oidc-fix (#741)

Co-authored-by: Gilles <gilles@wittezaele.fr>

.dockerignore

@@ -1,4 +1,6 @@
 backend/**.db
+backend/tmp
+backend/backend*
 backend/vendor/**
 frontend/dist/**
 frontend/node_modules/**

.github/CODEOWNERS

@@ -1,5 +0,0 @@
-# These owners will be the default owners for everything in the repo.
-# Unless a later match takes precedence, @o1egl will be requested for
-# review when someone opens a pull request.
-
-*       @o1egl

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,20 +1,10 @@
 **Description**
-<!--
-Please explain the changes you made here.
-If the feature changes current behaviour, explain why your solution is better.
--->
 
-:rotating_light: Before submitting your PR, please read [community](https://github.com/filebrowser/community), and indicate which issues (in any of the repos) are either fixed or closed by this PR. See [GitHub Help: Closing issues using keywords](https://help.github.com/articles/closing-issues-via-commit-messages/).
+According to the [contributing guide](https://github.com/gtsteffaniak/filebrowser/wiki/Contributing#contributing-as-an-unofficial-contributor), A PR should contain:
 
-- [ ] DO make sure you are requesting to **pull a topic/feature/bugfix branch** (right side). Don't request your master!
-- [ ] DO make sure you are making a pull request against the **master branch** (left side). Also you should start *your branch* off *our master*.
-- [ ] DO make sure that File Browser can be successfully built. See [builds](https://github.com/filebrowser/community/blob/master/builds.md) and [development](https://github.com/filebrowser/community/blob/master/development.md).
-- [ ] DO make sure that related issues are opened in other repositories. I.e., the frontend, caddy plugins or the web page need to be updated accordingly.
-- [ ] AVOID breaking the continuous integration build.
+- [ ] A clear description of why it was opened.
+- [ ] A short title that best describes the change.
+- [ ] Must pass unit and integration tests, which can be run checked locally prior to opening a PR.
+- [ ] Any additional details for functionality not covered by tests.
 
-**Further comments**
-<!--
-If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did, what alternatives you considered, etc.
-
-:heart: Thank you!
--->
+**Additional Details**

.github/workflows/create-dev-branch.yaml

@@ -0,0 +1,58 @@
+name: Create Dev Version
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to create (format: 0.0.0)"
+        required: true
+        type: string
+
+jobs:
+  create-dev-branch:
+    name: Create Dev Branch
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }} # Uses the Personal Access Token
+
+      - name: Validate version format
+        id: validate_version
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ ERROR: Version must be in '0.0.0' format."
+            exit 1
+          fi
+          echo "✅ Version format validated: $VERSION"
+
+      - name: Check if branch already exists
+        id: check_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+
+          if git ls-remote --exit-code origin "$DEV_BRANCH"; then
+            echo "❌ ERROR: Branch '$DEV_BRANCH' already exists!"
+            exit 1
+          fi
+          echo "✅ Branch '$DEV_BRANCH' does not exist."
+
+      - name: Create and push new dev branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+
+          # Fetch latest changes
+          git fetch origin main
+
+          # Create new branch from main
+          git checkout -b "$DEV_BRANCH" origin/main
+
+          # Push branch to remote
+          git push origin "$DEV_BRANCH"
+
+          echo "✅ Successfully created branch '$DEV_BRANCH'!"

.github/workflows/dev.yaml

@@ -1,76 +0,0 @@
-name: dev
-
-on:
-  push:
-    branches:
-      - 'dev_v*'
-
-jobs:
-  test-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: cd backend && go test -race -v ./...
-  lint-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.54.2
-      - run: cd backend && golangci-lint run
-  format-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: cd backend && go fmt ./...
-  lint-frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '20'
-      - run: cd frontend && npm i eslint
-      - run: cd frontend && npm run lint
-  push_dev_to_registry:
-    name: Push dev image
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-        # Workaround to fix error:
-        # failed to push: failed to copy: io: read/write on closed pipe
-        # See https://github.com/docker/build-push-action/issues/761
-        with:
-          driver-opts: |
-            image=moby/buildkit:v0.10.6
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: gtstef/filebrowser
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/main.yaml

@@ -1,49 +1,13 @@
-name: main job
+name: main release
 
 on:
   push:
     branches:
-      - 'main'
+      - "main"
 
 jobs:
-  test-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: cd backend && go test -race -v ./...
-  lint-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.54.2
-      - run: cd backend && golangci-lint run
-  format-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: cd backend && go fmt ./...
-  lint-frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '20'
-      - run: cd frontend && npm i eslint
-      - run: cd frontend && npm run lint
-
-  push_latest_to_registry:
-    needs: [lint-frontend, lint-backend, test-backend, format-backend]
-    name: Push latest
+  test_playwright:
+    name: Test Playwright
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -52,28 +16,17 @@ jobs:
         uses: docker/setup-qemu-action@v3.0.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3.0.0
-        # Workaround to fix error:
-        # failed to push: failed to copy: io: read/write on closed pipe
-        # See https://github.com/docker/build-push-action/issues/761
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
         with:
-          driver-opts: |
-            image=moby/buildkit:v0.10.6
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: gtstef/filebrowser
-      - name: Build and push
-        uses: docker/build-push-action@v5
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./Dockerfile
-          push: true
-          tags: 'gtstef/filebrowser:latest'
-          labels: ${{ steps.meta.outputs.labels }}
+          file: ./_docker/Dockerfile.playwright-general
+          push: false

.github/workflows/pr-merge.yaml

@@ -1,79 +0,0 @@
-name: pr-merge
-
-on:
-  pull_request:
-    branches:
-      - 'main'
-      - 'dev_v*'
-      - 'v[0-9]+.[0-9]+.[0-9]+'
-
-jobs:
-  test-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: cd backend && go test -race -v ./...
-  lint-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.54.2
-      - run: cd backend && golangci-lint run
-  format-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: cd backend && go fmt ./...
-  lint-frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '20'
-      - run: cd frontend && npm i eslint
-      - run: cd frontend && npm run lint
-
-  push_pr_to_registry:
-    name: Push PR
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-        # Workaround to fix error:
-        # failed to push: failed to copy: io: read/write on closed pipe
-        # See https://github.com/docker/build-push-action/issues/761
-        with:
-          driver-opts: |
-            image=moby/buildkit:v0.10.6
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: gtstef/filebrowser
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/pr.yaml

@@ -0,0 +1,113 @@
+name: PR Request
+
+on:
+  pull_request:
+    branches:
+      - "dev/v[0-9]+.[0-9]+.[0-9]+"
+      - "beta/v[0-9]+.[0-9]+.[0-9]+"
+      - "stable/v[0-9]+.[0-9]+.[0-9]+"
+
+jobs:
+  test_playwright:
+    name: Test Playwright - general
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-general
+          push: false
+  test_playwright_proxy:
+    name: Test Playwright - proxy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-proxy
+          push: false
+  test_playwright_noauth:
+    name: Test Playwright - noauth
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-noauth
+          push: false
+  push_pr_to_registry:
+    name: Build docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: gtstef/filebrowser
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.slim
+          push: false # Do not push the image for now
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ steps.meta.outputs.version }}
+            REVISION=${{ steps.meta.outputs.revision }}

.github/workflows/promote-beta-to-stable.yaml

@@ -0,0 +1,110 @@
+name: Promote Beta to Stable
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to promote (format: 0.0.0)"
+        required: true
+        type: string
+
+jobs:
+  promote-beta-to-stable:
+    name: Promote Beta to Stable
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }} # Uses Personal Access Token for branch operations
+
+      - name: Validate version format
+        id: validate_version
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ ERROR: Version must be in '0.0.0' format."
+            exit 1
+          fi
+          echo "✅ Version format validated: $VERSION"
+
+      - name: Check if beta branch exists
+        id: check_beta_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+
+          if ! git ls-remote --exit-code origin "$BETA_BRANCH"; then
+            echo "❌ ERROR: Beta branch '$BETA_BRANCH' does not exist!"
+            exit 1
+          fi
+          echo "✅ Beta branch '$BETA_BRANCH' exists."
+
+      - name: Check if stable branch already exists
+        id: check_stable_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          if git ls-remote --exit-code origin "$STABLE_BRANCH"; then
+            echo "❌ ERROR: Stable branch '$STABLE_BRANCH' already exists!"
+            exit 1
+          fi
+          echo "✅ Stable branch '$STABLE_BRANCH' does not exist."
+
+      - name: Create and push new stable branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          # Fetch latest changes
+          git fetch origin "$BETA_BRANCH"
+
+          # Create new stable branch from beta branch
+          git checkout -b "$STABLE_BRANCH" origin/"$BETA_BRANCH"
+
+          # Push new stable branch to remote
+          git push origin "$STABLE_BRANCH"
+
+          echo "✅ Successfully created stable branch '$STABLE_BRANCH' from '$BETA_BRANCH'."
+
+      - name: Merge beta into stable
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          # Checkout stable branch
+          git checkout "$STABLE_BRANCH"
+
+          # Merge beta into stable
+          git merge --no-ff "origin/$BETA_BRANCH" -m "Merge $BETA_BRANCH into $STABLE_BRANCH"
+
+          # Push merge changes
+          git push origin "$STABLE_BRANCH"
+
+          echo "✅ Successfully merged '$BETA_BRANCH' into '$STABLE_BRANCH'."
+
+#      - name: Delete beta branch after successful merge
+#        run: |
+#          VERSION="${{ github.event.inputs.version }}"
+#          BETA_BRANCH="beta/v$VERSION"
+#
+#          # Delete beta branch locally and remotely
+#          git branch -d "$BETA_BRANCH"
+#          git push origin --delete "$BETA_BRANCH"
+#
+#          echo "✅ Successfully deleted '$BETA_BRANCH'."
+
+      - name: Create Pull Request to Main
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.PAT }}
+          commit-message: "Promote stable/v${{ github.event.inputs.version }} to main"
+          title: "Promote stable/v${{ github.event.inputs.version }} to main"
+          body: "This PR promotes stable/v${{ github.event.inputs.version }} to the main branch."
+          base: main
+          branch: stable/v${{ github.event.inputs.version }}
+          delete-branch: false

.github/workflows/promote-dev-to-beta.yaml

@@ -0,0 +1,99 @@
+name: Promote Dev to Beta
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to promote (format: 0.0.0)"
+        required: true
+        type: string
+
+jobs:
+  promote-dev-to-beta:
+    name: Promote Dev to Beta
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }} # Uses the Personal Access Token
+
+      - name: Validate version format
+        id: validate_version
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ ERROR: Version must be in 'v0.0.0' format."
+            exit 1
+          fi
+          echo "✅ Version format validated: $VERSION"
+
+      - name: Check if dev branch exists
+        id: check_dev_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+
+          if ! git ls-remote --exit-code origin "$DEV_BRANCH"; then
+            echo "❌ ERROR: Dev branch '$DEV_BRANCH' does not exist!"
+            exit 1
+          fi
+          echo "✅ Dev branch '$DEV_BRANCH' exists."
+
+      - name: Check if beta branch already exists
+        id: check_beta_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+
+          if git ls-remote --exit-code origin "$BETA_BRANCH"; then
+            echo "❌ ERROR: Beta branch '$BETA_BRANCH' already exists!"
+            exit 1
+          fi
+          echo "✅ Beta branch '$BETA_BRANCH' does not exist."
+
+      - name: Create and push new beta branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+          BETA_BRANCH="beta/v$VERSION"
+
+          # Fetch latest changes
+          git fetch origin "$DEV_BRANCH"
+
+          # Create new beta branch from dev branch
+          git checkout -b "$BETA_BRANCH" origin/"$DEV_BRANCH"
+
+          # Push new beta branch to remote
+          git push origin "$BETA_BRANCH"
+
+          echo "✅ Successfully created beta branch '$BETA_BRANCH' from '$DEV_BRANCH'."
+
+      - name: Merge dev into beta
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+          BETA_BRANCH="beta/v$VERSION"
+
+          # Checkout beta branch
+          git checkout "$BETA_BRANCH"
+
+          # Merge dev into beta
+          git merge --no-ff "origin/$DEV_BRANCH" -m "Merge $DEV_BRANCH into $BETA_BRANCH"
+
+          # Push merge changes
+          git push origin "$BETA_BRANCH"
+
+          echo "✅ Successfully merged '$DEV_BRANCH' into '$BETA_BRANCH'."
+
+#      - name: Delete dev branch after successful merge
+#        run: |
+#          VERSION="${{ github.event.inputs.version }}"
+#          DEV_BRANCH="dev/v$VERSION"
+#
+#          # Delete dev branch locally and remotely
+#          git branch -d "$DEV_BRANCH"
+#          git push origin --delete "$DEV_BRANCH"
+#
+#          echo "✅ Successfully deleted '$DEV_BRANCH'."

.github/workflows/regular-tests.yaml

@@ -0,0 +1,52 @@
+name: regular tests
+
+on:
+  push:
+    branches:
+      - "**"
+
+jobs:
+  test-backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go test -race -v ./...
+# golanci-lint is currently disabled due to slowness
+#  lint-backend:
+#    runs-on: ubuntu-latest
+#    steps:
+#      - uses: actions/checkout@v4
+#      - uses: actions/setup-go@v5
+#        with:
+#            go-version: 'stable'
+#      - uses: golangci/golangci-lint-action@v5
+#        with:
+#          version: 'v1.64'
+#          working-directory: backend
+  format-backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go fmt ./...
+  lint-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run lint
+  test-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run test

.github/workflows/release.yaml

@@ -1,86 +0,0 @@
-name: release
-
-on:
-  push:
-    branches:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
-
-jobs:
-  test-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: cd backend && go test -race -v ./...
-  lint-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.54.2
-      - run: cd backend && golangci-lint run
-  format-backend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version: 1.21.1
-      - run: cd backend && go fmt ./...
-  lint-frontend:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '20'
-      - run: cd frontend && npm i eslint
-      - run: cd frontend && npm run lint
-  push_release_to_registry:
-    needs: [lint-frontend, lint-backend, test-backend, format-backend]
-    name: Push release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-        # Workaround to fix error:
-        # failed to push: failed to copy: io: read/write on closed pipe
-        # See https://github.com/docker/build-push-action/issues/761
-        with:
-          driver-opts: |
-            image=moby/buildkit:v0.10.6
-      - name: Login to Docker Hub
-        # Only push to Docker Hub when making a release
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: gtstef/filebrowser
-      - name: Strip v from version number
-        id: modify-json
-        run: |
-          JSON="${{ steps.meta.outputs.tags }}"
-          # Use jq to remove 'v' from the version field
-          JSON=$(echo "$JSON" | sed 's/filebrowser:v/filebrowser:/')
-          echo "cleaned_tag=$JSON" >> $GITHUB_OUTPUT
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./Dockerfile
-          push: true
-          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_beta.yaml

@@ -0,0 +1,66 @@
+name: beta release
+
+on:
+  push:
+    branches:
+      - "beta/v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  test_playwright:
+    name: Test Playwright - regular
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-general
+          push: false
+  create_release_tag:
+    needs: [ test_playwright ]
+    name: Create Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }}
+      - name: Extract branch name
+        shell: bash
+        run: |
+          original_branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "branch_name=$transformed_branch" >> $GITHUB_OUTPUT
+          tag_name=$(echo "$original_branch" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')-beta
+          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
+        id: extract_branch
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          target_commitish: ${{ github.sha }}
+          token: ${{ secrets.PAT }}
+          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
+          prerelease: false # change this to false when stable gets released
+          make_latest: true # change this to false when stable gets released
+          draft: false
+          generate_release_notes: true
+          name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/release_dev.yaml

@@ -0,0 +1,62 @@
+name: dev release
+
+on:
+  push:
+    branches:
+      - "dev/v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  push_release_to_registry:
+    name: Push release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{ secrets.PAT }}
+      - name: Extract metadata (tags, labels) for Docker and GHCR
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            gtstef/filebrowser
+            ghcr.io/gtsteffaniak/filebrowser
+      - name: Modify version names
+        id: modify-json
+        run: |
+          TAGS="${{ steps.meta.outputs.tags }}"
+          # Apply modifications to both docker.io and ghcr.io tags
+          CLEANED_TAGS=$(echo "$TAGS" | sed 's/filebrowser:dev-v/filebrowser:/g' | sed -E 's/(filebrowser:[0-9]+\.[0-9]+\.[0-9]+)/\1-dev/g')
+          # Add dev tag to both registries
+          CLEANED_TAGS="$CLEANED_TAGS,gtstef/filebrowser:dev,ghcr.io/gtsteffaniak/filebrowser:dev"
+          echo "cleaned_tag<<EOF" >> $GITHUB_OUTPUT
+          echo "$CLEANED_TAGS" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64,linux/arm64
+          file: ./_docker/Dockerfile
+          push: true
+          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_stable.yaml

@@ -0,0 +1,65 @@
+name: stable release
+
+on:
+  push:
+    branches:
+      - "stable/v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  test_playwright:
+    name: Test Playwright
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-general
+          push: false
+  create_release_tag:
+    needs: [ test_playwright ]
+    name: Create Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }}
+      - name: Extract branch name
+        shell: bash
+        run: |
+          original_branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "branch_name=$transformed_branch" >> $GITHUB_OUTPUT
+          tag_name=$(echo "$original_branch" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')-stable
+          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
+        id: extract_branch
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          target_commitish: ${{ github.sha }}
+          token: ${{ secrets.PAT }}
+          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
+          prerelease: false
+          draft: false
+          generate_release_notes: true
+          name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/stale.yaml

@@ -1,24 +0,0 @@
-name: 'Close stale issues and PRs'
-permissions:
-  issues: write
-  pull-requests: write
-
-on:
-  schedule:
-    - cron: '30 1 * * *'
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v5
-        with:
-          stale-pr-message: 'This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
-          close-pr-message: 'This PR was closed because it has been stalled for 5 days with no activity.'
-          stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
-          close-issue-message: 'This issue was closed because it has been stalled for 30 days with no activity.'
-          days-before-stale: 30
-          days-before-close: 30
-          exempt-issue-labels: 'feature ☘,enhancement ⚙,bug 🐞'
-          exempt-pr-labels: 'need-help,wip'
-          operations-per-run: 100

.github/workflows/tag.yaml

@@ -0,0 +1,167 @@
+name: tag update
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+*"
+
+permissions:
+  contents: write
+
+jobs:
+  update_tag:
+    name: Update Release tag
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+      - name: Install dependencies and build frontend
+        run: npm i && npm run build
+        working-directory: frontend
+      - name: Install OS Requirements
+        run: sudo apt update && sudo apt install -y upx build-essential musl-tools
+      - uses: goto-bus-stop/setup-zig@v2
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          args: release --clean
+          workdir: backend
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  push_release_to_registry:
+    name: Push release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{ secrets.PAT }}
+      - name: Extract metadata (tags, labels) for Docker and GHCR
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            gtstef/filebrowser
+            ghcr.io/gtsteffaniak/filebrowser
+      - name: Modify tags (strip 'v' and add 'beta'/'stable' if needed)
+        id: modify-json
+        run: |
+          JSON='${{ steps.meta.outputs.json }}'
+          MODIFIED_JSON=$(echo "$JSON" | jq '
+            .tags |= map(
+              sub(":v"; ":")      # Strip the 'v'
+              | select(test(":latest") | not)
+            ) |
+            if any(.tags[]; test("beta")) then
+              .tags += [
+                "gtstef/filebrowser:beta",
+                "ghcr.io/gtsteffaniak/filebrowser:beta",
+                "gtstef/filebrowser:latest",
+                "ghcr.io/gtsteffaniak/filebrowser:latest"
+              ]
+            else . end |
+            if any(.tags[]; test("stable")) then
+              .tags += [
+                "gtstef/filebrowser:stable",
+                "ghcr.io/gtsteffaniak/filebrowser:stable",
+                "gtstef/filebrowser:latest",
+                "ghcr.io/gtsteffaniak/filebrowser:latest"
+              ]
+            else . end
+          ')
+          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
+          echo "$TAGS_CSV" > modified_tags.txt  # Optional debug output
+          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64,linux/arm64
+          file: ./_docker/Dockerfile
+          push: true
+          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}
+  push_slim_release_to_registry:
+    name: Push slim release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{ secrets.PAT }}
+      - name: Extract metadata (tags, labels) for Docker and GHCR
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            gtstef/filebrowser
+            ghcr.io/gtsteffaniak/filebrowser
+      - name: Modify tags (strip 'v' and add 'slim' if needed)
+        id: modify-json-slim
+        run: |
+          JSON='${{ steps.meta.outputs.json }}'
+          MODIFIED_JSON=$(echo "$JSON" | jq '
+            .tags |= map(
+              sub(":v"; ":")                 # Strip the 'v'
+              | select(test(":latest") | not) # Remove the "latest" tag
+              | . + "-slim"                   # Append "-slim" to the versioned tag
+            ) |
+            if any(.tags[]; test("beta")) then
+              .tags += [
+                "gtstef/filebrowser:beta-slim",
+                "ghcr.io/gtsteffaniak/filebrowser:beta-slim"
+              ]
+            else . end |
+            if any(.tags[]; test("stable")) then
+              .tags += [
+                "gtstef/filebrowser:stable-slim",
+                "ghcr.io/gtsteffaniak/filebrowser:stable-slim"
+              ]
+            else . end
+          ')
+          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
+          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
+      - name: Build and push slim image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          file: ./_docker/Dockerfile.slim
+          push: true
+          tags: ${{ steps.modify-json-slim.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -1,13 +1,29 @@
 *.db
 *.bak
+*.log
+*.mjs
 _old
 rice-box.go
 .idea/
-/filebrowser
-/filebrowser.exe
+/backend/backend
+/backend/filebrowser
+/backend/filebrowser.exe
+/backend/backend.exe
+/backend/tmp
+/backend/dist
 /frontend/dist
+/frontend/pkg
+/frontend/test-results
+/frontend/tests/playwright-files/demo*
+/frontend/loginAuth.json
+/frontend/package-lock.json
 /backend/vendor
 /backend/*.cov
+/backend/test_config.yaml
+/backend/generated.yaml
+/backend/srv
+/backend/http/dist
+/backend/http/embed/*
 
 .DS_Store
 node_modules
@@ -31,3 +47,4 @@ yarn-error.log*
 *.sw*
 bin/
 build/
+*__debug*

