this on a config that worked before, "
-		errmsg += "then check the latest releases for breaking changes. "
-		errmsg += "visit https://github.com/gtsteffaniak/filebrowser/wiki/Full-Config-Example for more information."
-		logger.Error(errmsg)
-		time.Sleep(5 * time.Second) // allow sleep time before exiting to give docker/kubernetes time before restarting
-		logger.Fatal(err.Error())
-	}
-	setupLogging()
-	setupAuth(false)
-	setupSources(false)
-	setupUrls()
-	setupFrontend(false)
-}
-
-func setupFrontend(generate bool) {
-	if Config.Server.MinSearchLength == 0 {
-		Config.Server.MinSearchLength = 3
-	}
-	if !Config.Frontend.DisableDefaultLinks {
-		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
-			Text:  fmt.Sprintf("(%v)", version.Version),
-			Title: version.CommitSHA,
-			Url:   "https://github.com/gtsteffaniak/filebrowser/releases/",
-		})
-		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
-			Text: "Help",
-			Url:  "help prompt",
-		})
-	}
-	if Config.Frontend.Description == "" {
-		Config.Frontend.Description = "FileBrowser Quantum is a file manager for the web which can be used to manage files on your server"
-	}
-	Config.Frontend.Styling.LightBackground = FallbackColor(Config.Frontend.Styling.LightBackground, "#f5f5f5")
-	Config.Frontend.Styling.DarkBackground = FallbackColor(Config.Frontend.Styling.DarkBackground, "#141D24")
-	Config.Frontend.Styling.CustomCSSRaw = readCustomCSS(Config.Frontend.Styling.CustomCSS)
-	Config.Frontend.Styling.CustomThemeOptions = map[string]CustomTheme{}
-	Config.Frontend.Styling.CustomThemes = map[string]CustomTheme{}
-	for name, theme := range Config.Frontend.Styling.CustomThemes {
-		addCustomTheme(name, theme.Description, theme.CSS)
-	}
-	noThemes := len(Config.Frontend.Styling.CustomThemes) == 0
-	if noThemes {
-		addCustomTheme("default", "The default theme", "")
-		// check if file exists
-		if _, err := os.Stat("reduce-rounded-corners.css"); err == nil {
-			addCustomTheme("alternative", "Reduce rounded corners", "reduce-rounded-corners.css")
-			if generate {
-				Config.Frontend.Styling.CustomThemes["alternative"] = CustomTheme{
-					Description: "Reduce rounded corners",
-					CSS:         "reduce-rounded-corners.css",
-				}
-			}
-		}
-	}
-	_, ok := Config.Frontend.Styling.CustomThemes["default"]
-	if !ok {
-		addCustomTheme("default", "The default theme", "")
-	}
-
-	// Load custom favicon if configured
-	loadCustomFavicon()
-}
-
-func getRealPath(path string) string {
-	realPath, err := filepath.Abs(path)
-	if err != nil {
-		logger.Fatalf("could not find configured source path: %v", err)
-	}
-	// check path exists
-	if _, err = os.Stat(realPath); os.IsNotExist(err) {
-		logger.Fatalf("configured source path does not exist: %v", realPath)
-	}
-	return realPath
-}
-
-func setupSources(generate bool) {
-	if len(Config.Server.Sources) == 0 {
-		logger.Fatal("There are no `server.sources` configured. If you have `server.root` configured, please update the config and add at least one `server.sources` with a `path` configured.")
-	} else {
-		for k, source := range Config.Server.Sources {
-			if source.Config.Disabled {
-				continue
-			}
-			realPath := getRealPath(source.Path)
-			name := filepath.Base(realPath)
-			if name == "\\" {
-				name = strings.Split(realPath, ":")[0]
-			}
-			if generate {
-				source.Path = generatorPath // use placeholder path
-			} else {
-				source.Path = realPath // use absolute path
-			}
-			if source.Name == "" {
-				_, ok := Config.Server.SourceMap[source.Path]
-				if ok {
-					source.Name = name + fmt.Sprintf("-%v", k)
-				} else {
-					source.Name = name
-				}
-			}
-			modifyExcludeInclude(&source)
-
-			if source.Config.DefaultUserScope == "" {
-				source.Config.DefaultUserScope = "/"
-			}
-			Config.Server.SourceMap[source.Path] = source
-			Config.Server.NameToSource[source.Name] = source
-		}
-	}
-	// clean up the in memory source list to be accurate and unique
-	sourceList := []Source{}
-	defaultScopes := []users.SourceScope{}
-	allSourceNames := []string{}
-	for _, sourcePathOnly := range Config.Server.Sources {
-		realPath := getRealPath(sourcePathOnly.Path)
-		if generate {
-			realPath = generatorPath // use placeholder path
-		}
-		source, ok := Config.Server.SourceMap[realPath]
-		if ok && !slices.Contains(allSourceNames, source.Name) {
-			sourceList = append(sourceList, source)
-			if source.Config.DefaultEnabled {
-				defaultScopes = append(defaultScopes, users.SourceScope{
-					Name:  source.Path,
-					Scope: source.Config.DefaultUserScope,
-				})
-			}
-			allSourceNames = append(allSourceNames, source.Name)
-		} else {
-			logger.Warningf("source %v is not configured correctly, skipping", sourcePathOnly.Path)
-		}
-	}
-	Config.UserDefaults.DefaultScopes = defaultScopes
-	Config.Server.Sources = sourceList
-}
-
-func setupUrls() {
-	baseurl := strings.Trim(Config.Server.BaseURL, "/")
-	if baseurl == "" {
-		Config.Server.BaseURL = "/"
-	} else {
-		Config.Server.BaseURL = "/" + baseurl + "/"
-	}
-	if Config.Server.BaseURL != "/" {
-		if Config.Server.ExternalUrl != "" {
-			Config.Server.ExternalUrl = strings.TrimSuffix(Config.Server.ExternalUrl, "/") + "/"
-			Config.Server.ExternalUrl = strings.TrimSuffix(Config.Server.ExternalUrl, Config.Server.BaseURL)
-		}
-		if Config.Server.InternalUrl != "" {
-			Config.Server.InternalUrl = strings.TrimSuffix(Config.Server.InternalUrl, "/") + "/"
-			Config.Server.InternalUrl = strings.TrimSuffix(Config.Server.InternalUrl, Config.Server.BaseURL)
-		}
-	}
-	Config.Integrations.OnlyOffice.Url = strings.Trim(Config.Integrations.OnlyOffice.Url, "/")
-	Config.Integrations.OnlyOffice.InternalUrl = strings.Trim(Config.Integrations.OnlyOffice.InternalUrl, "/")
-}
-
-func setupAuth(generate bool) {
-	if generate {
-		Config.Auth.AdminPassword = "admin"
-	}
-	if Config.Auth.Methods.PasswordAuth.Enabled {
-		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "password")
-	}
-	if Config.Auth.Methods.ProxyAuth.Enabled {
-		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "proxy")
-	}
-	if Config.Auth.Methods.OidcAuth.Enabled {
-		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "oidc")
-	}
-	if Config.Auth.Methods.NoAuth {
-		logger.Warning("Configured with no authentication, this is not recommended.")
-		Config.Auth.AuthMethods = []string{"disabled"}
-	}
-	if Config.Auth.Methods.OidcAuth.Enabled || generate {
-		err := validateOidcAuth()
-		if err != nil && !generate {
-			logger.Fatalf("Error validating OIDC auth: %v", err)
-		}
-		logger.Info("OIDC Auth configured successfully")
-	}
-
-	// use password auth as default if no auth methods are set
-	if len(Config.Auth.AuthMethods) == 0 {
-		Config.Auth.Methods.PasswordAuth.Enabled = true
-		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "password")
-	}
-	Config.UserDefaults.LoginMethod = Config.Auth.AuthMethods[0]
-
-}
-
-func setupLogging() {
-	if len(Config.Server.Logging) == 0 {
-		Config.Server.Logging = []LogConfig{
-			{
-				Output: "stdout",
-			},
-		}
-	}
-	for _, logConfig := range Config.Server.Logging {
-		// Enable debug logging automatically in dev mode
-		levels := logConfig.Levels
-		if os.Getenv("FILEBROWSER_DEVMODE") == "true" {
-			levels = "info|warning|error|debug"
-		}
-
-		logConfig := logger.JsonConfig{
-			Levels:    levels,
-			ApiLevels: logConfig.ApiLevels,
-			Output:    logConfig.Output,
-			Utc:       logConfig.Utc,
-			NoColors:  logConfig.NoColors,
-			Json:      logConfig.Json,
-		}
-		err := logger.SetupLogger(logConfig)
-		if err != nil {
-			log.Println("[ERROR] Failed to set up logger:", err)
-		}
-	}
-}
-
-func loadConfigWithDefaults(configFile string, generate bool) error {
-	Config = setDefaults(generate)
-	// Open and read the YAML file
-	yamlFile, err := os.Open(configFile)
-	if err != nil {
-		if configFile != "" {
-			logger.Errorf("could not open config file '%v', using default settings.", configFile)
-		}
-		Config.Server.Sources = []Source{
-			{
-				Path: ".",
-			},
-		}
-		loadEnvConfig()
-		return nil
-	}
-	defer yamlFile.Close()
-	stat, err := yamlFile.Stat()
-	if err != nil {
-		return err
-	}
-	yamlData := make([]byte, stat.Size())
-	_, err = yamlFile.Read(yamlData)
-	if err != nil && configFile != "config.yaml" {
-		return fmt.Errorf("could not load specified config file: %v", err.Error())
-	}
-	if err != nil {
-		logger.Warningf("Could not load config file '%v', using default settings: %v", configFile, err)
-	}
-	err = yaml.NewDecoder(strings.NewReader(string(yamlData)), yaml.DisallowUnknownField()).Decode(&Config)
-	if err != nil {
-		return fmt.Errorf("error unmarshaling YAML data: %v", err)
-	}
-	loadEnvConfig()
-	return nil
-}
-
-func ValidateConfig(config Settings) error {
-
-	validate := validator.New()
-	err := validate.Struct(Config)
-	if err != nil {
-		return fmt.Errorf("could not validate config: %v", err)
-	}
-	return nil
-}
-
-func loadEnvConfig() {
-	adminPassword, ok := os.LookupEnv("FILEBROWSER_ADMIN_PASSWORD")
-	if ok {
-		logger.Info("Using admin password from FILEBROWSER_ADMIN_PASSWORD environment variable")
-		Config.Auth.AdminPassword = adminPassword
-	}
-	officeSecret, ok := os.LookupEnv("FILEBROWSER_ONLYOFFICE_SECRET")
-	if ok {
-		logger.Info("Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable")
-		Config.Integrations.OnlyOffice.Secret = officeSecret
-	}
-
-	ffmpegPath, ok := os.LookupEnv("FILEBROWSER_FFMPEG_PATH")
-	if ok {
-		Config.Integrations.Media.FfmpegPath = ffmpegPath
-	}
-
-	oidcClientId := os.Getenv("FILEBROWSER_OIDC_CLIENT_ID")
-	if oidcClientId != "" {
-		Config.Auth.Methods.OidcAuth.ClientID = oidcClientId
-		logger.Info("Using OIDC Client ID from FILEBROWSER_OIDC_CLIENT_ID environment variable")
-	}
-
-	oidcClientSecret := os.Getenv("FILEBROWSER_OIDC_CLIENT_SECRET")
-	if oidcClientSecret != "" {
-		Config.Auth.Methods.OidcAuth.ClientSecret = oidcClientSecret
-		logger.Info("Using OIDC Client Secret from FILEBROWSER_OIDC_CLIENT_SECRET environment variable")
-	}
-
-	jwtTokenSecret := os.Getenv("FILEBROWSER_JWT_TOKEN_SECRET")
-	if jwtTokenSecret != "" {
-		Config.Auth.Key = jwtTokenSecret
-		logger.Info("Using JWT Token Secret from FILEBROWSER_JWT_TOKEN_SECRET environment variable")
-	}
-
-	totpSecret := os.Getenv("FILEBROWSER_TOTP_SECRET")
-	if totpSecret != "" {
-		Config.Auth.TotpSecret = totpSecret
-		logger.Info("Using TOTP Secret from FILEBROWSER_TOTP_SECRET environment variable")
-	}
-
-	recaptchaSecret := os.Getenv("FILEBROWSER_RECAPTCHA_SECRET")
-	if recaptchaSecret != "" {
-		Config.Auth.Methods.PasswordAuth.Recaptcha.Secret = recaptchaSecret
-		logger.Info("Using ReCaptcha Secret from FILEBROWSER_RECAPTCHA_SECRET environment variable")
-	}
-
-}
-
-func setDefaults(generate bool) Settings {
-	// get number of CPUs available
-	numCpus := 4 // default to 4 CPUs if runtime.NumCPU() fails or is not available
-	cpus := runtime.NumCPU()
-	if cpus > 0 && !generate {
-		numCpus = cpus
-	}
-	database := os.Getenv("FILEBROWSER_DATABASE")
-	if database == "" {
-		database = "database.db"
-	}
-	return Settings{
-		Server: Server{
-			Port:               80,
-			NumImageProcessors: numCpus,
-			BaseURL:            "",
-			Database:           database,
-			SourceMap:          map[string]Source{},
-			NameToSource:       map[string]Source{},
-			MaxArchiveSizeGB:   50,
-			CacheDir:           "tmp",
-		},
-		Auth: Auth{
-			AdminUsername:        "admin",
-			TokenExpirationHours: 2,
-			Methods: LoginMethods{
-				PasswordAuth: PasswordAuthConfig{
-					Enabled:   true,
-					MinLength: 5,
-					Signup:    false,
-				},
-			},
-		},
-		Frontend: Frontend{
-			Name: "FileBrowser Quantum",
-		},
-
-		UserDefaults: UserDefaults{
-			StickySidebar:   true,
-			LockPassword:    false,
-			ShowHidden:      false,
-			DarkMode:        true,
-			DisableSettings: false,
-			ViewMode:        "normal",
-			Locale:          "en",
-			GallerySize:     3,
-			ThemeColor:      "var(--blue)",
-			Permissions: users.Permissions{
-				Modify: false,
-				Share:  false,
-				Admin:  false,
-				Api:    false,
-			},
-			FileLoading: users.FileLoading{
-				MaxConcurrent: 10,
-				ChunkSize:     10, // 10MB
-			},
-		},
-	}
-}
-
-func ConvertToBackendScopes(scopes []users.SourceScope) ([]users.SourceScope, error) {
-	if len(scopes) == 0 {
-		return Config.UserDefaults.DefaultScopes, nil
-	}
-	newScopes := []users.SourceScope{}
-	for _, scope := range scopes {
-
-		// first check if its already a path name and keep it
-		source, ok := Config.Server.SourceMap[scope.Name]
-		if ok {
-			if scope.Scope == "" {
-				scope.Scope = source.Config.DefaultUserScope
-			}
-			if !strings.HasPrefix(scope.Scope, "/") {
-				scope.Scope = "/" + scope.Scope
-			}
-			if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
-				scope.Scope = strings.TrimSuffix(scope.Scope, "/")
-			}
-			newScopes = append(newScopes, users.SourceScope{
-				Name:  source.Path, // backend name is path
-				Scope: scope.Scope,
-			})
-			continue
-		}
-
-		// check if its the name of a source and convert it to a path
-		source, ok = Config.Server.NameToSource[scope.Name]
-		if !ok {
-			// source might no longer be configured
-			continue
-		}
-		if scope.Scope == "" {
-			scope.Scope = source.Config.DefaultUserScope
-		}
-		if !strings.HasPrefix(scope.Scope, "/") {
-			scope.Scope = "/" + scope.Scope
-		}
-		if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
-			scope.Scope = strings.TrimSuffix(scope.Scope, "/")
-		}
-		newScopes = append(newScopes, users.SourceScope{
-			Name:  source.Path, // backend name is path
-			Scope: scope.Scope,
-		})
-	}
-	return newScopes, nil
-}
-
-func ConvertToFrontendScopes(scopes []users.SourceScope) []users.SourceScope {
-	newScopes := []users.SourceScope{}
-	for _, scope := range scopes {
-		if source, ok := Config.Server.SourceMap[scope.Name]; ok {
-			// Replace scope.Name with source.Path while keeping the same Scope value
-			newScopes = append(newScopes, users.SourceScope{
-				Name:  source.Name,
-				Scope: scope.Scope,
-			})
-		}
-	}
-	return newScopes
-}
-
-func HasSourceByPath(scopes []users.SourceScope, sourcePath string) bool {
-	for _, scope := range scopes {
-		if scope.Name == sourcePath {
-			return true
-		}
-	}
-	return false
-}
-
-func GetScopeFromSourceName(scopes []users.SourceScope, sourceName string) (string, error) {
-	source, ok := Config.Server.NameToSource[sourceName]
-	if !ok {
-		logger.Debug("Could not get scope from source name: ", sourceName)
-		return "", fmt.Errorf("source with name not found %v", sourceName)
-	}
-	for _, scope := range scopes {
-		if scope.Name == source.Path {
-			return scope.Scope, nil
-		}
-	}
-	logger.Debugf("scope not found for source %v", sourceName)
-	return "", fmt.Errorf("scope not found for source %v", sourceName)
-}
-
-func GetScopeFromSourcePath(scopes []users.SourceScope, sourcePath string) (string, error) {
-	for _, scope := range scopes {
-		if scope.Name == sourcePath {
-			return scope.Scope, nil
-		}
-	}
-	return "", fmt.Errorf("scope not found for source %v", sourcePath)
-}
-
-// assumes backend style scopes
-func GetSources(u *users.User) []string {
-	sources := []string{}
-	for _, scope := range u.Scopes {
-		source, ok := Config.Server.SourceMap[scope.Name]
-		if ok {
-			sources = append(sources, source.Name)
-		}
-	}
-	return sources
-}
-
-func loadCustomFavicon() {
-	// Check if a custom favicon path is configured
-	if Config.Frontend.Favicon == "" {
-		logger.Debug("No custom favicon configured, using default")
-		return
-	}
-
-	// Get absolute path for the favicon
-	faviconPath, err := filepath.Abs(Config.Frontend.Favicon)
-	if err != nil {
-		logger.Warningf("Could not resolve favicon path '%v': %v", Config.Frontend.Favicon, err)
-		Config.Frontend.Favicon = "" // Unset invalid path
-		return
-	}
-
-	// Check if the favicon file exists and get info
-	stat, err := os.Stat(faviconPath)
-	if err != nil {
-		logger.Warningf("Could not access custom favicon file '%v': %v", faviconPath, err)
-		Config.Frontend.Favicon = "" // Unset invalid path
-		return
-	}
-
-	// Check file size (limit to 1MB for security)
-	const maxFaviconSize = 1024 * 1024 // 1MB
-	if stat.Size() > maxFaviconSize {
-		logger.Warningf("Favicon file '%v' is too large (%d bytes), maximum allowed is %d bytes", faviconPath, stat.Size(), maxFaviconSize)
-		Config.Frontend.Favicon = "" // Unset invalid path
-		return
-	}
-
-	// Validate file format based on extension
-	ext := strings.ToLower(filepath.Ext(faviconPath))
-	switch ext {
-	case ".ico", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp":
-		// Valid favicon formats
-	default:
-		logger.Warningf("Unsupported favicon format '%v', supported formats: .ico, .png, .jpg, .gif, .svg, .webp", ext)
-		Config.Frontend.Favicon = "" // Unset invalid path
-		return
-	}
-
-	// Update to absolute path and mark as valid
-	Config.Frontend.Favicon = faviconPath
-
-	logger.Infof("Successfully validated custom favicon at '%v' (%d bytes, %s)", faviconPath, stat.Size(), ext)
-}
-
-func modifyExcludeInclude(config *Source) {
-	normalize := func(s []string, checkExists bool) {
-		for i, v := range s {
-			s[i] = "/" + strings.Trim(v, "/")
-			// check if file/folder exists
-			if checkExists {
-				realPath, err := filepath.Abs(config.Path + s[i])
-				if err != nil {
-					logger.Warningf("could not get absolute path for %v: %v", s[i], err)
-					continue
-				}
-				if _, err := os.Stat(realPath); os.IsNotExist(err) {
-					logger.Warningf("configured exclude/include path %v does not exist", realPath)
-				}
-			}
-		}
-	}
-
-	normalize(config.Config.Exclude.FolderPaths, true)
-	normalize(config.Config.Exclude.FilePaths, true)
-	normalize(config.Config.Include.RootFolders, true)
-	normalize(config.Config.Include.RootFiles, true)
-	normalize(config.Config.NeverWatchPaths, true)
-}