CHANGELOG.md

@@ -2,15 +2,740 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
+## v0.7.8-beta
+
+Note: if using oidc, please update from 0.7.7 to resolve invalid_grant issue. Also - oidc no longer creates users automatically by default -- must be enabled.
+
+ **New Features**:
+ - More oidc user creation options https://github.com/gtsteffaniak/filebrowser/issues/685
+   - `auth.methods.oidc.createUser` must be true to automatically create user, defaults to false.
+   - `auth.methods.oidc.adminGroup` allows using oidc provider group name to enable admin user creation.
+
+ **BugFixes**:
+ - fix save editor info sometimes saves wrong file. https://github.com/gtsteffaniak/filebrowser/issues/701
+ - make ctrl select work on mac or windows. https://github.com/gtsteffaniak/filebrowser/issues/739
+ - oidc login failures introduced in 0.7.6 https://github.com/gtsteffaniak/filebrowser/issues/731
+ - oidc respects non-default baseURL
+
+## v0.7.7-beta
+
+  This release cleans up some of the native preview (image preview) feature logic. And adds simple docx and epub viewers as well. Going through all of this, I think I know how I can add full-fledge google doc and microsoft office viewer support (no edit). But, for now "onlyOffice" remains the most comprehensive solution with most compatibility and ability to fully edit. One day, I think I will be able to integrate a minimal license-free server into the docker image. But that's something for another time.
+
+  Native preview (image preview) support is also available for linux arm64 and amd64 binaries, and windows exe.
+
+ **New Features**:
+ - since theres a wider kind of document preview types, a new disableOfficePreviewExt option has been added.
+ - native (and simple) docx and epub viewers.
+ - Other documents like xlsx get full size image preview when opened and no onlyoffice support.
+
+ **Notes**:
+ - all text mimetype files have preview support.
+ - high-quality preview image sizes bumped from 512x512 to 640x640 to help make text previews readable.
+ - no config is allowed and defaults to on source at current directory.
+
+ **BugFixes**:
+ - fix otp clearing on user save https://github.com/gtsteffaniak/filebrowser/issues/699
+ - admin special characters and general login improvements https://github.com/gtsteffaniak/filebrowser/issues/594
+ - updated editor caching behavior https://github.com/gtsteffaniak/filebrowser/issues/701
+ - move/copy file path issue and overwrite https://github.com/gtsteffaniak/filebrowser/issues/687
+ - fix popup preview loading on safari
+ - `preview.highQuality` only affects gallery view mode. popop preview is always high quality, and icons are always low quality.
+
+## v0.7.6-beta
+
+ **New Features**:
+ - native document preview generation enabled for certain document types on the regular docker image (no office integration needed)
+   - supported native document preview types:
+     - ".pdf",  // PDF
+     - ".xps",  // XPS
+     - ".epub", // EPUB
+     - ".mobi", // MOBI
+     - ".fb2",  // FB2
+     - ".cbz",  // CBZ
+     - ".svg",  // SVG
+     - ".txt",  // TXT
+     - ".docx", // DOCX
+     - ".ppt",  // PPT
+     - ".pptx", // PPTX
+     - ".xlsx", // exel XLSX
+     - ".hwp",  // HWP
+     - ".hwp",  // HWPX
+ - proxy logout redirectUrl support via `auth.methods.proxy.logoutRedirectUrl` https://github.com/gtsteffaniak/filebrowser/issues/684
+
+ **Notes**:
+ - image loading placeholders added and remain if image can't be loaded.
+ - no more arm32 support on main image -- use a `slim` tagged image.
+
+ **BugFixes**:
+ - onlyoffice and other cache issues https://github.com/gtsteffaniak/filebrowser/issues/686
+ - gallery size indicator centering https://github.com/gtsteffaniak/filebrowser/issues/652
+
+## v0.7.5-beta
+
+ **New Features**
+ - new `./filebrowser.exe setup` command for creating a config.yaml on first run. https://github.com/gtsteffaniak/filebrowser/issues/675
+ - new 2FA/OTP support for password-based users.
+ - `auth.password.enforcedOtp` option to enforce 2FA usage for password users.
+
+ **Notes**:
+ - logging uses localtime, optional UTC config added https://github.com/gtsteffaniak/filebrowser/issues/665
+ - generated config example now includes defaults https://github.com/gtsteffaniak/filebrowser/issues/590
+ - `server.debugMedia` config option added to help debug ffmpeg issues in the future (don't enable unless debugging an issue)
+ - more translations additions from english settings https://github.com/gtsteffaniak/filebrowser/issues/653
+ - visual tweaks https://github.com/gtsteffaniak/filebrowser/issues/652
+ - enhanced markdown viewer with code view spec
+
+ **BugFixes**:
+ - long video names ffmpeg issue fixed https://github.com/gtsteffaniak/filebrowser/issues/669
+ - certain files not passing content https://github.com/gtsteffaniak/filebrowser/issues/657
+ - https://github.com/gtsteffaniak/filebrowser/issues/668
+ - allow edit markdown files
+ - rename button doesn't close prompt https://github.com/gtsteffaniak/filebrowser/issues/664
+ - webm video preview issue https://github.com/gtsteffaniak/filebrowser/issues/673
+ - fix signup issue https://github.com/gtsteffaniak/filebrowser/issues/648
+ - fix default source bug
+ - https://github.com/gtsteffaniak/filebrowser/issues/666
+ - fix 500 error for subtitle videos https://github.com/gtsteffaniak/filebrowser/issues/678
+ - spaces and special characters in source name issue https://github.com/gtsteffaniak/filebrowser/issues/679
+
+![image](https://github.com/user-attachments/assets/28e4e67e-31a1-4107-9294-0e715e87b558)
+
+## v0.7.4-beta
+
+ **Notes**:
+ - Updated German translation. https://github.com/gtsteffaniak/filebrowser/pull/644
+
+ **BugFixes**:
+ - windows control click https://github.com/gtsteffaniak/filebrowser/issues/642
+ - create user issue https://github.com/gtsteffaniak/filebrowser/issues/647
+
+## v0.7.3-beta
+
+Note: OIDC changes require config update.
+
+ **New Features**
+ - Added code highlights to text editor and enabled text editor for all asci files under 25MB
+ - Motion previews for videos -- cycles screenshots of vidoes. https://github.com/gtsteffaniak/filebrowser/issues/588
+ - Optionally reset default admin username/password on startup, to guarentee a username/password on startup if needed. Use by setting `auth.resetAdminOnStart` true https://github.com/gtsteffaniak/filebrowser/issues/625
+
+ **Notes**:
+ - Updated translations everywhere. https://github.com/gtsteffaniak/filebrowser/issues/627
+ - Office viewer is now full-screen with floating close button. https://github.com/gtsteffaniak/filebrowser/issues/542
+ - OIDC config additions
+   - `issuerUrl` required now to get relevant oidc configurations.
+   - `disableVerifyTLS` optionally, disable verifying HTTPS provider endpoints.
+   - `logoutRedirectUrl` optionally, redirect the user to this URL on logout.
+   - other URL config parameters are no longer accepted -- replace with issuerUrl.
+ - Aadmins allowed to change user login methods in user settings when creating or updating users.
+   - https://github.com/gtsteffaniak/filebrowser/issues/618
+   - https://github.com/gtsteffaniak/filebrowser/issues/617
+ - Hide header when showing only office https://github.com/gtsteffaniak/filebrowser/issues/542
+
+ **BugFixes**:
+ - Editor save shows notification
+ - Preview settings resetting on startup
+ - Not all languages show correctly https://github.com/gtsteffaniak/filebrowser/issues/623
+ - scopes sometimes reset on startup https://github.com/gtsteffaniak/filebrowser/issues/636
+ - Update save password option
+   - https://github.com/gtsteffaniak/filebrowser/issues/587
+   - https://github.com/gtsteffaniak/filebrowser/issues/619
+   - https://github.com/gtsteffaniak/filebrowser/issues/615
+
+## v0.7.2-beta
+
+The `media` tags introduced in 0.7.0 have been removed -- all docker images have media enabled now.
+
+  **Notes**:
+  - Reverts enforced user login methods types -- until suitable methods to alter are available.
+  - When updating a user, updating scope always sets to the exact scope specified on updated.
+  - Redirect api messages are INFO instead of WARN
+  - Settings has close button instead of back https://github.com/gtsteffaniak/filebrowser/issues/583
+
+  **Bug Fixes**:
+  - Hover bug when exact timestamp setting enabled https://github.com/gtsteffaniak/filebrowser/issues/585
+
+## v0.7.1-beta
+
+The `media` tags introduced in 0.7.0 have been removed -- all docker images have media enabled now.
+
+  **Notes**:
+  - changes to support jwks url needed for authelia - still needs testing to ensure it works https://github.com/gtsteffaniak/filebrowser/issues/575, added debug logs to help identify any further issues.
+  - added apache license file back https://github.com/gtsteffaniak/filebrowser/discussions/599
+  - updated toggle view icons to better match.
+  - adjusted popup preview position on mobile.
+  - updated createUserDir logic, https://github.com/gtsteffaniak/filebrowser/issues/541
+    - it always creats user dir (even for admins)
+    - scope path must exist if it doesn't end in username, and if it does, the parent dir must exist
+    - enforced user login methods types -- can't be changed. a password user cannot login as oidc, etc.
+
+  **Bug Fixes**:
+  - right click context menu issue https://github.com/gtsteffaniak/filebrowser/issues/598
+  - upload file issue https://github.com/gtsteffaniak/filebrowser/issues/597
+  - defaultUserScope is not respected https://github.com/gtsteffaniak/filebrowser/issues/589
+  - defaultEnabled is not respected https://github.com/gtsteffaniak/filebrowser/issues/603
+  - user has weird navigation barhttps://github.com/gtsteffaniak/filebrowser/issues/593
+  - fix multibutton state issue for close overlay https://github.com/gtsteffaniak/filebrowser/issues/596
+
+## v0.7.0-beta
+
+ **New Features**:
+ - New authentication method: OIDC (OpenID Connect)
+ - UI refresh
+   - Refreshed icons and styles to provide more contrast https://github.com/gtsteffaniak/filebrowser/issues/493
+   - New scrollbar which includes information about the listing https://github.com/gtsteffaniak/filebrowser/issues/304
+   - User-configurable popup previewer and user can control preview size of images.
+   - Enhanced user settings page with more toggle options.
+   - Replaced checkboxes with toggles switches https://github.com/gtsteffaniak/filebrowser/issues/461
+   - Refreshed Breadcrumbs style.
+   - Main navbar icon is multipurpose menu, close, back and animates
+   - Enhanced source info on the UI
+     - User must have permission `realtime: true` property to get realtime events.
+     - Sources shows status of the directory `ready`, `indexing`, and `unavailable`
+   - Top-right overflow menu for deleting / editing files in peview https://github.com/gtsteffaniak/filebrowser/issues/456
+   - Helpful UI animation for drag and drop files, to get feedback where the drop target is.
+   - More consistent theme color https://github.com/gtsteffaniak/filebrowser/issues/538
+ - New file preview types:
+   - Video thumbnails available via new media integration (see configuration wiki for help) https://github.com/gtsteffaniak/filebrowser/issues/351
+   - Office file previews if you have office integration enabled. https://github.com/gtsteffaniak/filebrowser/issues/460
+
+  **Notes**:
+  - sesssionId is now unique per window. Previously it was shared accross browser tabs.
+  - DisableUsedPercentage is a backend property now, so users can't "hack" the information to be shown.
+  - Updated documentation for resources api https://github.com/gtsteffaniak/filebrowser/issues/560
+  - Updated placeholder for scopes https://github.com/gtsteffaniak/filebrowser/issues/475
+  - When user's API permissions are removed, any api keys the user had will be revoked.
+  - `server.enableThumbnails` moved to `server.disablePreviews` defaulting to false.
+  - `server.resizePreview` moved to `server.resizePreviews` (with an "s" at the end)
+
+  **Bug Fixes**:
+  - Nil pointer error when source media is disconnected while running.
+  - Source selection buggy https://github.com/gtsteffaniak/filebrowser/issues/537
+  - Upload folder structure https://github.com/gtsteffaniak/filebrowser/issues/539
+  - Editing files on multiple sources https://github.com/gtsteffaniak/filebrowser/issues/535
+  - Prevent the user from changing the password https://github.com/gtsteffaniak/filebrowser/issues/550
+  - Links in setting page does not navigate to correct location https://github.com/gtsteffaniak/filebrowser/issues/474
+  - Url encoding issue https://github.com/gtsteffaniak/filebrowser/issues/530
+  - Certain file types being treated as folders https://github.com/gtsteffaniak/filebrowser/issues/555
+  - Source name with special characters https://github.com/gtsteffaniak/filebrowser/issues/557
+  - Onlyoffice support on proxy auth https://github.com/gtsteffaniak/filebrowser/issues/559
+  - Downloading with user scope https://github.com/gtsteffaniak/filebrowser/issues/564
+  - User disableSettings property to be respected.
+  - Non admin users updating admin settings.
+  - Right click context issue on safari desktop.
+  - office save file issue.
+
+## v0.6.8-beta
+
+ **New Features**
+ - environment variables are available for certain secrets.
+   - see wiki https://github.com/gtsteffaniak/filebrowser/wiki/Environment-Variables
+   - thanks @aaronkyriesenbach https://github.com/gtsteffaniak/filebrowser/pull/511
+
+ **Notes**:
+ - config validation (see https://github.com/gtsteffaniak/filebrowser/wiki/Full-Config-Example)
+   - fails when config file contains unknown fields (helps spot typos)
+   - some light value validation on certain fields
+   - removed recaptcha -- was disabled and not used before.
+   - moved `recaptcha` and `signup` configs to `auth.methods.password`
+
+ **BugFixes**:
+ - fix scope reset on restart https://github.com/gtsteffaniak/filebrowser/issues/515
+ - Clicking empty space to deselect https://github.com/gtsteffaniak/filebrowser/issues/492
+
+## v0.6.7-beta
+
+ **Notes**:
+ - added full tests for single source example.
+ - adds descriptive error if temp dir can't be created on fatal startup
+ - clears temp directory on shutdown.
+ - removed put settings api (unused)
+ - removed more unused config properties.
+
+ **BugFixes**:
+ - fix url encoding issue for search links when theres only one source https://github.com/gtsteffaniak/filebrowser/issues/501
+ - files with # could have problems, double encoded.
+
+## v0.6.6-beta
+
+ **New Feature**:
+ - limit tar size creation to limit server burden. For example, don't let customers try to download the entire filesystem as a zip. see `server.maxArchiveSize` on config wiki.
+
+ **Notes**:
+ - disableUsedPercentage also hides text and source bar.
+ - share errors show up in logs in more verbose way.
+ - archive creation occurs on disk rather than in memory, use `server.cacheDir` to determine where temp files are stored.
+ - automatically ensures leading slash for scope
+   - https://github.com/gtsteffaniak/filebrowser/issues/472
+   - https://github.com/gtsteffaniak/filebrowser/issues/476
+
+ **BugFixes**:
+ - fix proxy user creation issue https://github.com/gtsteffaniak/filebrowser/issues/478
+ - externalUrl prefix issue fixed for shares. https://github.com/gtsteffaniak/filebrowser/issues/465
+ - fix File Opens Instead of Just Downloading https://github.com/gtsteffaniak/filebrowser/issues/480
+ - fix Download file name https://github.com/gtsteffaniak/filebrowser/issues/481
+
+## v0.6.5-beta
+
+ **Notes**:
+ - added more share and download tests
+
+ **BugFixes**:
+ - fix share download issue https://github.com/gtsteffaniak/filebrowser/issues/465
+ - fix content length size calculation issue when downloading multiple files.
+
+## v0.6.4-beta
+
+ **BugFixes**:
+ - fix preview arow issue. https://github.com/gtsteffaniak/filebrowser/issues/457
+ - fix password change issue.
+ - apply user defaults to publi user on startup https://github.com/gtsteffaniak/filebrowser/issues/451
+
+## v0.6.3-beta
+
+ **Notes**:
+ - windows directories get better naming, root directories like "D:\ get named "D", otherwise base filepath is the name when unselected "D:\path\to\folder" gets named "folder" (just like linux)
+ - `.pdf` files added to default onlyoffice exclusion list.
+
+ **BugFixes**:
+ - windows would not refresh file info automatically when viewing because of path issue.
+ - windows paths without name for "D:\" would cause issues.
+ - share path error https://github.com/gtsteffaniak/filebrowser/issues/429
+ - fix bug where resource content flag would load entire file into memory.
+
+## v0.6.2-beta
+
+ **Notes**:
+ - Added playwright tests for bugfixes for permantent fix for stability.
+    (except onlyoffice since it requires integrations)
+
+ **BugFixes**:
+ - Context menu should only be available inside the folder/files container https://github.com/gtsteffaniak/filebrowser/issues/430
+ - drag and drop files from desktop to browser is fixed.
+ - replace prompt cancel button didn't work.
+ - key events on listing page not working (like delete key)
+ - fixed share viewing issue https://github.com/gtsteffaniak/filebrowser/issues/429
+ - disableUsedPercentage hides entire source https://github.com/gtsteffaniak/filebrowser/issues/438
+ - createUserDir fix for proxy users and new users https://github.com/gtsteffaniak/filebrowser/issues/440
+
+## v0.6.1-beta
+
+ **New Feature**:
+ - download size information is added, including when downloding multiple files in zip/tar.gz. The browser will see the XMB of X GB and will show browser native progress.
+
+ **BugFixes**:
+ - fixed onlyoffice bug https://github.com/gtsteffaniak/filebrowser/issues/418
+ - fixed breadcrumbs bug https://github.com/gtsteffaniak/filebrowser/issues/419
+ - fixed search context bug https://github.com/gtsteffaniak/filebrowser/issues/417
+ - fixed sessionID for search
+
+## v0.6.0-beta
+
+> [!WARNING]
+> This release includes several config changes that could cause issues. Please backup your database file before upgrading.
+
+This release has several changes that should work without issues... however, still backup your database file first and proceed with caution. User permissions and source config changes have been updated -- and the `server.root` paramter is no longer used.
+
+This is a significant step towards a stable release. There shouldn't be any major breaking config changes after this.
+
+ **New Features**:
+  - multiple sources support https://github.com/gtsteffaniak/filebrowser/issues/360
+    - listing view keeps them independant, you switch between the two and the url address will have a prefix `/files/<sourcename>/path/to/file` when there is more than 1 source.
+    - search also happens independantly, with a selection toggle per source. searching current source searches the current scope in the listing view, if you toggle to an alternative source it will search from the source root.
+    - copy/moving is currently only supported within the same source -- that will come in a future release.
+  - `FILEBROWSER_CONFIG` environment variable is respected if no CLI config parameter is provided. https://github.com/gtsteffaniak/filebrowser/issues/413
+
+ **Notes**:
+  - downloads no longer open new window.
+  - swagger updated with auth api help for things like api token.
+    - GET api keys now uses `name` query instead of `key`. eg `GET /api/auth/tokens?name=apikeyname`
+  - user permissions simplified to four permission groups (no config change required):
+    - **removed**  : create, rename, delete, download
+    - **remaining**: admin, modify, share, api
+    - `scope` is deprecated, but still supported, applies to default source. if using multiple sources, set `defaultUserScope` at the [source config](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration#default-source-configuration) instead.
+  - **removed** user rules and commands.
+    - commands feature has never been enabled so just removing the references.
+    - rules will come back in a different form (not applied to the user).
+  - `server.root` is completely removed in favor of `server.sources`
+
+ **BugFixes**:
+  - fix conflict resolution issue https://github.com/gtsteffaniak/filebrowser/issues/384
+  - many user creation page bugfixes.
+  - fix share delete issue https://github.com/gtsteffaniak/filebrowser/issues/408
+
+## v0.5.4-beta
+
+ **BugFixes**:
+  - default scope share issue. @theryecatcher https://github.com/gtsteffaniak/filebrowser/pull/387
+  - drag and drop on empty folders https://github.com/gtsteffaniak/filebrowser/issues/361
+  - preview navigation issue https://github.com/gtsteffaniak/filebrowser/issues/372
+  - auth proxy password length error https://github.com/gtsteffaniak/filebrowser/issues/375
+
+<img width="294" alt="image" src="https://github.com/user-attachments/assets/669bca75-98d4-47c1-838b-1ffee2967d7d" />
+
+## v0.5.3-beta
+
+ **New Features**:
+  - onlyoffice disable filetypes for user specified file types. https://github.com/gtsteffaniak/filebrowser/issues/346
+
+ **Notes**:
+  - navbar/sidebar lightmode style tweaks.
+  - any item that has utf formatted text will get editor.
+  - tweaks to create options on context menu.
+  - removed small delay on preview before detecting the file.
+
+ **BugFixes**:
+  - fix `/files/` prefix loading issue https://github.com/gtsteffaniak/filebrowser/issues/362
+  - fix special characters in filename issue https://github.com/gtsteffaniak/filebrowser/issues/357
+  - fix drag and drop issue https://github.com/gtsteffaniak/filebrowser/issues/361
+  - fix conflict issue with creating same file after deletion.
+  - fix mimetype detection https://github.com/gtsteffaniak/filebrowser/issues/327
+  - subtitles for videos https://github.com/gtsteffaniak/filebrowser/issues/358
+    - supports caption sidecar files : ".vtt", ".srt", ".lrc", ".sbv", ".ass", ".ssa", ".sub", ".smi"
+    - embedded subtitles not yet supported.
+
+## v0.5.2-beta
+
+ **New Features**:
+  - Markdown file preview https://github.com/gtsteffaniak/filebrowser/issues/343
+  - Easy access download button https://github.com/gtsteffaniak/filebrowser/issues/341
+
+ **Notes**:
+  - Adds message about what sharing means when creating a link.
+  - api log duration is now always in milliseconds for consistency.
+  - advanced index config option `fileEndsWith` is now respected.
+  - Added Informative error for missing files for certificate load https://github.com/gtsteffaniak/filebrowser/issues/354
+
+ **BugFixes**:
+  - onlyoffice close window missing files issue https://github.com/gtsteffaniak/filebrowser/issues/345
+  - fixed download link inside file preview
+
+## v0.5.1-beta
+
+ > Note: I changed the [config](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration#example-auth-config) for password auth again... It was a mistake just to make it a boolean, so now you can provide options, going forward this allows for more.
+
+  **New Features**:
+  - password length requirement config via `auth.methods.password.minLength` as a number of characters required.
+
+  **Bugfixes**:
+  - NoAuth error message "resource not found"
+  - CLI user configuration works and simplified see examples in the [Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/CLI)
+
+## v0.5.0-beta
+
+ > Note: This Beta release includes a configuration change: `auth.method` is now deprecated. This is done to allow multiple login methods at once. Auth methods are specified via `auth.methods` instead. see [example on the wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration#example-auth-config).
+
+  **New Features**:
+  - Upload progress notification https://github.com/gtsteffaniak/filebrowser/issues/303
+  - proxy auth auto create user when `auth.methods.proxy.createUser: true` while using proxy auth.
+
+  **Notes**:
+  - Context menu positioning tweaks.
+  - using /tmp cachedir is disabled by default, cache dir can be specified via `server.cacheDir: /tmp` to enable it. https://github.com/gtsteffaniak/filebrowser/issues/326
+
+  **Bugfixes**:
+  - Gracefully shutdown to protect database. https://github.com/gtsteffaniak/filebrowser/issues/317
+  - validates auth method provided before server startup.
+  - fix sidebar disk space usage calculation. https://github.com/gtsteffaniak/filebrowser/issues/315
+  - Fixed proxy auth header support (make sure your proxy and server are secure!). https://github.com/gtsteffaniak/filebrowser/issues/322
+
+## v0.4.2-beta
+
+  **New Features**:
+  - Hidden files changes
+    - windows hidden file properties are respected -- when running on windows binary (not docker) with NTFS filesystem.
+    - windows "system" files are considered hidden.
+    - changed user property from `hideDotFiles` to `showHidden`. Defaults to false, so a user would need to must unhide hidden files if they want to view hidden files.
+
+  **Notes**:
+  - cleaned up old and deprecated config.
+  - removed unneeded "Global settings". All system configuration is done on config yaml, See configuration wiki for more help.
+
+  **Bugfixes**:
+  - Another fix for memory https://github.com/gtsteffaniak/filebrowser/issues/298
+
+## v0.4.1-beta
+
+  **New Features**:
+  - right-click actions are available on search. https://github.com/gtsteffaniak/filebrowser/issues/273
+
+  **Notes**:
+  - delete prompt now lists all items that will be affected by delete
+  - Debug and logger output tweaks.
+
+  **Bugfixes**:
+  - calculating checksums errors.
+  - copy/move issues for some circumstances.
+  - The previous position wasn't returned when closing a preview window https://github.com/gtsteffaniak/filebrowser/issues/298
+  - fixed sources configuration mapping error (advanced `server.sources` config)
+
+## v0.4.0-beta
+
+  **New Features**:
+  - Better logging https://github.com/gtsteffaniak/filebrowser/issues/288
+    - highly configurable
+    - api logs include user
+  - onlyOffice support for editing only office files (inspired from https://github.com/filebrowser/filebrowser/pull/2954)
+
+  **Notes**:
+  - Breadcrumbs will only show on file listing (not on previews or editors)
+  - Config file is now optional. It will run with default settings without one and throw a `[WARN ]` message.
+  - Added more descriptions to swagger API
+
+## v0.3.7-beta
+
+  **Notes**:
+  - Adding windows builds back to automated process... will replace manually if they throw malicious defender warnings.
+  - Adding playwright tests to all pr's against dev/beta/release branches.
+    - These playwright tests should help keep release more reliably stable.
+
+  **Bugfixes**:
+  - closing with the default bar issue.
+  - tar.gz archive creation issue
+
+## v0.3.6-beta
+
+  **New Features**:
+  - Adds "externalUrl" server config https://github.com/gtsteffaniak/filebrowser/issues/272
+
+  **Notes**:
+  - All views modes to show header bar for sorting.
+  - other small style changes
+
+  **Bugfixes**:
+  - select and info bug after sorting https://github.com/gtsteffaniak/filebrowser/issues/277
+  - downloading from shares with public user
+  - Ctrl and Shift key modifiers work on listing views as expected.
+  - copy/move file/folder error and show errors https://github.com/gtsteffaniak/filebrowser/issues/278
+  - file move/copy context fix.
+
+## v0.3.5
+
+  **New Features**:
+  - More indexing configuration options possible. However consider waiting on using this feature, because I will soon have a full onboarding experience in the UI to manage sources instead.
+    - added config file options "sources" in the server config.
+    - can enable/disable indexing a specified list of directories/files
+    - can enable/disable indexing hidden files
+    - prepped for multiple sources (not supported yet!)
+  - Theme and Branding support (see updates to [configuration wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration) on how to use)
+  - Automatically expire shares https://github.com/gtsteffaniak/filebrowser/issues/208
+
+  **Notes**:
+  - MacOS application files (ending in ".app") were previously treated as folders, now they are treated as a single file.
+  - No longer indexes "$RECYCLE.BIN" or "System Volume Information" directories.
+  - Icon styling tweaked so all icons have a background.
+  - Updated Login page styling.
+  - Settings profile menu has been simplified, password changes happen in user management.
+  - Improved windows compatibility and built on windows platform to fix false windows defender warning.
+  - If no "root" location is provided in the server config, the default is the **current directory** (rather than `/srv` like before)
+
+  **Bugfixes**:
+  - Fixed setting share expiration time would not work due to type conversion error.
+  - More safari fixes related to text-selection.
+  - Sort by name value sorting ignores the extension, only sorts by name https://github.com/gtsteffaniak/filebrowser/issues/230
+  - Fixed manual language selection issue.
+  - Fixed exact date time issue.
+
+New login page:
+
+<img width="300" alt="image" src="https://github.com/user-attachments/assets/d3ed359e-a969-4f6a-9f72-94d2b68aba49" />
+
+
+Example branding in sidebar:
+
+<img width="500" alt="image2" src="https://github.com/user-attachments/assets/d8ee14ca-4495-4106-9d26-631a5937e134" />
+
+Example user settings page:
+
+<img width="500" alt="image3" src="https://github.com/user-attachments/assets/79757a11-669e-4597-bd3d-e41efd667a1e" />
+
+## v0.3.4
+
+  **Bugfixes**:
+  - Safari right-click actions.
+  - Some small image viewer behavior
+  - Progressive webapp "install to homescreen" fix.
+
+## v0.3.3
+
+  **New Features**
+  - Navigating remembers your previous scroll position when opening items and then navigating backwards.
+  - New Icons with larger selection of file types
+  - file "type" is shown on item info page.
+  - added optional non-root "filebrowser" user for docker image. See https://github.com/gtsteffaniak/filebrowser/issues/251
+  - File preview supports more file types:
+    - images: jpg, bmp, gif, tiff, png, svg, heic, webp
+
+  **Notes**:
+  - The file "type" is now either "directory" or a specific mimetype such as "text/xml".
+  - update safari styling
+
+  **Bugfixes**:
+  - Delete/move file/folders sometimes wouldn't work.
+  - Possible fix for context menu not showing issue. See https://github.com/gtsteffaniak/filebrowser/issues/251
+  - Fixed drag/drop not refreshing immediately to reflect changes.
+
+## v0.3.2
+
+  **New Features**
+  - Mobile search has the same features as desktop.
+
+  **Notes**:
+  - Added compression. Helpful for browsing folders with a large number of items. Considering https://github.com/gtsteffaniak/filebrowser/issues/201 resolved, although future pagination support will still come.
+  - Compressed download options limited to `.zip` and `.tar.gz`
+  - right-click context menu stays in view.
+
+  **Bugfixes**:
+  - search result links when non-default baseUrl configured
+  - frontend sort bug squashed https://github.com/gtsteffaniak/filebrowser/issues/230
+  - bug which caused "noauth" method not to work after v0.3.0 routes update
+
+## v0.3.1
+
+  **New Features**
+  - Adds Smart Indexing by default.
+
+  **Notes**:
+  - Optimized api request response times via improved caching and simplified actions.
+  - User information persists more reliably.
+  - Added [indexing doc](./docs/indexing.md) to explain the expectations around indexing and how it works.
+  - The index should also use less RAM than it did in v0.3.0.
+
+  **Bugfixes**:
+  - Tweaked sorting by name, fixes case sensitive and numeric sorting. https://github.com/gtsteffaniak/filebrowser/issues/230
+  - Fixed unnecessary authentication status checks each route change
+  - Fix create file action issue.
+  - some small javascript related issues.
+  - Fixes pretty big bug viewing raw content in v0.3.0 (utf format message)
+
+## v0.3.0
+
+  This Release focuses on the API and making it more accessible for developers to access functions without the UI.
+
+  **New Features**:
+  - You can now long-live api tokens to interact with API from the user settings page.
+    - These tokens have the same permissions as your user.
+  - Helpful swagger page for API usage.
+  - Some API's were refactored for friendlier API usage, moving some attributes to parameters and first looking for a api token, then using the stored cookie if none is found. This allows for all api requests from swagger page to work without a token.
+  - Add file size to search preview! Should have been in last release... sorry!
+
+  **Notes**:
+  - Replaced backend http framework with go standard library.
+  - Right-click Context menu can target the item that was right-clicked. To fully address https://github.com/gtsteffaniak/filebrowser/issues/214
+  - adjusted settings menu for mobile, always shows all available cards rather than grayed out cards that need to be clicked.
+  - longer and more cryptographically secure share links based on UUID rather than base64.
+
+  **Bugfixes**:
+  - Fixed ui bug with shares with password.
+  - Fixes baseurl related bugs https://github.com/gtsteffaniak/filebrowser/pull/228 Thanks @SimLV
+  - Fixed empty directory load issue.
+  - Fixed image preview cutoff on mobile.
+  - Fixed issue introduced in v0.2.10 where new files and folders were not showing up on ui
+  - Fixed preview issue where preview would not load after viewing video files.
+  - Fixed sorting issue where files were not sorted by name by default.
+  - Fixed copy file prompt issue
+
+## v0.2.10
+
+  **New Features**:
+  - Allows user creation command line arguments https://github.com/gtsteffaniak/filebrowser/issues/196
+  - Folder sizes are always shown, leveraging the index. https://github.com/gtsteffaniak/filebrowser/issues/138
+  - Searching files based on filesize is no longer slower.
+
+  **Bugfixes**:
+  - fixes file selection usage when in single-click mode https://github.com/gtsteffaniak/filebrowser/issues/214
+  - Fixed displayed search context on root directory
+  - Fixed issue searching "smaller than" actually returned files "larger than"
+
+  **Notes**:
+  - Memory usage from index is reduced by ~40%
+  - Indexing time has increased 2x due to the extra processing time required to calculate directory sizes.
+  - File size calculations use 1024 base vs previous 1000 base (matching windows explorer)
+
+## v0.2.9
+
+  This release focused on UI navigation experience. Improving keyboard navigation and adds right click context menu.
+
+  **New Features**:
+  - listing view items are middle-clickable on selected listing or when in single-click mode.
+  - listing view items can be navigated via arrow keys.
+  - listing view can jump to items using letters and number keys to cycle through files that start with that character.
+  - You can use the enter key and backspace key to navigate backwards and forwards on selected items.
+  - ctr-space will open/close the search (leaving ctr-f to browser default find prompt)
+  - Added right-click context menu to replace the file selection prompt.
+
+  **Bugfixes**:
+  - Fixed drag to upload not working.
+  - Fixed shared video link issues.
+  - Fixed user edit bug related to other user.
+  - Fixed password reset bug.
+  - Fixed loading state getting stuck.
+
+## v0.2.8
+
+- **Feature**: New gallery view scaling options (closes [#141](https://github.com/gtsteffaniak/filebrowser/issues/141))
+- **Change**: Refactored backend files functions
+- **Change**: Improved UI response to filesystem changes
+- **Change**: Added frontend tests for deployment integrity
+- **Fix**: move/replace file prompt issue
+- **Fix**: opening files from search
+- **Fix**: Display count issue when hideDotFile is enabled.
+
+## v0.2.7
+
+ - **Change**: New sidebar style and behavior
+ - **Change**: make search view and button behavior more consistent.
+ - **Fix**: [upload file bug](https://github.com/gtsteffaniak/filebrowser/issues/153)
+ - **Fix**: user lock out bug introduced in 0.2.6
+ - **Fix**: many minor state related issues.
+
+## v0.2.6
+
+This change focuses on minimizing and simplifying build process.
+
+- **Change**: Migrated to Vite / Vue 3
+- **Change**: removed npm modules
+  - replaced vuex with custom state management via src/store
+  - replaced noty with simple card popup notifications
+  - replaced moment with simple date formatter where needed
+  - replaced vue-simple-progress with vue component
+- **Feature**: improved error logging
+  - backend errors show the root function that called them during the error
+  - frontend errors print errors to console that fail try/catch
+  - all frontend errors via popup notification & print to console as well
+- **Fix**: Allow editing blank text based files in editor
+- tweaked listing styles
+- Feature: Allow disabling the index via configuration yaml
+
+## v0.2.5
+
+- Fix: delete user prompt works using native hovers.
+
+## v0.2.4
+
+- Feature: [create-folder-feature](https://github.com/gtsteffaniak/filebrowser/pull/105)
+- Feature: [playable shared video](https://github.com/filebrowser/filebrowser/issues/2537)
+- Feature: photos, videos, and audio get embedded preview on share instead of icon
+- Fix: sharable link bug, now uses special publicUser
+- Bump go version to 1.22
+- In prep for vue3 migration, npm modules removed:
+  - js-base64
+  - pretty-bytes
+  - whatwg-fetch
+  - lodash.throttle
+  - lodash.clonedeep
+
+## v0.2.3
+
+- Feature: token expiration time now configurable
+- FIX: Hidden files are still directly accessible. (https://github.com/filebrowser/filebrowser/issues/2698)
+- FIX: search/user context bug
+
 ## v0.2.2
 
-- **Major Indexing Changes:**
-  - **Speed:** (0m57s) - Decreased by 78% compared to the previous release.
-  - **Memory Usage:** (41MB) - Reduced by 45% compared to the previous release.
-- Now utilizes the index for file browser listings!
-- **[Work in Progress]** Hidden files are still directly accessible.
-- **[Work in Progress]** Editor issues fixed on save and themes.
-- **[Work in Progress]** `running-config.yaml` gets updated when settings change, ensuring that running settings are up to date.
+- CHG: **Speed:** (0m57s) - Decreased by 78% compared to the previous release.
+- CHG: **Memory Usage:** (41MB) - Reduced by 45% compared to the previous release.
+- Feature: Now utilizes the index for file browser listings!
+- FIX: Editor issues fixed on save and themes.
 
 ## v0.2.1
 
@@ -33,7 +758,7 @@ All notable changes to this project will be documented in this file. For commit
 - The shell feature has been deprecated.
   - Custom commands can be executed within the Docker container if needed.
 - The JSON config file is no longer used.
-  - All configurations are now performed via the advanced `filebrowser.yaml`.
+  - All configurations are now performed via the advanced `config.yaml`.
   - The only allowed flag is specifying the config file.
 - Removed old code for migrating database versions.
 - Eliminated all unused `cmd` code.

Dockerfile

@@ -1,22 +0,0 @@
-FROM node:slim as nbuild
-WORKDIR /app
-COPY  ./frontend/package*.json ./
-RUN npm ci --maxsockets 1
-COPY  ./frontend/ ./
-RUN npm run build
-
-FROM golang:1.21-alpine as base
-WORKDIR /app
-COPY  ./backend ./
-RUN go get -u golang.org/x/net
-RUN go build -ldflags="-w -s" -o filebrowser .
-
-FROM alpine:latest
-ARG app="/app/filebrowser"
-RUN apk --no-cache add \
-      ca-certificates \
-      mailcap
-WORKDIR /
-COPY --from=base /app/filebrowser* ./
-COPY --from=nbuild /app/dist/ ./frontend/dist/
-ENTRYPOINT [ "./filebrowser" ]

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2018 File Browser contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -1,125 +1,149 @@
-<p align="center">
-  <a href="https://opensource.org/license/apache-2-0/"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License: Apache-2.0"></a>
-</p>
-<p align="center">
-<img src="frontend/public/img/icons/favicon-256x256.png" width="100" title="Login With Custom URL">
-</p>
-<h3 align="center">Filebrowser - A modern file manager for the web</h3>
-<p align="center">
-  <img width="800" src="https://github.com/gtsteffaniak/filebrowser/assets/42989099/899152cf-3e69-4179-aa82-752af2df3fc6" title="Main Screenshot">
-</p>
+<div align="center">
 
-> [!NOTE]  
-> Only intended to be used with docker.
+  [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
+  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
+  [![latest version](https://img.shields.io/github/release/gtsteffaniak/filebrowser/all.svg)](https://github.com/gtsteffaniak/filebrowser/releases)
+  [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
+  [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
+
+  [![Donate](https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif)](https://www.paypal.com/donate/?business=W5XKNXHJM2WPE&no_recurring=0&currency_code=USD)
+
+  <img width="150" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" title="Logo">
+  <h3>FileBrowser Quantum</h3>
+  The best free self-hosted web-based file manager.
+  <br/><br/>
+  <img width="800" src="https://github.com/user-attachments/assets/95af22fa-7760-4f7b-9c20-51fdcfe8f4ea" title="Main Screenshot">
+</div>
 
 > [!WARNING]
-> Starting with v0.2.0, *ALL* configuration is done via `filebrowser.yaml` configuration file.
+> There is no stable version -- planned for 2025. ([Read more](https://github.com/gtsteffaniak/filebrowser/discussions/628))
 
-This fork makes the following significant changes to filebrowser for origin:
+FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:
+
+  1. ✅ Multiple sources support
+  2. ✅ Login support for OIDC, password + 2FA, and proxy.
+  3. ✅ Revamped UI
+  4. ✅ Simplified configuration via `config.yaml` config file.
+  5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
+     - Real-time search results as you type.
+     - Real-time monitoring and updates in the UI.
+     - Search supports file and folder sizes, along with various filters.
+  6. ✅ Better listing browsing
+     - More file type previews, such as **office** and **video** file previews
+     - Instantly switches view modes and sort order without reloading data.
+     - Folder sizes are displayed.
+     - Navigating remembers the last scroll position.
+  7. ✅ Developer API support
+     - Ability to create long-lived API Tokens.
+     - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.
+
+Notable features that this fork *does not* have (removed):
+
+ - ❌ jobs are not supported yet (planned).
+ - ❌ rules are not supported yet (planned).
+ - ❌ shell commands are completely removed and will not be returned.
 
- 1. [x] Better search.
-    - Lightning fast
-    - realtime results as you type
-    - Works with more type filters
-    - interactive results page.
- 1. [x] Revamped and simplified GUI navbar and sidebar menu.
- 1. [x] **IMPORTANT** Revamped configuration via `filebrowser.yml` config file.
- 1. [x] More configurations possible at a per-user level
-    - <img width="450" alt="image" src="https://github.com/gtsteffaniak/filebrowser/assets/42989099/625bd7c4-5ee9-4011-aaae-2a388ab0813b">
- 1. [x] Additional compact view mode as well as refreshed view mode styles.
-    
 ## About
 
-Filebrowser provides a file managing interface within a specified directory
-and it can be used to upload, delete, preview, rename and edit your files.
-It allows the creation of multiple users and each user can have its own
-directory. It can be used as a standalone app.
+FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.
 
-This repository is a fork, a collection of changes that make this program
-work better in terms of asthetics and performance. Improved search,
- simplified ui (without removing features) and more secure and up-to-date
- build are just a few examples.
+This version is called "Quantum" because it packs tons of advanced features in a tiny executable file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
+
+The goal for this repo is to become the best open-source self-hosted file browsing application that exists -- **all for free**.
+
+This repo will always be free and open-source.
+
+For more, see the [Q&A Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A)
+
+## The UI
+
+The UI has a simple three-component navigation system:
+
+  1. (Left) Multi-action button with slide-out panel.
+  2. (Middle) The powerful search bar.
+  3. (Right) The view change toggle.
+
+All other functions are moved either into the action menu or pop-up menus.
+If the action does not depend on context, it will exist in the slide-out
+action panel. If the action is available based on context, it will show up as
+a pop-up menu.
 
-## Look
 <p align="center">
-  <img width="500" src="https://github.com/gtsteffaniak/filebrowser/assets/42989099/35cdeb3b-ab79-4b04-8001-8f51f6ea06bb" title="Dark mode">
-<img width="500" alt="image" src="https://github.com/gtsteffaniak/filebrowser/assets/42989099/55fa4f5c-440e-4a97-b711-96139208a163">
-<img width="500" alt="image" src="https://github.com/gtsteffaniak/filebrowser/assets/42989099/c76f4100-949b-4e17-a3e6-e410fb8ec08f">
-<img width="500" alt="image" src="https://github.com/gtsteffaniak/filebrowser/assets/42989099/0bde26f3-fa90-411e-bd0b-abaa47506d62">
-<img width="560" alt="image" src="https://github.com/gtsteffaniak/filebrowser/assets/42989099/71d8f2b8-6fe6-4fdc-8aac-503d08c28d86">
-
-
+  <img width="1000" src="https://github.com/user-attachments/assets/aa32b05c-f917-47bb-b07f-857edc5e47f7" title="Search GIF">
 </p>
 
+## Install and Configuration
 
-## Install
+Check out the [Getting Started Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Getting-Started)
 
-Using docker:
+For help configuring your filebrowser see [Configuration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration-And-Examples)
 
-1. docker run (no persistent db):
+## Command Line Usage
 
-```
-docker run -it -v /path/to/folder:/srv -p 80:8080 gtstef/filebrowser
-```
+See the [CLI Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/CLI)
 
-1. docker-compose:
+## API Usage
 
-  - with local storage
+See the [API Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/API)
 
-```
-version: '3.7'
-services:
-  filebrowser:
-    volumes:
-      - '/path/to/folder:/srv' # required (for now not configurable)
-      - './database:/database'  # optional if you want db to persist - configure a path under "database" dir in config file.
-      - './filebrowser.yaml:/filebrowser.yaml' # required
-    ports:
-      - '80:8080'
-    image: gtstef/filebrowser
-    restart: always
-```
+## Office File Support
 
-  - with network share
+See [Office Support Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Office-Support#adding-open-office-integration-for-docker) on how to enable office file editing and office-related features.
 
-```
-version: '3.7'
-services:
-  filebrowser:
-    volumes:
-      - 'storage:/srv' # required (for now not configurable)
-      - './database:/database'  # optional if you want db to persist - configure a path under "database" dir in config file.
-      - './filebrowser.yaml:/filebrowser.yaml' # required
-    ports:
-      - '80:8080'
-    image: gtstef/filebrowser
-    restart: always
-volumes:
-  storage:
-    driver_opts:
-      type: cifs
-      o: "username=admin,password=password,rw" # enter valid info here
-      device: "//192.168.1.100/share/"         # enter valid hinfo here
+## Migration from the original filebrowser
 
-```
+See the [Migration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Migration)
 
-## Configuration
-
-All configuration is now done via a single configuration file: `filebrowser.yaml`, here is an example minimal [configuration file](./backend/filebrowser.yaml).
-
-View the [Configuration Help Page](./configuration.md) for available configuration options and other help.
-
-### background & help
-
-The original project filebrowser/filebrowser used multiple different ways to configure the server.
-This was confusing and difficult to work with from a user and from a developer's perspective.
-So I completely redesigned the program to use one single human-readable config file.
-
-I understand many coming from the original fork may notice differences which make using this improved version more difficult. If you notice issues that you believe should be fixed, please open an issue here and it will very likely be addressed with a PR within a few weeks.
-
-This version of filebrowser is going through a configuration overhaul as mentioned above. Certain features related to rules and commands may not work as they do on the original filebrowser. The purpose of this is to create a more consistent experience where configuration is done via files rather than running commands, so that it's very clear what the current state of the configuration is. When running commands its not clear what the configuration is.
-
-## Roadmap
-
-see [Roadmap Page](./roadmap.md)
+## Comparison Chart
 
+ Application Name | <img width="48" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
+--- | --- | --- | --- | --- | --- | --- |
+Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
+Windows                       | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+Self hostable                 | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
+Has Stable Release?           | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ |
+S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
+webdav support                | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
+FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
+Dedicated docs site?          | ❌ | ✅ | ✅ | ✅ | ❌ | ✅ |
+Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+Docker image size             | 200 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
+Min. Memory Requirements      | 256 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
+has standalone binary         | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
+price                         | free | free | free | free tier | free tier | $99+ |
+rich media preview            | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Advanced Search?              | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
+Indexed Search?               | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
+Content-aware search?         | ❌ | ❌ | ❌ | configurable | ✅ | ✅ |
+Custom job support            | ❌ | ✅ | ❌ | ✅ | ❌ | ✅ |
+Multiple users                | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Single sign-on support        | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
+LDAP sign-on support          | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Long-live API key support     | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+API documentation page        | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+Mobile App                    | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ |
+open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
+tags support                  | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ |
+shareable web links?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Event-based notifications     | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Metrics                       | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
+file space quotas             | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
+text-based files editor       | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Themes                        | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
+Branding support              | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
+activity log                  | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Comments support              | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+trash support                 | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Starred/pinned files          | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
+Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
+Share collections of files    | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can archive selected files    | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can browse archive files      | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can convert documents         | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can convert videos            | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
+Can convert photos            | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |

_docker/Dockerfile

@@ -0,0 +1,42 @@
+FROM gtstef/ffmpeg:7.1.1-decode AS ffmpeg
+FROM golang:alpine AS base
+ARG VERSION
+ARG REVISION
+WORKDIR /app
+COPY ./backend ./
+RUN apk update && apk add --no-cache gcc musl-dev upx
+ENV CGO_ENABLED=1
+RUN go build -tags mupdf,musl -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
+  -o filebrowser .
+RUN upx filebrowser
+
+FROM node:lts-slim AS nbuild
+WORKDIR /app
+COPY ./frontend/package.json ./
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
+RUN npm run build-docker
+
+FROM alpine:latest
+COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
+
+ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
+ENV FILEBROWSER_NO_EMBEDED="true"
+ENV PATH="$PATH:/home/filebrowser"
+RUN apk --no-cache add ca-certificates mailcap tzdata
+RUN adduser -D -s /bin/true -u 1000 filebrowser
+USER filebrowser
+WORKDIR /home/filebrowser
+COPY --from=base --chown=filebrowser:1000 /app/filebrowser ./
+COPY --from=base --chown=filebrowser:1000 /app/config.media.yaml ./config.yaml
+COPY --from=nbuild --chown=filebrowser:1000 /app/dist/ ./http/dist/
+## sanity checks
+RUN [ "filebrowser", "version" ]
+RUN [ "ffmpeg", "-version" ]
+RUN [ "ffprobe", "-version" ]
+USER root
+# exposing default port for auto discovery.
+EXPOSE 80
+ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-base

@@ -0,0 +1,4 @@
+FROM node:22-slim
+WORKDIR /app/frontend
+RUN npm i @playwright/test
+RUN npx playwright install --with-deps firefox

_docker/Dockerfile.playwright-general

@@ -0,0 +1,8 @@
+FROM gtstef/playwright-base
+WORKDIR /app
+COPY [ "./_docker/src/general/", "./" ]
+WORKDIR /app/frontend
+COPY [ "./frontend/", "./" ]
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-noauth

@@ -0,0 +1,8 @@
+FROM gtstef/playwright-base
+WORKDIR /app
+COPY [ "./_docker/src/noauth/", "./" ]
+WORKDIR /app/frontend
+COPY [ "./frontend/", "./" ]
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser", "./"]
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-proxy

@@ -0,0 +1,11 @@
+FROM gtstef/playwright-base
+WORKDIR /app
+COPY [ "./_docker/src/proxy/", "./" ]
+WORKDIR /app/frontend
+COPY [ "./frontend/", "./" ]
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser", "./"]
+RUN apt update && apt install nginx -y
+RUN mv default.conf /etc/nginx/conf.d/default.conf
+RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
+RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.slim

@@ -0,0 +1,35 @@
+FROM golang:alpine AS base
+ARG VERSION
+ARG REVISION
+WORKDIR /app
+COPY ./backend ./
+RUN apk update && apk add upx
+RUN go build -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
+  -o filebrowser .
+RUN upx filebrowser
+
+FROM node:lts-slim AS nbuild
+WORKDIR /app
+COPY ./frontend/package.json ./
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
+RUN npm run build-docker
+
+FROM alpine:latest
+ENV FILEBROWSER_NO_EMBEDED="true"
+ENV PATH="$PATH:/home/filebrowser"
+RUN apk --no-cache add ca-certificates mailcap tzdata
+RUN adduser -D -s /bin/true -u 1000 filebrowser
+USER filebrowser
+WORKDIR /home/filebrowser
+COPY --from=base --chown=filebrowser:1000 /app/filebrowser ./
+COPY --from=base --chown=filebrowser:1000 /app/config.yaml ./config.yaml
+COPY --from=nbuild --chown=filebrowser:1000 /app/dist/ ./http/dist/
+## sanity checks
+RUN [ "filebrowser", "version" ]
+USER root
+# exposing default port for auto discovery.
+EXPOSE 80
+ENTRYPOINT [ "./filebrowser" ]

_docker/docker-compose.yaml

@@ -0,0 +1,16 @@
+services:
+  nginx-proxy-auth:
+    image: nginx
+    container_name: nginx-proxy-auth
+    ports:
+      - "80:80"
+    volumes:
+      - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
+  filebrowser:
+    hostname: filebrowser
+    volumes:
+      - '../frontend:/home/frontend'
+      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
+    build:
+      context: ../
+      dockerfile: ./_docker/Dockerfile

_docker/src/general/backend/config.yaml

@@ -0,0 +1,16 @@
+server:
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+    - path: "."
+      name: "docker"
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"

_docker/src/general/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests-playwright/global-setup",
+  timeout: 5000,
+  testDir: "./tests-playwright/general",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1/",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

_docker/src/noauth/backend/config.yaml

@@ -0,0 +1,20 @@
+server:
+  port: 80
+  baseURL:  "/files/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+auth:
+  methods:
+    noauth: true
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+userDefaults:
+  permissions:
+   realtime: true

_docker/src/noauth/frontend/playwright.config.ts

@@ -0,0 +1,48 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests-playwright/noauth-setup",
+  timeout: 5000,
+  testDir: "./tests-playwright/noauth",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    storageState: "noauth.json",
+    actionTimeout: 5000,
+    //storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

_docker/src/proxy/backend/config.yaml

@@ -0,0 +1,36 @@
+server:
+  port: 8080
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      config:
+        defaultEnabled: true
+        createUserDir: true
+
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+
+auth:
+  methods:
+    proxy:
+      enabled: true
+      header: "X-Username"
+      createUser: true
+      logoutRedirectUrl: "https://localhost/api/auth/logout2"
+
+userDefaults:
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: false
+    api: false

_docker/src/proxy/backend/default.conf

@@ -0,0 +1,19 @@
+
+map $remote_addr $uuid {
+    default "demo-${remote_addr}";
+}
+
+server {
+    listen 80;
+    server_name localhost 127.0.0.1;
+
+    location / {
+        proxy_set_header X-Username $uuid;
+        add_header X-Username $uuid;
+        proxy_pass http://filebrowser:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

_docker/src/proxy/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  //globalSetup: "./global-setup",
+  timeout: 3000,
+  testDir: "./tests-playwright/proxy",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 3000,
+    //storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

backend/.golangci.yml

@@ -0,0 +1,232 @@
+# This code is licensed under the terms of the MIT license https://opensource.org/license/mit
+# Copyright (c) 2021 Marat Reymers
+
+## Golden config for golangci-lint v1.59.1
+#
+# This is the best config for golangci-lint based on my experience and opinion.
+# It is very strict, but not extremely strict.
+# Feel free to adapt and change it for your needs.
+
+run:
+  # Timeout for analysis, e.g. 30s, 5m.
+  # Default: 1m
+  timeout: 3m
+
+
+# This file contains only configs which differ from defaults.
+# All possible options can be found here https://github.com/golangci/golangci-lint/blob/master/.golangci.reference.yml
+linters-settings:
+  cyclop:
+    # The maximal code complexity to report.
+    # Default: 10
+    max-complexity: 30
+    # The maximal average package complexity.
+    # If it's higher than 0.0 (float) the check is enabled
+    # Default: 0.0
+    package-average: 10.0
+
+  errcheck:
+    # Report about not checking of errors in type assertions: `a := b.(MyStruct)`.
+    # Such cases aren't reported by default.
+    # Default: false
+    check-type-assertions: true
+
+  exhaustive:
+    # Program elements to check for exhaustiveness.
+    # Default: [ switch ]
+    check:
+      - switch
+      - map
+
+  exhaustruct:
+    # List of regular expressions to exclude struct packages and their names from checks.
+    # Regular expressions must match complete canonical struct package/name/structname.
+    # Default: []
+    exclude:
+      # std libs
+      - "^net/http.Client$"
+      - "^net/http.Cookie$"
+      - "^net/http.Request$"
+      - "^net/http.Response$"
+      - "^net/http.Server$"
+      - "^net/http.Transport$"
+      - "^net/url.URL$"
+      - "^os/exec.Cmd$"
+      - "^reflect.StructField$"
+      # public libs
+      - "^github.com/Shopify/sarama.Config$"
+      - "^github.com/Shopify/sarama.ProducerMessage$"
+      - "^github.com/mitchellh/mapstructure.DecoderConfig$"
+      - "^github.com/prometheus/client_golang/.+Opts$"
+      - "^github.com/spf13/cobra.Command$"
+      - "^github.com/spf13/cobra.CompletionOptions$"
+      - "^github.com/stretchr/testify/mock.Mock$"
+      - "^github.com/testcontainers/testcontainers-go.+Request$"
+      - "^github.com/testcontainers/testcontainers-go.FromDockerfile$"
+      - "^golang.org/x/tools/go/analysis.Analyzer$"
+      - "^google.golang.org/protobuf/.+Options$"
+      - "^gopkg.in/yaml.v3.Node$"
+
+  funlen:
+    # Checks the number of lines in a function.
+    # If lower than 0, disable the check.
+    # Default: 60
+    lines: 100
+    # Checks the number of statements in a function.
+    # If lower than 0, disable the check.
+    # Default: 40
+    statements: 50
+    # Ignore comments when counting lines.
+    # Default false
+    ignore-comments: true
+
+  gocognit:
+    # Minimal code complexity to report.
+    # Default: 30 (but we recommend 10-20)
+    min-complexity: 20
+
+  gocritic:
+    # Settings passed to gocritic.
+    # The settings key is the name of a supported gocritic checker.
+    # The list of supported checkers can be find in https://go-critic.github.io/overview.
+    settings:
+      captLocal:
+        # Whether to restrict checker to params only.
+        # Default: true
+        paramsOnly: false
+      underef:
+        # Whether to skip (*x).method() calls where x is a pointer receiver.
+        # Default: true
+        skipRecvDeref: false
+
+  gomodguard:
+    blocked:
+      # List of blocked modules.
+      # Default: []
+      modules:
+        - github.com/golang/protobuf:
+            recommendations:
+              - google.golang.org/protobuf
+            reason: "see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules"
+        - github.com/satori/go.uuid:
+            recommendations:
+              - github.com/google/uuid
+            reason: "satori's package is not maintained"
+        - github.com/gofrs/uuid:
+            recommendations:
+              - github.com/gofrs/uuid/v5
+            reason: "gofrs' package was not go module before v5"
+
+  govet:
+    # Enable all analyzers.
+    # Default: false
+    enable-all: true
+    # Disable analyzers by name.
+    # Run `go tool vet help` to see all analyzers.
+    # Default: []
+    disable:
+      - fieldalignment # too strict
+    # Settings per analyzer.
+    settings:
+      shadow:
+        # Whether to be strict about shadowing; can be noisy.
+        # Default: false
+        strict: false
+
+  inamedparam:
+    # Skips check for interface methods with only a single parameter.
+    # Default: false
+    skip-single-param: true
+
+  mnd:
+    # List of function patterns to exclude from analysis.
+    # Values always ignored: `time.Date`,
+    # `strconv.FormatInt`, `strconv.FormatUint`, `strconv.FormatFloat`,
+    # `strconv.ParseInt`, `strconv.ParseUint`, `strconv.ParseFloat`.
+    # Default: []
+    ignored-functions:
+      - args.Error
+      - flag.Arg
+      - flag.Duration.*
+      - flag.Float.*
+      - flag.Int.*
+      - flag.Uint.*
+      - os.Chmod
+      - os.Mkdir.*
+      - os.OpenFile
+      - os.WriteFile
+      - prometheus.ExponentialBuckets.*
+      - prometheus.LinearBuckets
+
+  nakedret:
+    # Make an issue if func has more lines of code than this setting, and it has naked returns.
+    # Default: 30
+    max-func-lines: 0
+
+  nolintlint:
+    # Exclude following linters from requiring an explanation.
+    # Default: []
+    allow-no-explanation: [ funlen, gocognit, lll ]
+    # Enable to require an explanation of nonzero length after each nolint directive.
+    # Default: false
+    require-explanation: true
+    # Enable to require nolint directives to mention the specific linter being suppressed.
+    # Default: false
+    require-specific: true
+
+  perfsprint:
+    # Optimizes into strings concatenation.
+    # Default: true
+    strconcat: false
+
+  rowserrcheck:
+    # database/sql is always checked
+    # Default: []
+    packages:
+      - github.com/jmoiron/sqlx
+
+  sloglint:
+    # Enforce not using global loggers.
+    # Values:
+    # - "": disabled
+    # - "all": report all global loggers
+    # - "default": report only the default slog logger
+    # https://github.com/go-simpler/sloglint?tab=readme-ov-file#no-global
+    # Default: ""
+    no-global: "all"
+    # Enforce using methods that accept a context.
+    # Values:
+    # - "": disabled
+    # - "all": report all contextless calls
+    # - "scope": report only if a context exists in the scope of the outermost function
+    # https://github.com/go-simpler/sloglint?tab=readme-ov-file#context-only
+    # Default: ""
+    context: "scope"
+
+  tenv:
+    # The option `all` will run against whole test files (`_test.go`) regardless of method/function signatures.
+    # Otherwise, only methods that take `*testing.T`, `*testing.B`, and `testing.TB` as arguments are checked.
+    # Default: false
+    all: true
+
+
+issues:
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
+  max-same-issues: 50
+
+  exclude-rules:
+    - source: "(noinspection|TODO)"
+      linters: [ godot ]
+    - source: "//noinspection"
+      linters: [ gocritic ]
+    - path: "_test\\.go"
+      linters:
+        - bodyclose
+        - dupl
+        - funlen
+        - goconst
+        - gosec
+        - noctx
+        - wrapcheck

backend/.goreleaser.yaml

@@ -0,0 +1,108 @@
+# .goreleaser.yaml
+project_name: filebrowser
+version: 2
+
+builds:
+  # Build configuration for linux amd64
+  - id: linux-amd64
+    env:
+      - CGO_ENABLED=1
+    tags:
+      - mupdf
+    ldflags: &ldflags
+      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/common/version.Version={{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA={{ .ShortCommit }}
+    main: main.go
+    binary: filebrowser
+    goos:
+      - linux
+    goarch:
+      - amd64
+    hooks:
+      post:
+        - upx {{ .Path }}
+
+  # Build configuration for linux arm64
+  - id: linux-arm64
+    ldflags: *ldflags
+    main: main.go
+    binary: filebrowser
+    env:
+      - CGO_ENABLED=1
+      - CC=zig cc -target aarch64-linux-musl
+    tags:
+      - mupdf
+      - musl
+    goos:
+      - linux
+    goarch:
+      - arm64
+    hooks:
+      post:
+        - upx {{ .Path }}
+
+  # Build configuration for linux
+  - id: linux-arm32
+    ldflags: *ldflags
+    main: main.go
+    binary: filebrowser
+    goos:
+      - linux
+    goarch:
+      - arm
+    goarm:
+      - "6"
+      - "7"
+    hooks:
+      post:
+        - upx {{ .Path }}  # Compress the binary with UPX
+
+  # Build configuration for windows without arm
+  - id: windows
+    env:
+      - CGO_ENABLED=1
+      - CC=zig cc -target x86_64-windows
+    tags:
+      - mupdf
+    ldflags: *ldflags
+    main: main.go
+    binary: filebrowser
+    goos:
+      - windows
+    goarch:
+      - amd64
+    hooks:
+      post:
+        - upx {{ .Path }}  # Compress the binary with UPX
+
+  # Build configuration for freebsd without arm & upx
+  - id: freeBSD and freebsd-arm
+    ldflags: *ldflags
+    main: main.go
+    binary: filebrowser
+    goos:
+      - freebsd
+    goarch:
+      - amd64
+
+  # Build configuration for macos without upx
+  - id: macos
+    ldflags: *ldflags
+    main: main.go
+    binary: filebrowser
+    goos:
+      - darwin
+    goarch:
+      - arm64
+      - amd64
+
+archives:
+  - name_template: >
+      {{- if eq .Os "windows" -}}
+      {{.ProjectName}}
+      {{- else -}}
+      {{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{.ProjectName}}
+      {{- end -}}
+    format: binary
+
+checksum:
+  disable: true

backend/adapters/fs/diskcache/file_cache.go

@@ -10,13 +10,17 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
-
-	"github.com/spf13/afero"
 )
 