backend/common/settings/config_test.go

@@ -1,101 +0,0 @@
-package settings
-
-import (
-	"os"
-	"reflect"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-)
-
-func TestInitialize(t *testing.T) {
-	type args struct {
-		configFile string
-	}
-	tests := []struct {
-		name string
-		args args
-	}{
-		// TODO: Add test cases.
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			Initialize(tt.args.configFile)
-		})
-	}
-}
-
-func Test_setDefaults(t *testing.T) {
-	tests := []struct {
-		name string
-		want Settings
-	}{
-		// TODO: Add test cases.
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := setDefaults(true); !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("setDefaults() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestConfigLoadChanged(t *testing.T) {
-	defaultConfig := setDefaults(true)
-	err := loadConfigWithDefaults("./validConfig.yaml", true)
-	if err != nil {
-		t.Fatalf("error loading config file: %v", err)
-	}
-	// Use go-cmp to compare the two structs
-	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
-		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
-	}
-}
-
-func TestConfigLoadEnvVars(t *testing.T) {
-	defaultConfig := setDefaults(true)
-	expectedKey := "MYKEY"
-	// mock environment variables
-	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
-	err := loadConfigWithDefaults("./validConfig.yaml", true)
-	if err != nil {
-		t.Fatalf("error loading config file: %v", err)
-	}
-	if Config.Integrations.OnlyOffice.Secret != expectedKey {
-		t.Errorf("Expected OnlyOffice.Secret to be '%v', got '%s'", expectedKey, Config.Integrations.OnlyOffice.Secret)
-	}
-	// Use go-cmp to compare the two structs
-	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
-		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
-	}
-}
-
-func TestConfigLoadSpecificValues(t *testing.T) {
-	defaultConfig := setDefaults(true)
-	err := loadConfigWithDefaults("./validConfig.yaml", true)
-	if err != nil {
-		t.Fatalf("error loading config file: %v", err)
-	}
-	testCases := []struct {
-		fieldName string
-		globalVal interface{}
-		newVal    interface{}
-	}{
-		{"Server.Database", Config.Server.Database, defaultConfig.Server.Database},
-	}
-
-	for _, tc := range testCases {
-		if tc.globalVal == tc.newVal {
-			t.Errorf("Differences should have been found:\nConfig.%s: %v \nSetConfig: %v \n", tc.fieldName, tc.globalVal, tc.newVal)
-		}
-	}
-}
-
-func TestInvalidConfig(t *testing.T) {
-	configFile := "./invalidConfig.yaml"
-	err := loadConfigWithDefaults(configFile, true)
-	if err == nil {
-		t.Fatalf("expected error loading config file %s, got nil", configFile)
-	}
-}

backend/common/settings/generator.go

@@ -1,517 +0,0 @@
-package settings
-
-import (
-	"bytes"
-	"fmt"
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-
-	"gopkg.in/yaml.v3"
-)
-
-// CommentsMap[typeName][fieldName] = combined doc+inline comment text
-type CommentsMap map[string]map[string]string
-
-// SecretFieldsMap[typeName][fieldName] = true if field should be redacted
-type SecretFieldsMap map[string]map[string]bool
-
-// DeprecatedFieldsMap[typeName][fieldName] = true if field is deprecated
-type DeprecatedFieldsMap map[string]map[string]bool
-
-// getStringStyle determines whether a string should be quoted in YAML
-func getStringStyle(value string) yaml.Style {
-	// Always quote all strings for consistency
-	return yaml.DoubleQuotedStyle
-}
-
-// CollectComments parses all Go source in the directory of srcPath and returns CommentsMap.
-func CollectComments(srcPath string) (CommentsMap, error) {
-	comments, _, _, err := CollectCommentsAndSecrets(srcPath)
-	return comments, err
-}
-
-// CollectCommentsAndSecrets parses all Go source and returns comments, secrets, and deprecated field mappings
-func CollectCommentsAndSecrets(srcPath string) (CommentsMap, SecretFieldsMap, DeprecatedFieldsMap, error) {
-	// parse entire package so we capture comments on all types
-	dir := srcPath
-	if filepath.IsAbs(srcPath) {
-		// If it's an absolute path to a file, get the directory
-		dir = filepath.Dir(srcPath)
-	}
-
-	fset := token.NewFileSet()
-	pkgs, err := parser.ParseDir(fset, dir, nil, parser.ParseComments)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	comments := make(CommentsMap)
-	secrets := make(SecretFieldsMap)
-	deprecated := make(DeprecatedFieldsMap)
-	for _, pkg := range pkgs {
-		for _, file := range pkg.Files {
-			for _, decl := range file.Decls {
-				gen, ok := decl.(*ast.GenDecl)
-				if !ok || gen.Tok != token.TYPE {
-					continue
-				}
-				for _, spec := range gen.Specs {
-					ts, ok := spec.(*ast.TypeSpec)
-					if !ok {
-						continue
-					}
-					st, ok := ts.Type.(*ast.StructType)
-					if !ok {
-						continue
-					}
-					typeName := ts.Name.Name
-					commentMap := make(map[string]string)
-					secretMap := make(map[string]bool)
-					deprecatedMap := make(map[string]bool)
-					comments[typeName] = commentMap
-					secrets[typeName] = secretMap
-					deprecated[typeName] = deprecatedMap
-
-					for _, field := range st.Fields.List {
-						if len(field.Names) == 0 {
-							continue
-						}
-						name := field.Names[0].Name
-						var parts []string
-						var fullComment string
-
-						if field.Doc != nil {
-							docText := strings.TrimSpace(field.Doc.Text())
-							parts = append(parts, docText)
-							fullComment += docText + " "
-						}
-						if field.Comment != nil {
-							commentText := strings.TrimSpace(field.Comment.Text())
-							parts = append(parts, commentText)
-							fullComment += commentText
-						}
-
-						if len(parts) > 0 {
-							commentMap[name] = strings.Join(parts, " : ")
-						}
-
-						// Check if field should be treated as secret
-						if strings.Contains(strings.ToLower(fullComment), "secret:") {
-							secretMap[name] = true
-						}
-
-						// Check if field should be treated as deprecated
-						if strings.Contains(strings.ToLower(fullComment), "deprecated:") {
-							deprecatedMap[name] = true
-						}
-					}
-				}
-			}
-		}
-	}
-	return comments, secrets, deprecated, nil
-}
-
-// BuildNode constructs a yaml.Node for any Go value, injecting comments on struct fields.
-func BuildNode(v reflect.Value, comm CommentsMap) (*yaml.Node, error) {
-	return buildNodeWithDefaults(v, comm, reflect.Value{}, SecretFieldsMap{}, DeprecatedFieldsMap{})
-}
-
-// buildNodeWithDefaults constructs a yaml.Node for any Go value, skipping fields that match defaults, redacting secrets, and filtering deprecated fields
-func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.Value, secrets SecretFieldsMap, deprecated DeprecatedFieldsMap) (*yaml.Node, error) {
-	// Dereference pointers
-	if v.Kind() == reflect.Ptr {
-		if v.IsNil() {
-			return &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!null", Value: "null"}, nil
-		}
-		var defaultsElem reflect.Value
-		if defaults.IsValid() && !defaults.IsNil() {
-			defaultsElem = defaults.Elem()
-		}
-		return buildNodeWithDefaults(v.Elem(), comm, defaultsElem, secrets, deprecated)
-	}
-
-	switch v.Kind() {
-	case reflect.String:
-		value := v.String()
-		return &yaml.Node{
-			Kind:  yaml.ScalarNode,
-			Tag:   "!!str",
-			Value: value,
-			Style: getStringStyle(value),
-		}, nil
-	case reflect.Struct:
-		rt := v.Type()
-		typeName := rt.Name()
-		mapNode := &yaml.Node{Kind: yaml.MappingNode}
-		for i := 0; i < rt.NumField(); i++ {
-			sf := rt.Field(i)
-
-			// skip unexported or omitted fields
-			if sf.PkgPath != "" {
-				continue
-			}
-			if yamlTag := sf.Tag.Get("yaml"); yamlTag == "-" {
-				continue
-			}
-			if jsonTag := sf.Tag.Get("json"); jsonTag == "-" {
-				continue
-			}
-
-			// Skip deprecated fields if filtering is enabled
-			if len(deprecated) > 0 && deprecated[typeName][sf.Name] {
-				continue
-			}
-
-			currentField := v.Field(i)
-
-			// If we have defaults, compare and skip if values match
-			if defaults.IsValid() && i < defaults.NumField() {
-				defaultField := defaults.Field(i)
-				currentValue := currentField.Interface()
-				defaultValue := defaultField.Interface()
-
-				isEqual := reflect.DeepEqual(currentValue, defaultValue)
-
-				if isEqual {
-					continue // Skip this field as it matches the default
-				}
-			}
-
-			// determine key: yaml tag > json tag > field name
-			yamlTag := sf.Tag.Get("yaml")
-			jsonTag := sf.Tag.Get("json")
-			var keyName string
-			if yamlTag != "" && yamlTag != "-" {
-				keyName = strings.Split(yamlTag, ",")[0]
-			} else if jsonTag != "" && jsonTag != "-" {
-				keyName = strings.Split(jsonTag, ",")[0]
-			} else {
-				keyName = sf.Name
-			}
-
-			keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: keyName}
-
-			// attach validate and comments inline (only when comments are enabled)
-			var parts []string
-			if cm := comm[typeName][sf.Name]; cm != "" {
-				parts = append(parts, cm)
-			}
-			// Only add validation tags if comments map is not empty (meaning comments are enabled)
-			if len(comm) > 0 {
-				if vt := sf.Tag.Get("validate"); vt != "" {
-					parts = append(parts, fmt.Sprintf(" validate:%s", vt))
-				}
-			}
-
-			if len(parts) > 0 {
-				keyNode.LineComment = strings.Join(parts, " ")
-			}
-
-			// Check if this field should be redacted as a secret
-			var valNode *yaml.Node
-			var err error
-			if secrets[typeName][sf.Name] {
-				valNode = &yaml.Node{
-					Kind:  yaml.ScalarNode,
-					Tag:   "!!str",
-					Value: "**hidden**",
-					Style: yaml.DoubleQuotedStyle, // Keep secrets quoted for clarity
-				}
-			} else {
-				// Pass through the corresponding default field for recursive comparison
-				var defaultField reflect.Value
-				if defaults.IsValid() && i < defaults.NumField() {
-					defaultField = defaults.Field(i)
-				}
-
-				valNode, err = buildNodeWithDefaults(currentField, comm, defaultField, secrets, deprecated)
-				if err != nil {
-					return nil, err
-				}
-			}
-			mapNode.Content = append(mapNode.Content, keyNode, valNode)
-		}
-		return mapNode, nil
-
-	case reflect.Slice, reflect.Array:
-		seq := &yaml.Node{Kind: yaml.SequenceNode}
-		// for non-struct slices, render inline [] via flow style
-		if v.Type().Elem().Kind() != reflect.Struct {
-			seq.Style = yaml.FlowStyle
-		}
-		// placeholder for empty slice of structs
-		if v.Len() == 0 && v.Type().Elem().Kind() == reflect.Struct {
-			zero := reflect.Zero(v.Type().Elem())
-			var defaultElem reflect.Value
-			if defaults.IsValid() && defaults.Len() > 0 {
-				defaultElem = defaults.Index(0)
-			}
-			n, err := buildNodeWithDefaults(zero, comm, defaultElem, secrets, deprecated)
-			if err != nil {
-				return nil, err
-			}
-			seq.Content = append(seq.Content, n)
-			return seq, nil
-		}
-		for i := 0; i < v.Len(); i++ {
-			var defaultElem reflect.Value
-			if defaults.IsValid() && i < defaults.Len() {
-				defaultElem = defaults.Index(i)
-			}
-			n, err := buildNodeWithDefaults(v.Index(i), comm, defaultElem, secrets, deprecated)
-			if err != nil {
-				return nil, err
-			}
-			seq.Content = append(seq.Content, n)
-		}
-		return seq, nil
-
-	case reflect.Map:
-		mapNode := &yaml.Node{Kind: yaml.MappingNode}
-
-		for _, key := range v.MapKeys() {
-			// Handle key
-			keyStr := fmt.Sprintf("%v", key.Interface())
-			keyNode := &yaml.Node{
-				Kind:  yaml.ScalarNode,
-				Value: keyStr,
-			}
-
-			// Handle value recursively
-			mapVal := v.MapIndex(key)
-			var defaultVal reflect.Value
-			if defaults.IsValid() {
-				defaultVal = defaults.MapIndex(key)
-			}
-
-			valNode, err := buildNodeWithDefaults(mapVal, comm, defaultVal, secrets, deprecated)
-			if err != nil {
-				return nil, err
-			}
-
-			mapNode.Content = append(mapNode.Content, keyNode, valNode)
-		}
-		return mapNode, nil
-
-	default:
-		n := &yaml.Node{}
-		if err := n.Encode(v.Interface()); err != nil {
-			return nil, err
-		}
-		return n, nil
-	}
-}
-
-func GenerateYaml() {
-	_ = loadConfigWithDefaults("", true)
-	Config.Server.Sources = []Source{
-		{
-			Path: ".",
-		},
-	}
-
-	setupLogging()
-	setupAuth(true)
-	setupSources(true)
-	setupUrls()
-	setupFrontend(true)
-	output := "generated.yaml" // "output YAML file"
-
-	// Generate YAML with comments enabled, full config, and deprecated fields filtered
-	// Force the source path to be correct for static generation
-	yamlContent, err := GenerateConfigYamlWithSource(&Config, true, true, true, "common/settings")
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "error generating YAML: %v\n", err)
-		os.Exit(1)
-	}
-
-	if err := os.WriteFile(output, []byte(yamlContent), 0644); err != nil {
-		fmt.Fprintf(os.Stderr, "error writing YAML: %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Printf("Generated YAML with comments (deprecated fields filtered): %s\n", output)
-}
-
-// GenerateConfigYaml generates YAML from a given config with options for comments and filtering
-func GenerateConfigYaml(config *Settings, showComments bool, showFull bool, filterDeprecated bool) (string, error) {
-	// Try different source paths to handle both runtime and test scenarios
-	sourcePaths := []string{
-		"common/settings", // When running from backend directory
-		".",               // When running tests from settings directory
-		"../settings",     // Alternative test path
-	}
-
-	for _, sourcePath := range sourcePaths {
-		yamlOutput, err := GenerateConfigYamlWithSource(config, showComments, showFull, filterDeprecated, sourcePath)
-		if err == nil {
-			return yamlOutput, nil
-		}
-		// If it's not a file not found error, return immediately
-		if !strings.Contains(err.Error(), "no such file or directory") && !strings.Contains(err.Error(), "cannot find") {
-			return "", err
-		}
-	}
-
-	// If all paths failed, try with empty maps to at least generate basic YAML
-	return GenerateConfigYamlWithEmptyMaps(config, showFull)
-}
-
-// GenerateConfigYamlWithEmptyMaps generates YAML without comment parsing when source files are unavailable
-func GenerateConfigYamlWithEmptyMaps(config *Settings, showFull bool) (string, error) {
-	// Create empty maps
-	comm := make(CommentsMap)
-	secrets := make(SecretFieldsMap)
-	deprecated := make(DeprecatedFieldsMap)
-
-	var node *yaml.Node
-	var err error
-
-	if showFull {
-		// Show the full current config
-		node, err = buildNodeWithDefaults(reflect.ValueOf(config), comm, reflect.Value{}, secrets, deprecated)
-	} else {
-		// Show only non-default values by comparing with defaults during node building
-		defaultConfig := setDefaults(true)
-		defaultConfig.Server.Sources = []Source{{Path: "."}}
-
-		node, err = buildNodeWithDefaults(reflect.ValueOf(config), comm, reflect.ValueOf(&defaultConfig), secrets, deprecated)
-	}
-
-	if err != nil {
-		return "", err
-	}
-
-	// Convert to YAML
-	doc := &yaml.Node{Kind: yaml.DocumentNode}
-	doc.Content = []*yaml.Node{node}
-
-	var rawBuf bytes.Buffer
-	enc := yaml.NewEncoder(&rawBuf)
-	enc.SetIndent(2)
-	if err := enc.Encode(doc); err != nil {
-		return "", err
-	}
-
-	return AlignComments(rawBuf.String()), nil
-}
-
-// GenerateConfigYamlWithSource generates YAML from a given config with options for comments and filtering, using a custom source path
-func GenerateConfigYamlWithSource(config *Settings, showComments bool, showFull bool, filterDeprecated bool, sourcePath string) (string, error) {
-	var comm CommentsMap
-	var secrets SecretFieldsMap
-	var deprecated DeprecatedFieldsMap
-	var err error
-
-	if showComments {
-		// Collect comments, secrets, and deprecated fields from the settings source files
-		comm, secrets, deprecated, err = CollectCommentsAndSecrets(sourcePath)
-		if err != nil {
-			return "", err
-		}
-	} else {
-		// Still need to collect secrets and deprecated fields even if not showing comments
-		_, secrets, deprecated, err = CollectCommentsAndSecrets(sourcePath)
-		if err != nil {
-			return "", err
-		}
-		// Create empty comments map
-		comm = make(CommentsMap)
-	}
-
-	// If not filtering deprecated fields, clear the deprecated map
-	if !filterDeprecated {
-		deprecated = make(DeprecatedFieldsMap)
-	}
-
-	var node *yaml.Node
-
-	if showFull {
-		// Show the full current config
-		node, err = buildNodeWithDefaults(reflect.ValueOf(config), comm, reflect.Value{}, secrets, deprecated)
-	} else {
-		// Show only non-default values by comparing with defaults during node building
-		// Create a clean default config (no file loading, just pure defaults)
-		defaultConfig := setDefaults(true)
-		// Apply same setup as a fresh instance would have
-		defaultConfig.Server.Sources = []Source{{Path: "."}}
-
-		node, err = buildNodeWithDefaults(reflect.ValueOf(config), comm, reflect.ValueOf(&defaultConfig), secrets, deprecated)
-	}
-
-	if err != nil {
-		return "", err
-	}
-
-	// Create document
-	doc := &yaml.Node{Kind: yaml.DocumentNode}
-	doc.Content = []*yaml.Node{node}
-
-	// Encode to YAML
-	var rawBuf bytes.Buffer
-	enc := yaml.NewEncoder(&rawBuf)
-	enc.SetIndent(2)
-	if err := enc.Encode(doc); err != nil {
-		return "", err
-	}
-
-	// Apply comment alignment if comments are enabled
-	yamlOutput := rawBuf.String()
-	if showComments {
-		yamlOutput = AlignComments(yamlOutput)
-	}
-
-	return yamlOutput, nil
-}
-
-// formatLine applies padding to a single line so its comment starts at a target column.
-func formatLine(line string) string {
-	const targetCol = 42
-	const defaultPadding = 1
-
-	// Find the first # character that is NOT inside double or single quotes.
-	inSingle, inDouble := false, false
-	for i := 0; i < len(line); i++ {
-		c := line[i]
-		switch c {
-		case '\'':
-			if !inDouble {
-				inSingle = !inSingle
-			}
-		case '"':
-			if !inSingle {
-				inDouble = !inDouble
-			}
-		case '#':
-			if !inSingle && !inDouble {
-				// found a comment
-				contentPart := line[:i]
-				commentPart := line[i:]
-				trimmedContent := strings.TrimRight(contentPart, " ")
-				if len(trimmedContent) >= targetCol {
-					return trimmedContent + strings.Repeat(" ", defaultPadding) + commentPart
-				}
-				paddingNeeded := targetCol - len(trimmedContent)
-				return trimmedContent + strings.Repeat(" ", paddingNeeded) + commentPart
-			}
-		}
-	}
-	// No comment found
-	return line
-}
-
-// AlignComments formats each line of the YAML string independently.
-func AlignComments(input string) string {
-	lines := strings.Split(input, "\n")
-	outputLines := make([]string, len(lines))
-
-	for i, line := range lines {
-		outputLines[i] = formatLine(line)
-	}
-
-	return strings.Join(outputLines, "\n")
-}

backend/common/settings/generator_simple_test.go

@@ -1,230 +0,0 @@
-package settings
-
-import (
-	"regexp"
-	"strings"
-	"testing"
-)
-
-func TestGenerateConfigYaml_Basic(t *testing.T) {
-	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
-	// Test using the actual source directory structure
-	config := &Settings{
-		UserDefaults: UserDefaults{
-			Locale:                  "es",          // Non-default value
-			DarkMode:                true,          // Default value
-			DisableOfficePreviewExt: ".docx .xlsx", // This field is deprecated
-		},
-		Auth: Auth{
-			Key:           "secret123",    // This is a secret field
-			AdminUsername: "testadmin",    // This is a secret field
-			AdminPassword: "testpassword", // This is a secret field
-		},
-	}
-
-	// Test different combinations
-	testCases := []struct {
-		name             string
-		showComments     bool
-		showFull         bool
-		filterDeprecated bool
-		expectSecrets    bool
-		expectDeprecated bool
-	}{
-		{
-			name:             "API_mode_all_fields",
-			showComments:     false,
-			showFull:         true,
-			filterDeprecated: false,
-			expectSecrets:    true, // Secrets should be hidden
-			expectDeprecated: true, // Deprecated should be shown
-		},
-		{
-			name:             "Static_config_filter_deprecated",
-			showComments:     true,
-			showFull:         true,
-			filterDeprecated: true,
-			expectSecrets:    true,  // Secrets should be hidden
-			expectDeprecated: false, // Deprecated should be filtered
-		},
-		{
-			name:             "Filtered_non_defaults",
-			showComments:     false,
-			showFull:         false,
-			filterDeprecated: false,
-			expectSecrets:    true,  // Secrets should be hidden
-			expectDeprecated: false, // Might not appear if matches default
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			// Use the current directory structure for real testing
-			yamlOutput, err := GenerateConfigYaml(config, tc.showComments, tc.showFull, tc.filterDeprecated)
-			if err != nil {
-				t.Fatalf("GenerateConfigYaml failed: %v", err)
-			}
-
-			// Basic validation - should produce some output
-			if len(yamlOutput) == 0 {
-				t.Fatal("Generated empty YAML")
-			}
-
-			// Test string quoting - string values should be quoted, numbers and booleans should not
-			lines := strings.Split(yamlOutput, "\n")
-			for _, line := range lines {
-				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
-					// This is a key-value line, skip comment portion
-					parts := strings.SplitN(line, ":", 2)
-					if len(parts) == 2 {
-						value := strings.TrimSpace(parts[1])
-						// Remove comments
-						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
-							value = strings.TrimSpace(value[:commentIdx])
-						}
-
-						// Skip empty values, arrays, and objects
-						if value == "" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
-							continue
-						}
-
-						// Check if it's a number (should NOT be quoted)
-						if reNumber.MatchString(value) {
-							if strings.HasPrefix(value, "\"") {
-								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
-							}
-							continue
-						}
-
-						// Check if it's a boolean (should NOT be quoted)
-						if value == "true" || value == "false" {
-							if strings.HasPrefix(value, "\"") {
-								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
-							}
-							continue
-						}
-
-						// Everything else should be a quoted string
-						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
-							// Add debug info to see what's wrong
-							t.Logf("DEBUG: Checking value '%s' from line '%s'", value, strings.TrimSpace(line))
-							t.Errorf("String value should be quoted in line: %s (value: %s)", strings.TrimSpace(line), value)
-						}
-					}
-				}
-			}
-
-			// Test secret hiding
-			if tc.expectSecrets {
-				if !strings.Contains(yamlOutput, "**hidden**") {
-					t.Error("Expected secrets to be hidden with **hidden**")
-				}
-				if strings.Contains(yamlOutput, "secret123") || strings.Contains(yamlOutput, "testadmin") || strings.Contains(yamlOutput, "testpassword") {
-					t.Error("Secret values should not appear in output")
-				}
-			}
-
-			// Test deprecated field filtering
-			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
-			if tc.expectDeprecated && !hasDeprecated {
-				t.Error("Expected deprecated field to be present")
-			}
-			if !tc.expectDeprecated && hasDeprecated && tc.filterDeprecated {
-				t.Error("Expected deprecated field to be filtered out when filterDeprecated=true")
-			}
-
-			// Test comments
-			hasComments := strings.Contains(yamlOutput, "#")
-			if tc.showComments && !hasComments {
-				t.Error("Expected comments to be present when showComments=true")
-			}
-
-			t.Logf("Test case: %s\nGenerated YAML:\n%s\n", tc.name, yamlOutput)
-		})
-	}
-}
-
-func TestCollectCommentsAndSecrets_Basic(t *testing.T) {
-	// Test the comment and secret collection directly
-	comments, secrets, deprecated, err := CollectCommentsAndSecrets(".")
-	if err != nil {
-		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
-	}
-
-	// Should find some secrets in the actual source files
-	foundSecrets := false
-	for typeName, typeSecrets := range secrets {
-		for fieldName := range typeSecrets {
-			t.Logf("Found secret: %s.%s", typeName, fieldName)
-			foundSecrets = true
-		}
-	}
-	if !foundSecrets {
-		t.Error("Expected to find some secret fields in the actual source code")
-	}
-
-	// Should find some deprecated fields
-	foundDeprecated := false
-	for typeName, typeDeprecated := range deprecated {
-		for fieldName := range typeDeprecated {
-			t.Logf("Found deprecated: %s.%s", typeName, fieldName)
-			foundDeprecated = true
-		}
-	}
-	if !foundDeprecated {
-		t.Error("Expected to find some deprecated fields in the actual source code")
-	}
-
-	t.Logf("Comments: %d types", len(comments))
-	t.Logf("Secrets: %d types", len(secrets))
-	t.Logf("Deprecated: %d types", len(deprecated))
-}
-
-func TestGenerateYaml_StaticGeneration(t *testing.T) {
-	// Test the static generation function that's used by FILEBROWSER_GENERATE_CONFIG=true
-
-	// Create a temporary config for testing
-	config := &Settings{
-		UserDefaults: UserDefaults{
-			Locale:                  "en",
-			DisableOfficePreviewExt: ".docx .xlsx", // This should be filtered out
-		},
-		Auth: Auth{
-			Key: "test-secret", // This should be redacted
-		},
-	}
-
-	// Test static generation with comments and deprecated filtering
-	yamlOutput, err := GenerateConfigYamlWithSource(config, true, true, true, ".")
-	if err != nil {
-		t.Fatalf("Static generation failed: %v", err)
-	}
-
-	// Verify comments are included
-	if !strings.Contains(yamlOutput, "#") {
-		t.Error("Static generation should include comments")
-	}
-
-	// Verify deprecated field is filtered out
-	if strings.Contains(yamlOutput, "disableOfficePreviewExt") {
-		t.Error("Static generation should filter out deprecated field disableOfficePreviewExt")
-	}
-
-	// Verify secrets are redacted
-	if !strings.Contains(yamlOutput, "**hidden**") {
-		t.Error("Static generation should redact secrets")
-	}
-	if strings.Contains(yamlOutput, "test-secret") {
-		t.Error("Static generation should not contain actual secret values")
-	}
-
-	// Verify it has proper structure
-	if !strings.Contains(yamlOutput, "userDefaults:") {
-		t.Error("Static generation should contain userDefaults section")
-	}
-	if !strings.Contains(yamlOutput, "auth:") {
-		t.Error("Static generation should contain auth section")
-	}
-
-	t.Logf("Static generation successful with comments and proper filtering")
-}