-type FileCache struct {
-	fs afero.Fs
+// Cache interface for caching operations
+type Cache interface {
+	Get(key string) ([]byte, error)
+	Set(key string, value []byte) error
+}
 
+// FileCache struct for file-based caching
+type FileCache struct {
+	dir string
 	// granular locks
 	scopedLocks struct {
 		sync.Mutex
@@ -25,10 +29,9 @@ type FileCache struct {
 	}
 }
 
-func New(fs afero.Fs, root string) *FileCache {
-	return &FileCache{
-		fs: afero.NewBasePathFs(fs, root),
-	}
+// NewFileCache creates a new FileCache
+func NewFileCache(dir string) (*FileCache, error) {
+	return &FileCache{dir: dir}, nil
 }
 
 func (f *FileCache) Store(ctx context.Context, key string, value []byte) error {
@@ -37,11 +40,11 @@ func (f *FileCache) Store(ctx context.Context, key string, value []byte) error {
 	defer mu.Unlock()
 
 	fileName := f.getFileName(key)
-	if err := f.fs.MkdirAll(filepath.Dir(fileName), 0700); err != nil { //nolint:gomnd
+	if err := os.MkdirAll(filepath.Dir(fileName), 0700); err != nil {
 		return err
 	}
 
-	if err := afero.WriteFile(f.fs, fileName, value, 0700); err != nil { //nolint:gomnd
+	if err := os.WriteFile(fileName, value, 0600); err != nil {
 		return err
 	}
 
@@ -68,15 +71,15 @@ func (f *FileCache) Delete(ctx context.Context, key string) error {
 	defer mu.Unlock()
 
 	fileName := f.getFileName(key)
-	if err := f.fs.Remove(fileName); err != nil && !errors.Is(err, os.ErrNotExist) {
+	if err := os.Remove(fileName); err != nil && !errors.Is(err, os.ErrNotExist) {
 		return err
 	}
 	return nil
 }
 
-func (f *FileCache) open(key string) (afero.File, bool, error) {
+func (f *FileCache) open(key string) (*os.File, bool, error) {
 	fileName := f.getFileName(key)
-	file, err := f.fs.Open(fileName)
+	file, err := os.Open(fileName)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil, false, nil
@@ -106,5 +109,5 @@ func (f *FileCache) getFileName(key string) string {
 	hasher := sha1.New() //nolint:gosec
 	_, _ = hasher.Write([]byte(key))
 	hash := hex.EncodeToString(hasher.Sum(nil))
-	return fmt.Sprintf("%s/%s/%s", hash[:1], hash[1:3], hash)
+	return filepath.Join(f.dir, fmt.Sprintf("%s/%s/%s", hash[:1], hash[1:3], hash))
 }

backend/adapters/fs/diskcache/file_cache_test.go

@@ -2,10 +2,10 @@ package diskcache
 
 import (
 	"context"
+	"os"
 	"path/filepath"
 	"testing"
 
-	"github.com/spf13/afero"
 	"github.com/stretchr/testify/require"
 )
 
@@ -15,35 +15,39 @@ func TestFileCache(t *testing.T) {
 		key            = "key"
 		value          = "some text"
 		newValue       = "new text"
-		cacheRoot      = "/cache"
+		cacheRoot      = "cache"
 		cachedFilePath = "a/62/a62f2225bf70bfaccbc7f1ef2a397836717377de"
 	)
 
-	fs := afero.NewMemMapFs()
-	cache := New(fs, "/cache")
+	// Create temporary directory for the cache
+	cacheDir, err := os.MkdirTemp("", cacheRoot)
+	require.NoError(t, err)
+	defer os.RemoveAll(cacheDir) // Clean up
+
+	cache, err := NewFileCache(cacheDir)
+	require.NoError(t, err)
 
 	// store new key
-	err := cache.Store(ctx, key, []byte(value))
+	err = cache.Store(ctx, key, []byte(value))
 	require.NoError(t, err)
-	checkValue(t, ctx, fs, filepath.Join(cacheRoot, cachedFilePath), cache, key, value)
+	checkValue(t, ctx, cache, filepath.Join(cacheDir, cachedFilePath), key, value)
 
 	// update existing key
 	err = cache.Store(ctx, key, []byte(newValue))
 	require.NoError(t, err)
-	checkValue(t, ctx, fs, filepath.Join(cacheRoot, cachedFilePath), cache, key, newValue)
+	checkValue(t, ctx, cache, filepath.Join(cacheDir, cachedFilePath), key, newValue)
 
 	// delete key
 	err = cache.Delete(ctx, key)
 	require.NoError(t, err)
-	exists, err := afero.Exists(fs, filepath.Join(cacheRoot, cachedFilePath))
-	require.NoError(t, err)
+	exists := fileExists(filepath.Join(cacheDir, cachedFilePath))
 	require.False(t, exists)
 }
 
-func checkValue(t *testing.T, ctx context.Context, fs afero.Fs, fileFullPath string, cache *FileCache, key, wantValue string) { //nolint:golint
+func checkValue(t *testing.T, ctx context.Context, cache *FileCache, fileFullPath string, key, wantValue string) {
 	t.Helper()
 	// check actual file content
-	b, err := afero.ReadFile(fs, fileFullPath)
+	b, err := os.ReadFile(fileFullPath)
 	require.NoError(t, err)
 	require.Equal(t, wantValue, string(b))
 
@@ -53,3 +57,11 @@ func checkValue(t *testing.T, ctx context.Context, fs afero.Fs, fileFullPath str
 	require.True(t, ok)
 	require.Equal(t, wantValue, string(b))
 }
+
+func fileExists(filename string) bool {
+	info, err := os.Stat(filename)
+	if os.IsNotExist(err) {
+		return false
+	}
+	return !info.IsDir()
+}

backend/adapters/fs/files/file_test.go

@@ -0,0 +1,179 @@
+package files
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+)
+
+func Test_GetRealPath(t *testing.T) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return
+	}
+	trimPrefix := filepath.Dir(filepath.Dir(cwd))
+	tests := []struct {
+		name  string
+		paths []string
+		want  struct {
+			path  string
+			isDir bool
+		}
+	}{
+		{
+			name: "current directory",
+			paths: []string{
+				"./",
+			},
+			want: struct {
+				path  string
+				isDir bool
+			}{
+				path:  "",
+				isDir: true,
+			},
+		},
+		{
+			name: "current directory",
+			paths: []string{
+				"./files/file.go",
+			},
+			want: struct {
+				path  string
+				isDir bool
+			}{
+				path:  "/files/file.go",
+				isDir: false,
+			},
+		},
+		{
+			name: "other test case",
+			paths: []string{
+				"/mnt/doesnt/exist",
+			},
+			want: struct {
+				path  string
+				isDir bool
+			}{
+				path:  "/mnt/doesnt/exist",
+				isDir: false,
+			},
+		},
+	}
+	idx := indexing.Index{
+		Source: settings.Source{
+			Path: trimPrefix,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			realPath, isDir, _ := idx.GetRealPath(tt.paths...)
+			adjustedRealPath := strings.TrimPrefix(realPath, trimPrefix)
+			if tt.want.path != adjustedRealPath || tt.want.isDir != isDir {
+				t.Errorf("expected %v:%v but got: %v:%v", tt.want.path, tt.want.isDir, adjustedRealPath, isDir)
+			}
+		})
+	}
+}
+
+func TestSortItems(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    iteminfo.FileInfo
+		expected iteminfo.FileInfo
+	}{
+		{
+			name: "Numeric and Lexicographical Sorting",
+			input: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
+					{Name: "10.txt"},
+					{Name: "2.txt"},
+					{Name: "apple"},
+					{Name: "Banana"},
+				},
+				Files: []iteminfo.ItemInfo{
+					{Name: "File2.txt"},
+					{Name: "File10.txt"},
+					{Name: "File1"},
+					{Name: "banana"},
+				},
+			},
+			expected: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
+					{Name: "2.txt"},
+					{Name: "10.txt"},
+					{Name: "apple"},
+					{Name: "Banana"},
+				},
+				Files: []iteminfo.ItemInfo{
+					{Name: "banana"},
+					{Name: "File1"},
+					{Name: "File10.txt"},
+					{Name: "File2.txt"},
+				},
+			},
+		},
+		{
+			name: "Only Lexicographical Sorting",
+			input: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
+					{Name: "dog.txt"},
+					{Name: "Cat.txt"},
+					{Name: "apple"},
+				},
+				Files: []iteminfo.ItemInfo{
+					{Name: "Zebra"},
+					{Name: "apple"},
+					{Name: "cat"},
+				},
+			},
+			expected: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
+					{Name: "apple"},
+					{Name: "Cat.txt"},
+					{Name: "dog.txt"},
+				},
+				Files: []iteminfo.ItemInfo{
+					{Name: "apple"},
+					{Name: "cat"},
+					{Name: "Zebra"},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			test.input.SortItems()
+
+			getNames := func(items []iteminfo.ItemInfo) []string {
+				names := []string{}
+				for _, folder := range items {
+					names = append(names, folder.Name)
+				}
+				return names
+			}
+
+			actualFolderNames := getNames(test.input.Folders)
+			expectedFolderNames := getNames(test.expected.Folders)
+
+			if !reflect.DeepEqual(actualFolderNames, expectedFolderNames) {
+				t.Errorf("Folders not sorted correctly.\nGot: %v\nExpected: %v", actualFolderNames, expectedFolderNames)
+			}
+
+			actualFileNames := getNames(test.input.Files)
+			expectedFileNames := getNames(test.expected.Files)
+
+			if !reflect.DeepEqual(actualFileNames, expectedFileNames) {
+				t.Errorf("Files not sorted correctly.\nGot: %v\nExpected: %v", actualFileNames, expectedFileNames)
+			}
+		})
+	}
+}

backend/adapters/fs/files/files.go

@@ -0,0 +1,414 @@
+package files
+
+import (
+	"crypto/md5"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/hex"
+	"fmt"
+	"hash"
+	"io"
+	"unicode"
+	"unicode/utf8"
+
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+func FileInfoFaster(opts iteminfo.FileOptions) (iteminfo.ExtendedFileInfo, error) {
+	response := iteminfo.ExtendedFileInfo{}
+	if opts.Source == "" {
+		opts.Source = settings.Config.Server.DefaultSource.Name
+	}
+	index := indexing.GetIndex(opts.Source)
+	if index == nil {
+		return response, fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	realPath, isDir, err := index.GetRealPath(opts.Path)
+	if err != nil {
+		return response, err
+	}
+	opts.IsDir = isDir
+	// TODO: whats the best way to save trips to disk here?
+	// disabled using cache because its not clear if this is helping or hurting
+	// check if the file exists in the index
+	//info, exists := index.GetReducedMetadata(opts.Path, opts.IsDir)
+	//if exists {
+	//	err := RefreshFileInfo(opts)
+	//	if err != nil {
+	//		return info, err
+	//	}
+	//	if opts.Content {
+	//		content := ""
+	//		content, err = getContent(opts.Path)
+	//		if err != nil {
+	//			return info, err
+	//		}
+	//		info.Content = content
+	//	}
+	//	return info, nil
+	//}
+	err = index.RefreshFileInfo(opts)
+	if err != nil {
+		return response, err
+	}
+	info, exists := index.GetReducedMetadata(opts.Path, opts.IsDir)
+	if !exists {
+		return response, fmt.Errorf("could not get metadata for path: %v", opts.Path)
+	}
+	if opts.Content {
+		if info.Size < 20*1024*1024 { // 20 megabytes in bytes
+			content, err := getContent(realPath)
+			if err != nil {
+				logger.Debugf("could not get content for file: "+info.Path, info.Name, err)
+				return response, err
+			}
+			response.Content = content
+		} else {
+			logger.Debug("skipping large text file contents (20MB limit): "+info.Path, info.Name)
+		}
+	}
+	response.FileInfo = *info
+	response.RealPath = realPath
+	response.Source = opts.Source
+	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
+		response.OnlyOfficeId = generateOfficeId(realPath)
+	}
+	if strings.HasPrefix(info.Type, "video") {
+		parentInfo, exists := index.GetReducedMetadata(filepath.Dir(info.Path), true)
+		if exists {
+			response.DetectSubtitles(parentInfo)
+		}
+	}
+	return response, nil
+}
+
+func generateOfficeId(realPath string) string {
+	key, ok := utils.OnlyOfficeCache.Get(realPath).(string)
+	if !ok {
+		timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)
+		documentKey := utils.HashSHA256(realPath + timestamp)
+		utils.OnlyOfficeCache.Set(realPath, documentKey)
+		return documentKey
+	}
+	return key
+}
+
+// Checksum checksums a given File for a given User, using a specific
+// algorithm. The checksums data is saved on File object.
+func GetChecksum(fullPath, algo string) (map[string]string, error) {
+	subs := map[string]string{}
+	reader, err := os.Open(fullPath)
+	if err != nil {
+		return subs, err
+	}
+	defer reader.Close()
+
+	hashFuncs := map[string]hash.Hash{
+		"md5":    md5.New(),
+		"sha1":   sha1.New(),
+		"sha256": sha256.New(),
+		"sha512": sha512.New(),
+	}
+
+	h, ok := hashFuncs[algo]
+	if !ok {
+		return subs, errors.ErrInvalidOption
+	}
+
+	_, err = io.Copy(h, reader)
+	if err != nil {
+		return subs, err
+	}
+	subs[algo] = hex.EncodeToString(h.Sum(nil))
+	return subs, nil
+}
+
+func DeleteFiles(source, absPath string, absDirPath string) error {
+	err := os.RemoveAll(absPath)
+	if err != nil {
+		return err
+	}
+	index := indexing.GetIndex(source)
+	if index == nil {
+		return fmt.Errorf("could not get index: %v ", source)
+	}
+	refreshConfig := iteminfo.FileOptions{Path: index.MakeIndexPath(absDirPath), IsDir: true}
+	err = index.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func MoveResource(sourceIndex, destIndex, realsrc, realdst string) error {
+	err := fileutils.MoveFile(realsrc, realdst)
+	if err != nil {
+		return err
+	}
+	idxSrc := indexing.GetIndex(sourceIndex)
+	if idxSrc == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	idxDst := indexing.GetIndex(destIndex)
+	if idxDst == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	refreshSourceDir := idxSrc.MakeIndexPath(filepath.Dir(realsrc))
+	refreshDestDir := idxDst.MakeIndexPath(filepath.Dir(realdst))
+	// refresh info for source and dest
+	err = idxSrc.RefreshFileInfo(iteminfo.FileOptions{
+		Path:  refreshSourceDir,
+		IsDir: true,
+	})
+	if err != nil {
+		return fmt.Errorf("could not refresh index for source: %v", err)
+	}
+	if refreshSourceDir == refreshDestDir {
+		return nil
+	}
+	refreshConfig := iteminfo.FileOptions{Path: refreshDestDir, IsDir: true}
+	err = idxDst.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return fmt.Errorf("could not refresh index for dest: %v", err)
+	}
+	return nil
+}
+
+func CopyResource(sourceIndex, destIndex, realsrc, realdst string) error {
+	err := fileutils.CopyFile(realsrc, realdst)
+	if err != nil {
+		return err
+	}
+	idxSrc := indexing.GetIndex(sourceIndex)
+	if idxSrc == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	idxDst := indexing.GetIndex(destIndex)
+	if idxDst == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	refreshSourceDir := idxSrc.MakeIndexPath(filepath.Dir(realsrc))
+	refreshDestDir := idxDst.MakeIndexPath(filepath.Dir(realdst))
+	index := indexing.GetIndex(sourceIndex)
+	if index == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	refreshConfig := iteminfo.FileOptions{Path: refreshSourceDir, IsDir: true}
+	// refresh info for source and dest
+	err = index.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return fmt.Errorf("could not refresh index for source: %v", err)
+	}
+	refreshConfig.Path = refreshDestDir
+	err = index.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return errors.ErrEmptyKey
+	}
+
+	return nil
+}
+
+func WriteDirectory(opts iteminfo.FileOptions) error {
+	idx := indexing.GetIndex(opts.Source)
+	if idx == nil {
+		return fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	realPath, _, _ := idx.GetRealPath(opts.Path)
+	// Ensure the parent directories exist
+	err := os.MkdirAll(realPath, 0775)
+	if err != nil {
+		return err
+	}
+	err = idx.RefreshFileInfo(opts)
+	if err != nil {
+		return errors.ErrEmptyKey
+	}
+	return nil
+}
+
+func WriteFile(opts iteminfo.FileOptions, in io.Reader) error {
+	idx := indexing.GetIndex(opts.Source)
+	if idx == nil {
+		return fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	dst, _, _ := idx.GetRealPath(opts.Path)
+	parentDir := filepath.Dir(dst)
+	// Create the directory and all necessary parents
+	err := os.MkdirAll(parentDir, 0775)
+	if err != nil {
+		return err
+	}
+
+	// Open the file for writing (create if it doesn't exist, truncate if it does)
+	file, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0775)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	// Copy the contents from the reader to the file
+	_, err = io.Copy(file, in)
+	if err != nil {
+		return err
+	}
+	opts.Path = idx.MakeIndexPath(parentDir)
+	opts.IsDir = true
+	return idx.RefreshFileInfo(opts)
+}
+
+// getContent reads and returns the file content if it's considered an editable text file.
+func getContent(realPath string) (string, error) {
+	const headerSize = 4096
+	// Thresholds for detecting binary-like content (these can be tuned)
+	const maxNullBytesInHeaderAbs = 10    // Max absolute null bytes in header
+	const maxNullByteRatioInHeader = 0.1  // Max 10% null bytes in header
+	const maxNullByteRatioInFile = 0.05   // Max 5% null bytes in the entire file
+	const maxNonPrintableRuneRatio = 0.05 // Max 5% non-printable runes in the entire file
+
+	// Open file
+	f, err := os.Open(realPath)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	// Read header
+	headerBytes := make([]byte, headerSize)
+	n, err := f.Read(headerBytes)
+	if err != nil && err != io.EOF {
+		return "", err
+	}
+	actualHeader := headerBytes[:n]
+
+	// --- Start of new heuristic checks ---
+
+	if n > 0 {
+		// 1. Basic Check: Is the header valid UTF-8?
+		// If not, it's unlikely an editable UTF-8 text file.
+		if !utf8.Valid(actualHeader) {
+			return "", nil // Not an error, just not the text file we want
+		}
+
+		// 2. Check for excessive null bytes in the header
+		nullCountInHeader := 0
+		for _, b := range actualHeader {
+			if b == 0x00 {
+				nullCountInHeader++
+			}
+		}
+		// Reject if too many nulls absolutely or relatively in the header
+		if nullCountInHeader > 0 { // Only perform check if there are any nulls
+			if nullCountInHeader > maxNullBytesInHeaderAbs ||
+				(float64(nullCountInHeader)/float64(n) > maxNullByteRatioInHeader) {
+				return "", nil // Too many nulls in header
+			}
+		}
+
+		// 3. Check for other non-text ASCII control characters in the header
+		// (C0 controls excluding \t, \n, \r)
+		for _, b := range actualHeader {
+			if b < 0x20 && b != '\t' && b != '\n' && b != '\r' {
+				return "", nil // Found problematic control character
+			}
+			// C1 control characters (0x80-0x9F) would be caught by utf8.Valid if part of invalid sequences,
+			// or by the non-printable rune check later if they form valid (but undesirable) codepoints.
+		}
+
+		// Optional: Use http.DetectContentType for an additional check on the header
+		// contentType := http.DetectContentType(actualHeader)
+		// if !strings.HasPrefix(contentType, "text/") && contentType != "application/octet-stream" {
+		//     // If it's clearly a non-text MIME type (e.g., "image/jpeg"), reject it.
+		//     // "application/octet-stream" is ambiguous, so we rely on other heuristics.
+		//     return "", nil
+		// }
+	}
+	// --- End of new heuristic checks for header ---
+
+	// Now read the full file (original logic)
+	content, err := os.ReadFile(realPath)
+	if err != nil {
+		return "", err
+	}
+
+	// Handle empty file (original logic - returns specific string)
+	if len(content) == 0 {
+		return "empty-file-x6OlSil", nil
+	}
+
+	stringContent := string(content)
+
+	// 4. Final UTF-8 validation for the entire file
+	// (This is crucial as the header might be fine, but the rest of the file isn't)
+	if !utf8.ValidString(stringContent) {
+		return "", nil
+	}
+
+	// 5. Check for excessive null bytes in the entire file content
+	if len(content) > 0 { // Check only for non-empty files
+		totalNullCount := 0
+		for _, b := range content {
+			if b == 0x00 {
+				totalNullCount++
+			}
+		}
+		if float64(totalNullCount)/float64(len(content)) > maxNullByteRatioInFile {
+			return "", nil // Too many nulls in the entire file
+		}
+	}
+
+	// 6. Check for excessive non-printable runes in the entire file content
+	// (Excluding tab, newline, carriage return, which are common in text files)
+	if len(stringContent) > 0 { // Check only for non-empty strings
+		nonPrintableRuneCount := 0
+		totalRuneCount := 0
+		for _, r := range stringContent {
+			totalRuneCount++
+			// unicode.IsPrint includes letters, numbers, punctuation, symbols, and spaces.
+			// It excludes control characters. We explicitly allow \t, \n, \r.
+			if !unicode.IsPrint(r) && r != '\t' && r != '\n' && r != '\r' {
+				nonPrintableRuneCount++
+			}
+		}
+
+		if totalRuneCount > 0 { // Avoid division by zero
+			if float64(nonPrintableRuneCount)/float64(totalRuneCount) > maxNonPrintableRuneRatio {
+				return "", nil // Too many non-printable runes
+			}
+		}
+	}
+
+	// The file has passed all checks and is considered editable text.
+	return stringContent, nil
+}
+
+func IsNamedPipe(mode os.FileMode) bool {
+	return mode&os.ModeNamedPipe != 0
+}
+
+func IsSymlink(mode os.FileMode) bool {
+	return mode&os.ModeSymlink != 0
+}
+
+func Exists(path string) bool {
+	_, err := os.Stat(path)
+	if err == nil {
+		return true
+	}
+	if os.IsNotExist(err) {
+		return false
+	}
+	return false
+}