backend/common/settings/generator_test.go

@@ -1,470 +0,0 @@
-package settings
-
-import (
-	"os"
-	"regexp"
-	"strings"
-	"testing"
-)
-
-// Test structs for comprehensive testing
-type TestConfig struct {
-	PublicField     string     `json:"publicField"`     // A regular public field
-	SecretField     string     `json:"secretField"`     // secret: this should be hidden
-	DeprecatedField string     `json:"deprecatedField"` // deprecated: this field is old
-	EmptyField      string     `json:"emptyField"`      // An empty string field
-	DefaultField    string     `json:"defaultField"`    // A field that matches default
-	NonDefaultField string     `json:"nonDefaultField"` // A field that differs from default
-	NestedStruct    TestNested `json:"nestedStruct"`
-}
-
-type TestNested struct {
-	NestedPublic     string `json:"nestedPublic"`     // A nested public field
-	NestedSecret     string `json:"nestedSecret"`     // secret: nested secret field
-	NestedDeprecated string `json:"nestedDeprecated"` // deprecated: nested deprecated field
-}
-
-// Helper to create test source files for comment parsing
-func createTestSourceFile(t *testing.T, content string) (string, func()) {
-	tmpFile, err := os.CreateTemp("", "test_*.go")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if _, err := tmpFile.WriteString(content); err != nil {
-		t.Fatal(err)
-	}
-	tmpFile.Close()
-
-	cleanup := func() {
-		os.Remove(tmpFile.Name())
-	}
-
-	return tmpFile.Name(), cleanup
-}
-
-func TestGenerateConfigYaml_StringQuoting(t *testing.T) {
-	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
-	// Create a simple test source file for this test
-	sourceContent := `package settings
-
-type Settings struct {
-	UserDefaults UserDefaults ` + "`json:\"userDefaults\"`" + `
-	Auth Auth ` + "`json:\"auth\"`" + `
-}
-
-type UserDefaults struct {
-	Locale string ` + "`json:\"locale\"`" + `
-}
-
-type Auth struct {
-	AdminUsername string ` + "`json:\"adminUsername\"`" + `
-}
-`
-	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
-	defer cleanup()
-	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]
-
-	// Create real Settings with string values to test quoting
-	settings := &Settings{
-		UserDefaults: UserDefaults{
-			Locale: "en-US",
-		},
-		Auth: Auth{
-			AdminUsername: "admin",
-		},
-	}
-
-	// Test with no filtering - should quote all strings
-	yamlOutput, err := GenerateConfigYamlWithSource(settings, false, true, false, sourcePath)
-	if err != nil {
-		t.Fatalf("GenerateConfigYaml failed: %v", err)
-	}
-
-	// All string values should be quoted
-	lines := strings.Split(yamlOutput, "\n")
-	for _, line := range lines {
-		if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
-			// This is a key-value line
-			parts := strings.SplitN(line, ":", 2)
-			if len(parts) == 2 {
-				value := strings.TrimSpace(parts[1])
-
-				// Remove comments
-				if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
-					value = strings.TrimSpace(value[:commentIdx])
-				}
-
-				// Skip empty values, arrays, objects, booleans
-				if value == "" || value == "false" || value == "true" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
-					continue
-				}
-
-				// Check if it's a number (should NOT be quoted)
-				if reNumber.MatchString(value) {
-					if strings.HasPrefix(value, "\"") {
-						t.Errorf("Numeric value should not be quoted: %s (value: '%s')", line, value)
-					}
-					continue
-				}
-
-				// Everything else should be a quoted string
-				if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
-					t.Errorf("String value should be quoted: %s (value: '%s')", line, value)
-				}
-			}
-		}
-	}
-}
-
-func TestGenerateConfigYaml_SecretHiding(t *testing.T) {
-	// Create temporary source file with our test structs
-	sourceContent := `package settings
-
-type TestConfig struct {
-	PublicField string ` + "`json:\"publicField\"`" + ` // A regular public field
-	SecretField string ` + "`json:\"secretField\"`" + ` // secret: this should be hidden
-}
-
-type TestNested struct {
-	NestedPublic string ` + "`json:\"nestedPublic\"`" + ` // A nested public field
-	NestedSecret string ` + "`json:\"nestedSecret\"`" + ` // secret: nested secret field
-}
-`
-
-	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
-	defer cleanup()
-
-	// Test secret detection
-	_, secrets, _, err := CollectCommentsAndSecrets(tmpFile)
-	if err != nil {
-		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
-	}
-
-	// Verify secret fields are detected
-	if !secrets["TestConfig"]["SecretField"] {
-		t.Error("SecretField should be marked as secret")
-	}
-	if !secrets["TestNested"]["NestedSecret"] {
-		t.Error("NestedSecret should be marked as secret")
-	}
-	if secrets["TestConfig"]["PublicField"] {
-		t.Error("PublicField should not be marked as secret")
-	}
-
-	// Test that secrets are properly collected
-	if len(secrets["TestConfig"]) != 1 {
-		t.Errorf("Expected 1 secret field in TestConfig, got %d", len(secrets["TestConfig"]))
-	}
-}
-
-func TestGenerateConfigYaml_DeprecatedFiltering(t *testing.T) {
-	// Create temporary source file with deprecated fields
-	sourceContent := `package settings
-
-type TestConfig struct {
-	PublicField     string ` + "`json:\"publicField\"`" + ` // A regular public field
-	DeprecatedField string ` + "`json:\"deprecatedField\"`" + ` // deprecated: this field is old
-}
-`
-
-	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
-	defer cleanup()
-
-	// Test deprecated detection
-	_, _, deprecated, err := CollectCommentsAndSecrets(tmpFile)
-	if err != nil {
-		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
-	}
-
-	// Verify deprecated fields are detected
-	if !deprecated["TestConfig"]["DeprecatedField"] {
-		t.Error("DeprecatedField should be marked as deprecated")
-	}
-	if deprecated["TestConfig"]["PublicField"] {
-		t.Error("PublicField should not be marked as deprecated")
-	}
-}
-
-func TestGenerateConfigYaml_FullVsFiltered(t *testing.T) {
-	// Create minimal test source
-	sourceContent := `package settings
-
-type Settings struct {
-	UserDefaults UserDefaults ` + "`json:\"userDefaults\"`" + `
-}
-
-type UserDefaults struct {
-	DarkMode bool ` + "`json:\"darkMode\"`" + `
-	Locale string ` + "`json:\"locale\"`" + `
-}
-`
-	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
-	defer cleanup()
-	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]
-
-	// Create a config with both default and non-default values
-	config := &Settings{
-		UserDefaults: UserDefaults{
-			DarkMode: true, // This matches default
-			Locale:   "es", // This differs from default ("en")
-		},
-	}
-
-	// Test full=true - should show all fields
-	fullYaml, err := GenerateConfigYamlWithSource(config, false, true, false, sourcePath)
-	if err != nil {
-		t.Fatalf("GenerateConfigYaml with full=true failed: %v", err)
-	}
-
-	// Test full=false - should only show non-default fields
-	filteredYaml, err := GenerateConfigYamlWithSource(config, false, false, false, sourcePath)
-	if err != nil {
-		t.Fatalf("GenerateConfigYaml with full=false failed: %v", err)
-	}
-
-	// Full output should be longer than filtered
-	if len(fullYaml) <= len(filteredYaml) {
-		t.Error("Full YAML should be longer than filtered YAML")
-	}
-
-	// Filtered output should contain the non-default field
-	if !strings.Contains(filteredYaml, "locale") {
-		t.Error("Filtered YAML should contain non-default locale field")
-	}
-
-	// Full output should contain default fields
-	if !strings.Contains(fullYaml, "darkMode") {
-		t.Error("Full YAML should contain darkMode field")
-	}
-}
-
-func TestGenerateConfigYaml_CommentsOnOff(t *testing.T) {
-	// Use the actual settings source directory since comments work there
-	config := &Settings{
-		UserDefaults: UserDefaults{
-			Locale: "en",
-		},
-	}
-
-	// Test with comments=true using the real source
-	withComments, err := GenerateConfigYaml(config, true, true, false)
-	if err != nil {
-		t.Fatalf("GenerateConfigYaml with comments=true failed: %v", err)
-	}
-
-	// Test with comments=false using the real source
-	withoutComments, err := GenerateConfigYaml(config, false, true, false)
-	if err != nil {
-		t.Fatalf("GenerateConfigYaml with comments=false failed: %v", err)
-	}
-
-	// Output with comments should be longer
-	if len(withComments) <= len(withoutComments) {
-		t.Errorf("YAML with comments (%d chars) should be longer than without comments (%d chars)", len(withComments), len(withoutComments))
-	}
-
-	// With comments should contain '#' characters
-	if !strings.Contains(withComments, "#") {
-		t.Error("YAML with comments should contain '#' characters")
-	}
-
-	// Without comments should not contain '#' characters
-	if strings.Contains(withoutComments, "#") {
-		t.Error("YAML without comments should not contain '#' characters")
-	}
-}
-
-func TestGenerateConfigYaml_IntegrationTest(t *testing.T) {
-	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
-	// Comprehensive test with all features
-	config := &Settings{
-		UserDefaults: UserDefaults{
-			Locale:                  "es",          // Non-default
-			DarkMode:                true,          // Default
-			DisableOfficePreviewExt: ".docx .xlsx", // This is deprecated
-		},
-		Auth: Auth{
-			Key:           "secret123", // This is secret
-			AdminUsername: "admin",     // This is secret
-			AdminPassword: "password",  // This is secret
-		},
-	}
-
-	tests := []struct {
-		name             string
-		showComments     bool
-		showFull         bool
-		filterDeprecated bool
-		expectSecret     bool
-		expectDeprecated bool
-		expectFull       bool
-		expectComments   bool
-	}{
-		{
-			name:             "API mode: show all including deprecated",
-			showComments:     false,
-			showFull:         true,
-			filterDeprecated: false,
-			expectSecret:     true,  // secrets should be hidden
-			expectDeprecated: true,  // deprecated should be shown
-			expectFull:       true,  // all fields shown
-			expectComments:   false, // no comments
-		},
-		{
-			name:             "Static config mode: filter deprecated",
-			showComments:     true,
-			showFull:         true,
-			filterDeprecated: true,
-			expectSecret:     true,  // secrets should be hidden
-			expectDeprecated: false, // deprecated should be filtered
-			expectFull:       true,  // all non-deprecated fields shown
-			expectComments:   true,  // comments included
-		},
-		{
-			name:             "Filtered output: only changes",
-			showComments:     false,
-			showFull:         false,
-			filterDeprecated: false,
-			expectSecret:     true,  // secrets should be hidden
-			expectDeprecated: false, // might not appear if matches default
-			expectFull:       false, // only non-default fields
-			expectComments:   false, // no comments
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			yamlOutput, err := GenerateConfigYaml(config, tt.showComments, tt.showFull, tt.filterDeprecated)
-			if err != nil {
-				t.Fatalf("GenerateConfigYaml failed: %v", err)
-			}
-
-			// Check secret hiding
-			if tt.expectSecret {
-				if !strings.Contains(yamlOutput, "**hidden**") {
-					t.Error("Expected secrets to be hidden with **hidden**")
-				}
-				if strings.Contains(yamlOutput, "secret123") {
-					t.Error("Secret values should not appear in output")
-				}
-			}
-
-			// Check deprecated field filtering
-			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
-			if tt.expectDeprecated && !hasDeprecated {
-				t.Error("Expected deprecated field to be present")
-			}
-			if !tt.expectDeprecated && hasDeprecated && tt.filterDeprecated {
-				t.Error("Expected deprecated field to be filtered out")
-			}
-
-			// Check comments
-			hasComments := strings.Contains(yamlOutput, "#")
-			if tt.expectComments && !hasComments {
-				t.Error("Expected comments to be present")
-			}
-			if !tt.expectComments && hasComments {
-				t.Error("Expected no comments")
-			}
-
-			// Check string quoting - all string values should be quoted
-			lines := strings.Split(yamlOutput, "\n")
-			for _, line := range lines {
-				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
-					// This is a key-value line
-					parts := strings.SplitN(line, ":", 2)
-					if len(parts) == 2 {
-						value := strings.TrimSpace(parts[1])
-						// Skip comments and empty values
-						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
-							// If comment starts at the beginning, there's no value, just a comment
-							if commentIdx == 0 {
-								continue
-							}
-							value = strings.TrimSpace(value[:commentIdx])
-						}
-						// Check if it's a number (should NOT be quoted)
-						if reNumber.MatchString(value) {
-							if strings.HasPrefix(value, "\"") {
-								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
-							}
-							continue
-						}
-
-						// Check if it's a boolean (should NOT be quoted)
-						if value == "true" || value == "false" {
-							if strings.HasPrefix(value, "\"") {
-								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
-							}
-							continue
-						}
-
-						// Skip arrays, objects, and empty values
-						if value == "" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") || strings.Contains(value, ":") {
-							continue
-						}
-
-						// Everything else should be a quoted string
-						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
-							t.Errorf("String value should be quoted in line: %s (value: '%s')", line, value)
-						}
-					}
-				}
-			}
-
-			t.Logf("Generated YAML for %s:\n%s", tt.name, yamlOutput)
-		})
-	}
-}
-
-func TestGenerateConfigYaml_EdgeCases(t *testing.T) {
-	tests := []struct {
-		name   string
-		config *Settings
-		desc   string
-	}{
-		{
-			name:   "empty_config",
-			config: &Settings{},
-			desc:   "Empty config should generate valid YAML",
-		},
-		{
-			name: "only_defaults",
-			config: &Settings{
-				UserDefaults: UserDefaults{
-					DarkMode: true, // default value
-					Locale:   "en", // default value
-				},
-			},
-			desc: "Config with only default values",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Test all combinations
-			for _, showComments := range []bool{false, true} {
-				for _, showFull := range []bool{false, true} {
-					for _, filterDeprecated := range []bool{false, true} {
-						yamlOutput, err := GenerateConfigYaml(tt.config, showComments, showFull, filterDeprecated)
-						if err != nil {
-							t.Fatalf("GenerateConfigYaml failed for %s (comments=%v, full=%v, filterDeprecated=%v): %v",
-								tt.desc, showComments, showFull, filterDeprecated, err)
-						}
-
-						// Basic validation - should produce valid YAML structure
-						if yamlOutput == "" {
-							t.Errorf("Generated empty YAML for %s", tt.desc)
-						}
-
-						// Should not contain obvious error messages (but allow "error" in log levels etc)
-						if strings.Contains(yamlOutput, "Error:") || strings.Contains(yamlOutput, "ERROR:") {
-							t.Errorf("YAML contains error for %s", tt.desc)
-						}
-					}
-				}
-			}
-		})
-	}
-}

backend/common/settings/settings.go

@@ -1,67 +0,0 @@
-//go:generate go run ./tools/yaml.go -input=common/settings/settings.go -output=config.generated.yaml
-package settings
-
-import (
-	"crypto/rand"
-
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-const DefaultUsersHomeBasePath = "/users"
-
-// AuthMethod describes an authentication method.
-type AuthMethod string
-
-// GenerateKey generates a key of 512 bits.
-func GenerateKey() ([]byte, error) {
-	b := make([]byte, 64) //nolint:gomnd
-	_, err := rand.Read(b)
-	// Note that err == nil only if we read len(b) bytes.
-	if err != nil {
-		return nil, err
-	}
-
-	return b, nil
-}
-
-func GetSettingsConfig(nameType string, Value string) string {
-	return nameType + Value
-}
-
-func AdminPerms() users.Permissions {
-	return users.Permissions{
-		Modify: true,
-		Share:  true,
-		Admin:  true,
-		Api:    true,
-	}
-}
-
-// Apply applies the default options to a user.
-func ApplyUserDefaults(u *users.User) {
-	u.StickySidebar = Config.UserDefaults.StickySidebar
-	u.DisableSettings = Config.UserDefaults.DisableSettings
-	u.DarkMode = Config.UserDefaults.DarkMode
-	u.Locale = Config.UserDefaults.Locale
-	u.ViewMode = Config.UserDefaults.ViewMode
-	u.SingleClick = Config.UserDefaults.SingleClick
-	u.Permissions = Config.UserDefaults.Permissions
-	u.Preview = Config.UserDefaults.Preview
-	u.ShowHidden = Config.UserDefaults.ShowHidden
-	u.DateFormat = Config.UserDefaults.DateFormat
-	u.DisableViewingExt = Config.UserDefaults.DisableViewingExt
-	u.ThemeColor = Config.UserDefaults.ThemeColor
-	u.GallerySize = Config.UserDefaults.GallerySize
-	u.QuickDownload = Config.UserDefaults.QuickDownload
-	u.LockPassword = Config.UserDefaults.LockPassword
-	if len(u.Scopes) == 0 {
-		for _, source := range Config.Server.Sources {
-			if source.Config.DefaultEnabled {
-				u.Scopes = append(u.Scopes, users.SourceScope{
-					Name:  source.Path, // backend name is path
-					Scope: source.Config.DefaultUserScope,
-				})
-			}
-		}
-	}
-}