backend/adapters/fs/files/mime.go

@@ -0,0 +1,612 @@
+package files
+
+// This file contains code primarily sourced from::
+// github.com/kataras/iris
+
+import (
+	"mime"
+)
+
+const (
+	// ContentBinaryHeaderValue header value for binary data.
+	ContentBinaryHeaderValue = "application/octet-stream"
+	// ContentWebassemblyHeaderValue header value for web assembly files.
+	ContentWebassemblyHeaderValue = "application/wasm"
+	// ContentHTMLHeaderValue is the  string of text/html response header's content type value.
+	ContentHTMLHeaderValue = "text/html"
+	// ContentJSONHeaderValue header value for JSON data.
+	ContentJSONHeaderValue = "application/json"
+	// ContentJSONProblemHeaderValue header value for JSON API problem error.
+	// Read more at: https://tools.ietf.org/html/rfc7807
+	ContentJSONProblemHeaderValue = "application/problem+json"
+	// ContentXMLProblemHeaderValue header value for XML API problem error.
+	// Read more at: https://tools.ietf.org/html/rfc7807
+	ContentXMLProblemHeaderValue = "application/problem+xml"
+	// ContentJavascriptHeaderValue header value for JSONP & Javascript data.
+	ContentJavascriptHeaderValue = "text/javascript"
+	// ContentTextHeaderValue header value for Text data.
+	ContentTextHeaderValue = "text/plain"
+	// ContentXMLHeaderValue header value for XML data.
+	ContentXMLHeaderValue = "text/xml"
+	// ContentXMLUnreadableHeaderValue obsolete header value for XML.
+	ContentXMLUnreadableHeaderValue = "application/xml"
+	// ContentMarkdownHeaderValue custom key/content type, the real is the text/html.
+	ContentMarkdownHeaderValue = "text/markdown"
+	// ContentYAMLHeaderValue header value for YAML data.
+	ContentYAMLHeaderValue = "application/x-yaml"
+	// ContentYAMLTextHeaderValue header value for YAML plain text.
+	ContentYAMLTextHeaderValue = "text/yaml"
+	// ContentProtobufHeaderValue header value for Protobuf messages data.
+	ContentProtobufHeaderValue = "application/x-protobuf"
+	// ContentMsgPackHeaderValue header value for MsgPack data.
+	ContentMsgPackHeaderValue = "application/msgpack"
+	// ContentMsgPack2HeaderValue alternative header value for MsgPack data.
+	ContentMsgPack2HeaderValue = "application/x-msgpack"
+	// ContentFormHeaderValue header value for post form data.
+	ContentFormHeaderValue = "application/x-www-form-urlencoded"
+	// ContentFormMultipartHeaderValue header value for post multipart form data.
+	ContentFormMultipartHeaderValue = "multipart/form-data"
+	// ContentMultipartRelatedHeaderValue header value for multipart related data.
+	ContentMultipartRelatedHeaderValue = "multipart/related"
+	// ContentGRPCHeaderValue Content-Type header value for gRPC.
+	ContentGRPCHeaderValue = "application/grpc"
+)
+
+var types = map[string]string{
+	".3dm":       "x-world/x-3dmf",
+	".3dmf":      "x-world/x-3dmf",
+	".7z":        "application/x-7z-compressed",
+	".a":         "application/octet-stream",
+	".aab":       "application/x-authorware-bin",
+	".aam":       "application/x-authorware-map",
+	".aas":       "application/x-authorware-seg",
+	".abc":       "text/vndabc",
+	".ace":       "application/x-ace-compressed",
+	".acgi":      "text/html",
+	".afl":       "video/animaflex",
+	".ai":        "application/postscript",
+	".aif":       "audio/aiff",
+	".aifc":      "audio/aiff",
+	".aiff":      "audio/aiff",
+	".aim":       "application/x-aim",
+	".aip":       "text/x-audiosoft-intra",
+	".alz":       "application/x-alz-compressed",
+	".ani":       "application/x-navi-animation",
+	".aos":       "application/x-nokia-9000-communicator-add-on-software",
+	".aps":       "application/mime",
+	".apk":       "application/vnd.android.package-archive",
+	".arc":       "application/x-arc-compressed",
+	".arj":       "application/arj",
+	".art":       "image/x-jg",
+	".asf":       "video/x-ms-asf",
+	".asm":       "text/x-asm",
+	".asp":       "text/asp",
+	".asx":       "application/x-mplayer2",
+	".au":        "audio/basic",
+	".avi":       "video/x-msvideo",
+	".avs":       "video/avs-video",
+	".bcpio":     "application/x-bcpio",
+	".bin":       "application/mac-binary",
+	".bmp":       "image/bmp",
+	".boo":       "application/book",
+	".book":      "application/book",
+	".boz":       "application/x-bzip2",
+	".bsh":       "application/x-bsh",
+	".bz2":       "application/x-bzip2",
+	".bz":        "application/x-bzip",
+	".c++":       ContentTextHeaderValue,
+	".c":         "text/x-c",
+	".cab":       "application/vnd.ms-cab-compressed",
+	".cat":       "application/vndms-pkiseccat",
+	".cc":        "text/x-c",
+	".ccad":      "application/clariscad",
+	".cco":       "application/x-cocoa",
+	".cdf":       "application/cdf",
+	".cer":       "application/pkix-cert",
+	".cha":       "application/x-chat",
+	".chat":      "application/x-chat",
+	".chrt":      "application/vnd.kde.kchart",
+	".class":     "application/java",
+	".com":       ContentTextHeaderValue,
+	".conf":      ContentTextHeaderValue,
+	".cpio":      "application/x-cpio",
+	".cpp":       "text/x-c",
+	".cpt":       "application/mac-compactpro",
+	".crl":       "application/pkcs-crl",
+	".crt":       "application/pkix-cert",
+	".crx":       "application/x-chrome-extension",
+	".csh":       "text/x-scriptcsh",
+	".css":       "text/css",
+	".csv":       "text/csv",
+	".cxx":       ContentTextHeaderValue,
+	".dar":       "application/x-dar",
+	".dcr":       "application/x-director",
+	".deb":       "application/x-debian-package",
+	".deepv":     "application/x-deepv",
+	".def":       ContentTextHeaderValue,
+	".der":       "application/x-x509-ca-cert",
+	".dif":       "video/x-dv",
+	".dir":       "application/x-director",
+	".divx":      "video/divx",
+	".dl":        "video/dl",
+	".dmg":       "application/x-apple-diskimage",
+	".doc":       "application/msword",
+	".dot":       "application/msword",
+	".dp":        "application/commonground",
+	".drw":       "application/drafting",
+	".dump":      "application/octet-stream",
+	".dv":        "video/x-dv",
+	".dvi":       "application/x-dvi",
+	".dwf":       "drawing/x-dwf=(old)",
+	".dwg":       "application/acad",
+	".dxf":       "application/dxf",
+	".dxr":       "application/x-director",
+	".el":        "text/x-scriptelisp",
+	".elc":       "application/x-bytecodeelisp=(compiled=elisp)",
+	".eml":       "message/rfc822",
+	".env":       "application/x-envoy",
+	".eps":       "application/postscript",
+	".es":        "application/x-esrehber",
+	".etx":       "text/x-setext",
+	".evy":       "application/envoy",
+	".exe":       "application/octet-stream",
+	".f77":       "text/x-fortran",
+	".f90":       "text/x-fortran",
+	".f":         "text/x-fortran",
+	".fdf":       "application/vndfdf",
+	".fif":       "application/fractals",
+	".fli":       "video/fli",
+	".flo":       "image/florian",
+	".flv":       "video/x-flv",
+	".flx":       "text/vndfmiflexstor",
+	".fmf":       "video/x-atomic3d-feature",
+	".for":       "text/x-fortran",
+	".fpx":       "image/vndfpx",
+	".frl":       "application/freeloader",
+	".funk":      "audio/make",
+	".g3":        "image/g3fax",
+	".g":         ContentTextHeaderValue,
+	".gif":       "image/gif",
+	".gl":        "video/gl",
+	".gsd":       "audio/x-gsm",
+	".gsm":       "audio/x-gsm",
+	".gsp":       "application/x-gsp",
+	".gss":       "application/x-gss",
+	".gtar":      "application/x-gtar",
+	".gz":        "application/x-compressed",
+	".gzip":      "application/x-gzip",
+	".h":         "text/x-h",
+	".hdf":       "application/x-hdf",
+	".help":      "application/x-helpfile",
+	".hgl":       "application/vndhp-hpgl",
+	".hh":        "text/x-h",
+	".hlb":       "text/x-script",
+	".hlp":       "application/hlp",
+	".hpg":       "application/vndhp-hpgl",
+	".hpgl":      "application/vndhp-hpgl",
+	".hqx":       "application/binhex",
+	".hta":       "application/hta",
+	".htc":       "text/x-component",
+	".htm":       "text/html",
+	".html":      "text/html",
+	".htmls":     "text/html",
+	".htt":       "text/webviewhtml",
+	".htx":       "text/html",
+	".ice":       "x-conference/x-cooltalk",
+	".ico":       "image/x-icon",
+	".ics":       "text/calendar",
+	".icz":       "text/calendar",
+	".idc":       ContentTextHeaderValue,
+	".ief":       "image/ief",
+	".iefs":      "image/ief",
+	".iges":      "application/iges",
+	".igs":       "application/iges",
+	".ima":       "application/x-ima",
+	".imap":      "application/x-httpd-imap",
+	".inf":       "application/inf",
+	".ins":       "application/x-internett-signup",
+	".ip":        "application/x-ip2",
+	".isu":       "video/x-isvideo",
+	".it":        "audio/it",
+	".iv":        "application/x-inventor",
+	".ivr":       "i-world/i-vrml",
+	".ivy":       "application/x-livescreen",
+	".jam":       "audio/x-jam",
+	".jav":       "text/x-java-source",
+	".java":      "text/x-java-source",
+	".jcm":       "application/x-java-commerce",
+	".jfif-tbnl": "image/jpeg",
+	".jfif":      "image/jpeg",
+	".jnlp":      "application/x-java-jnlp-file",
+	".jpe":       "image/jpeg",
+	".jpeg":      "image/jpeg",
+	".jpg":       "image/jpeg",
+	".jps":       "image/x-jps",
+	".js":        ContentJavascriptHeaderValue,
+	".mjs":       ContentJavascriptHeaderValue,
+	".json":      ContentJSONHeaderValue,
+	".vue":       ContentJavascriptHeaderValue,
+	".jut":       "image/jutvision",
+	".kar":       "audio/midi",
+	".karbon":    "application/vnd.kde.karbon",
+	".kfo":       "application/vnd.kde.kformula",
+	".flw":       "application/vnd.kde.kivio",
+	".kml":       "application/vnd.google-earth.kml+xml",
+	".kmz":       "application/vnd.google-earth.kmz",
+	".kon":       "application/vnd.kde.kontour",
+	".kpr":       "application/vnd.kde.kpresenter",
+	".kpt":       "application/vnd.kde.kpresenter",
+	".ksp":       "application/vnd.kde.kspread",
+	".kwd":       "application/vnd.kde.kword",
+	".kwt":       "application/vnd.kde.kword",
+	".ksh":       "text/x-scriptksh",
+	".la":        "audio/nspaudio",
+	".lam":       "audio/x-liveaudio",
+	".latex":     "application/x-latex",
+	".lha":       "application/lha",
+	".lhx":       "application/octet-stream",
+	".list":      ContentTextHeaderValue,
+	".lma":       "audio/nspaudio",
+	".log":       ContentTextHeaderValue,
+	".lsp":       "text/x-scriptlisp",
+	".lst":       ContentTextHeaderValue,
+	".lsx":       "text/x-la-asf",
+	".ltx":       "application/x-latex",
+	".lzh":       "application/octet-stream",
+	".lzx":       "application/lzx",
+	".m1v":       "video/mpeg",
+	".m2a":       "audio/mpeg",
+	".m2v":       "video/mpeg",
+	".m3u":       "audio/x-mpegurl",
+	".m":         "text/x-m",
+	".man":       "application/x-troff-man",
+	".manifest":  "text/cache-manifest",
+	".map":       "application/x-navimap",
+	".mar":       ContentTextHeaderValue,
+	".mbd":       "application/mbedlet",
+	".mc$":       "application/x-magic-cap-package-10",
+	".mcd":       "application/mcad",
+	".mcf":       "text/mcf",
+	".mcp":       "application/netmc",
+	".me":        "application/x-troff-me",
+	".mht":       "message/rfc822",
+	".mhtml":     "message/rfc822",
+	".mid":       "application/x-midi",
+	".midi":      "application/x-midi",
+	".mif":       "application/x-frame",
+	".mime":      "message/rfc822",
+	".mjf":       "audio/x-vndaudioexplosionmjuicemediafile",
+	".mjpg":      "video/x-motion-jpeg",
+	".mm":        "application/base64",
+	".mme":       "application/base64",
+	".mod":       "audio/mod",
+	".moov":      "video/quicktime",
+	".mov":       "video/quicktime",
+	".movie":     "video/x-sgi-movie",
+	".mp2":       "audio/mpeg",
+	".mp3":       "audio/mpeg",
+	".mp4":       "video/mp4",
+	".mpa":       "audio/mpeg",
+	".mpc":       "application/x-project",
+	".mpe":       "video/mpeg",
+	".mpeg":      "video/mpeg",
+	".mpg":       "video/mpeg",
+	".mpga":      "audio/mpeg",
+	".mpp":       "application/vndms-project",
+	".mpt":       "application/x-project",
+	".mpv":       "application/x-project",
+	".mpx":       "application/x-project",
+	".mrc":       "application/marc",
+	".ms":        "application/x-troff-ms",
+	".mv":        "video/x-sgi-movie",
+	".my":        "audio/make",
+	".mzz":       "application/x-vndaudioexplosionmzz",
+	".nap":       "image/naplps",
+	".naplps":    "image/naplps",
+	".nc":        "application/x-netcdf",
+	".ncm":       "application/vndnokiaconfiguration-message",
+	".nif":       "image/x-niff",
+	".niff":      "image/x-niff",
+	".nix":       "application/x-mix-transfer",
+	".nsc":       "application/x-conference",
+	".nvd":       "application/x-navidoc",
+	".o":         "application/octet-stream",
+	".oda":       "application/oda",
+	".odb":       "application/vnd.oasis.opendocument.database",
+	".odc":       "application/vnd.oasis.opendocument.chart",
+	".odf":       "application/vnd.oasis.opendocument.formula",
+	".odg":       "application/vnd.oasis.opendocument.graphics",
+	".odi":       "application/vnd.oasis.opendocument.image",
+	".odm":       "application/vnd.oasis.opendocument.text-master",
+	".odp":       "application/vnd.oasis.opendocument.presentation",
+	".ods":       "application/vnd.oasis.opendocument.spreadsheet",
+	".odt":       "application/vnd.oasis.opendocument.text",
+	".oga":       "audio/ogg",
+	".ogg":       "audio/ogg",
+	".ogv":       "video/ogg",
+	".omc":       "application/x-omc",
+	".omcd":      "application/x-omcdatamaker",
+	".omcr":      "application/x-omcregerator",
+	".otc":       "application/vnd.oasis.opendocument.chart-template",
+	".otf":       "application/vnd.oasis.opendocument.formula-template",
+	".otg":       "application/vnd.oasis.opendocument.graphics-template",
+	".oth":       "application/vnd.oasis.opendocument.text-web",
+	".oti":       "application/vnd.oasis.opendocument.image-template",
+	".otm":       "application/vnd.oasis.opendocument.text-master",
+	".otp":       "application/vnd.oasis.opendocument.presentation-template",
+	".ots":       "application/vnd.oasis.opendocument.spreadsheet-template",
+	".ott":       "application/vnd.oasis.opendocument.text-template",
+	".p10":       "application/pkcs10",
+	".p12":       "application/pkcs-12",
+	".p7a":       "application/x-pkcs7-signature",
+	".p7c":       "application/pkcs7-mime",
+	".p7m":       "application/pkcs7-mime",
+	".p7r":       "application/x-pkcs7-certreqresp",
+	".p7s":       "application/pkcs7-signature",
+	".p":         "text/x-pascal",
+	".part":      "application/pro_eng",
+	".pas":       "text/pascal",
+	".pbm":       "image/x-portable-bitmap",
+	".pcl":       "application/vndhp-pcl",
+	".pct":       "image/x-pict",
+	".pcx":       "image/x-pcx",
+	".pdb":       "chemical/x-pdb",
+	".pdf":       "application/pdf",
+	".pfunk":     "audio/make",
+	".pgm":       "image/x-portable-graymap",
+	".pic":       "image/pict",
+	".pict":      "image/pict",
+	".pkg":       "application/x-newton-compatible-pkg",
+	".pko":       "application/vndms-pkipko",
+	".pl":        "text/x-scriptperl",
+	".plx":       "application/x-pixclscript",
+	".pm4":       "application/x-pagemaker",
+	".pm5":       "application/x-pagemaker",
+	".pm":        "text/x-scriptperl-module",
+	".png":       "image/png",
+	".pnm":       "application/x-portable-anymap",
+	".pot":       "application/mspowerpoint",
+	".pov":       "model/x-pov",
+	".ppa":       "application/vndms-powerpoint",
+	".ppm":       "image/x-portable-pixmap",
+	".pps":       "application/mspowerpoint",
+	".ppt":       "application/mspowerpoint",
+	".ppz":       "application/mspowerpoint",
+	".pre":       "application/x-freelance",
+	".prt":       "application/pro_eng",
+	".ps":        "application/postscript",
+	".psd":       "application/octet-stream",
+	".pvu":       "paleovu/x-pv",
+	".pwz":       "application/vndms-powerpoint",
+	".py":        "text/x-scriptphyton",
+	".pyc":       "application/x-bytecodepython",
+	".qcp":       "audio/vndqcelp",
+	".qd3":       "x-world/x-3dmf",
+	".qd3d":      "x-world/x-3dmf",
+	".qif":       "image/x-quicktime",
+	".qt":        "video/quicktime",
+	".qtc":       "video/x-qtc",
+	".qti":       "image/x-quicktime",
+	".qtif":      "image/x-quicktime",
+	".ra":        "audio/x-pn-realaudio",
+	".ram":       "audio/x-pn-realaudio",
+	".rar":       "application/x-rar-compressed",
+	".ras":       "application/x-cmu-raster",
+	".rast":      "image/cmu-raster",
+	".rexx":      "text/x-scriptrexx",
+	".rf":        "image/vndrn-realflash",
+	".rgb":       "image/x-rgb",
+	".rm":        "application/vndrn-realmedia",
+	".rmi":       "audio/mid",
+	".rmm":       "audio/x-pn-realaudio",
+	".rmp":       "audio/x-pn-realaudio",
+	".rng":       "application/ringing-tones",
+	".rnx":       "application/vndrn-realplayer",
+	".roff":      "application/x-troff",
+	".rp":        "image/vndrn-realpix",
+	".rpm":       "audio/x-pn-realaudio-plugin",
+	".rt":        "text/vndrn-realtext",
+	".rtf":       "text/richtext",
+	".rtx":       "text/richtext",
+	".rv":        "video/vndrn-realvideo",
+	".s":         "text/x-asm",
+	".s3m":       "audio/s3m",
+	".s7z":       "application/x-7z-compressed",
+	".saveme":    "application/octet-stream",
+	".sbk":       "application/x-tbook",
+	".scm":       "text/x-scriptscheme",
+	".sdml":      ContentTextHeaderValue,
+	".sdp":       "application/sdp",
+	".sdr":       "application/sounder",
+	".sea":       "application/sea",
+	".set":       "application/set",
+	".sgm":       "text/x-sgml",
+	".sgml":      "text/x-sgml",
+	".sh":        "text/x-scriptsh",
+	".shar":      "application/x-bsh",
+	".shtml":     "text/x-server-parsed-html",
+	".sid":       "audio/x-psid",
+	".skd":       "application/x-koan",
+	".skm":       "application/x-koan",
+	".skp":       "application/x-koan",
+	".skt":       "application/x-koan",
+	".sit":       "application/x-stuffit",
+	".sitx":      "application/x-stuffitx",
+	".sl":        "application/x-seelogo",
+	".smi":       "application/smil",
+	".smil":      "application/smil",
+	".snd":       "audio/basic",
+	".sol":       "application/solids",
+	".spc":       "text/x-speech",
+	".spl":       "application/futuresplash",
+	".spr":       "application/x-sprite",
+	".sprite":    "application/x-sprite",
+	".spx":       "audio/ogg",
+	".src":       "application/x-wais-source",
+	".srt":       "text/plain",
+	".sbv":       "text/plain",
+	".ssa":       "text/plain",
+	".ssi":       "text/x-server-parsed-html",
+	".ssm":       "application/streamingmedia",
+	".sst":       "application/vndms-pkicertstore",
+	".step":      "application/step",
+	".stl":       "application/sla",
+	".stp":       "application/step",
+	".sv4cpio":   "application/x-sv4cpio",
+	".sv4crc":    "application/x-sv4crc",
+	".svf":       "image/vnddwg",
+	".svg":       "image/svg+xml",
+	".svr":       "application/x-world",
+	".swf":       "application/x-shockwave-flash",
+	".t":         "application/x-troff",
+	".talk":      "text/x-speech",
+	".tar":       "application/x-tar",
+	".tbk":       "application/toolbook",
+	".tcl":       "text/x-scripttcl",
+	".tcsh":      "text/x-scripttcsh",
+	".tex":       "application/x-tex",
+	".texi":      "application/x-texinfo",
+	".texinfo":   "application/x-texinfo",
+	".text":      ContentTextHeaderValue,
+	".tgz":       "application/gnutar",
+	".tif":       "image/tiff",
+	".tiff":      "image/tiff",
+	".tr":        "application/x-troff",
+	".tsi":       "audio/tsp-audio",
+	".tsp":       "application/dsptype",
+	".tsv":       "text/tab-separated-values",
+	".turbot":    "image/florian",
+	".txt":       ContentTextHeaderValue,
+	".uil":       "text/x-uil",
+	".uni":       "text/uri-list",
+	".unis":      "text/uri-list",
+	".unv":       "application/i-deas",
+	".uri":       "text/uri-list",
+	".uris":      "text/uri-list",
+	".ustar":     "application/x-ustar",
+	".uu":        "text/x-uuencode",
+	".uue":       "text/x-uuencode",
+	".vcd":       "application/x-cdlink",
+	".vcf":       "text/x-vcard",
+	".vcard":     "text/x-vcard",
+	".vcs":       "text/x-vcalendar",
+	".vda":       "application/vda",
+	".vdo":       "video/vdo",
+	".vew":       "application/groupwise",
+	".viv":       "video/vivo",
+	".vivo":      "video/vivo",
+	".vmd":       "application/vocaltec-media-desc",
+	".vmf":       "application/vocaltec-media-file",
+	".voc":       "audio/voc",
+	".vos":       "video/vosaic",
+	".vox":       "audio/voxware",
+	".vqe":       "audio/x-twinvq-plugin",
+	".vqf":       "audio/x-twinvq",
+	".vql":       "audio/x-twinvq-plugin",
+	".vrml":      "application/x-vrml",
+	".vrt":       "x-world/x-vrt",
+	".vsd":       "application/x-visio",
+	".vst":       "application/x-visio",
+	".vsw":       "application/x-visio",
+	".w60":       "application/wordperfect60",
+	".w61":       "application/wordperfect61",
+	".w6w":       "application/msword",
+	".wav":       "audio/wav",
+	".wb1":       "application/x-qpro",
+	".wbmp":      "image/vnd.wap.wbmp",
+	".web":       "application/vndxara",
+	".wiz":       "application/msword",
+	".wk1":       "application/x-123",
+	".wmf":       "windows/metafile",
+	".wml":       "text/vnd.wap.wml",
+	".wmlc":      "application/vnd.wap.wmlc",
+	".wmls":      "text/vnd.wap.wmlscript",
+	".wmlsc":     "application/vnd.wap.wmlscriptc",
+	".word":      "application/msword",
+	".wp5":       "application/wordperfect",
+	".wp6":       "application/wordperfect",
+	".wp":        "application/wordperfect",
+	".wpd":       "application/wordperfect",
+	".wq1":       "application/x-lotus",
+	".wri":       "application/mswrite",
+	".wrl":       "application/x-world",
+	".wrz":       "model/vrml",
+	".wsc":       "text/scriplet",
+	".wsrc":      "application/x-wais-source",
+	".wtk":       "application/x-wintalk",
+	".x-png":     "image/png",
+	".xbm":       "image/x-xbitmap",
+	".xdr":       "video/x-amt-demorun",
+	".xgz":       "xgl/drawing",
+	".xif":       "image/vndxiff",
+	".xl":        "application/excel",
+	".xla":       "application/excel",
+	".xlb":       "application/excel",
+	".xlc":       "application/excel",
+	".xld":       "application/excel",
+	".xlk":       "application/excel",
+	".xll":       "application/excel",
+	".xlm":       "application/excel",
+	".xls":       "application/excel",
+	".xlt":       "application/excel",
+	".xlv":       "application/excel",
+	".xlw":       "application/excel",
+	".xm":        "audio/xm",
+	".xml":       ContentXMLHeaderValue,
+	".xmz":       "xgl/movie",
+	".xpix":      "application/x-vndls-xpix",
+	".xpm":       "image/x-xpixmap",
+	".xsr":       "video/x-amt-showrun",
+	".xwd":       "image/x-xwd",
+	".xyz":       "chemical/x-pdb",
+	".z":         "application/x-compress",
+	".zip":       "application/zip",
+	".zoo":       "application/octet-stream",
+	".zsh":       "text/x-scriptzsh",
+	".docx":      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	".docm":      "application/vnd.ms-word.document.macroEnabled.12",
+	".dotx":      "application/vnd.openxmlformats-officedocument.wordprocessingml.template",
+	".dotm":      "application/vnd.ms-word.template.macroEnabled.12",
+	".xlsx":      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	".xlsm":      "application/vnd.ms-excel.sheet.macroEnabled.12",
+	".xltx":      "application/vnd.openxmlformats-officedocument.spreadsheetml.template",
+	".xltm":      "application/vnd.ms-excel.template.macroEnabled.12",
+	".xlsb":      "application/vnd.ms-excel.sheet.binary.macroEnabled.12",
+	".xlam":      "application/vnd.ms-excel.addin.macroEnabled.12",
+	".pptx":      "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	".pptm":      "application/vnd.ms-powerpoint.presentation.macroEnabled.12",
+	".ppsx":      "application/vnd.openxmlformats-officedocument.presentationml.slideshow",
+	".ppsm":      "application/vnd.ms-powerpoint.slideshow.macroEnabled.12",
+	".potx":      "application/vnd.openxmlformats-officedocument.presentationml.template",
+	".potm":      "application/vnd.ms-powerpoint.template.macroEnabled.12",
+	".ppam":      "application/vnd.ms-powerpoint.addin.macroEnabled.12",
+	".sldx":      "application/vnd.openxmlformats-officedocument.presentationml.slide",
+	".sldm":      "application/vnd.ms-powerpoint.slide.macroEnabled.12",
+	".thmx":      "application/vnd.ms-officetheme",
+	".onetoc":    "application/onenote",
+	".onetoc2":   "application/onenote",
+	".onetmp":    "application/onenote",
+	".onepkg":    "application/onenote",
+	".xpi":       "application/x-xpinstall",
+	".wasm":      "application/wasm",
+	".m4a":       "audio/mp4",
+	".flac":      "audio/x-flac",
+	".amr":       "audio/amr",
+	".aac":       "audio/aac",
+	".opus":      "video/ogg",
+	".m4v":       "video/mp4",
+	".mkv":       "video/x-matroska",
+	".caf":       "audio/x-caf",
+	".m3u8":      "application/x-mpegURL",
+	".mpd":       "application/dash+xml",
+	".webp":      "image/webp",
+	".epub":      "application/epub+zip",
+}
+
+//nolint:gochecknoinits
+func init() {
+	for ext, typ := range types {
+		// skip errors
+		_ = mime.AddExtensionType(ext, typ)
+	}
+}

backend/adapters/fs/files/user.go

@@ -0,0 +1,64 @@
+package files
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// MakeUserDir makes the user directory according to settings.
+func MakeUserDir(fullPath string) error {
+	if err := os.MkdirAll(fullPath, os.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func MakeUserDirs(u *users.User, disableScopeChange bool) error {
+	cleanedUserName := users.CleanUsername(u.Username)
+	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
+		return fmt.Errorf("create user: invalid user for home dir creation: [%s]", u.Username)
+	}
+	for i, scope := range u.Scopes {
+		source, ok := settings.Config.Server.SourceMap[scope.Name]
+		if !ok {
+			return fmt.Errorf("create user: source not found: %s", scope.Name)
+		}
+		// create directory and append user name
+		if filepath.Base(scope.Scope) != cleanedUserName && source.Config.CreateUserDir && !disableScopeChange {
+			fullPath := filepath.Join(source.Path, scope.Scope, cleanedUserName)
+			parentDir := filepath.Join(source.Path, scope.Scope)
+			// validate that scope path exists
+			if !Exists(parentDir) {
+				return fmt.Errorf("create user: scope path does not exist: %s", scope.Scope)
+			}
+			scope.Scope = filepath.Join(scope.Scope, cleanedUserName)
+			err := MakeUserDir(fullPath)
+			if err != nil {
+				return fmt.Errorf("create user: failed to create user home dir: %s", err)
+			}
+		} else if filepath.Base(scope.Scope) == cleanedUserName && source.Config.CreateUserDir {
+			// create directory exactly as specified
+			fullPath := filepath.Join(source.Path, scope.Scope)
+			parentDir := filepath.Dir(fullPath)
+			if !Exists(parentDir) {
+				return fmt.Errorf("create user: scope folder does not exist: %s", parentDir)
+			}
+			err := MakeUserDir(fullPath)
+			if err != nil {
+				return fmt.Errorf("create user: failed to create user home dir: %s", err)
+			}
+		} else {
+			// just assigning scope to path provided, so just check that it exists
+			path := filepath.Join(source.Path, scope.Scope)
+			if !Exists(path) {
+				return fmt.Errorf("create user: scope folder does not exist: %s", path)
+			}
+		}
+		u.Scopes[i] = scope
+	}
+	return nil
+}

backend/adapters/fs/fileutils/copy.go

@@ -0,0 +1,39 @@
+package fileutils
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// Copy copies a file or folder from one place to another.
+func CopyHelper(src, dst string) error {
+	src = filepath.Clean(src)
+	if src == "" {
+		return os.ErrNotExist
+	}
+
+	dst = filepath.Clean(dst)
+	if dst == "" {
+		return os.ErrNotExist
+	}
+
+	if src == "/" || dst == "/" {
+		// Prohibit copying from or to the root directory.
+		return os.ErrInvalid
+	}
+
+	if dst == src {
+		return os.ErrInvalid
+	}
+
+	info, err := os.Stat(src)
+	if err != nil {
+		return err
+	}
+
+	if info.IsDir() {
+		return CopyDir(src, dst)
+	}
+
+	return CopyFile(src, dst)
+}

backend/adapters/fs/fileutils/dir.go

@@ -2,27 +2,32 @@ package fileutils
 
 import (
 	"errors"
-
-	"github.com/spf13/afero"
+	"os"
+	"path/filepath"
 )
 