backend/common/settings/structs.go

@@ -1,178 +0,0 @@
-package settings
-
-import (
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-type AllowedMethods string
-
-const (
-	ProxyAuth    AllowedMethods = "proxyAuth"
-	NoAuth       AllowedMethods = "noAuth"
-	PasswordAuth AllowedMethods = "passwordAuth"
-)
-
-type Settings struct {
-	Server       Server       `json:"server"`
-	Auth         Auth         `json:"auth"`
-	Frontend     Frontend     `json:"frontend"`
-	UserDefaults UserDefaults `json:"userDefaults"`
-	Integrations Integrations `json:"integrations"`
-}
-
-type Server struct {
-	MinSearchLength              int         `json:"minSearchLength"`              // minimum length of search query to begin searching (default: 3)
-	DisableUpdateCheck           bool        `json:"disableUpdateCheck"`           // disables backend update check service
-	NumImageProcessors           int         `json:"numImageProcessors"`           // number of concurrent image processing jobs used to create previews, default is number of cpu cores available.
-	Socket                       string      `json:"socket"`                       // socket to listen on
-	TLSKey                       string      `json:"tlsKey"`                       // path to TLS key
-	TLSCert                      string      `json:"tlsCert"`                      // path to TLS cert
-	DisablePreviews              bool        `json:"disablePreviews"`              // disable all previews thumbnails, simple icons will be used
-	DisableResize                bool        `json:"disablePreviewResize"`         // disable resizing of previews for faster loading over slow connections
-	DisableTypeDetectionByHeader bool        `json:"disableTypeDetectionByHeader"` // disable type detection by header, useful if filesystem is slow.
-	Port                         int         `json:"port"`                         // port to listen on
-	BaseURL                      string      `json:"baseURL"`                      // base URL for the server, the subpath that the server is running on.
-	Logging                      []LogConfig `json:"logging"`
-	DebugMedia                   bool        `json:"debugMedia"` // output ffmpeg stdout for media integration -- careful can produces lots of output!
-	Database                     string      `json:"database"`   // path to the database file
-	Sources                      []Source    `json:"sources" validate:"required,dive"`
-	ExternalUrl                  string      `json:"externalUrl"`    // used by share links if set (eg. http://mydomain.com)
-	InternalUrl                  string      `json:"internalUrl"`    // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
-	CacheDir                     string      `json:"cacheDir"`       // path to the cache directory, used for thumbnails and other cached files
-	MaxArchiveSizeGB             int64       `json:"maxArchiveSize"` // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
-	// not exposed to config
-	SourceMap      map[string]Source `json:"-" validate:"omitempty"` // uses realpath as key
-	NameToSource   map[string]Source `json:"-" validate:"omitempty"` // uses name as key
-	MuPdfAvailable bool              `json:"-"`                      // used internally if compiled with mupdf support
-}
-
-type Integrations struct {
-	OnlyOffice OnlyOffice `json:"office" validate:"omitempty"`
-	Media      Media      `json:"media" validate:"omitempty"`
-}
-
-// onlyoffice secret is stored in the local.json file
-// docker exec <containerID> /var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/local.json 'services.CoAuthoring.secret.session.string'
-type OnlyOffice struct {
-	Url         string `json:"url" validate:"required"`    // The URL to the OnlyOffice Document Server, needs to be accessible to the user.
-	InternalUrl string `json:"internalUrl"`                // An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
-	Secret      string `json:"secret" validate:"required"` // secret: authentication key for OnlyOffice integration
-}
-
-type Media struct {
-	FfmpegPath string `json:"ffmpegPath"` // path to ffmpeg directory with ffmpeg and ffprobe (eg. /usr/local/bin)
-}
-
-type LogConfig struct {
-	Levels    string `json:"levels"`    // separated list of log levels to enable. (eg. "info|warning|error|debug")
-	ApiLevels string `json:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
-	Output    string `json:"output"`    // output location. (eg. "stdout" or "path/to/file.log")
-	NoColors  bool   `json:"noColors"`  // disable colors in the output
-	Json      bool   `json:"json"`      // output in json format, currently not supported
-	Utc       bool   `json:"utc"`       // use UTC time in the output instead of local time
-}
-
-type Source struct {
-	Path   string       `json:"path" validate:"required"` // file system path. (Can be relative)
-	Name   string       `json:"name"`                     // display name
-	Config SourceConfig `json:"config,omitempty"`
-}
-
-type SourceConfig struct {
-	DenyByDefault    bool               `json:"denyByDefault,omitempty"`           // deny access unless an "allow" access rule was specifically created.
-	Private          bool               `json:"private"`                           // designate as source as private -- currently just means no sharing permitted.
-	Disabled         bool               `json:"disabled,omitempty"`                // disable the source, this is useful so you don't need to remove it from the config file
-	IndexingInterval uint32             `json:"indexingIntervalMinutes,omitempty"` // optional manual overide interval in minutes to re-index the source
-	DisableIndexing  bool               `json:"disableIndexing,omitempty"`         // disable the indexing of this source
-	MaxWatchers      int                `json:"maxWatchers"`                       // number of concurrent watchers to use for this source, currently not supported
-	NeverWatchPaths  []string           `json:"neverWatchPaths"`                   // paths that get initially once. Useful for folders that rarely change contents (without source path prefix)
-	Exclude          ExcludeIndexFilter `json:"exclude"`                           // exclude files and folders from indexing, if include is not set
-	Include          IncludeIndexFilter `json:"include"`                           // include files and folders from indexing, if exclude is not set
-	DefaultUserScope string             `json:"defaultUserScope"`                  // default "/" should match folders under path
-	DefaultEnabled   bool               `json:"defaultEnabled"`                    // should be added as a default source for new users?
-	CreateUserDir    bool               `json:"createUserDir"`                     // create a user directory for each user
-}
-
-type IncludeIndexFilter struct {
-	RootFolders []string `json:"rootFolders"` // list of root folders to include, relative to the source path (eg. "folder1")
-	RootFiles   []string `json:"rootFiles"`   // list of root files to include, relative to the source path (eg. "file1.txt")
-}
-
-type ExcludeIndexFilter struct {
-	Hidden          bool     `json:"hidden"`                // exclude hidden files and folders.
-	ZeroSizeFolders bool     `json:"ignoreZeroSizeFolders"` // ignore folders with 0 size
-	FilePaths       []string `json:"filePaths"`             // list of filepaths Eg. "folder1" or "file1.txt" or "folder1/file1.txt" (without source path prefix)
-	FolderPaths     []string `json:"folderPaths"`           // (filepath) list of folder names to include/exclude. Eg. "folder1" or "folder1/subfolder" (do not include source path, just the subpaths from the source path)
-	FileNames       []string `json:"fileNames"`             // (global) list of file names to include/exclude. Eg. "a.jpg"
-	FolderNames     []string `json:"folderNames"`           // (global) list of folder names to include/exclude. Eg. "@eadir" or ".thumbnails"
-	FileEndsWith    []string `json:"fileEndsWith"`          // (global) exclude files that end with these suffixes. Eg. ".jpg" or ".txt"
-	FolderEndsWith  []string `json:"folderEndsWith"`        // (global) exclude folders that end with these suffixes. Eg. ".thumbnails" or ".git"
-}
-
-type Frontend struct {
-	Name                  string         `json:"name"`                  // display name
-	DisableDefaultLinks   bool           `json:"disableDefaultLinks"`   // disable default links in the sidebar
-	DisableUsedPercentage bool           `json:"disableUsedPercentage"` // disable used percentage for the sources in the sidebar
-	ExternalLinks         []ExternalLink `json:"externalLinks"`
-	DisableNavButtons     bool           `json:"disableNavButtons"` // disable the nav buttons in the sidebar
-	Styling               StylingConfig  `json:"styling"`
-	Favicon               string         `json:"favicon"`     // path to a favicon to use for the frontend
-	Description           string         `json:"description"` // description that shows up in html head meta description
-}
-
-type StylingConfig struct {
-	CustomCSS       string                 `json:"customCSS"`       // if a valid path to a css file is provided, it will be applied for all users. (eg. "reduce-rounded-corners.css")
-	CustomCSSRaw    string                 `json:"-"`               // The css raw content to use for the custom css.
-	LightBackground string                 `json:"lightBackground"` // specify a valid CSS color property value to use as the background color in light mode
-	DarkBackground  string                 `json:"darkBackground"`  // Specify a valid CSS color property value to use as the background color in dark mode
-	CustomThemes    map[string]CustomTheme `json:"customThemes"`    // A list of custom css files that each user can select to override the default styling. if "default" is key name then it will be the default option.
-	// In-memory (not exposed to config)
-	CustomThemeOptions map[string]CustomTheme `json:"-"` // not exposed
-}
-
-type CustomTheme struct {
-	Description string `json:"description"`   // The description of the theme to display in the UI.
-	CSS         string `json:"css,omitempty"` // The css file path and filename to use for the theme.
-	CssRaw      string `json:"-"`             // The css raw content to use for the theme.
-}
-
-type ExternalLink struct {
-	Text  string `json:"text" validate:"required"` // the text to display on the link
-	Title string `json:"title"`                    // the title to display on hover
-	Url   string `json:"url" validate:"required"`  // the url to link to
-}
-
-// UserDefaults is a type that holds the default values
-// for some fields on User.
-type UserDefaults struct {
-	EditorQuickSave            bool                `json:"editorQuickSave"`           // show quick save button in editor
-	HideSidebarFileActions     bool                `json:"hideSidebarFileActions"`    // hide the file actions in the sidebar
-	DisableQuickToggles        bool                `json:"disableQuickToggles"`       // disable the quick toggles in the sidebar
-	DisableSearchOptions       bool                `json:"disableSearchOptions"`      // disable the search options in the search bar
-	StickySidebar              bool                `json:"stickySidebar"`             // keep sidebar open when navigating
-	DarkMode                   bool                `json:"darkMode"`                  // should dark mode be enabled
-	Locale                     string              `json:"locale"`                    // language to use: eg. de, en, or fr
-	ViewMode                   string              `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
-	SingleClick                bool                `json:"singleClick"`               // open directory on single click, also enables middle click to open in new tab
-	ShowHidden                 bool                `json:"showHidden"`                // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-	DateFormat                 bool                `json:"dateFormat"`                // when false, the date is relative, when true, the date is an exact timestamp
-	GallerySize                int                 `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
-	ThemeColor                 string              `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-	QuickDownload              bool                `json:"quickDownload"`             // show icon to download in one click
-	DisablePreviewExt          string              `json:"disablePreviewExt"`         // space separated list of file extensions to disable preview for
-	DisableViewingExt          string              `json:"disableViewingExt"`         // space separated list of file extensions to disable viewing for
-	LockPassword               bool                `json:"lockPassword"`              // disable the user from changing their password
-	DisableSettings            bool                `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
-	Preview                    users.Preview       `json:"preview"`
-	DefaultScopes              []users.SourceScope `json:"-"`
-	Permissions                users.Permissions   `json:"permissions"`
-	LoginMethod                string              `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
-	DisableUpdateNotifications bool                `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
-	DeleteWithoutConfirming    bool                `json:"deleteWithoutConfirming"`    // delete files without confirmation
-	FileLoading                users.FileLoading   `json:"fileLoading"`                // upload and download settings
-	DisableOfficePreviewExt    string              `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
-	DisableOnlyOfficeExt       string              `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
-	CustomTheme                string              `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
-	ShowSelectMultiple         bool                `json:"showSelectMultiple"`         // show select multiple files on desktop
-	DebugOffice                bool                `json:"debugOffice"`                // debug onlyoffice editor
-}

backend/common/settings/styling.go

@@ -1,113 +0,0 @@
-package settings
-
-import (
-	"os"
-	"regexp"
-	"strings"
-
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// Strict hex color regex: #RGB, #RGBA, #RRGGBB, #RRGGBBAA
-var hexColorRE = regexp.MustCompile(`^#([0-9a-fA-F]{3}|[0-9a-fA-F]{4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$`)
-
-// All valid CSS named colors (W3C spec, lower-case)
-var cssNamedColors = map[string]struct{}{
-	"aliceblue": {}, "antiquewhite": {}, "aqua": {}, "aquamarine": {}, "azure": {},
-	"beige": {}, "bisque": {}, "black": {}, "blanchedalmond": {}, "blue": {}, "blueviolet": {},
-	"brown": {}, "burlywood": {}, "cadetblue": {}, "chartreuse": {}, "chocolate": {},
-	"coral": {}, "cornflowerblue": {}, "cornsilk": {}, "crimson": {}, "cyan": {},
-	"darkblue": {}, "darkcyan": {}, "darkgoldenrod": {}, "darkgray": {}, "darkgreen": {},
-	"darkgrey": {}, "darkkhaki": {}, "darkmagenta": {}, "darkolivegreen": {}, "darkorange": {},
-	"darkorchid": {}, "darkred": {}, "darksalmon": {}, "darkseagreen": {}, "darkslateblue": {},
-	"darkslategray": {}, "darkslategrey": {}, "darkturquoise": {}, "darkviolet": {}, "deeppink": {},
-	"deepskyblue": {}, "dimgray": {}, "dimgrey": {}, "dodgerblue": {}, "firebrick": {},
-	"floralwhite": {}, "forestgreen": {}, "fuchsia": {}, "gainsboro": {}, "ghostwhite": {},
-	"gold": {}, "goldenrod": {}, "gray": {}, "green": {}, "greenyellow": {}, "grey": {},
-	"honeydew": {}, "hotpink": {}, "indianred": {}, "indigo": {}, "ivory": {},
-	"khaki": {}, "lavender": {}, "lavenderblush": {}, "lawngreen": {}, "lemonchiffon": {},
-	"lightblue": {}, "lightcoral": {}, "lightcyan": {}, "lightgoldenrodyellow": {}, "lightgray": {},
-	"lightgreen": {}, "lightgrey": {}, "lightpink": {}, "lightsalmon": {}, "lightseagreen": {},
-	"lightskyblue": {}, "lightslategray": {}, "lightslategrey": {}, "lightsteelblue": {}, "lightyellow": {},
-	"lime": {}, "limegreen": {}, "linen": {}, "magenta": {}, "maroon": {}, "mediumaquamarine": {},
-	"mediumblue": {}, "mediumorchid": {}, "mediumpurple": {}, "mediumseagreen": {}, "mediumslateblue": {},
-	"mediumspringgreen": {}, "mediumturquoise": {}, "mediumvioletred": {}, "midnightblue": {}, "mintcream": {},
-	"mistyrose": {}, "moccasin": {}, "navajowhite": {}, "navy": {}, "oldlace": {},
-	"olive": {}, "olivedrab": {}, "orange": {}, "orangered": {}, "orchid": {},
-	"palegoldenrod": {}, "palegreen": {}, "paleturquoise": {}, "palevioletred": {}, "papayawhip": {},
-	"peachpuff": {}, "peru": {}, "pink": {}, "plum": {}, "powderblue": {},
-	"purple": {}, "rebeccapurple": {}, "red": {}, "rosybrown": {}, "royalblue": {},
-	"saddlebrown": {}, "salmon": {}, "sandybrown": {}, "seagreen": {}, "seashell": {},
-	"sienna": {}, "silver": {}, "skyblue": {}, "slateblue": {}, "slategray": {},
-	"slategrey": {}, "snow": {}, "springgreen": {}, "steelblue": {}, "tan": {},
-	"teal": {}, "thistle": {}, "tomato": {}, "turquoise": {}, "violet": {},
-	"wheat": {}, "white": {}, "whitesmoke": {}, "yellow": {}, "yellowgreen": {},
-	// And the special values:
-	"transparent": {}, "currentcolor": {},
-}
-
-func FallbackColor(val, defaultColor string) string {
-	val = strings.TrimSpace(val)
-	if val == "" {
-		return defaultColor
-	}
-	if hexColorRE.MatchString(val) {
-		return val
-	}
-	lc := strings.ToLower(val)
-	// CSS color functions
-	if strings.HasPrefix(lc, "rgb(") || strings.HasPrefix(lc, "rgba(") ||
-		strings.HasPrefix(lc, "hsl(") || strings.HasPrefix(lc, "hsla(") {
-		return val
-	}
-	// CSS variable
-	if strings.HasPrefix(lc, "var(") {
-		return val
-	}
-	// Named colors and special values
-	if _, ok := cssNamedColors[lc]; ok {
-		return val
-	}
-	// Log a warning if the color is invalid
-	logger.Warningf("Invalid CSS color value provided: '%s'. Falling back to default: '%s'", val, defaultColor)
-	return defaultColor
-}
-
-func addCustomTheme(name, description, cssFilePath string) {
-	// Store only file path in config (for YAML export)
-	Config.Frontend.Styling.CustomThemes[name] = CustomTheme{
-		Description: description,
-		CSS:         cssFilePath, // Store file path, not content
-	}
-
-	// Load CSS content for runtime use (frontend consumption)
-	cssContent := ""
-	if cssFilePath != "" {
-		cssContent = readCustomCSS(cssFilePath)
-	}
-	Config.Frontend.Styling.CustomThemeOptions[name] = CustomTheme{
-		Description: description,
-		CSS:         cssFilePath,
-		CssRaw:      cssContent, // Store loaded content
-	}
-}
-
-func readCustomCSS(path string) string {
-	if path == "" {
-		return ""
-	}
-	content, err := os.ReadFile(path)
-	if err != nil {
-		// Only log if the file exists but cannot be read (e.g., permission error)
-		if !os.IsNotExist(err) {
-			logger.Warningf("Could not read custom CSS file %s: %v", path, err)
-			return ""
-		}
-	}
-	if len(content) > 128*1024 {
-		logger.Warningf("Custom CSS file %s is too large (%d bytes), ignoring", path, len(content))
-		return ""
-	}
-	logger.Infof("Loaded custom CSS from: %s (%d bytes)", path, len(content))
-	return string(content)
-}

backend/common/settings/validConfig.yaml

@@ -1,35 +0,0 @@
-server:
-  numImageProcessors: 4
-  socket: ""
-  tlsKey: ""
-  tlsCert: ""
-  disablePreviews: false
-  disablePreviewResize: false
-  port: 80
-  baseURL: "/"
-  database: "mydb.db"
-  sources:
-    - path: "."
-integrations:
-  office:
-    url: "http://localhost:9052"
-    secret: 6H1H7GzUk2alRkNxAPav0W02g8JS5oUd
-auth:
-  methods:
-    password:
-      enabled: true
-frontend:
-  name: ""
-  disableUsedPercentage: true
-userDefaults:
-  locale: ""
-  viewMode: ""
-  darkMode: true
-  disableSettings: false
-  singleClick: true
-  permissions:
-    admin: true
-    modify: true
-    share: true
-    api: true
-  dateFormat: false

backend/common/utils/cache.go

@@ -1,16 +0,0 @@
-package utils
-
-import (
-	"time"
-
-	"github.com/gtsteffaniak/go-cache/cache"
-)
-
-var (
-	DiskUsageCache     = cache.NewCache(30*time.Second, 24*time.Hour)
-	RealPathCache      = cache.NewCache(48*time.Hour, 72*time.Hour)
-	SearchResultsCache = cache.NewCache(15*time.Second, 1*time.Hour)
-	OnlyOfficeCache    = cache.NewCache(48*time.Hour, 1*time.Hour)
-	JwtCache           = cache.NewCache(1*time.Hour, 72*time.Hour)
-	MediaCache         = cache.NewCache(24 * time.Hour) // subtitles get cached for 24 hours
-)

backend/common/utils/checkForUpdates.go

@@ -1,102 +0,0 @@
-package utils
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/version"
-	"github.com/gtsteffaniak/go-logger/logger"
-	"golang.org/x/mod/semver"
-)
-
-var updateAvailableUrl = ""
-
-type Tag struct {
-	Name string `json:"name"`
-}
-
-type updateInfo struct {
-	LatestVersion  string
-	CurrentVersion string
-	ReleaseNotes   string
-	ReleaseUrl     string
-}
-
-func CheckForUpdates() (updateInfo, error) {
-	// --- Configuration ---
-	repoOwner := "gtsteffaniak"
-	repoName := "filebrowser"
-	currentVersion := version.Version
-	splitVersion := strings.Split(currentVersion, "-")
-	versionCategory := "stable"
-	if len(splitVersion) > 1 {
-		versionCategory = splitVersion[1]
-	}
-	githubApiUrl := fmt.Sprintf("https://api.github.com/repos/%s/%s/tags", repoOwner, repoName)
-	// Make the GET request
-	resp, err := http.Get(githubApiUrl)
-	if err != nil {
-		return updateInfo{}, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return updateInfo{}, fmt.Errorf("failed to fetch tags from GitHub API")
-	}
-	// Decode the JSON response
-	var tags []Tag
-	if err := json.NewDecoder(resp.Body).Decode(&tags); err != nil {
-		return updateInfo{}, err
-	}
-	// Find the latest beta version greater than the current one
-	var NewVersion string
-	for _, tag := range tags {
-		// Check if the version is valid, is a pre-release, and contains "beta"
-		if semver.IsValid(tag.Name) && strings.Contains(semver.Prerelease(tag.Name), versionCategory) {
-			// Check if this tag is greater than the current version
-			// and also greater than any other beta version we've found so far
-			if semver.Compare(tag.Name, currentVersion) > 0 {
-				if NewVersion == "" || semver.Compare(tag.Name, NewVersion) > 0 {
-					NewVersion = tag.Name
-				}
-			}
-		}
-	}
-	if NewVersion == "" {
-		// No newer version found, return empty updateInfo
-		return updateInfo{}, fmt.Errorf("no newer version found for %s", currentVersion)
-	}
-
-	updateAvailableUrl = fmt.Sprintf("https://github.com/%s/%s/releases/tag/%s", repoOwner, repoName, NewVersion)
-	return updateInfo{
-		LatestVersion:  NewVersion,
-		CurrentVersion: currentVersion,
-		ReleaseNotes:   updateAvailableUrl,
-		ReleaseUrl:     updateAvailableUrl,
-	}, nil
-}
-
-func GetUpdateAvailableUrl() string {
-	return updateAvailableUrl
-}
-
-// starts a background process to check for updates periodically.
-func StartCheckForUpdates() {
-	// Create a ticker that fires every 24 hours.
-	ticker := time.NewTicker(24 * time.Hour)
-	defer ticker.Stop()
-	// Start a loop that waits for the ticker to fire.
-	for range ticker.C {
-		_, err := CheckForUpdates()
-		if err != nil {
-			// In a real application, you might want more sophisticated logging.
-			logger.Debug("update check failed:", err)
-			continue // Don't stop the loop, just wait for the next tick.
-		}
-		// Update the global variable with the result of the check.
-		// This will be an empty string if no newer version was found.
-	}
-}

backend/common/utils/main.go

@@ -1,130 +0,0 @@
-package utils
-
-import (
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	math "math/rand"
-	"path/filepath"
-	"reflect"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-func CheckErr(source string, err error) {
-	if err != nil {
-		logger.Fatalf("%s: %v", source, err)
-	}
-}
-
-func GenerateKey() string {
-	b := make([]byte, 64)
-	_, err := rand.Read(b)
-	if err != nil {
-		return ""
-	}
-	return string(b)
-}
-
-// CapitalizeFirst returns the input string with the first letter capitalized.
-func CapitalizeFirst(s string) string {
-	if len(s) == 0 {
-		return s // Return the empty string as is
-	}
-	return strings.ToUpper(string(s[0])) + s[1:]
-}
-
-func InsecureRandomIdentifier(length int) string {
-	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
-	math.New(math.NewSource(time.Now().UnixNano()))
-	result := make([]byte, length)
-	for i := range result {
-		result[i] = charset[math.Intn(len(charset))]
-	}
-	return string(result)
-}
-
-func PrintStructFields(v interface{}) {
-	val := reflect.ValueOf(v)
-	typ := reflect.TypeOf(v)
-
-	// Ensure the input is a struct
-	if val.Kind() != reflect.Struct {
-		logger.Debug("Provided value is not a struct")
-		return
-	}
-
-	// Iterate over the fields of the struct
-	for i := 0; i < val.NumField(); i++ {
-		field := val.Field(i)
-		fieldType := typ.Field(i)
-
-		// Convert field value to string, if possible
-		fieldValue := fmt.Sprintf("%v", field.Interface())
-
-		// Limit to 50 characters
-		if len(fieldValue) > 100 {
-			fieldValue = fieldValue[:100] + "..."
-		}
-
-		logger.Debugf("Field: %s, %s\n", fieldType.Name, fieldValue)
-	}
-}
-
-func GetParentDirectoryPath(path string) string {
-	if path == "/" || path == "" {
-		return ""
-	}
-	path = strings.TrimSuffix(path, "/") // Remove trailing slash if any
-	lastSlash := strings.LastIndex(path, "/")
-	if lastSlash == -1 {
-		return "" // No parent directory for a relative path without slashes
-	}
-	if lastSlash == 0 {
-		return "/" // If the last slash is the first character, return root
-	}
-	return path[:lastSlash]
-}
-
-func HashSHA256(data string) string {
-	bytes := sha256.Sum256([]byte(data))
-	return hex.EncodeToString(bytes[:])
-}
-
-func GetLastComponent(path string) string {
-	if path == "" {
-		return ""
-	}
-	path = strings.TrimSuffix(path, "/") // Remove trailing slash if any
-	lastSlash := strings.LastIndex(path, "/")
-	if lastSlash == -1 {
-		return path // No parent directory for a relative path without slashes
-	}
-	return path[lastSlash+1:]
-}
-
-func JoinPathAsUnix(parts ...string) string {
-	joinedPath := filepath.Join(parts...)
-	if runtime.GOOS == "windows" {
-		joinedPath = strings.ReplaceAll(joinedPath, "\\", "/")
-	}
-	return joinedPath
-}
-
-func NonNilSlice[T any](in []T) []T {
-	if in == nil {
-		return []T{}
-	}
-	return in
-}
-
-func Ternary[T any](cond bool, vtrue, vfalse T) T {
-	if cond {
-		return vtrue
-	}
-	return vfalse
-}

backend/common/utils/main_test.go

@@ -1,59 +0,0 @@
-package utils
-
-import (
-	"testing"
-)
-
-func TestGetParentDirectoryPath(t *testing.T) {
-	tests := []struct {
-		input          string
-		expectedOutput string
-	}{
-		{input: "/", expectedOutput: ""},                                              // Root directory
-		{input: "/subfolder", expectedOutput: "/"},                                    // Single subfolder
-		{input: "/sub/sub/", expectedOutput: "/sub"},                                  // Nested subfolder with trailing slash
-		{input: "/subfolder/", expectedOutput: "/"},                                   // Relative path with trailing slash
-		{input: "", expectedOutput: ""},                                               // Empty string treated as root
-		{input: "/sub/subfolder", expectedOutput: "/sub"},                             // Double slash in path
-		{input: "/sub/subfolder/deep/nested/", expectedOutput: "/sub/subfolder/deep"}, // Double slash in path
-	}
-
-	for _, test := range tests {
-		t.Run(test.input, func(t *testing.T) {
-			actualOutput := GetParentDirectoryPath(test.input)
-			if actualOutput != test.expectedOutput {
-				t.Errorf("\n\tinput %q\n\texpected %q\n\tgot %q",
-					test.input, test.expectedOutput, actualOutput)
-			}
-		})
-	}
-}
-
-func TestCapitalizeFirst(t *testing.T) {
-	tests := []struct {
-		input          string
-		expectedOutput string
-	}{
-		{input: "", expectedOutput: ""},                               // Empty string
-		{input: "a", expectedOutput: "A"},                             // Single lowercase letter
-		{input: "A", expectedOutput: "A"},                             // Single uppercase letter
-		{input: "hello", expectedOutput: "Hello"},                     // All lowercase
-		{input: "Hello", expectedOutput: "Hello"},                     // Already capitalized
-		{input: "123hello", expectedOutput: "123hello"},               // Non-alphabetic first character
-		{input: "hELLO", expectedOutput: "HELLO"},                     // Mixed case
-		{input: " hello", expectedOutput: " hello"},                   // Leading space, no capitalization
-		{input: "hello world", expectedOutput: "Hello world"},         // Phrase with spaces
-		{input: " hello world", expectedOutput: " hello world"},       // Phrase with leading space
-		{input: "123 hello world", expectedOutput: "123 hello world"}, // Numbers before text
-	}
-
-	for _, test := range tests {
-		t.Run(test.input, func(t *testing.T) {
-			actualOutput := CapitalizeFirst(test.input)
-			if actualOutput != test.expectedOutput {
-				t.Errorf("\n\tinput %q\n\texpected %q\n\tgot %q",
-					test.input, test.expectedOutput, actualOutput)
-			}
-		})
-	}
-}

backend/common/utils/mocks.go

@@ -1,46 +0,0 @@
-package utils
-
-import (
-	"time"
-
-	"math/rand"
-)
-
-func GenerateRandomPath(levels int) string {
-	rand.New(rand.NewSource(time.Now().UnixNano()))
-	dirName := "srv"
-	for i := 0; i < levels; i++ {
-		dirName += "/" + GetRandomTerm()
-	}
-	return dirName
-}
-
-func GetRandomTerm() string {
-	wordbank := []string{
-		"hi", "test", "other", "name",
-		"cool", "things", "more", "items",
-	}
-	rand.New(rand.NewSource(time.Now().UnixNano()))
-
-	index := rand.Intn(len(wordbank))
-	return wordbank[index]
-}
-
-func GetRandomExtension() string {
-	wordbank := []string{
-		".txt", ".mp3", ".mov", ".doc",
-		".mp4", ".bak", ".zip", ".jpg",
-	}
-	rand.New(rand.NewSource(time.Now().UnixNano()))
-	index := rand.Intn(len(wordbank))
-	return wordbank[index]
-}
-
-func GenerateRandomSearchTerms(numTerms int) []string {
-	// Generate random search terms
-	searchTerms := make([]string, numTerms)
-	for i := 0; i < numTerms; i++ {
-		searchTerms[i] = GetRandomTerm()
-	}
-	return searchTerms
-}

backend/common/version/version.go

@@ -1,7 +0,0 @@
-package version
-
-var (
-	// Dynamically updated during build via build args
-	Version   = "untracked"
-	CommitSHA = "untracked"
-)

backend/config.media.yaml

@@ -1,11 +0,0 @@
-server:
-  logging:
-    - levels: "info|warning|error"
-  sources:
-    - path: "/srv"
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    highQuality: true

backend/config.yaml

@@ -1,22 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|warning|error"
-  sources:
-    - path: "/srv"
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: false
-    office: false
-    highQuality: false
-  darkMode: true
-  disableSettings: false
-  singleClick: false
-  permissions:
-    admin: false
-    modify: false
-    share: false
-    api: false