 // CopyDir copies a directory from source to dest and all
 // of its sub-directories. It doesn't stop if it finds an error
 // during the copy. Returns an error if any.
-func CopyDir(fs afero.Fs, source, dest string) error {
+func CopyDir(source, dest string) error {
 	// Get properties of source.
-	srcinfo, err := fs.Stat(source)
+	srcinfo, err := os.Stat(source)
 	if err != nil {
 		return err
 	}
 
 	// Create the destination directory.
-	err = fs.MkdirAll(dest, srcinfo.Mode())
+	err = os.MkdirAll(dest, srcinfo.Mode())
 	if err != nil {
 		return err
 	}
 
-	dir, _ := fs.Open(source)
+	dir, err := os.Open(source)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+
 	obs, err := dir.Readdir(-1)
 	if err != nil {
 		return err
@@ -31,18 +36,18 @@ func CopyDir(fs afero.Fs, source, dest string) error {
 	var errs []error
 
 	for _, obj := range obs {
-		fsource := source + "/" + obj.Name()
-		fdest := dest + "/" + obj.Name()
+		fsource := filepath.Join(source, obj.Name())
+		fdest := filepath.Join(dest, obj.Name())
 
 		if obj.IsDir() {
 			// Create sub-directories, recursively.
-			err = CopyDir(fs, fsource, fdest)
+			err = CopyDir(fsource, fdest)
 			if err != nil {
 				errs = append(errs, err)
 			}
 		} else {
 			// Perform the file copy.
-			err = CopyFile(fs, fsource, fdest)
+			err = CopyFile(fsource, fdest)
 			if err != nil {
 				errs = append(errs, err)
 			}

backend/adapters/fs/fileutils/file.go

@@ -0,0 +1,194 @@
+package fileutils
+
+import (
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// MoveFile moves a file from src to dst.
+// By default, the rename system call is used. If src and dst point to different volumes,
+// the file copy is used as a fallback.
+func MoveFile(src, dst string) error {
+	err := os.Rename(src, dst)
+	if err == nil {
+		return nil
+	}
+
+	// fallback
+	err = CopyFile(src, dst)
+	if err != nil {
+		logger.Errorf("CopyFile failed %v %v %v ", src, dst, err)
+		return err
+	}
+
+	go func() {
+		err = os.RemoveAll(src)
+		if err != nil {
+			logger.Errorf("os.Remove failed %v %v ", src, err)
+		}
+	}()
+
+	return nil
+}
+
+// CopyFile copies a file or directory from source to dest and returns an error if any.
+func CopyFile(source, dest string) error {
+	// Check if the source exists and whether it's a file or directory.
+	info, err := os.Stat(source)
+	if err != nil {
+		return err
+	}
+
+	if info.IsDir() {
+		// If the source is a directory, copy it recursively.
+		return copyDirectory(source, dest)
+	}
+
+	// If the source is a file, copy the file.
+	return copySingleFile(source, dest)
+}
+
+// copySingleFile handles copying a single file.
+func copySingleFile(source, dest string) error {
+	// Open the source file.
+	src, err := os.Open(source)
+	if err != nil {
+		return err
+	}
+	defer src.Close()
+
+	// Create the destination directory if needed.
+	err = os.MkdirAll(filepath.Dir(dest), 0775) //nolint:gomnd
+	if err != nil {
+		return err
+	}
+
+	// Create the destination file.
+	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0666) //nolint:gomnd
+	if err != nil {
+		return err
+	}
+	defer dst.Close()
+
+	// Copy the contents of the file.
+	_, err = io.Copy(dst, src)
+	if err != nil {
+		return err
+	}
+
+	// Copy the mode.
+	info, err := os.Stat(source)
+	if err != nil {
+		return err
+	}
+	err = os.Chmod(dest, info.Mode())
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// copyDirectory handles copying directories recursively.
+func copyDirectory(source, dest string) error {
+	// Create the destination directory.
+	err := os.MkdirAll(dest, 0775) //nolint:gomnd
+	if err != nil {
+		return err
+	}
+
+	// Read the contents of the source directory.
+	entries, err := os.ReadDir(source)
+	if err != nil {
+		return err
+	}
+
+	// Iterate over each entry in the directory.
+	for _, entry := range entries {
+		srcPath := filepath.Join(source, entry.Name())
+		destPath := filepath.Join(dest, entry.Name())
+
+		if entry.IsDir() {
+			// Recursively copy subdirectories.
+			err = copyDirectory(srcPath, destPath)
+			if err != nil {
+				return err
+			}
+		} else {
+			// Copy files.
+			err = copySingleFile(srcPath, destPath)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// CommonPrefix returns the common directory path of provided files.
+func CommonPrefix(sep byte, paths ...string) string {
+	// Handle special cases.
+	switch len(paths) {
+	case 0:
+		return ""
+	case 1:
+		return path.Clean(paths[0])
+	}
+
+	// Treat string as []byte, not []rune as is often done in Go.
+	c := []byte(path.Clean(paths[0]))
+
+	// Add a trailing sep to handle the case where the common prefix directory
+	// is included in the path list.
+	c = append(c, sep)
+
+	// Ignore the first path since it's already in c.
+	for _, v := range paths[1:] {
+		// Clean up each path before testing it.
+		v = path.Clean(v) + string(sep)
+
+		// Find the first non-common byte and truncate c.
+		if len(v) < len(c) {
+			c = c[:len(v)]
+		}
+		for i := 0; i < len(c); i++ {
+			if v[i] != c[i] {
+				c = c[:i]
+				break
+			}
+		}
+	}
+
+	// Remove trailing non-separator characters and the final separator.
+	for i := len(c) - 1; i >= 0; i-- {
+		if c[i] == sep {
+			c = c[:i]
+			break
+		}
+	}
+
+	return string(c)
+}
+
+func ClearCacheDir() {
+	cacheDir := settings.Config.Server.CacheDir
+	entries, err := os.ReadDir(cacheDir)
+	if err != nil {
+		logger.Errorf("failed clear cache dir: %v", err)
+	}
+
+	for _, entry := range entries {
+		path := filepath.Join(cacheDir, entry.Name())
+		err = os.RemoveAll(path)
+		if err != nil {
+			logger.Errorf("failed clear cache dir: %v", err)
+		}
+	}
+
+}

backend/auth/auth.go

@@ -2,14 +2,31 @@ package auth
 
 import (
 	"net/http"
+	"sync"
 
-	"github.com/gtsteffaniak/filebrowser/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+var (
+	revokedApiKeyList map[string]bool
+	revokeMu          sync.Mutex
 )
 
 // Auther is the authentication interface.
 type Auther interface {
 	// Auth is called to authenticate a request.
-	Auth(r *http.Request, usr users.Store) (*users.User, error)
+	Auth(r *http.Request, userStore *users.Storage) (*users.User, error)
 	// LoginPage indicates if this auther needs a login page.
 	LoginPage() bool
 }
+
+func IsRevokedApiKey(key string) bool {
+	_, exists := revokedApiKeyList[key]
+	return exists
+}
+
+func RevokeAPIKey(key string) {
+	revokeMu.Lock()
+	delete(revokedApiKeyList, key)
+	revokeMu.Unlock()
+}

backend/auth/hook.go

@@ -3,15 +3,15 @@ package auth
 import (
 	"encoding/json"
 	"fmt"
-	"log"
 	"net/http"
 	"os"
 	"os/exec"
 	"strings"
 
-	"github.com/gtsteffaniak/filebrowser/errors"
-	"github.com/gtsteffaniak/filebrowser/settings"
-	"github.com/gtsteffaniak/filebrowser/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
 )
 
 type hookCred struct {
@@ -30,15 +30,15 @@ type HookAuth struct {
 }
 
 // Auth authenticates the user via a json in content body.
-func (a *HookAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
+func (a *HookAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
 	var cred hookCred
-
 	if r.Body == nil {
 		return nil, os.ErrPermission
 	}
 
 	err := json.NewDecoder(r.Body).Decode(&cred)
 	if err != nil {
+		logger.Error("decode body error")
 		return nil, os.ErrPermission
 	}
 
@@ -51,6 +51,7 @@ func (a *HookAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
 	if err != nil {
 		return nil, err
 	}
+	logger.Debugf("hook auth %v", action)
 
 	switch action {
 	case "auth":
@@ -60,11 +61,19 @@ func (a *HookAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
 		}
 		return u, nil
 	case "block":
+		logger.Error("block error")
+
 		return nil, os.ErrPermission
 	case "pass":
-		u, err := a.Users.Get(a.Server.Root, a.Cred.Username)
-		if err != nil || !users.CheckPwd(a.Cred.Password, u.Password) {
-			return nil, os.ErrPermission
+		logger.Error("pass error")
+
+		u, err := a.Users.Get(a.Cred.Username)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get user from store: %v", err)
+		}
+		err = users.CheckPwd(cred.Password, u.Password)
+		if err != nil {
+			return nil, err
 		}
 		return u, nil
 	default:
@@ -139,43 +148,41 @@ func (a *HookAuth) GetValues(s string) {
 
 // SaveUser updates the existing user or creates a new one when not found
 func (a *HookAuth) SaveUser() (*users.User, error) {
-	u, err := a.Users.Get(a.Server.Root, a.Cred.Username)
+	u, err := a.Users.Get(a.Cred.Username)
 	if err != nil && err != errors.ErrNotExist {
 		return nil, err
 	}
 
 	if u == nil {
-		log.Println("creds", a.Cred.Password)
 		// create user with the provided credentials
 		d := &users.User{
-			Username:     a.Cred.Username,
-			Password:     a.Cred.Password,
-			Scope:        a.Settings.UserDefaults.Scope,
-			Locale:       a.Settings.UserDefaults.Locale,
-			ViewMode:     a.Settings.UserDefaults.ViewMode,
-			SingleClick:  a.Settings.UserDefaults.SingleClick,
-			Sorting:      a.Settings.UserDefaults.Sorting,
-			Perm:         a.Settings.UserDefaults.Perm,
-			Commands:     a.Settings.UserDefaults.Commands,
-			HideDotfiles: a.Settings.UserDefaults.HideDotfiles,
+			NonAdminEditable: users.NonAdminEditable{
+				Password:    a.Cred.Password,
+				Locale:      a.Settings.UserDefaults.Locale,
+				ViewMode:    a.Settings.UserDefaults.ViewMode,
+				SingleClick: a.Settings.UserDefaults.SingleClick,
+				ShowHidden:  a.Settings.UserDefaults.ShowHidden,
+			},
+			Username:    a.Cred.Username,
+			Permissions: a.Settings.UserDefaults.Permissions,
 		}
 		u = a.GetUser(d)
 
-		userHome, err := a.Settings.MakeUserDir(u.Username, u.Scope, a.Server.Root)
-		if err != nil {
-			return nil, fmt.Errorf("user: failed to mkdir user home dir: [%s]", userHome)
-		}
-		u.Scope = userHome
-		log.Printf("user: %s, home dir: [%s].", u.Username, userHome)
-
-		err = a.Users.Save(u)
+		err = a.Users.Save(u, false, false)
 		if err != nil {
 			return nil, err
 		}
-	} else if p := !users.CheckPwd(a.Cred.Password, u.Password); len(a.Fields.Values) > 1 || p {
+		return u, nil
+	}
+	err = users.CheckPwd(a.Cred.Password, u.Password)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(a.Fields.Values) > 1 {
 		u = a.GetUser(u)
 		// update user with provided fields
-		err := a.Users.Update(u)
+		err := a.Users.Update(u, u.Permissions.Admin)
 		if err != nil {
 			return nil, err
 		}
@@ -187,32 +194,24 @@ func (a *HookAuth) SaveUser() (*users.User, error) {
 // GetUser returns a User filled with hook values or provided defaults
 func (a *HookAuth) GetUser(d *users.User) *users.User {
 	// adds all permissions when user is admin
-	isAdmin := d.Perm.Admin
+	isAdmin := d.Permissions.Admin
 	perms := users.Permissions{
-		Admin:    isAdmin,
-		Execute:  isAdmin || d.Perm.Execute,
-		Create:   isAdmin || d.Perm.Create,
-		Rename:   isAdmin || d.Perm.Rename,
-		Modify:   isAdmin || d.Perm.Modify,
-		Delete:   isAdmin || d.Perm.Delete,
-		Share:    isAdmin || d.Perm.Share,
-		Download: isAdmin || d.Perm.Download,
+		Admin:  isAdmin,
+		Modify: isAdmin || d.Permissions.Modify,
+		Share:  isAdmin || d.Permissions.Share,
 	}
 	user := users.User{
-		ID:          d.ID,
-		Username:    d.Username,
-		Password:    d.Password,
-		Scope:       d.Scope,
-		Locale:      d.Locale,
-		ViewMode:    d.ViewMode,
-		SingleClick: d.SingleClick,
-		Sorting: users.Sorting{
-			Asc: d.Sorting.Asc,
-			By:  d.Sorting.By,
+		NonAdminEditable: users.NonAdminEditable{
+			Password:    d.Password,
+			Locale:      a.Fields.GetString("user.locale", d.Locale),
+			ViewMode:    a.Fields.GetString("user.viewMode", d.ViewMode),
+			SingleClick: a.Fields.GetBoolean("user.singleClick", d.SingleClick),
+			ShowHidden:  a.Fields.GetBoolean("user.showHidden", d.ShowHidden),
 		},
-		Commands:     d.Commands,
-		HideDotfiles: d.HideDotfiles,
-		Perm:         perms,
+		ID:           d.ID,
+		Username:     d.Username,
+		Scopes:       d.Scopes,
+		Permissions:  perms,
 		LockPassword: true,
 	}
 
@@ -233,16 +232,11 @@ var validHookFields = []string{
 	"user.singleClick",
 	"user.sorting.by",
 	"user.sorting.asc",
-	"user.commands",
-	"user.hideDotfiles",
+	"user.showHidden",
 	"user.perm.admin",
-	"user.perm.execute",
-	"user.perm.create",
-	"user.perm.rename",
 	"user.perm.modify",
-	"user.perm.delete",
 	"user.perm.share",
-	"user.perm.download",
+	"user.perm.api",
 }
 
 // IsValid checks if the provided field is on the valid fields list

backend/auth/json.go

@@ -2,42 +2,32 @@ package auth
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/url"
 	"os"
 	"strings"
 
-	"github.com/gtsteffaniak/filebrowser/settings"
-	"github.com/gtsteffaniak/filebrowser/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
 )
 
-type jsonCred struct {
-	Password  string `json:"password"`
-	Username  string `json:"username"`
-	ReCaptcha string `json:"recaptcha"`
-}
-
 // JSONAuth is a json implementation of an Auther.
 type JSONAuth struct {
 	ReCaptcha *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
 }
 
 // Auth authenticates the user via a json in content body.
-func (a JSONAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
-	config := &settings.Config
-	var cred jsonCred
-
-	if r.Body == nil {
-		return nil, os.ErrPermission
-	}
-	err := json.NewDecoder(r.Body).Decode(&cred)
-	if err != nil {
-		return nil, os.ErrPermission
-	}
+func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.User, error) {
+	username := r.URL.Query().Get("username")
+	recaptcha := r.URL.Query().Get("recaptcha")
+	password := r.Header.Get("X-Password")
+	totpCode := r.Header.Get("X-Secret")
 
 	// If ReCaptcha is enabled, check the code.
-	if a.ReCaptcha != nil && len(a.ReCaptcha.Secret) > 0 {
-		ok, err := a.ReCaptcha.Ok(cred.ReCaptcha) //nolint:govet
+	if auther.ReCaptcha != nil && len(auther.ReCaptcha.Secret) > 0 {
+		ok, err := auther.ReCaptcha.Ok(recaptcha) //nolint:govet
 
 		if err != nil {
 			return nil, err
@@ -48,12 +38,40 @@ func (a JSONAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
 		}
 	}
 
-	u, err := usr.Get(config.Server.Root, cred.Username)
-	if err != nil || !users.CheckPwd(cred.Password, u.Password) {
-		return nil, os.ErrPermission
+	user, err := userStore.Get(username)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get user from store: %v", err)
+	}
+	err = users.CheckPwd(password, user.Password)
+	if err != nil {
+		return nil, err
 	}
 
-	return u, nil
+	// check for OTP for password
+	if user.TOTPSecret != "" {
+		if totpCode == "" {
+			return nil, errors.ErrNoTotpProvided
+		}
+		err = VerifyTotpCode(user, totpCode, userStore)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if user.LoginMethod != users.LoginMethodPassword {
+		logger.Warningf("user %s is not allowed to login with password authentication, bypassing and updating login method", user.Username)
+		user.LoginMethod = users.LoginMethodPassword
+		// Perform the user update
+		err = userStore.Update(user, true, "LoginMethod")
+		if err != nil {
+			logger.Debug(err.Error())
+		}
+		//http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+		//return
+	}
+
+	return user, nil
+
 }
 
 // LoginPage tells that json auth doesn't require a login page.

backend/auth/none.go

@@ -3,8 +3,7 @@ package auth
 import (
 	"net/http"
 
-	"github.com/gtsteffaniak/filebrowser/settings"
-	"github.com/gtsteffaniak/filebrowser/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // MethodNoAuth is used to identify no auth.
@@ -14,8 +13,8 @@ const MethodNoAuth = "noauth"
 type NoAuth struct{}
 
 // Auth uses authenticates user 1.
-func (a NoAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
-	return usr.Get(settings.Config.Server.Root, uint(1))
+func (a NoAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
+	return usr.Get(uint(1))
 }
 
 // LoginPage tells that no auth doesn't require a login page.

backend/auth/proxy.go

@@ -4,10 +4,8 @@ import (
 	"net/http"
 	"os"
 
-	"github.com/gtsteffaniak/filebrowser/settings"
-
-	"github.com/gtsteffaniak/filebrowser/errors"
-	"github.com/gtsteffaniak/filebrowser/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // MethodProxyAuth is used to identify no auth.
@@ -19,9 +17,9 @@ type ProxyAuth struct {
 }
 
 // Auth authenticates the user via an HTTP header.
-func (a ProxyAuth) Auth(r *http.Request, usr users.Store) (*users.User, error) {
+func (a ProxyAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
 	username := r.Header.Get(a.Header)
-	user, err := usr.Get(settings.Config.Server.Root, username)
+	user, err := usr.Get(username)
 	if err == errors.ErrNotExist {
 		return nil, os.ErrPermission
 	}

backend/auth/storage.go

@@ -1,7 +1,11 @@
 package auth
 
 import (
-	"github.com/gtsteffaniak/filebrowser/users"
+	"encoding/base64"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
 )
 
 // StorageBackend is a storage backend for auth storage.
@@ -17,8 +21,29 @@ type Storage struct {
 }
 
 // NewStorage creates a auth storage from a backend.
-func NewStorage(back StorageBackend, userStore *users.Storage) *Storage {
-	return &Storage{back: back, users: userStore}
+func NewStorage(back StorageBackend, userStore *users.Storage) (*Storage, error) {
+	store := &Storage{back: back, users: userStore}
+	err := store.Save(&JSONAuth{})
+	if err != nil {
+		return nil, err
+	}
+	err = store.Save(&ProxyAuth{})
+	if err != nil {
+		return nil, err
+	}
+	err = store.Save(&HookAuth{})
+	if err != nil {
+		return nil, err
+	}
+	err = store.Save(&NoAuth{})
+	if err != nil {
+		return nil, err
+	}
+	encryptionKey, err = base64.StdEncoding.DecodeString(settings.Config.Auth.TotpSecret)
+	if err != nil {
+		logger.Warning("failed to decode TOTP secret, using default key. This is insecure and should be fixed.")
+	}
+	return store, nil
 }
 
 // Get wraps a StorageBackend.Get.

backend/auth/totp.go

@@ -0,0 +1,203 @@
+package auth
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"strings"
+	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-cache/cache"
+	"github.com/gtsteffaniak/go-logger/logger"
+	"github.com/pquerna/otp"
+	"github.com/pquerna/otp/totp"
+)
+
+// Constants for TOTP (Time-based One-Time Password) configuration.
+const (
+	// IssuerName is the name of the application or service.
+	IssuerName = "FileBrowser Quantum"
+
+	// TokenValidTime defines the total duration a token is considered valid.
+	// Note: The actual validation window might be slightly longer depending on the period.
+	TokenValidTime = time.Minute * 2
+
+	// TOTPPeriod is the standard duration in seconds that a TOTP code is valid.
+	TOTPPeriod uint = 30
+
+	// TOTPSecretSize is the byte length of the shared secret.
+	TOTPSecretSize uint = 20
+
+	// TOTPDigits specifies the number of digits in the OTP code.
+	TOTPDigits = otp.DigitsSix
+
+	// TOTPAlgorithm is the hashing algorithm to use.
+	TOTPAlgorithm = otp.AlgorithmSHA1
+)
+
+var (
+	// TOTPSkew allows for a certain number of periods of clock drift.
+	// We calculate it to best match the TokenValidTime.
+	// (2 * Skew + 1) * Period >= TokenValidTime
+	// For a 2-minute (120s) window with a 30s period, we need a Skew of 2.
+	// (2*2 + 1) * 30s = 150s (2.5 minutes). This is the closest we can get.
+	TOTPSkew      uint = uint(TokenValidTime.Seconds()) / (2 * uint(TOTPPeriod))
+	encryptionKey []byte
+	TotpCache     = cache.NewCache(5 * time.Minute)
+)
+
+func GenerateOtpForUser(user *users.User, userStore *users.Storage) (string, error) {
+	// Generate a new TOTP key using the defined constants.
+	key, err := totp.Generate(totp.GenerateOpts{
+		Issuer:      IssuerName,
+		AccountName: user.Username,
+		Period:      TOTPPeriod,
+		SecretSize:  TOTPSecretSize,
+		Digits:      TOTPDigits,
+		Algorithm:   TOTPAlgorithm,
+	})
+	if err != nil {
+		return "", fmt.Errorf("error generating TOTP key: %w", err)
+	}
+
+	secretText := key.Secret()
+	nonce := ""
+	if settings.Config.Auth.TotpSecret != "" {
+		// If an encryption key is provided, encrypt the secret.
+		secretText, nonce, err = encryptSecret(secretText, encryptionKey)
+		if err != nil {
+			return "", fmt.Errorf("failed to encrypt TOTP secret: %w", err)
+		}
+	}
+	// set cache so verify can attempt to use it but not require it for user yet.
+	TotpCache.Set(user.Username, secretText+"||"+nonce)
+	url := "otpauth://totp/FileBrowser%20Quantum?secret=" + secretText
+	return url, nil
+}
+
+// encryptSecret uses AES-GCM to encrypt a plaintext secret.
+// It returns the base64-encoded ciphertext and nonce, or an error.
+func encryptSecret(secret string, key []byte) (string, string, error) {
+	if len(key) != 32 {
+		return "", "", fmt.Errorf("invalid encryption key length: must be 32 bytes")
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", "", err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", "", err
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return "", "", err
+	}
+
+	ciphertext := gcm.Seal(nil, nonce, []byte(secret), nil)
+
+	return base64.StdEncoding.EncodeToString(ciphertext), base64.StdEncoding.EncodeToString(nonce), nil
+}
+
+// decryptSecret uses AES-GCM to decrypt a ciphertext using its key and nonce.
+// It returns the plaintext secret or an error.
+func decryptSecret(b64Ciphertext, b64Nonce string) (string, error) {
+	if len(encryptionKey) != 32 {
+		return "", fmt.Errorf("invalid encryption key length: must be 32 bytes")
+	}
+
+	ciphertext, err := base64.StdEncoding.DecodeString(b64Ciphertext)
+	if err != nil {
+		return "", fmt.Errorf("failed to decode ciphertext: %w", err)
+	}
+
+	nonce, err := base64.StdEncoding.DecodeString(b64Nonce)
+	if err != nil {
+		return "", fmt.Errorf("failed to decode nonce: %w", err)
+	}
+
+	block, err := aes.NewCipher(encryptionKey)
+	if err != nil {
+		return "", err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+
+	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
+	if err != nil {
+		// This error often means the key is wrong or the data is corrupt
+		return "", fmt.Errorf("failed to decrypt secret: %w", err)
+	}
+
+	return string(plaintext), nil
+}
+
+func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) error {
+	// get data from cache
+	cachedSecret, found := TotpCache.Get(user.Username).(string)
+	if !found && user.TOTPSecret == "" {
+		return fmt.Errorf("OTP token not found in cache, please generate a new one")
+	}
+	totpSecret := user.TOTPSecret // The encrypted or plaintext secret
+	totpNonce := user.TOTPNonce   // The nonce if encrypted, or empty if plaintext
+	if found {
+		splitSecret := strings.Split(cachedSecret, "||")
+		if len(splitSecret) < 2 {
+			return fmt.Errorf("invalid cached OTP token format")
+		}
+		totpSecret = splitSecret[0]
+		totpNonce = splitSecret[1]
+	}
+	secretToValidate := totpSecret
+	if settings.Config.Auth.TotpSecret != "" {
+		// If an encryption key is configured, we must decrypt the secret first.
+		if totpNonce == "" {
+			return fmt.Errorf("secret is encrypted but nonce is missing")
+		}
+		decryptedSecret, err := decryptSecret(totpSecret, totpNonce)
+		if err != nil {
+			return fmt.Errorf("failed to decrypt TOTP secret: %w", err)
+		}
+		secretToValidate = decryptedSecret
+	}
+	// --- END: ADD THIS DECRYPTION LOGIC ---
+
+	// Validate the token using the (now plaintext) secret.
+	valid, err := totp.ValidateCustom(code, secretToValidate, time.Now().UTC(), totp.ValidateOpts{
+		Period:    TOTPPeriod,
+		Skew:      TOTPSkew,
+		Digits:    TOTPDigits,
+		Algorithm: TOTPAlgorithm,
+	})
+	if err != nil {
+		logger.Errorf("error during TOTP validation: %v", err)
+	}
+	if !valid {
+		return fmt.Errorf("invalid OTP token")
+	}
+	if totpSecret != "" {
+		user.TOTPSecret = totpSecret // The encrypted or plaintext secret
+		user.TOTPNonce = totpNonce   // The nonce if encrypted, or empty if plaintext
+		user.OtpEnabled = true       // Enable OTP for the user
+		// save user
+		if err := userStore.Update(user, user.Permissions.Admin, "TOTPSecret", "TOTPNonce"); err != nil {
+			logger.Error("error updating user with OTP token:", err)
+			return fmt.Errorf("error updating user with OTP token: %w", err)
+		}
+	} else {
+		return fmt.Errorf("opt secret is empty, cannot enable TOTP")
+	}
+
+	return nil
+}