backend/database/access/access.go

@@ -1,995 +0,0 @@
-package access
-
-import (
-	"encoding/json"
-	"fmt"
-	"maps"
-	"slices"
-	"sort"
-	"sync"
-	"time"
-
-	"github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-cache/cache"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-var accessCache = cache.NewCache(1 * time.Minute)
-
-const accessRulesBucket = "access_rules"
-const accessRulesKey = "rules"
-const accessChangedKey = "newRule:"
-
-type RuleMap map[string]*AccessRule
-type SourceRuleMap map[string]RuleMap
-
-type StringSet map[string]struct{}
-
-type dbStorage struct {
-	AllRules SourceRuleMap `json:"all_rules"`
-	Groups   GroupMap      `json:"groups"`
-}
-
-// RuleSet groups users and groups for allow/deny lists.
-type RuleSet struct {
-	Users  StringSet
-	Groups StringSet
-}
-
-// AccessRule defines allow/deny lists for a path.
-type AccessRule struct {
-	DenyAll bool `json:"denyAll,omitempty"`
-	Deny    RuleSet
-	Allow   RuleSet
-}
-
-type FrontendRuleSet struct {
-	Users  []string `json:"users"`
-	Groups []string `json:"groups"`
-}
-
-type FrontendAccessRule struct {
-	DenyAll           bool            `json:"denyAll,omitempty"`
-	Deny              FrontendRuleSet `json:"deny"`
-	Allow             FrontendRuleSet `json:"allow"`
-	SourceDenyDefault bool            `json:"sourceDenyDefault"`
-}
-
-// GroupMap maps group names to a set of usernames.
-type GroupMap map[string]StringSet
-
-// Storage manages access rules and group membership.
-type Storage struct {
-	mux      sync.RWMutex
-	AllRules SourceRuleMap  // AllRules[sourcePath][indexPath] - in-memory authoritative state
-	Groups   GroupMap       // key: group name, value: set of usernames - in-memory authoritative state
-	DB       *storm.DB      // Optional: DB for persistence
-	Users    *users.Storage // Reference to users storage
-}
-
-// SaveToDB persists all rules to the DB if DB is set.
-func (s *Storage) SaveToDB() error {
-	if s.DB == nil {
-		return nil
-	}
-	data, err := json.Marshal(&dbStorage{
-		AllRules: s.AllRules,
-		Groups:   s.Groups,
-	})
-	if err != nil {
-		return err
-	}
-	return s.DB.Set(accessRulesBucket, accessRulesKey, data)
-}
-
-// Flush persists the current in-memory state to the backing store.
-// Call during graceful shutdown to ensure DB matches memory.
-func (s *Storage) Flush() error {
-	return s.SaveToDB()
-}
-
-// LoadFromDB loads all rules from the DB if DB is set.
-func (s *Storage) LoadFromDB() error {
-	if s.DB == nil {
-		return nil
-	}
-	var data []byte
-	err := s.DB.Get(accessRulesBucket, accessRulesKey, &data)
-	if err != nil {
-		return err
-	}
-	var storage dbStorage
-	if err := json.Unmarshal(data, &storage); err != nil {
-		return err
-	}
-	s.mux.Lock()
-	s.AllRules = storage.AllRules
-	if s.AllRules == nil {
-		s.AllRules = make(SourceRuleMap)
-	}
-	s.Groups = storage.Groups
-	if s.Groups == nil {
-		s.Groups = make(GroupMap)
-	}
-	s.mux.Unlock()
-	return nil
-}
-
-// NewStorage creates a new Storage instance. Optionally pass a DB for persistence and users storage.
-// After creating Storage with a DB, call LoadFromDB() to load rules from the database on startup.
-// Example:
-//
-//	store := NewStorage(db, usersStore)
-//	err := store.LoadFromDB()
-//	if err != nil { /* handle error */ }
-func NewStorage(db *storm.DB, usersStore *users.Storage) *Storage {
-	var s = &Storage{
-		AllRules: make(SourceRuleMap),
-		Groups:   make(GroupMap),
-		DB:       db,
-		Users:    usersStore,
-	}
-	return s
-}
-
-// ClearCache clears the access cache (useful for testing)
-func ClearCache() {
-	// Recreate the cache to clear it
-	accessCache = cache.NewCache(1 * time.Minute)
-}
-
-// getOrCreateRuleNL ensures a rule exists for the given source and index path.
-// The caller must hold the lock.
-func (s *Storage) getOrCreateRuleNL(sourcePath, indexPath string) *AccessRule {
-	if _, ok := s.AllRules[sourcePath]; !ok {
-		s.AllRules[sourcePath] = make(RuleMap)
-	}
-	rule, ok := s.AllRules[sourcePath][indexPath]
-	if !ok {
-		rule = &AccessRule{
-			Deny:  RuleSet{Users: make(StringSet), Groups: make(StringSet)},
-			Allow: RuleSet{Users: make(StringSet), Groups: make(StringSet)},
-		}
-		s.AllRules[sourcePath][indexPath] = rule
-	}
-	logger.Debugf("Created rule for source: %s and index: %s", sourcePath, indexPath)
-	return rule
-}
-
-// DenyUser adds a user to the deny list for a given source and index path.
-func (s *Storage) DenyUser(sourcePath, indexPath, username string) error {
-	if s.Users != nil {
-		_, err := s.Users.Get(username)
-		if err != nil {
-			return fmt.Errorf("user '%s' does not exist: %w", username, err)
-		}
-	}
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
-	if _, ok := rule.Deny.Users[username]; ok {
-		return errors.ErrExist
-	}
-	rule.Deny.Users[username] = struct{}{}
-	s.incrementSourceVersion(sourcePath)
-	accessCache.Set(accessChangedKey+sourcePath, false)
-	return s.SaveToDB()
-}
-
-// AllowUser adds a user to the allow list for a given source and index path.
-func (s *Storage) AllowUser(sourcePath, indexPath, username string) error {
-	if s.Users != nil {
-		_, err := s.Users.Get(username)
-		if err != nil {
-			return fmt.Errorf("user '%s' does not exist: %w", username, err)
-		}
-	}
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
-	if _, ok := rule.Allow.Users[username]; ok {
-		return errors.ErrExist
-	}
-	rule.Allow.Users[username] = struct{}{}
-	s.incrementSourceVersion(sourcePath)
-	accessCache.Set(accessChangedKey+sourcePath, false)
-	return s.SaveToDB()
-}
-
-// DenyGroup adds a group to the deny list for a given source and index path.
-func (s *Storage) DenyGroup(sourcePath, indexPath, groupname string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	_, ok := s.Groups[groupname]
-	if !ok {
-		return fmt.Errorf("group '%s' does not exist", groupname)
-	}
-	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
-	if _, ok := rule.Deny.Groups[groupname]; ok {
-		return errors.ErrExist
-	}
-	rule.Deny.Groups[groupname] = struct{}{}
-	s.incrementSourceVersion(sourcePath)
-	accessCache.Set(accessChangedKey+sourcePath, false)
-	return s.SaveToDB()
-}
-
-// AllowGroup adds a group to the allow list for a given source and index path.
-func (s *Storage) AllowGroup(sourcePath, indexPath, groupname string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	_, ok := s.Groups[groupname]
-	if !ok {
-		return fmt.Errorf("group '%s' does not exist", groupname)
-	}
-	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
-	if _, ok := rule.Allow.Groups[groupname]; ok {
-		return errors.ErrExist
-	}
-	rule.Allow.Groups[groupname] = struct{}{}
-	s.incrementSourceVersion(sourcePath)
-	accessCache.Set(accessChangedKey+sourcePath, false)
-	return s.SaveToDB()
-}
-
-// DenyAll sets a rule to deny all access for a given source and index path.
-func (s *Storage) DenyAll(sourcePath, indexPath string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
-	if rule.DenyAll {
-		return errors.ErrExist
-	}
-	rule.DenyAll = true
-	s.incrementSourceVersion(sourcePath)
-	accessCache.Set(accessChangedKey+sourcePath, false)
-	return s.SaveToDB()
-}
-
-// Permitted checks if a username is permitted for a given sourcePath and indexPath, recursively checking parent directories.
-func (s *Storage) Permitted(sourcePath, indexPath, username string) bool {
-
-	// Get current version for the sourcePath
-	versionKey := "version:" + sourcePath
-	version := 0
-	if v, ok := accessCache.Get(versionKey).(int); ok {
-		version = v
-	}
-
-	// Check cache with versioned key
-	permKey := fmt.Sprintf("perm:%s:%d:%s:%s", sourcePath, version, indexPath, username)
-	if p, ok := accessCache.Get(permKey).(bool); ok {
-		return p
-	}
-
-	// Not in cache, compute, then cache it.
-	result := s.computePermitted(sourcePath, indexPath, username)
-	accessCache.Set(permKey, result)
-	return result
-}
-
-func (s *Storage) computePermitted(sourcePath, indexPath, username string) bool {
-	for {
-		permitted, found := s.permittedAtExactPath(sourcePath, indexPath, username)
-		if found {
-			return permitted
-		}
-		indexPath = utils.GetParentDirectoryPath(indexPath)
-		if indexPath == "" {
-			break
-		}
-	}
-
-	// No rules found anywhere in the path hierarchy
-	// Check if the source has DenyByDefault configured (acts like a root-level denyAll rule)
-	sourceInfo, ok := settings.Config.Server.SourceMap[sourcePath]
-	if !ok {
-		logger.Errorf("source %s not found in config during access check", sourcePath)
-		return false
-	}
-
-	if sourceInfo.Config.DenyByDefault {
-		return false
-	}
-
-	return true
-}
-
-// permittedAtExactPath checks if a rule exists at the given path and evaluates it if so.
-func (s *Storage) permittedAtExactPath(sourcePath, indexPath, username string) (bool, bool) {
-	s.mux.RLock()
-	rulesBySource, ok := s.AllRules[sourcePath]
-	if !ok {
-		s.mux.RUnlock()
-		return true, false
-	}
-	rule, ok := rulesBySource[indexPath]
-	s.mux.RUnlock()
-	if !ok {
-		return true, false
-	}
-	return s.permittedRule(rule, username, sourcePath), true
-}
-
-// permittedRule contains the old Permitted logic, but operates on a rule and username only.
-func (s *Storage) permittedRule(rule *AccessRule, username string, sourcePath string) bool {
-	// Check user deny first - this always takes precedence
-	if _, found := rule.Deny.Users[username]; found {
-		return false
-	}
-	// Check group deny
-	for group := range rule.Deny.Groups {
-		if s.isUserInGroup(username, group) {
-			return false
-		}
-	}
-
-	// Check allow rules - these can override DenyAll
-	hasUserAllow := len(rule.Allow.Users) > 0
-	hasGroupAllow := len(rule.Allow.Groups) > 0
-	if hasUserAllow || hasGroupAllow {
-		// If user is in any allow list, permit them (overrides DenyAll)
-		if hasUserAllow {
-			if _, found := rule.Allow.Users[username]; found {
-				return true
-			}
-		}
-		if hasGroupAllow {
-			for group := range rule.Allow.Groups {
-				if s.isUserInGroup(username, group) {
-					return true
-				}
-			}
-		}
-
-		// User is not in any allow list
-		// Check DenyByDefault to determine behavior
-		sourceInfo, ok := settings.Config.Server.SourceMap[sourcePath]
-		if ok && sourceInfo.Config.DenyByDefault {
-			// DenyByDefault=true: allow lists are exclusive, deny users not on the list
-			return false
-		} else {
-			// DenyByDefault=false: allow lists are additive, allow users not on the list
-			return true
-		}
-	}
-
-	// Check DenyAll - only applies if no allow rules exist
-	if rule.DenyAll {
-		return false
-	}
-
-	// No specific rules apply - check source DenyByDefault setting
-	sourceInfo, ok := settings.Config.Server.SourceMap[sourcePath]
-	if ok && sourceInfo.Config.DenyByDefault {
-		return false
-	}
-
-	return true
-}
-
-// isUserInGroup checks if a username is in a group.
-func (s *Storage) isUserInGroup(username, group string) bool {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-	users, ok := s.Groups[group]
-	if !ok {
-		return false
-	}
-	_, found := users[username]
-	return found
-}
-
-// GetRule retrieves a rule for a sourcePath and indexPath.
-func (s *Storage) GetFrontendRules(sourcePath, indexPath string) (FrontendAccessRule, bool) {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-
-	// Get source configuration
-	sourceDenyDefault := false
-	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
-	if sourceExists {
-		sourceDenyDefault = sourceInfo.Config.DenyByDefault
-	}
-
-	frontendRules := FrontendAccessRule{
-		SourceDenyDefault: sourceDenyDefault,
-		Deny: FrontendRuleSet{
-			Users:  make([]string, 0),
-			Groups: make([]string, 0),
-		},
-		Allow: FrontendRuleSet{
-			Users:  make([]string, 0),
-			Groups: make([]string, 0),
-		},
-	}
-	rulesBySource, ok := s.AllRules[sourcePath]
-	if !ok {
-		return frontendRules, false
-	}
-	rule, ok := rulesBySource[indexPath]
-	if !ok || rule == nil {
-		return frontendRules, false
-	}
-	// Convert AccessRule to FrontendAccessRule
-	frontendRules.DenyAll = rule.DenyAll
-	frontendRules.Deny.Users = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users)))
-	frontendRules.Deny.Groups = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups)))
-	frontendRules.Allow.Users = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users)))
-	frontendRules.Allow.Groups = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups)))
-
-	logger.Debugf("Returning frontend rules for source: %s and index: %s", sourcePath, indexPath)
-	return frontendRules, ok
-}
-
-// GetAllRules returns all access rules as a map.
-func (s *Storage) GetAllRules(sourcePath string) (map[string]FrontendAccessRule, error) {
-	value, ok := accessCache.Get(accessChangedKey + sourcePath).(map[string]FrontendAccessRule)
-	if ok {
-		return value, nil
-	}
-
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-
-	// Get source configuration
-	sourceDenyDefault := false
-	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
-	if sourceExists {
-		sourceDenyDefault = sourceInfo.Config.DenyByDefault
-	}
-
-	// Return a copy to avoid external mutation
-	frontendRules := make(map[string]FrontendAccessRule, len(s.AllRules))
-	rules, ok := s.AllRules[sourcePath]
-	if !ok {
-		return frontendRules, nil
-	}
-	for indexPath, rule := range rules {
-		// Convert AccessRule to FrontendAccessRule
-		frontendRules[indexPath] = FrontendAccessRule{
-			DenyAll:           rule.DenyAll,
-			SourceDenyDefault: sourceDenyDefault,
-			Deny: FrontendRuleSet{
-				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
-				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
-			},
-			Allow: FrontendRuleSet{
-				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
-				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
-			},
-		}
-	}
-	// cache responses
-	accessCache.Set(accessChangedKey+sourcePath, frontendRules)
-	return frontendRules, nil
-}
-
-// AddUserToGroup adds a username to a group.
-func (s *Storage) AddUserToGroup(group, username string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	if _, ok := s.Groups[group]; !ok {
-		s.Groups[group] = make(StringSet)
-	}
-	if _, ok := s.Groups[group][username]; ok {
-		return nil
-	}
-	s.Groups[group][username] = struct{}{}
-	return s.SaveToDB()
-}
-
-// GetAllGroups returns all group names.
-func (s *Storage) GetAllGroups() []string {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-	groups := make([]string, 0, len(s.Groups))
-	for group := range s.Groups {
-		groups = append(groups, group)
-	}
-	sort.Strings(groups)
-	return groups
-}
-
-// GetUserGroups returns all groups for a specific user.
-func (s *Storage) GetUserGroups(username string) []string {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-	var groups []string
-	for group, users := range s.Groups {
-		if _, ok := users[username]; ok {
-			groups = append(groups, group)
-		}
-	}
-	return utils.NonNilSlice(groups)
-}
-
-// SyncUserGroups updates a user's group memberships.
-// It removes the user from groups not in the new list and adds them to new ones.
-func (s *Storage) SyncUserGroups(username string, newGroups []string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	changed := false
-
-	// Create a set of new groups for efficient lookup
-	newGroupsSet := make(StringSet, len(newGroups))
-	for _, g := range newGroups {
-		newGroupsSet[g] = struct{}{}
-	}
-
-	// Iterate over all existing groups to find the user's current memberships
-	for group, users := range s.Groups {
-		_, userIsInGroup := users[username]
-		_, groupIsInNewSet := newGroupsSet[group]
-
-		// If user is in a group that is not in their new set of groups, remove them.
-		if userIsInGroup && !groupIsInNewSet {
-			delete(s.Groups[group], username)
-			changed = true
-		}
-	}
-
-	// Add user to new groups
-	for group := range newGroupsSet {
-		if _, ok := s.Groups[group]; !ok {
-			s.Groups[group] = make(StringSet)
-		}
-		if _, ok := s.Groups[group][username]; !ok {
-			s.Groups[group][username] = struct{}{}
-			changed = true
-		}
-	}
-	if changed {
-		return s.SaveToDB()
-	}
-	return nil
-}
-
-// RemoveUserFromGroup removes a username from a group.
-func (s *Storage) RemoveUserFromGroup(group, username string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	users, ok := s.Groups[group]
-	if !ok {
-		return nil
-	}
-	if _, ok := users[username]; !ok {
-		return nil
-	}
-	delete(users, username)
-	if len(s.Groups[group]) == 0 {
-		delete(s.Groups, group)
-	}
-	return s.SaveToDB()
-}
-
-// RemoveAllowUser removes a user from the allow list for a given source and index path.
-func (s *Storage) RemoveAllowUser(sourcePath, indexPath, username string) (bool, error) {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
-	if !ok {
-		return false, nil
-	}
-	_, exists := rule.Allow.Users[username]
-	if exists {
-		delete(rule.Allow.Users, username)
-	}
-	removed := false
-	if exists {
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
-	// If rule is now empty, remove it
-	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
-		if len(s.AllRules[sourcePath]) == 0 {
-			delete(s.AllRules, sourcePath)
-		}
-	}
-	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
-		return exists, s.SaveToDB()
-	}
-	return false, nil
-}
-
-// RemoveAllowGroup removes a group from the allow list for a given source and index path.
-func (s *Storage) RemoveAllowGroup(sourcePath, indexPath, groupname string) (bool, error) {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
-	if !ok {
-		return false, nil
-	}
-	_, exists := rule.Allow.Groups[groupname]
-	if exists {
-		delete(rule.Allow.Groups, groupname)
-	}
-	removed := false
-	if exists {
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
-	// If rule is now empty, remove it
-	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
-		if len(s.AllRules[sourcePath]) == 0 {
-			delete(s.AllRules, sourcePath)
-		}
-	}
-	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
-		return exists, s.SaveToDB()
-	}
-	return exists, nil
-}
-
-// RemoveDenyUser removes a user from the deny list for a given source and index path.
-func (s *Storage) RemoveDenyUser(sourcePath, indexPath, username string) (bool, error) {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
-	if !ok {
-		return false, nil
-	}
-	_, exists := rule.Deny.Users[username]
-	if exists {
-		delete(rule.Deny.Users, username)
-	}
-	removed := false
-	if exists {
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
-	// If rule is now empty, remove it
-	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
-		if len(s.AllRules[sourcePath]) == 0 {
-			delete(s.AllRules, sourcePath)
-		}
-	}
-	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
-		return exists, s.SaveToDB()
-	}
-	return false, nil
-}
-
-// RemoveDenyGroup removes a group from the deny list for a given source and index path.
-func (s *Storage) RemoveDenyGroup(sourcePath, indexPath, groupname string) (bool, error) {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
-	if !ok {
-		return false, nil
-	}
-	_, exists := rule.Deny.Groups[groupname]
-	if exists {
-		delete(rule.Deny.Groups, groupname)
-	}
-	removed := false
-	if exists {
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
-	// If rule is now empty, remove it
-	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
-		if len(s.AllRules[sourcePath]) == 0 {
-			delete(s.AllRules, sourcePath)
-		}
-	}
-	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
-		return exists, s.SaveToDB()
-	}
-	return exists, nil
-}
-
-// RemoveDenyAll removes the deny all rule for a given source and index path.
-func (s *Storage) RemoveDenyAll(sourcePath, indexPath string) (bool, error) {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
-	if !ok {
-		return false, nil
-	}
-	removed := false
-	if rule.DenyAll {
-		rule.DenyAll = false
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
-	// If rule is now empty, remove it
-	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
-		if len(s.AllRules[sourcePath]) == 0 {
-			delete(s.AllRules, sourcePath)
-		}
-	}
-	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
-		return true, s.SaveToDB()
-	}
-	return false, nil
-}
-
-// RemoveAllRulesForUser removes a user from all allow and deny lists.
-func (s *Storage) RemoveAllRulesForUser(username string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	changed := false
-	changedSourcePaths := make(map[string]struct{})
-	for sourcePath, rulesBySource := range s.AllRules {
-		for indexPath, rule := range rulesBySource {
-			if _, exists := rule.Allow.Users[username]; exists {
-				delete(rule.Allow.Users, username)
-				changedSourcePaths[sourcePath] = struct{}{}
-				changed = true
-			}
-			if _, exists := rule.Deny.Users[username]; exists {
-				delete(rule.Deny.Users, username)
-				changedSourcePaths[sourcePath] = struct{}{}
-				changed = true
-			}
-			if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-				delete(s.AllRules[sourcePath], indexPath)
-				if len(s.AllRules[sourcePath]) == 0 {
-					delete(s.AllRules, sourcePath)
-				}
-			}
-		}
-	}
-	for sp := range changedSourcePaths {
-		s.incrementSourceVersion(sp)
-		accessCache.Set(accessChangedKey+sp, false)
-	}
-	if changed {
-		return s.SaveToDB()
-	}
-	return nil
-}
-
-// RemoveAllRulesForGroup removes a group from all allow and deny lists.
-func (s *Storage) RemoveAllRulesForGroup(groupname string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	changed := false
-	changedSourcePaths := make(map[string]struct{})
-	for sourcePath, rulesBySource := range s.AllRules {
-		for indexPath, rule := range rulesBySource {
-			if _, exists := rule.Allow.Groups[groupname]; exists {
-				delete(rule.Allow.Groups, groupname)
-				changedSourcePaths[sourcePath] = struct{}{}
-				changed = true
-			}
-			if _, exists := rule.Deny.Groups[groupname]; exists {
-				delete(rule.Deny.Groups, groupname)
-				changedSourcePaths[sourcePath] = struct{}{}
-				changed = true
-			}
-			if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-				delete(s.AllRules[sourcePath], indexPath)
-				if len(s.AllRules[sourcePath]) == 0 {
-					delete(s.AllRules, sourcePath)
-				}
-			}
-		}
-	}
-	for sp := range changedSourcePaths {
-		s.incrementSourceVersion(sp)
-		accessCache.Set(accessChangedKey+sp, false)
-	}
-	if changed {
-		return s.SaveToDB()
-	}
-	return nil
-}
-
-// GetRulesForUser returns all rules for a specific user for a given sourcePath.
-func (s *Storage) GetRulesForUser(sourcePath, username string) map[string]FrontendAccessRule {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-
-	// Get source configuration
-	sourceDenyDefault := false
-	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
-	if sourceExists {
-		sourceDenyDefault = sourceInfo.Config.DenyByDefault
-	}
-
-	userRules := make(map[string]FrontendAccessRule)
-	rulesBySource, ok := s.AllRules[sourcePath]
-	if !ok {
-		return userRules
-	}
-	for indexPath, rule := range rulesBySource {
-		userHasRule := false
-		if _, ok := rule.Allow.Users[username]; ok {
-			userHasRule = true
-		}
-		if !userHasRule {
-			if _, ok := rule.Deny.Users[username]; ok {
-				userHasRule = true
-			}
-		}
-		if userHasRule {
-			userRules[indexPath] = FrontendAccessRule{
-				DenyAll:           rule.DenyAll,
-				SourceDenyDefault: sourceDenyDefault,
-				Deny: FrontendRuleSet{
-					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
-					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
-				},
-				Allow: FrontendRuleSet{
-					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
-					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
-				},
-			}
-		}
-	}
-	return userRules
-}
-
-// GetRulesForGroup returns all rules for a specific group for a given sourcePath.
-func (s *Storage) GetRulesForGroup(sourcePath, groupname string) map[string]FrontendAccessRule {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-
-	// Get source configuration
-	sourceDenyDefault := false
-	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
-	if sourceExists {
-		sourceDenyDefault = sourceInfo.Config.DenyByDefault
-	}
-
-	groupRules := make(map[string]FrontendAccessRule)
-	rulesBySource, ok := s.AllRules[sourcePath]
-	if !ok {
-		return groupRules
-	}
-	for indexPath, rule := range rulesBySource {
-		groupHasRule := false
-		if _, ok := rule.Allow.Groups[groupname]; ok {
-			groupHasRule = true
-		}
-		if !groupHasRule {
-			if _, ok := rule.Deny.Groups[groupname]; ok {
-				groupHasRule = true
-			}
-		}
-		if groupHasRule {
-			groupRules[indexPath] = FrontendAccessRule{
-				DenyAll:           rule.DenyAll,
-				SourceDenyDefault: sourceDenyDefault,
-				Deny: FrontendRuleSet{
-					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
-					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
-				},
-				Allow: FrontendRuleSet{
-					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
-					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
-				},
-			}
-		}
-	}
-	return groupRules
-}
-
-// GetAllRulesByUsers returns a map of usernames to their rules for a given sourcePath.
-func (s *Storage) GetAllRulesByUsers(sourcePath string) map[string]map[string]FrontendAccessRule {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-
-	// Get source configuration
-	sourceDenyDefault := false
-	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
-	if sourceExists {
-		sourceDenyDefault = sourceInfo.Config.DenyByDefault
-	}
-
-	allUserRules := make(map[string]map[string]FrontendAccessRule)
-	rulesBySource, ok := s.AllRules[sourcePath]
-	if !ok {
-		return allUserRules
-	}
-	for indexPath, rule := range rulesBySource {
-		hasAllowUsers := len(rule.Allow.Users) > 0
-		hasDenyUsers := len(rule.Deny.Users) > 0
-		if !hasAllowUsers && !hasDenyUsers {
-			continue
-		}
-		frontendRule := FrontendAccessRule{
-			DenyAll:           rule.DenyAll,
-			SourceDenyDefault: sourceDenyDefault,
-			Deny: FrontendRuleSet{
-				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
-				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
-			},
-			Allow: FrontendRuleSet{
-				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
-				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
-			},
-		}
-		for user := range rule.Allow.Users {
-			if _, ok := allUserRules[user]; !ok {
-				allUserRules[user] = make(map[string]FrontendAccessRule)
-			}
-			allUserRules[user][indexPath] = frontendRule
-		}
-		for user := range rule.Deny.Users {
-			if _, ok := allUserRules[user]; !ok {
-				allUserRules[user] = make(map[string]FrontendAccessRule)
-			}
-			allUserRules[user][indexPath] = frontendRule
-		}
-	}
-	return allUserRules
-}
-
-// GetAllRulesByGroups returns a map of groupnames to their rules for a given sourcePath.
-func (s *Storage) GetAllRulesByGroups(sourcePath string) map[string]map[string]FrontendAccessRule {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-
-	// Get source configuration
-	sourceDenyDefault := false
-	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
-	if sourceExists {
-		sourceDenyDefault = sourceInfo.Config.DenyByDefault
-	}
-
-	allGroupRules := make(map[string]map[string]FrontendAccessRule)
-	rulesBySource, ok := s.AllRules[sourcePath]
-	if !ok {
-		return allGroupRules
-	}
-	for indexPath, rule := range rulesBySource {
-		hasAllowGroups := len(rule.Allow.Groups) > 0
-		hasDenyGroups := len(rule.Deny.Groups) > 0
-		if !hasAllowGroups && !hasDenyGroups {
-			continue
-		}
-		frontendRule := FrontendAccessRule{
-			DenyAll:           rule.DenyAll,
-			SourceDenyDefault: sourceDenyDefault,
-			Deny: FrontendRuleSet{
-				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
-				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
-			},
-			Allow: FrontendRuleSet{
-				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
-				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
-			},
-		}
-		for group := range rule.Allow.Groups {
-			if _, ok := allGroupRules[group]; !ok {
-				allGroupRules[group] = make(map[string]FrontendAccessRule)
-			}
-			allGroupRules[group][indexPath] = frontendRule
-		}
-		for group := range rule.Deny.Groups {
-			if _, ok := allGroupRules[group]; !ok {
-				allGroupRules[group] = make(map[string]FrontendAccessRule)
-			}
-			allGroupRules[group][indexPath] = frontendRule
-		}
-	}
-	return allGroupRules
-}
-
-// incrementSourceVersion increments the version of a sourcePath to invalidate caches.
-// The caller MUST hold the mutex lock.
-func (s *Storage) incrementSourceVersion(sourcePath string) {
-	key := "version:" + sourcePath
-	version := 0
-	if v, ok := accessCache.Get(key).(int); ok {
-		version = v
-	}
-	accessCache.Set(key, version+1)
-}