backend/benchmark_results.txt

@@ -1,53 +1,83 @@
 
  == Running benchmark == 
 /usr/local/go/bin/go
-?   	github.com/gtsteffaniak/filebrowser	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/auth	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/cmd	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend	[no test files]
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/diskcache	0.003s
-?   	github.com/gtsteffaniak/filebrowser/errors	[no test files]
+ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/diskcache	0.004s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files	0.006s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils	0.003s
+?   	github.com/gtsteffaniak/filebrowser/backend/auth	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/cmd	[no test files]
+?   	github.com/gtsteffaniak/go-cache/cache	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/common/errors	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/common/logger	[no test files]
+2025/05/11 20:42:56 Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable
+2025/05/11 20:42:56 Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/common/settings	0.006s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/common/utils	0.003s
+?   	github.com/gtsteffaniak/filebrowser/backend/common/version	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/database/share	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/database/storage	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt	[no test files]
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/database/users	0.002s
+?   	github.com/gtsteffaniak/filebrowser/backend/events	[no test files]
+2025/05/11 20:42:56 [DEBUG]  Saving user [admin] changepass: true
+2025/05/11 20:42:56 [DEBUG]  Saving user [non-admin] changepass: true
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/http	0.197s
+2025/05/11 20:42:57 initializing index: [test]
+2025/05/11 20:42:57 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:42:57 [DEBUG]  Starting full scan for [test]
+2025/05/11 20:42:57 Index assessment         : [test] complexity=simple directories=0 files=0
+2025/05/11 20:42:57 [DEBUG]  Time spent indexing [test]: 0 seconds
+2025/05/11 20:42:57 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:42:57 [DEBUG]  Next scan in 1m0s
+2025/05/11 20:42:58 initializing index: [test]
+2025/05/11 20:42:58 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:42:58 [DEBUG]  Starting full scan for [test]
+2025/05/11 20:42:58 Index assessment         : [test] complexity=simple directories=0 files=0
+2025/05/11 20:42:58 [DEBUG]  Time spent indexing [test]: 0 seconds
+2025/05/11 20:42:58 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:42:58 [DEBUG]  Next scan in 1m0s
 goos: linux
 goarch: amd64
-pkg: github.com/gtsteffaniak/filebrowser/files
+pkg: github.com/gtsteffaniak/filebrowser/backend/indexing
 cpu: 11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz
-BenchmarkFillIndex-8          	      10	   3295862 ns/op	  230448 B/op	    1927 allocs/op
-BenchmarkSearchAllIndexes-8   	      10	  30033386 ns/op	19647893 B/op	  298702 allocs/op
+BenchmarkFillIndex-8                     	2025/05/11 20:42:59 initializing index: [test]
+2025/05/11 20:42:59 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:42:59 [DEBUG]  Starting full scan for [test]
+2025/05/11 20:42:59 Index assessment         : [test] complexity=simple directories=0 files=0
+2025/05/11 20:42:59 [DEBUG]  Time spent indexing [test]: 0 seconds
+2025/05/11 20:42:59 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:42:59 [DEBUG]  Next scan in 1m0s
+      10	   3548759 ns/op	   38032 B/op	     452 allocs/op
+BenchmarkCheckIndexExclude-8             	      10	       172.6 ns/op	       0 B/op	       0 allocs/op
+BenchmarkCheckIndexConditionsInclude-8   	      10	       118.2 ns/op	       0 B/op	       0 allocs/op
+2025/05/11 20:43:01 initializing index: [test]
+2025/05/11 20:43:01 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:43:01 [DEBUG]  Starting full scan for [test]
+2025/05/11 20:43:01 Index assessment         : [test] complexity=simple directories=0 files=0
+2025/05/11 20:43:01 [DEBUG]  Time spent indexing [test]: 0 seconds
+2025/05/11 20:43:01 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:43:01 [DEBUG]  Next scan in 1m0s
+BenchmarkSearchAllIndexes-8              	2025/05/11 20:43:02 initializing index: [test]
+2025/05/11 20:43:02 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:43:02 [DEBUG]  Starting full scan for [test]
+2025/05/11 20:43:02 Index assessment         : [test] complexity=simple directories=0 files=0
+2025/05/11 20:43:02 [DEBUG]  Time spent indexing [test]: 0 seconds
+2025/05/11 20:43:02 [DEBUG]  Skipping source update event for mock index.
+2025/05/11 20:43:02 [DEBUG]  Next scan in 1m0s
+      10	    781119 ns/op	   38515 B/op	     900 allocs/op
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/files	0.392s
+ok  	github.com/gtsteffaniak/filebrowser/backend/indexing	5.097s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/fileutils	0.003s
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 h: 401  <nil>
-2023/11/24 13:57:20 h: 401  <nil>
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 Saving new user: username
-2023/11/24 13:57:20 h: 401  <nil>
-2023/11/24 13:57:20 h: 401  <nil>
-2023/11/24 13:57:20 h: 401  <nil>
-2023/11/24 13:57:20 h: 401  <nil>
+ok  	github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo	0.005s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/http	0.208s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/img	0.118s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/rules	0.002s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/runner	0.003s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/settings	0.005s
-?   	github.com/gtsteffaniak/filebrowser/share	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/storage	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/storage/bolt	[no test files]
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/users	0.003s
-?   	github.com/gtsteffaniak/filebrowser/version	[no test files]
+ok  	github.com/gtsteffaniak/filebrowser/backend/preview	0.128s
+?   	github.com/gtsteffaniak/filebrowser/backend/swagger/docs	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/tools	[no test files]

backend/cmd/cli.go

@@ -0,0 +1,366 @@
+package cmd
+
+import (
+	"bufio"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/goccy/go-yaml"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+var (
+	configPath string
+)
+
+// return bool to indicate if the program should continue running
+func runCLI() bool {
+
+	generateYaml()
+
+	// Global flags
+	var help bool
+	// Override the default usage output to use generalUsage()
+	flag.Usage = generalUsage
+	flag.StringVar(&configPath, "c", "", "Path to the config file, default: config.yaml")
+	flag.BoolVar(&help, "h", false, "Get help about commands")
+
+	if configPath == "" {
+		configPath = os.Getenv("FILEBROWSER_CONFIG")
+	}
+
+	if configPath == "" {
+		configPath = "config.yaml"
+	}
+
+	// Parse global flags (before subcommands)
+	flag.Parse() // print generalUsage on error
+
+	// Show help if requested
+	if help {
+		generalUsage()
+		return false
+	}
+
+	// Create a new FlagSet for the 'set' subcommand
+	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
+	var user, scope, dbConfig string
+	var asAdmin bool
+
+	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
+	setCmd.BoolVar(&asAdmin, "a", false, "Create user as admin user, used in combination with -u")
+	setCmd.StringVar(&scope, "s", "", "Specify a user scope, otherwise default user config scope is used")
+	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
+
+	// Parse subcommand flags only if a subcommand is specified
+	if len(os.Args) > 1 {
+		switch os.Args[1] {
+		case "setup":
+			createConfig(configPath)
+			return false
+		case "set":
+			err := setCmd.Parse(os.Args[2:])
+			if err != nil {
+				setCmd.PrintDefaults()
+				os.Exit(1)
+			}
+			userInfo := strings.Split(user, ",")
+			if len(userInfo) < 2 {
+				fmt.Printf("not enough info to create user: \"set -u username,password\", only provided %v\n", userInfo)
+				setCmd.PrintDefaults()
+				os.Exit(1)
+			}
+			username := userInfo[0]
+			password := userInfo[1]
+			ok := getStore(dbConfig)
+			if !ok {
+				logger.Fatal("could not load db info")
+			}
+			user, err := store.Users.Get(username)
+			if err != nil {
+				newUser := users.User{
+					Username:    username,
+					LoginMethod: users.LoginMethodPassword,
+					NonAdminEditable: users.NonAdminEditable{
+						Password: password,
+					},
+				}
+				for _, source := range settings.Config.Server.SourceMap {
+					if source.Config.DefaultEnabled {
+						newUser.Scopes = append(newUser.Scopes, users.SourceScope{
+							Name:  source.Name,
+							Scope: source.Config.DefaultUserScope,
+						})
+					}
+				}
+
+				// Create the user logic
+				if asAdmin {
+					logger.Infof("Creating user as admin: %s\n", username)
+				} else {
+					logger.Infof("Creating non-admin user: %s\n", username)
+				}
+				err = storage.CreateUser(newUser, asAdmin)
+				if err != nil {
+					logger.Errorf("could not create user: %v", err)
+				}
+				return false
+			}
+			if user.LoginMethod != users.LoginMethodPassword {
+				logger.Warningf("user %s is not allowed to login with password authentication, bypassing and updating login method", user.Username)
+			}
+			user.Password = password
+			user.TOTPSecret = "" // reset TOTP secret if it exists
+			user.TOTPNonce = ""  // reset TOTP nonce if it exists
+			user.LoginMethod = users.LoginMethodPassword
+			if asAdmin {
+				user.Permissions.Admin = true
+			}
+			err = store.Users.Save(user, true, false)
+			if err != nil {
+				logger.Errorf("could not update user: %v", err)
+			}
+			fmt.Printf("successfully updated user: %s\n", username)
+			return false
+
+		case "version":
+			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
+	Version 	 : %v
+	Commit 		 : %v
+	Release Info 	 : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
+	`, version.Version, version.CommitSHA, version.Version)
+			return false
+		}
+	}
+	return true
+}
+
+// UserDefaults defines default settings for new users.
+type UserDefaults struct {
+	Permissions users.Permissions `yaml:"permissions"`
+}
+
+// Frontend defines settings related to the web interface.
+type Frontend struct {
+	Name string `yaml:"name,omitempty"`
+}
+
+// Source defines a directory to be served.
+type Source struct {
+	Name string `yaml:"name,omitempty"`
+	Path string `yaml:"path"`
+}
+
+// Server defines server-specific configurations.
+type Server struct {
+	Port     int         `yaml:"port"`
+	Database string      `yaml:"database"`
+	Sources  []Source    `yaml:"sources"`
+	Logging  []LogConfig `json:"logging"`
+}
+
+type LogConfig struct {
+	Levels    string `json:"levels"`    // separated list of log levels to enable. (eg. "info|warning|error|debug")
+	ApiLevels string `json:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
+	Output    string `json:"output"`    // output location. (eg. "stdout" or "path/to/file.log")
+	NoColors  bool   `json:"noColors"`  // disable colors in the output
+	Utc       bool   `json:"utc"`       // use UTC time in the output instead of local time
+}
+
+type Auth struct {
+	AdminUsername string `yaml:"adminUsername"`
+	AdminPassword string `yaml:"adminPassword"`
+}
+
+// Settings is the top-level configuration structure.
+type Settings struct {
+	Server       Server       `yaml:"server"`
+	Frontend     Frontend     `yaml:"frontend,omitempty"`
+	Auth         Auth         `yaml:"auth"`
+	UserDefaults UserDefaults `yaml:"userDefaults"`
+}
+
+// askQuestion displays a prompt and reads a line of input from the user.
+// It returns the defaultValue if the user's input is empty.
+func askQuestion(reader *bufio.Reader, prompt string, defaultValue string) string {
+	fmt.Printf("%s (default: %s): ", prompt, defaultValue)
+	input, _ := reader.ReadString('\n')
+	input = strings.TrimSpace(input)
+	if input == "" {
+		return defaultValue
+	}
+	return input
+}
+
+// askYesNoQuestion prompts the user with a yes/no question and returns a boolean.
+// It retries until valid input ("yes", "y", "no", "n") is received.
+// The defaultValue must be "yes" or "no".
+func askYesNoQuestion(reader *bufio.Reader, prompt string, defaultValue string) bool {
+	for {
+		answer := askQuestion(reader, prompt, defaultValue)
+		answer = strings.ToLower(answer)
+		if answer == "yes" || answer == "y" {
+			return true
+		}
+		if answer == "no" || answer == "n" {
+			return false
+		}
+		fmt.Println("Error: Invalid input. Please enter 'yes' or 'no'.")
+	}
+}
+
+// createConfig orchestrates the configuration process by asking the user a series of questions.
+func createConfig(configpath string) {
+	// check if config file exists
+	if _, err := os.Stat("config.yaml"); err == nil {
+		fmt.Println("Config file 'config.yaml' already exists, skipping setup.")
+		return
+	}
+	reader := bufio.NewReader(os.Stdin)
+	config := Settings{
+		Server: Server{
+			Logging: []LogConfig{
+				{
+					Levels:    "info|warning|error",
+					ApiLevels: "info|warning|error",
+					Output:    "stdout",
+					NoColors:  false,
+					Utc:       false,
+				},
+			},
+			Sources: []Source{
+				{
+					Path: "",
+				},
+			},
+		},
+	}
+
+	fmt.Println("--- Starting Configuration Setup ---")
+	realPath := ""
+	// 1. Ask for the source filesystem path (with validation)
+	for {
+		config.Server.Sources[0].Path = askQuestion(reader, "What is the source filesystem path?", "./")
+		// Convert relative path to absolute path
+		absolutePath, err := filepath.Abs(config.Server.Sources[0].Path)
+		if err == nil {
+			var isDir bool
+			// Resolve symlinks and get the real path
+			realPath, isDir, _ = utils.ResolveSymlinks(absolutePath)
+			if realPath != "" && isDir {
+				break // Valid path found, exit loop
+			}
+		}
+		fmt.Printf("Error: The path '%s' does not exist or isn't valid. Please try again.\n", config.Server.Sources[0].Path)
+	}
+	// 2. Ask for the source name
+	defaultSourceName := filepath.Base(realPath)
+	sourceName := askQuestion(reader, "What should the first source name be?", defaultSourceName)
+	if sourceName != defaultSourceName {
+		config.Server.Sources[0].Name = sourceName
+	}
+
+	// 3. Ask for server port (with validation)
+	for {
+		portStr := askQuestion(reader, "What port should the server listen on?", "80")
+		port, err := strconv.Atoi(portStr)
+		if err == nil && (port >= 1 && port <= 65535) {
+			config.Server.Port = port
+			break // Port is valid, exit loop
+		}
+		fmt.Printf("Error: '%s' is not a valid port. Please enter a number between 1 and 65535.\n", portStr)
+	}
+
+	for {
+		levels := askQuestion(reader, "What should the log levels be?", "info|warning|error")
+		checkLevels := SplitByMultiple(levels)
+		invalidOptions := []string{}
+		for _, level := range checkLevels {
+			if !(level == "info" || level == "warning" || level == "error" || level == "debug") {
+				invalidOptions = append(invalidOptions, level)
+			}
+		}
+		if len(invalidOptions) == 0 {
+			break
+		}
+		fmt.Printf("Error: invalid options given '%s'. valid options: 'info|warning|error|debug'.\n", invalidOptions)
+	}
+
+	for {
+		config.Server.Database = askQuestion(reader, "What should the file name and path be for the database?", "./database.db")
+		if strings.HasSuffix(config.Server.Database, ".db") {
+			break // Valid path found, exit loop
+		}
+		fmt.Printf("Error: '%s' is not a valid path. Please enter a path to a file ending in .db", config.Server.Database)
+	}
+	// 4. Ask for the application brand name
+	config.Frontend.Name = askQuestion(reader, "What should the application brand name be?", "FileBrowser Quantum")
+
+	// 5. Ask for admin username and password
+	config.Auth.AdminUsername = askQuestion(reader, "What should the default admin username be?", "admin")
+	config.Auth.AdminPassword = askQuestion(reader, "What should the default admin password be?", "admin")
+
+	// 6. Ask boolean (Yes/No) questions using the helper
+	config.UserDefaults.Permissions.Modify = askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
+	config.UserDefaults.Permissions.Share = askYesNoQuestion(reader, "Should a new user be able to create shares by default?", "no")
+
+	fmt.Println("--- 	Configuration Complete 	---")
+
+	// marshall yaml and write to file
+	// Marshal the struct to YAML bytes
+	yamlData, err := yaml.Marshal(&config)
+	if err != nil {
+		return
+	}
+
+	// Write the YAML data to the file
+	err = os.WriteFile("config.yaml", yamlData, 0644) // 0644 provides read/write for owner, read for others
+	if err != nil {
+		return
+	}
+	// cleanup database if it exists
+	if _, err := os.Stat(config.Server.Database); err == nil {
+		response := askYesNoQuestion(reader, "Database specified already exists. Move databse file to backup to start fresh?", "no")
+		if !response {
+			return
+		}
+		// move database file to backup
+		backupPath := config.Server.Database + ".bak"
+		err = os.Rename(config.Server.Database, backupPath)
+		if err != nil {
+			fmt.Printf("Error moving database file to backup: %v\n", err)
+		} else {
+			fmt.Printf("Database file moved to backup: %s\n", backupPath)
+		}
+	}
+
+}
+
+func generateYaml() {
+	if os.Getenv("FILEBROWSER_GENERATE_CONFIG") != "" {
+		logger.Info("Generating config.yaml")
+		settings.GenerateYaml()
+		os.Exit(0)
+	}
+}
+
+func SplitByMultiple(str string) []string {
+	delimiters := []rune{'|', ',', ' '}
+	return strings.FieldsFunc(str, func(r rune) bool {
+		for _, d := range delimiters {
+			if r == d {
+				return true
+			}
+		}
+		return false
+	})
+}

backend/cmd/office.go

@@ -0,0 +1,21 @@
+package cmd
+
+import (
+	"net/http"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// healthcheck attempt to save test file against configured url
+func validateOfficeIntegration() {
+	if settings.Config.Integrations.OnlyOffice.Url != "" {
+		// get url health
+		// get request against the url
+		_, err := http.NewRequest("GET", settings.Config.Integrations.OnlyOffice.Url, nil)
+		if err != nil {
+			logger.Warning("Could not create request to only office Url, make sure its valid and running")
+			return
+		}
+	}
+}

backend/cmd/root.go

@@ -1,154 +1,127 @@
 package cmd
 
 import (
-	"crypto/tls"
-	"flag"
-	"io/fs"
-	"log"
-	"net"
-	"net/http"
+	"context"
+	"fmt"
 	"os"
 	"os/signal"
-	"strconv"
 	"syscall"
 
-	"github.com/spf13/pflag"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/preview"
+	"github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
+	"github.com/gtsteffaniak/go-logger/logger"
+	"github.com/swaggo/swag"
 
-	"github.com/spf13/afero"
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/auth"
-	"github.com/gtsteffaniak/filebrowser/diskcache"
-	"github.com/gtsteffaniak/filebrowser/files"
-	fbhttp "github.com/gtsteffaniak/filebrowser/http"
-	"github.com/gtsteffaniak/filebrowser/img"
-	"github.com/gtsteffaniak/filebrowser/settings"
-	"github.com/gtsteffaniak/filebrowser/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 )
 
-type dirFS struct {
-	http.Dir
+var store *storage.Storage
+
+func getStore(configFile string) bool {
+	// Use the config file (global flag)
+	settings.Initialize(configFile)
+	s, hasDB, err := storage.InitializeDb(settings.Config.Server.Database)
+	if err != nil {
+		logger.Fatalf("could not load db info: %v", err)
+	}
+	store = s
+	return hasDB
 }
 
-func (d dirFS) Open(name string) (fs.File, error) {
-	return d.Dir.Open(name)
-}
-
-func init() {
-	// Define a flag for the config option (-c or --config)
-	configFlag := pflag.StringP("config", "c", "filebrowser.yaml", "Path to the config file")
-	// Bind the flags to the pflag command line parser
-	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
-	pflag.Parse()
-	log.Println("Initializing with config file:", *configFlag)
-	settings.Initialize(*configFlag)
-}
-
-var rootCmd = &cobra.Command{
-	Use: "filebrowser",
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		serverConfig := settings.Config.Server
-		if !d.hadDB {
-			quickSetup(d)
-		}
-		if serverConfig.NumImageProcessors < 1 {
-			log.Fatal("Image resize workers count could not be < 1")
-		}
-		imgSvc := img.New(serverConfig.NumImageProcessors)
-		var fileCache diskcache.Interface = diskcache.NewNoOp()
-		cacheDir := "/tmp"
-		if cacheDir != "" {
-			if err := os.MkdirAll(cacheDir, 0700); err != nil { //nolint:govet,gomnd
-				log.Fatalf("can't make directory %s: %s", cacheDir, err)
-			}
-			fileCache = diskcache.New(afero.NewOsFs(), cacheDir)
-		}
-		// initialize indexing and schedule indexing ever n minutes (default 5)
-		go files.InitializeIndex(serverConfig.IndexingInterval, true)
-		_, err := os.Stat(serverConfig.Root)
-		checkErr(err)
-		var listener net.Listener
-		address := serverConfig.Address + ":" + strconv.Itoa(serverConfig.Port)
-		switch {
-		case serverConfig.Socket != "":
-			listener, err = net.Listen("unix", serverConfig.Socket)
-			checkErr(err)
-			socketPerm, err := cmd.Flags().GetUint32("socket-perm") //nolint:govet
-			checkErr(err)
-			err = os.Chmod(serverConfig.Socket, os.FileMode(socketPerm))
-			checkErr(err)
-		case serverConfig.TLSKey != "" && serverConfig.TLSCert != "":
-			cer, err := tls.LoadX509KeyPair(serverConfig.TLSCert, serverConfig.TLSKey) //nolint:govet
-			checkErr(err)
-			listener, err = tls.Listen("tcp", address, &tls.Config{
-				MinVersion:   tls.VersionTLS12,
-				Certificates: []tls.Certificate{cer}},
-			)
-			checkErr(err)
-		default:
-			listener, err = net.Listen("tcp", address)
-			checkErr(err)
-		}
-		sigc := make(chan os.Signal, 1)
-		signal.Notify(sigc, os.Interrupt, syscall.SIGTERM)
-		go cleanupHandler(listener, sigc)
-		assetsFs := dirFS{Dir: http.Dir("frontend/dist")}
-		handler, err := fbhttp.NewHandler(imgSvc, fileCache, d.store, &serverConfig, assetsFs)
-		checkErr(err)
-		defer listener.Close()
-		log.Println("Listening on", listener.Addr().String())
-		//nolint: gosec
-		if err := http.Serve(listener, handler); err != nil {
-			log.Fatal(err)
-		}
-	}, pythonConfig{allowNoDB: true}),
+func generalUsage() {
+	fmt.Printf(`usage: ./filebrowser <command> [options]
+commands:
+	-h    	Print help
+	-c    	Print the default config file
+	version Print version information
+	set -u	Username and password for the new user
+	set -a	Create user as admin
+	set -s	Specify a user scope
+	set -h	Print this help message
+`)
 }
 
 func StartFilebrowser() {
-	if err := rootCmd.Execute(); err != nil {
-		log.Fatal(err)
+	keepGoing := runCLI()
+	if !keepGoing {
+		return
 	}
+	// Create context and channels for graceful shutdown
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	signalChan := make(chan os.Signal, 1)
+	signal.Notify(signalChan, syscall.SIGINT, syscall.SIGTERM)
+
+	done := make(chan struct{})             // Signals server has stopped
+	shutdownComplete := make(chan struct{}) // Signals shutdown process is complete
+	dbExists := getStore(configPath)
+	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
+	if !dbExists {
+		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
+	}
+	sourceList := []string{}
+	for path, source := range settings.Config.Server.SourceMap {
+		sourceList = append(sourceList, fmt.Sprintf("%v: %v", source.Name, path))
+	}
+	logger.Infof("Initializing FileBrowser Quantum (%v)", version.Version)
+	logger.Infof("Using Config file        : %v", configPath)
+	logger.Infof("Auth Methods             : %v", settings.Config.Auth.AuthMethods)
+	logger.Info(database)
+	logger.Infof("Sources                  : %v", sourceList)
+
+	serverConfig := settings.Config.Server
+	swagInfo := docs.SwaggerInfo
+	swagInfo.BasePath = serverConfig.BaseURL
+	swag.Register(docs.SwaggerInfo.InstanceName(), swagInfo)
+	// initialize indexing and schedule indexing ever n minutes (default 5)
+	if len(settings.Config.Server.SourceMap) == 0 {
+		logger.Fatal("No sources configured, exiting...")
+	}
+	for _, source := range settings.Config.Server.SourceMap {
+		go indexing.Initialize(source, false)
+	}
+	validateUserInfo()
+	validateOfficeIntegration()
+	// Start the rootCMD in a goroutine
+	go func() {
+		if err := rootCMD(ctx, store, &serverConfig, shutdownComplete); err != nil {
+			logger.Fatalf("Error starting filebrowser: %v", err)
+		}
+		close(done) // Signal that the server has stopped
+	}()
+	// Wait for a shutdown signal or the server to stop
+	select {
+	case <-signalChan:
+		logger.Info("Received shutdown signal. Shutting down gracefully...")
+		cancel() // Trigger context cancellation
+	case <-done:
+		logger.Info("Server stopped unexpectedly. Shutting down...")
+	}
+	fileutils.ClearCacheDir()
+
+	<-shutdownComplete // Ensure we don't exit prematurely
+	// Wait for the server to stop
+	logger.Info("Shutdown complete.")
 }
 