backend/database/access/access_test.go

@@ -1,407 +0,0 @@
-package access_test
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/access"
-	boltusers "github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-func createTestStorage(t *testing.T) (*access.Storage, *users.Storage) {
-	dir := t.TempDir()
-	dbPath := filepath.Join(dir, "test.db")
-	db, err := storm.Open(dbPath)
-	if err != nil {
-		t.Fatalf("failed to open storm db: %v", err)
-	}
-	userStore := users.NewStorage(boltusers.NewUsersBackend(db))
-	return access.NewStorage(db, userStore), userStore
-}
-
-func createTestUser(t *testing.T, userStore *users.Storage, username string) {
-	u := &users.User{NonAdminEditable: users.NonAdminEditable{Password: "test"}, Username: username}
-	err := userStore.Save(u, false, false)
-	if err != nil {
-		t.Fatalf("failed to create user %s: %v", username, err)
-	}
-}
-
-func setupTestSources() {
-	// Setup default test sources with allow-by-default behavior
-	settings.Config.Server.SourceMap = map[string]settings.Source{
-		"mnt/storage": {
-			Path: "mnt/storage",
-			Name: "storage",
-			Config: settings.SourceConfig{
-				DenyByDefault: false,
-			},
-		},
-		"mnt/open": {
-			Path: "mnt/open",
-			Name: "open",
-			Config: settings.SourceConfig{
-				DenyByDefault: false,
-			},
-		},
-	}
-}
-
-func TestPermitted_UserBlacklist(t *testing.T) {
-	setupTestSources()
-	s, userStore := createTestStorage(t)
-	createTestUser(t, userStore, "alice")
-	createTestUser(t, userStore, "bob")
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-	if err := s.DenyUser("mnt/storage", "/secret", "alice"); err != nil {
-		t.Errorf("DenyUser failed: %v", err)
-	}
-	if s.Permitted("mnt/storage", "/secret", "alice") {
-		t.Error("alice should not be permitted (denied)")
-	}
-	if !s.Permitted("mnt/storage", "/secret", "bob") {
-		t.Error("bob should be permitted (not denied)")
-	}
-}
-
-func TestPermitted_UserWhitelist(t *testing.T) {
-	setupTestSources()
-	s, userStore := createTestStorage(t)
-	createTestUser(t, userStore, "alice")
-	createTestUser(t, userStore, "bob")
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-	if err := s.AllowUser("mnt/storage", "/vip", "bob"); err != nil {
-		t.Errorf("AllowUser failed: %v", err)
-	}
-	if !s.Permitted("mnt/storage", "/vip", "bob") {
-		t.Error("bob should be permitted (allowed)")
-	}
-	if !s.Permitted("mnt/storage", "/vip", "alice") {
-		t.Error("alice should be permitted (default allow behavior when DenyByDefault=false)")
-	}
-}
-
-func TestPermitted_GroupBlacklist(t *testing.T) {
-	setupTestSources()
-	s, userStore := createTestStorage(t)
-	createTestUser(t, userStore, "alice")
-	createTestUser(t, userStore, "bob")
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-	_ = s.AddUserToGroup("admins", "alice")
-	if err := s.DenyGroup("mnt/storage", "/admin", "admins"); err != nil {
-		t.Errorf("DenyGroup failed: %v", err)
-	}
-	if s.Permitted("mnt/storage", "/admin", "bob") == false {
-		t.Error("bob should be permitted (not in denied group)")
-	}
-	if s.Permitted("mnt/storage", "/admin", "alice") {
-		t.Error("alice should not be permitted (in denied group)")
-	}
-}
-
-func TestPermitted_GroupWhitelist(t *testing.T) {
-	setupTestSources()
-	s, userStore := createTestStorage(t)
-	createTestUser(t, userStore, "alice")
-	createTestUser(t, userStore, "bob")
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-	_ = s.AddUserToGroup("vip", "bob")
-	if err := s.AllowGroup("mnt/storage", "/vip", "vip"); err != nil {
-		t.Errorf("AllowGroup failed: %v", err)
-	}
-	if !s.Permitted("mnt/storage", "/vip", "bob") {
-		t.Error("bob should be permitted (in allowed group)")
-	}
-	if !s.Permitted("mnt/storage", "/vip", "alice") {
-		t.Error("alice should be permitted (default allow behavior when DenyByDefault=false)")
-	}
-}
-
-func TestPermitted_NoRule(t *testing.T) {
-	setupTestSources()
-	s, _ := createTestStorage(t)
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-	if !s.Permitted("mnt/storage", "/public", "anyone") {
-		t.Error("anyone should be permitted if no rule exists")
-	}
-}
-
-func TestPermitted_CombinedRules(t *testing.T) {
-	setupTestSources()
-	s, userStore := createTestStorage(t)
-	createTestUser(t, userStore, "alice")
-	createTestUser(t, userStore, "bob")
-	createTestUser(t, userStore, "carol")
-	createTestUser(t, userStore, "eve")
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-	err = s.AddUserToGroup("vip", "bob")
-	if err != nil {
-		t.Errorf("AddUserToGroup failed: %v", err)
-	}
-	err = s.AddUserToGroup("admins", "alice")
-	if err != nil {
-		t.Errorf("AddUserToGroup failed: %v", err)
-	}
-	if err := s.DenyUser("mnt/storage", "/combo", "eve"); err != nil {
-		t.Errorf("DenyUser failed: %v", err)
-	}
-	if err := s.AllowUser("mnt/storage", "/combo", "carol"); err != nil {
-		t.Errorf("AllowUser failed: %v", err)
-	}
-	if err := s.DenyGroup("mnt/storage", "/combo", "admins"); err != nil {
-		t.Errorf("DenyGroup failed: %v", err)
-	}
-	if err := s.AllowGroup("mnt/storage", "/combo", "vip"); err != nil {
-		t.Errorf("AllowGroup failed: %v", err)
-	}
-	if s.Permitted("mnt/storage", "/combo", "eve") {
-		t.Error("eve should not be permitted (user denied)")
-	}
-	if !s.Permitted("mnt/storage", "/combo", "carol") {
-		t.Error("carol should be permitted (user allowed)")
-	}
-	if s.Permitted("mnt/storage", "/combo", "alice") {
-		t.Error("alice should not be permitted (in group denied)")
-	}
-	if !s.Permitted("mnt/storage", "/combo", "bob") {
-		t.Error("bob should be permitted (in group allowed)")
-	}
-}
-
-func TestPermitted_DenyAll(t *testing.T) {
-	setupTestSources()
-	s, userStore := createTestStorage(t)
-	createTestUser(t, userStore, "alice")
-	createTestUser(t, userStore, "bob")
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-
-	// Test DenyAll
-	if err = s.DenyAll("mnt/storage", "/private"); err != nil {
-		t.Errorf("DenyAll failed: %v", err)
-	}
-	if s.Permitted("mnt/storage", "/private", "alice") {
-		t.Error("alice should not be permitted (deny all)")
-	}
-	if s.Permitted("mnt/storage", "/private", "bob") {
-		t.Error("bob should not be permitted (deny all)")
-	}
-
-	// Test that Allow rule overrides DenyAll
-	if err = s.AllowUser("mnt/storage", "/private", "alice"); err != nil {
-		t.Errorf("AllowUser failed: %v", err)
-	}
-	if !s.Permitted("mnt/storage", "/private", "alice") {
-		t.Error("alice should be permitted (allow overrides deny all)")
-	}
-
-	// Test removing DenyAll
-	removed, err := s.RemoveDenyAll("mnt/storage", "/private")
-	if err != nil {
-		t.Errorf("RemoveDenyAll failed: %v", err)
-	}
-	if !removed {
-		t.Error("RemoveDenyAll should have removed the rule")
-	}
-
-	// After removing DenyAll, alice should be permitted due to the Allow rule
-	if !s.Permitted("mnt/storage", "/private", "alice") {
-		t.Error("alice should be permitted after removing deny all")
-	}
-
-	// Bob should be permitted because DenyByDefault=false makes allow lists additive (not exclusive)
-	if !s.Permitted("mnt/storage", "/private", "bob") {
-		t.Error("bob should be permitted after removing deny all (DenyByDefault=false makes allow lists additive)")
-	}
-}
-
-func TestPermitted_DenyByDefault(t *testing.T) {
-	// Clear access cache to prevent test pollution
-	access.ClearCache()
-
-	// Create isolated storage for this test
-	s, userStore := createTestStorage(t)
-	createTestUser(t, userStore, "alice")
-	createTestUser(t, userStore, "bob")
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-
-	// Setup test configuration with DenyByDefault enabled for one source
-	originalSourceMap := settings.Config.Server.SourceMap
-	defer func() {
-		settings.Config.Server.SourceMap = originalSourceMap
-		access.ClearCache()
-	}()
-
-	settings.Config.Server.SourceMap = map[string]settings.Source{
-		"mnt/storage": {
-			Path: "mnt/storage",
-			Name: "storage",
-			Config: settings.SourceConfig{
-				DenyByDefault: true,
-			},
-		},
-		"mnt/open": {
-			Path: "mnt/open",
-			Name: "open",
-			Config: settings.SourceConfig{
-				DenyByDefault: false,
-			},
-		},
-	}
-
-	// Test DenyByDefault: When no rules exist, users should be denied
-	if s.Permitted("mnt/storage", "/private", "alice") {
-		t.Error("alice should not be permitted (DenyByDefault is true and no rules exist)")
-	}
-	if s.Permitted("mnt/storage", "/private", "bob") {
-		t.Error("bob should not be permitted (DenyByDefault is true and no rules exist)")
-	}
-
-	// Test that explicit allow rules override DenyByDefault
-	if err := s.AllowUser("mnt/storage", "/allowed", "alice"); err != nil {
-		t.Errorf("AllowUser failed: %v", err)
-	}
-	if !s.Permitted("mnt/storage", "/allowed", "alice") {
-		t.Error("alice should be permitted (explicit allow rule overrides DenyByDefault)")
-	}
-	if s.Permitted("mnt/storage", "/allowed", "bob") {
-		t.Error("bob should not be permitted (not in allow list and DenyByDefault is true)")
-	}
-
-	// Test that explicit deny rules work with DenyByDefault
-	if err := s.DenyUser("mnt/storage", "/denied", "alice"); err != nil {
-		t.Errorf("DenyUser failed: %v", err)
-	}
-	if s.Permitted("mnt/storage", "/denied", "alice") {
-		t.Error("alice should not be permitted (explicit deny rule)")
-	}
-	if s.Permitted("mnt/storage", "/denied", "bob") {
-		t.Error("bob should not be permitted (DenyByDefault is true)")
-	}
-
-	// Test that DenyByDefault doesn't affect sources where it's disabled
-	if !s.Permitted("mnt/open", "/public", "alice") {
-		t.Error("alice should be permitted in open source (DenyByDefault is false)")
-	}
-	if !s.Permitted("mnt/open", "/public", "bob") {
-		t.Error("bob should be permitted in open source (DenyByDefault is false)")
-	}
-
-	// Test recursive path checking with DenyByDefault
-	// Allow alice at parent path, should work for child paths too
-	if err := s.AllowUser("mnt/storage", "/parent", "alice"); err != nil {
-		t.Errorf("AllowUser failed: %v", err)
-	}
-	if !s.Permitted("mnt/storage", "/parent/child", "alice") {
-		t.Error("alice should be permitted for child path (inherits from parent allow rule)")
-	}
-	if s.Permitted("mnt/storage", "/parent/child", "bob") {
-		t.Error("bob should not be permitted for child path (DenyByDefault and not in allow list)")
-	}
-
-	// Test that group rules work with DenyByDefault
-	_ = s.AddUserToGroup("vip", "alice")
-	if err := s.AllowGroup("mnt/storage", "/vip", "vip"); err != nil {
-		t.Errorf("AllowGroup failed: %v", err)
-	}
-	if !s.Permitted("mnt/storage", "/vip", "alice") {
-		t.Error("alice should be permitted (in allowed group)")
-	}
-	if s.Permitted("mnt/storage", "/vip", "bob") {
-		t.Error("bob should not be permitted (not in allowed group and DenyByDefault is true)")
-	}
-}
-
-func TestPermitted_DenyByDefaultWithDenyAll(t *testing.T) {
-	// Clear access cache to prevent test pollution
-	access.ClearCache()
-
-	// Create isolated storage for this test
-	s, userStore := createTestStorage(t)
-	createTestUser(t, userStore, "alice")
-	createTestUser(t, userStore, "bob")
-	err := s.LoadFromDB()
-	if err != nil && err != storm.ErrNotFound {
-		t.Errorf("unexpected error loading from DB: %v", err)
-	}
-
-	// Setup test configuration with DenyByDefault enabled
-	originalSourceMap := settings.Config.Server.SourceMap
-	defer func() {
-		settings.Config.Server.SourceMap = originalSourceMap
-		access.ClearCache()
-	}()
-
-	settings.Config.Server.SourceMap = map[string]settings.Source{
-		"mnt/storage": {
-			Path: "mnt/storage",
-			Name: "storage",
-			Config: settings.SourceConfig{
-				DenyByDefault: true,
-			},
-		},
-	}
-
-	// Test that explicit DenyAll rule also works when DenyByDefault is enabled
-	if err = s.DenyAll("mnt/storage", "/restricted"); err != nil {
-		t.Errorf("DenyAll failed: %v", err)
-	}
-	if s.Permitted("mnt/storage", "/restricted", "alice") {
-		t.Error("alice should not be permitted (DenyAll rule)")
-	}
-	if s.Permitted("mnt/storage", "/restricted", "bob") {
-		t.Error("bob should not be permitted (DenyAll rule)")
-	}
-
-	// Test that Allow rule overrides DenyAll even with DenyByDefault
-	if err = s.AllowUser("mnt/storage", "/restricted", "alice"); err != nil {
-		t.Errorf("AllowUser failed: %v", err)
-	}
-	if !s.Permitted("mnt/storage", "/restricted", "alice") {
-		t.Error("alice should be permitted (allow overrides DenyAll)")
-	}
-
-	// Remove DenyAll and test that DenyByDefault takes effect
-	removed, err := s.RemoveDenyAll("mnt/storage", "/restricted")
-	if err != nil {
-		t.Errorf("RemoveDenyAll failed: %v", err)
-	}
-	if !removed {
-		t.Error("RemoveDenyAll should have removed the rule")
-	}
-
-	// After removing DenyAll, alice should be permitted due to Allow rule
-	if !s.Permitted("mnt/storage", "/restricted", "alice") {
-		t.Error("alice should be permitted after removing DenyAll (has allow rule)")
-	}
-	// Bob should not be permitted due to DenyByDefault
-	if s.Permitted("mnt/storage", "/restricted", "bob") {
-		t.Error("bob should not be permitted (DenyByDefault is true and no allow rule)")
-	}
-}