-func cleanupHandler(listener net.Listener, c chan os.Signal) { //nolint:interfacer
-	sig := <-c
-	log.Printf("Caught signal %s: shutting down.", sig)
-	listener.Close()
-	os.Exit(0)
-}
-
-func quickSetup(d pythonData) {
-	settings.Config.Auth.Key = generateKey()
-	if settings.Config.Auth.Method == "noauth" {
-		err := d.store.Auth.Save(&auth.NoAuth{})
-		checkErr(err)
-	} else {
-		settings.Config.Auth.Method = "password"
-		err := d.store.Auth.Save(&auth.JSONAuth{})
-		checkErr(err)
+func rootCMD(ctx context.Context, store *storage.Storage, serverConfig *settings.Server, shutdownComplete chan struct{}) error {
+	if serverConfig.NumImageProcessors < 1 {
+		logger.Fatal("Image resize workers count could not be < 1")
 	}
-	err := d.store.Settings.Save(&settings.Config)
-	checkErr(err)
-	err = d.store.Settings.SaveServer(&settings.Config.Server)
-	checkErr(err)
-	user := &users.User{}
-	settings.Config.UserDefaults.Apply(user)
-	user.Username = settings.Config.Auth.AdminUsername
-	user.Password = settings.Config.Auth.AdminPassword
-	user.Perm.Admin = true
-	user.Scope = "./"
-	user.DarkMode = true
-	user.ViewMode = "normal"
-	user.LockPassword = false
-	user.Perm = users.Permissions{
-		Create:   true,
-		Rename:   true,
-		Modify:   true,
-		Delete:   true,
-		Share:    true,
-		Download: true,
-		Admin:    true,
+	cacheDir := settings.Config.Server.CacheDir
+	numWorkers := settings.Config.Server.NumImageProcessors
+	ffpmpegPath := settings.Config.Integrations.Media.FfmpegPath
+	// setup disk cache
+	err := preview.StartPreviewGenerator(numWorkers, ffpmpegPath, cacheDir)
+	if err != nil {
+		logger.Fatalf("Error starting preview service: %v", err)
 	}
-	err = d.store.Users.Save(user)
-	checkErr(err)
+	fbhttp.StartHttp(ctx, store, shutdownComplete)
+	return nil
 }

backend/cmd/rule_rm.go

@@ -1,66 +0,0 @@
-package cmd
-
-import (
-	"strconv"
-
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/settings"
-	"github.com/gtsteffaniak/filebrowser/users"
-)
-
-func init() {
-	rulesCmd.AddCommand(rulesRmCommand)
-	rulesRmCommand.Flags().Uint("index", 0, "index of rule to remove")
-	_ = rulesRmCommand.MarkFlagRequired("index")
-}
-
-var rulesRmCommand = &cobra.Command{
-	Use:   "rm <index> [index_end]",
-	Short: "Remove a global rule or user rule",
-	Long: `Remove a global rule or user rule. The provided index
-is the same that's printed when you run 'rules ls'. Note
-that after each removal/addition, the index of the
-commands change. So be careful when removing them after each
-other.
-
-You can also specify an optional parameter (index_end) so
-you can remove all commands from 'index' to 'index_end',
-including 'index_end'.`,
-	Args: func(cmd *cobra.Command, args []string) error {
-		if err := cobra.RangeArgs(1, 2)(cmd, args); err != nil { //nolint:gomnd
-			return err
-		}
-
-		for _, arg := range args {
-			if _, err := strconv.Atoi(arg); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	},
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		i, err := strconv.Atoi(args[0])
-		checkErr(err)
-		f := i
-		if len(args) == 2 { //nolint:gomnd
-			f, err = strconv.Atoi(args[1])
-			checkErr(err)
-		}
-
-		user := func(u *users.User) {
-			u.Rules = append(u.Rules[:i], u.Rules[f+1:]...)
-			err := d.store.Users.Save(u)
-			checkErr(err)
-		}
-
-		global := func(s *settings.Settings) {
-			s.Rules = append(s.Rules[:i], s.Rules[f+1:]...)
-			err := d.store.Settings.Save(s)
-			checkErr(err)
-		}
-
-		runRules(d.store, cmd, user, global)
-	}, pythonConfig{}),
-}

backend/cmd/rules.go

@@ -1,92 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-
-	"github.com/gtsteffaniak/filebrowser/rules"
-	"github.com/gtsteffaniak/filebrowser/settings"
-	"github.com/gtsteffaniak/filebrowser/storage"
-	"github.com/gtsteffaniak/filebrowser/users"
-)
-
-func init() {
-	rootCmd.AddCommand(rulesCmd)
-	rulesCmd.PersistentFlags().StringP("username", "u", "", "username of user to which the rules apply")
-	rulesCmd.PersistentFlags().UintP("id", "i", 0, "id of user to which the rules apply")
-}
-
-var rulesCmd = &cobra.Command{
-	Use:   "rules",
-	Short: "Rules management utility",
-	Long: `On each subcommand you'll have available at least two flags:
-"username" and "id". You must either set only one of them
-or none. If you set one of them, the command will apply to
-an user, otherwise it will be applied to the global set or
-rules.`,
-	Args: cobra.NoArgs,
-}
-
-func runRules(st *storage.Storage, cmd *cobra.Command, usersFn func(*users.User), globalFn func(*settings.Settings)) {
-	id := getUserIdentifier(cmd.Flags())
-	if id != nil {
-		user, err := st.Users.Get("", id)
-		checkErr(err)
-
-		if usersFn != nil {
-			usersFn(user)
-		}
-
-		printRules(user.Rules, id)
-		return
-	}
-
-	s, err := st.Settings.Get()
-	checkErr(err)
-
-	if globalFn != nil {
-		globalFn(s)
-	}
-
-	printRules(s.Rules, id)
-}
-
-func getUserIdentifier(flags *pflag.FlagSet) interface{} {
-	id := mustGetUint(flags, "id")
-	username := mustGetString(flags, "username")
-
-	if id != 0 {
-		return id
-	} else if username != "" {
-		return username
-	}
-
-	return nil
-}
-
-func printRules(rulez []rules.Rule, id interface{}) {
-	if id == nil {
-		fmt.Printf("Global Rules:\n\n")
-	} else {
-		fmt.Printf("Rules for user %v:\n\n", id)
-	}
-
-	for id, rule := range rulez {
-		fmt.Printf("(%d) ", id)
-		if rule.Regex {
-			if rule.Allow {
-				fmt.Printf("Allow Regex: \t%s\n", rule.Regexp.Raw)
-			} else {
-				fmt.Printf("Disallow Regex: \t%s\n", rule.Regexp.Raw)
-			}
-		} else {
-			if rule.Allow {
-				fmt.Printf("Allow Path: \t%s\n", rule.Path)
-			} else {
-				fmt.Printf("Disallow Path: \t%s\n", rule.Path)
-			}
-		}
-	}
-}

backend/cmd/rules_add.go

@@ -1,58 +0,0 @@
-package cmd
-
-import (
-	"regexp"
-
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/rules"
-	"github.com/gtsteffaniak/filebrowser/settings"
-	"github.com/gtsteffaniak/filebrowser/users"
-)
-
-func init() {
-	rulesCmd.AddCommand(rulesAddCmd)
-	rulesAddCmd.Flags().BoolP("allow", "a", false, "indicates this is an allow rule")
-	rulesAddCmd.Flags().BoolP("regex", "r", false, "indicates this is a regex rule")
-}
-
-var rulesAddCmd = &cobra.Command{
-	Use:   "add <path|expression>",
-	Short: "Add a global rule or user rule",
-	Long:  `Add a global rule or user rule.`,
-	Args:  cobra.ExactArgs(1),
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		allow := mustGetBool(cmd.Flags(), "allow")
-		regex := mustGetBool(cmd.Flags(), "regex")
-		exp := args[0]
-
-		if regex {
-			regexp.MustCompile(exp)
-		}
-
-		rule := rules.Rule{
-			Allow: allow,
-			Regex: regex,
-		}
-
-		if regex {
-			rule.Regexp = &rules.Regexp{Raw: exp}
-		} else {
-			rule.Path = exp
-		}
-
-		user := func(u *users.User) {
-			u.Rules = append(u.Rules, rule)
-			err := d.store.Users.Save(u)
-			checkErr(err)
-		}
-
-		global := func(s *settings.Settings) {
-			s.Rules = append(s.Rules, rule)
-			err := d.store.Settings.Save(s)
-			checkErr(err)
-		}
-
-		runRules(d.store, cmd, user, global)
-	}, pythonConfig{}),
-}

backend/cmd/rules_ls.go

@@ -1,19 +0,0 @@
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-)
-
-func init() {
-	rulesCmd.AddCommand(rulesLsCommand)
-}
-
-var rulesLsCommand = &cobra.Command{
-	Use:   "ls",
-	Short: "List global rules or user specific rules",
-	Long:  `List global rules or user specific rules.`,
-	Args:  cobra.NoArgs,
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		runRules(d.store, cmd, nil, nil)
-	}, pythonConfig{}),
-}

backend/cmd/user.go

@@ -0,0 +1,161 @@
+package cmd
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+var createBackup = []bool{}
+
+func validateUserInfo() {
+	// update source info for users if names/sources/paths might have changed
+	usersList, err := store.Users.Gets()
+	if err != nil {
+		logger.Fatalf("could not load users: %v", err)
+	}
+	for _, user := range usersList {
+		updateUser := false
+		if user.Username == "publicUser" {
+			settings.ApplyUserDefaults(user)
+			updateUser = true
+		}
+		if updateUserScopes(user) {
+			updateUser = true
+		}
+		if updatePermissions(user) {
+			updateUser = true
+		}
+		if updatePreviewSettings(user) {
+			updateUser = true
+		}
+		if updateLoginType(user) {
+			updateUser = true
+		}
+		if updateUser {
+			if len(createBackup) == 1 {
+				logger.Warning("Incompatible user settings detected, creating backup of database before converting.")
+				err = fileutils.CopyFile(settings.Config.Server.Database, fmt.Sprintf("%s.bak", settings.Config.Server.Database))
+				if err != nil {
+					logger.Fatalf("Unable to create automatic backup of database due to error: %v", err)
+				}
+			}
+			err := store.Users.Save(user, false, true)
+			if err != nil {
+				logger.Errorf("could not update user: %v", err)
+			}
+		}
+	}
+	if settings.Config.Auth.ResetAdminOnStart {
+		logger.Info("Resetting admin user to default username and password.")
+		adminUser, err := store.Users.Get(1)
+		if err != nil {
+			logger.Fatalf("could not load admin user: %v", err)
+		}
+		adminUser.Username = settings.Config.Auth.AdminUsername
+		adminUser.Password = settings.Config.Auth.AdminPassword
+		adminUser.Permissions.Admin = true
+		err = store.Users.Save(adminUser, true, true)
+		if err != nil {
+			logger.Errorf("could not Save admin user: %v", err)
+		}
+	}
+}
+
+func updateUserScopes(user *users.User) bool {
+	newScopes := []users.SourceScope{}
+	seen := make(map[string]bool)
+
+	// Build map for existing scopes by Name
+	existing := make(map[string]users.SourceScope)
+	for _, s := range user.Scopes {
+		existing[s.Name] = s
+	}
+
+	// Preserve order by using Config.Server.Sources
+	for _, src := range settings.Config.Server.Sources {
+		realsource, ok := settings.Config.Server.NameToSource[src.Name]
+		if !ok {
+			continue
+		}
+		existingScope, ok := existing[realsource.Path]
+		if ok {
+			// If scope is empty and there's a default, apply default
+			if existingScope.Scope == "" {
+				existingScope.Scope = src.Config.DefaultUserScope
+			}
+		} else if realsource.Config.DefaultEnabled {
+			existingScope.Scope = realsource.Config.DefaultUserScope
+		} else {
+			continue
+		}
+
+		newScopes = append(newScopes, users.SourceScope{
+			Name:  realsource.Path,
+			Scope: existingScope.Scope,
+		})
+		seen[realsource.Path] = true
+	}
+
+	// Preserve user-defined scopes not matching current sources, append to end
+	for _, s := range user.Scopes {
+		if !seen[s.Name] {
+			newScopes = append(newScopes, s)
+		}
+	}
+	changed := !reflect.DeepEqual(user.Scopes, newScopes)
+	user.Scopes = newScopes
+	return changed
+}
+
+// func to convert legacy user with perm key to permissions
+func updatePermissions(user *users.User) bool {
+	updateUser := false
+	// if any keys are true, set the permissions to true
+	if user.Perm.Api {
+		user.Permissions.Api = true
+		user.Perm.Api = false
+		updateUser = true
+	}
+	if user.Perm.Admin {
+		user.Permissions.Admin = true
+		user.Perm.Admin = false
+		updateUser = true
+	}
+	if user.Perm.Modify {
+		user.Permissions.Modify = true
+		user.Perm.Modify = false
+		updateUser = true
+	}
+	if user.Perm.Share {
+		user.Permissions.Share = true
+		user.Perm.Share = false
+		updateUser = true
+	}
+	if updateUser {
+		createBackup = append(createBackup, true)
+	}
+	return updateUser
+}
+
+func updateLoginType(user *users.User) bool {
+	if user.LoginMethod == "" {
+		user.LoginMethod = users.LoginMethodPassword
+		return true
+	}
+	return false
+}
+
+func updatePreviewSettings(user *users.User) bool {
+	// if user hasn't been updated yet
+	if user.LoginMethod == "" {
+		user.Preview.Image = true
+		user.Preview.PopUp = true
+		return true
+	}
+	return false
+}

backend/cmd/user_test.go

@@ -0,0 +1,184 @@
+package cmd
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUpdateUserScopes_Phases(t *testing.T) {
+
+	sourceA := settings.Source{Path: "/pathA", Name: "sourceA", Config: settings.SourceConfig{
+		DefaultEnabled:   false,
+		DefaultUserScope: "/defaultA",
+	}}
+	sourceB := settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
+	settings.Config.Server.Sources = []settings.Source{sourceA, sourceB}
+	settings.Config.Server.DefaultSource = sourceB
+	settings.Config.Server.SourceMap = map[string]settings.Source{
+		"/pathA": sourceA,
+		"/pathB": sourceB,
+	}
+	settings.Config.Server.NameToSource = map[string]settings.Source{
+		"sourceA": sourceA,
+		"sourceB": sourceB,
+	}
+
+	// ---------------------
+	// Test Cases Definition
+	// ---------------------
+	testCases := []struct {
+		name           string
+		user           *users.User
+		expectedPhase1 []users.SourceScope
+		expectedPhase2 []users.SourceScope
+	}{
+		{
+			name: "Single valid scope",
+			user: &users.User{
+				Scopes: []users.SourceScope{
+					{Scope: "/home", Name: "/pathA"},
+				},
+			},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/home", Name: "/pathA"},
+				{Scope: "/defaultB", Name: "/pathB"},
+			},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/home", Name: "/pathA"},
+				{Scope: "/defaultB", Name: "/pathB"},
+			},
+		},
+		{
+			name: "Single empty scope path",
+			user: &users.User{
+				Scopes: []users.SourceScope{
+					{Scope: "", Name: "/pathB"},
+				},
+			},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/defaultB", Name: "/pathB"},
+			},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/defaultA", Name: "/pathA"},
+				{Scope: "/defaultB", Name: "/pathB"},
+			},
+		},
+		{
+			name: "Two scopes, one includes username in path",
+			user: &users.User{
+				Username: "user123",
+				Scopes: []users.SourceScope{
+					{Scope: "/home/user123", Name: "/pathA"},
+					{Scope: "/data", Name: "/pathB"},
+				},
+			},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/home/user123", Name: "/pathA"},
+				{Scope: "/data", Name: "/pathB"},
+			},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/home/user123", Name: "/pathA"},
+				{Scope: "/data", Name: "/pathB"},
+			},
+		},
+		{
+			name: "Two scopes, one with empty name",
+			user: &users.User{
+				Scopes: []users.SourceScope{
+					{Scope: "/home", Name: "/pathB"},
+					{Scope: "/data", Name: "/somethingElse"},
+				},
+			},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/home", Name: "/pathB"},
+				{Scope: "/data", Name: "/somethingElse"},
+			},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/defaultA", Name: "/pathA"},
+				{Scope: "/home", Name: "/pathB"},
+				{Scope: "/data", Name: "/somethingElse"},
+			},
+		},
+		{
+			name: "No scopes at all",
+			user: &users.User{
+				Scopes: []users.SourceScope{},
+			},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/defaultB", Name: "/pathB"},
+			},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/defaultA", Name: "/pathA"},
+				{Scope: "/defaultB", Name: "/pathB"},
+			},
+		},
+		{
+			name: "All user Scope and source change",
+			user: &users.User{
+				Username: "user123",
+				Scopes: []users.SourceScope{
+					{Scope: "/defaultC/user123", Name: "/pathC"},
+					{Scope: "/defaultA/user123", Name: "/pathA"},
+					{Scope: "/defaultB/user123", Name: "/pathB"},
+				},
+			},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/defaultA/user123", Name: "/pathA"},
+				{Scope: "/defaultB/user123", Name: "/pathB"},
+				{Scope: "/defaultC/user123", Name: "/pathC"},
+			},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/defaultA/user123", Name: "/pathA"},
+				{Scope: "/defaultB/user123", Name: "/pathB"},
+				{Scope: "/defaultC/user123", Name: "/pathC"},
+			},
+		},
+	}
+
+	// ---------------------
+	// Phase 1 Tests
+	// ---------------------
+	for _, tc := range testCases {
+		t.Run(tc.name+"_Phase1", func(t *testing.T) {
+			originalScopes := tc.user.Scopes
+			updated := updateUserScopes(tc.user)
+			assert.Equal(t, tc.expectedPhase1, tc.user.Scopes, "Phase1 scope mismatch for test case: %s", tc.name)
+			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.Scopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.Scopes, tc.expectedPhase1)
+		})
+	}
+
+	// ---------------------
+	// Phase 2: rename sources but keep same paths
+	// ---------------------
+	sourceA = settings.Source{Path: "/pathA", Name: "sourceA", Config: settings.SourceConfig{
+		DefaultEnabled:   true,
+		DefaultUserScope: "/defaultA",
+		CreateUserDir:    true,
+	}}
+	sourceB = settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
+	settings.Config.Server.Sources = []settings.Source{sourceA, sourceB}
+	settings.Config.Server.DefaultSource = sourceB
+	settings.Config.Server.SourceMap = map[string]settings.Source{
+		"/pathA": sourceA,
+		"/pathB": sourceB,
+	}
+	settings.Config.Server.NameToSource = map[string]settings.Source{
+		"sourceA": sourceA,
+		"sourceB": sourceB,
+	}
+
+	// Run again without resetting user objects to test idempotency + renaming
+	for _, tc := range testCases {
+		t.Run(tc.name+"_Phase2", func(t *testing.T) {
+			originalScopes := tc.user.Scopes
+			updated := updateUserScopes(tc.user)
+			assert.Equal(t, tc.expectedPhase2, tc.user.Scopes, "Phase2 scope mismatch for test case: %s", tc.name)
+			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.Scopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.Scopes, tc.expectedPhase1)
+
+		})
+	}
+}

backend/cmd/users.go

@@ -1,58 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-	"strconv"
-	"text/tabwriter"
-
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/users"
-)
-
-func init() {
-	rootCmd.AddCommand(usersCmd)
-}
-
-var usersCmd = &cobra.Command{
-	Use:   "users",
-	Short: "Users management utility",
-	Long:  `Users management utility.`,
-	Args:  cobra.NoArgs,
-}
-
-func printUsers(usrs []*users.User) {
-	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0) //nolint:gomnd
-	fmt.Fprintln(w, "ID\tUsername\tScope\tLocale\tV. Mode\tS.Click\tAdmin\tExecute\tCreate\tRename\tModify\tDelete\tShare\tDownload\tPwd Lock")
-
-	for _, u := range usrs {
-		fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t\n",
-			u.ID,
-			u.Username,
-			u.Scope,
-			u.Locale,
-			u.ViewMode,
-			u.SingleClick,
-			u.Perm.Admin,
-			u.Perm.Execute,
-			u.Perm.Create,
-			u.Perm.Rename,
-			u.Perm.Modify,
-			u.Perm.Delete,
-			u.Perm.Share,
-			u.Perm.Download,
-			u.LockPassword,
-		)
-	}
-
-	w.Flush()
-}
-
-func parseUsernameOrID(arg string) (username string, id uint) {
-	id64, err := strconv.ParseUint(arg, 10, 64)
-	if err != nil {
-		return arg, 0
-	}
-	return "", uint(id64)
-}

backend/cmd/users_add.go

@@ -1,40 +0,0 @@
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/users"
-)
-
-func init() {
-	usersCmd.AddCommand(usersAddCmd)
-}
-
-var usersAddCmd = &cobra.Command{
-	Use:   "add <username> <password>",
-	Short: "Create a new user",
-	Long:  `Create a new user and add it to the database.`,
-	Args:  cobra.ExactArgs(2), //nolint:gomnd
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		user := &users.User{
-			Username:     args[0],
-			Password:     args[1],
-			LockPassword: mustGetBool(cmd.Flags(), "lockPassword"),
-		}
-		servSettings, err := d.store.Settings.GetServer()
-		checkErr(err)
-		// since getUserDefaults() polluted s.Defaults.Scope
-		// which makes the Scope not the one saved in the db
-		// we need the right s.Defaults.Scope here
-		s2, err := d.store.Settings.Get()
-		checkErr(err)
-
-		userHome, err := s2.MakeUserDir(user.Username, user.Scope, servSettings.Root)
-		checkErr(err)
-		user.Scope = userHome
-
-		err = d.store.Users.Save(user)
-		checkErr(err)
-		printUsers([]*users.User{user})
-	}, pythonConfig{}),
-}

backend/cmd/users_export.go

@@ -1,24 +0,0 @@
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-)
-
-func init() {
-	usersCmd.AddCommand(usersExportCmd)
-}
-
-var usersExportCmd = &cobra.Command{
-	Use:   "export <path>",
-	Short: "Export all users to a file.",
-	Long: `Export all users to a json or yaml file. Please indicate the
-path to the file where you want to write the users.`,
-	Args: jsonYamlArg,
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		list, err := d.store.Users.Gets("")
-		checkErr(err)
-
-		err = marshal(args[0], list)
-		checkErr(err)
-	}, pythonConfig{}),
-}

backend/cmd/users_find.go

@@ -1,51 +0,0 @@
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/users"
-)
-
-func init() {
-	usersCmd.AddCommand(usersFindCmd)
-	usersCmd.AddCommand(usersLsCmd)
-}
-
-var usersFindCmd = &cobra.Command{
-	Use:   "find <id|username>",
-	Short: "Find a user by username or id",
-	Long:  `Find a user by username or id. If no flag is set, all users will be printed.`,
-	Args:  cobra.ExactArgs(1),
-	Run:   findUsers,
-}
-
-var usersLsCmd = &cobra.Command{
-	Use:   "ls",
-	Short: "List all users.",
-	Args:  cobra.NoArgs,
-	Run:   findUsers,
-}
-
-var findUsers = python(func(cmd *cobra.Command, args []string, d pythonData) {
-	var (
-		list []*users.User
-		user *users.User
-		err  error
-	)
-
-	if len(args) == 1 {
-		username, id := parseUsernameOrID(args[0])
-		if username != "" {
-			user, err = d.store.Users.Get("", username)
-		} else {
-			user, err = d.store.Users.Get("", id)
-		}
-
-		list = []*users.User{user}
-	} else {
-		list, err = d.store.Users.Gets("")
-	}
-
-	checkErr(err)
-	printUsers(list)
-}, pythonConfig{})

backend/cmd/users_import.go

@@ -1,89 +0,0 @@
-package cmd
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/users"
-)
-
-func init() {
-	usersCmd.AddCommand(usersImportCmd)
-	usersImportCmd.Flags().Bool("overwrite", false, "overwrite users with the same id/username combo")
-	usersImportCmd.Flags().Bool("replace", false, "replace the entire user base")
-}
-
-var usersImportCmd = &cobra.Command{
-	Use:   "import <path>",
-	Short: "Import users from a file",
-	Long: `Import users from a file. The path must be for a json or yaml
-file. You can use this command to import new users to your
-installation. For that, just don't place their ID on the files
-list or set it to 0.`,
-	Args: jsonYamlArg,
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		fd, err := os.Open(args[0])
-		checkErr(err)
-		defer fd.Close()
-
-		list := []*users.User{}
-		err = unmarshal(args[0], &list)
-		checkErr(err)
-
-		for _, user := range list {
-			err = user.Clean("")
-			checkErr(err)
-		}
-
-		if mustGetBool(cmd.Flags(), "replace") {
-			oldUsers, err := d.store.Users.Gets("")
-			checkErr(err)
-
-			err = marshal("users.backup.json", list)
-			checkErr(err)
-
-			for _, user := range oldUsers {
-				err = d.store.Users.Delete(user.ID)
-				checkErr(err)
-			}
-		}
-
-		overwrite := mustGetBool(cmd.Flags(), "overwrite")
-
-		for _, user := range list {
-			onDB, err := d.store.Users.Get("", user.ID)
-
-			// User exists in DB.
-			if err == nil {
-				if !overwrite {
-					checkErr(errors.New("user " + strconv.Itoa(int(user.ID)) + " is already registred"))
-				}
-
-				// If the usernames mismatch, check if there is another one in the DB
-				// with the new username. If there is, print an error and cancel the
-				// operation
-				if user.Username != onDB.Username {
-					if conflictuous, err := d.store.Users.Get("", user.Username); err == nil { //nolint:govet
-						checkErr(usernameConflictError(user.Username, conflictuous.ID, user.ID))
-					}
-				}
-			} else {
-				// If it doesn't exist, set the ID to 0 to automatically get a new
-				// one that make sense in this DB.
-				user.ID = 0
-			}
-
-			err = d.store.Users.Save(user)
-			checkErr(err)
-		}
-	}, pythonConfig{}),
-}
-
-func usernameConflictError(username string, originalID, newID uint) error {
-	return fmt.Errorf(`can't import user with ID %d and username "%s" because the username is already registred with the user %d`,
-		newID, username, originalID)
-}

backend/cmd/users_rm.go

@@ -1,31 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-)
-
-func init() {
-	usersCmd.AddCommand(usersRmCmd)
-}
-
-var usersRmCmd = &cobra.Command{
-	Use:   "rm <id|username>",
-	Short: "Delete a user by username or id",
-	Long:  `Delete a user by username or id`,
-	Args:  cobra.ExactArgs(1),
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		username, id := parseUsernameOrID(args[0])
-		var err error
-
-		if username != "" {
-			err = d.store.Users.Delete(username)
-		} else {
-			err = d.store.Users.Delete(id)
-		}
-
-		checkErr(err)
-		fmt.Println("user deleted successfully")
-	}, pythonConfig{}),
-}

backend/cmd/users_update.go

@@ -1,38 +0,0 @@
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/users"
-)
-
-func init() {
-	usersCmd.AddCommand(usersUpdateCmd)
-}
-
-var usersUpdateCmd = &cobra.Command{
-	Use:   "update <id|username>",
-	Short: "Updates an existing user",
-	Long: `Updates an existing user. Set the flags for the
-options you want to change.`,
-	Args: cobra.ExactArgs(1),
-	Run: python(func(cmd *cobra.Command, args []string, d pythonData) {
-		username, id := parseUsernameOrID(args[0])
-
-		var (
-			err  error
-			user *users.User
-		)
-
-		if id != 0 {
-			user, err = d.store.Users.Get("", id)
-		} else {
-			user, err = d.store.Users.Get("", username)
-		}
-		checkErr(err)
-
-		err = d.store.Users.Update(user)
-		checkErr(err)
-		printUsers([]*users.User{user})
-	}, pythonConfig{}),
-}

backend/cmd/utils.go

@@ -1,152 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"errors"
-	"log"
-	"os"
-	"path/filepath"
-
-	"github.com/asdine/storm/v3"
-	"github.com/goccy/go-yaml"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-
-	"github.com/gtsteffaniak/filebrowser/settings"
-	"github.com/gtsteffaniak/filebrowser/storage"
-	"github.com/gtsteffaniak/filebrowser/storage/bolt"
-)
-
-func checkErr(err error) {
-	if err != nil {
-		log.Fatal(err)
-	}
-}
-
-func mustGetString(flags *pflag.FlagSet, flag string) string {
-	s, err := flags.GetString(flag)
-	checkErr(err)
-	return s
-}
-
-func mustGetBool(flags *pflag.FlagSet, flag string) bool {
-	b, err := flags.GetBool(flag)
-	checkErr(err)
-	return b
-}
-
-func mustGetUint(flags *pflag.FlagSet, flag string) uint {
-	b, err := flags.GetUint(flag)
-	checkErr(err)
-	return b
-}
-
-func generateKey() []byte {
-	k, err := settings.GenerateKey()
-	checkErr(err)
-	return k
-}
-
-type cobraFunc func(cmd *cobra.Command, args []string)
-type pythonFunc func(cmd *cobra.Command, args []string, data pythonData)
-
-type pythonConfig struct {
-	noDB      bool
-	allowNoDB bool
-}
-
-type pythonData struct {
-	hadDB bool
-	store *storage.Storage
-}
-
-func dbExists(path string) (bool, error) {
-	stat, err := os.Stat(path)
-	if err == nil {
-		return stat.Size() != 0, nil
-	}
-
-	if os.IsNotExist(err) {
-		d := filepath.Dir(path)
-		_, err = os.Stat(d)
-		if os.IsNotExist(err) {
-			if err := os.MkdirAll(d, 0700); err != nil { //nolint:govet,gomnd
-				return false, err
-			}
-			return false, nil
-		}
-	}
-
-	return false, err
-}
-
-func python(fn pythonFunc, cfg pythonConfig) cobraFunc {
-	return func(cmd *cobra.Command, args []string) {
-		data := pythonData{hadDB: true}
-		path := settings.Config.Server.Database
-		exists, err := dbExists(path)
-
-		if err != nil {
-			panic(err)
-		} else if exists && cfg.noDB {
-			log.Fatal(path + " already exists")
-		} else if !exists && !cfg.noDB && !cfg.allowNoDB {
-			log.Fatal(path + " does not exist. Please run 'filebrowser config init' first.")
-		}
-
-		data.hadDB = exists
-		db, err := storm.Open(path)
-		checkErr(err)
-
-		defer db.Close()
-		data.store, err = bolt.NewStorage(db)
-		checkErr(err)
-		fn(cmd, args, data)
-	}
-}
-
-func marshal(filename string, data interface{}) error {
-	fd, err := os.Create(filename)
-	checkErr(err)
-	defer fd.Close()
-
-	switch ext := filepath.Ext(filename); ext {
-	case ".json":
-		encoder := json.NewEncoder(fd)
-		encoder.SetIndent("", "    ")
-		return encoder.Encode(data)
-	case ".yml", ".yaml": //nolint:goconst
-		_, err := yaml.Marshal(fd)
-		return err
-	default:
-		return errors.New("invalid format: " + ext)
-	}
-}
-
-func unmarshal(filename string, data interface{}) error {
-	fd, err := os.Open(filename)
-	checkErr(err)
-	defer fd.Close()
-
-	switch ext := filepath.Ext(filename); ext {
-	case ".json":
-		return json.NewDecoder(fd).Decode(data)
-	case ".yml", ".yaml":
-		return yaml.NewDecoder(fd).Decode(data)
-	default:
-		return errors.New("invalid format: " + ext)
-	}
-}
-
-func jsonYamlArg(cmd *cobra.Command, args []string) error {
-	if err := cobra.ExactArgs(1)(cmd, args); err != nil {
-		return err
-	}
-
-	switch ext := filepath.Ext(args[0]); ext {
-	case ".json", ".yml", ".yaml":
-		return nil
-	default:
-		return errors.New("invalid format: " + ext)
-	}
-}

backend/cmd/version.go

@@ -1,21 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-
-	"github.com/gtsteffaniak/filebrowser/version"
-)
-
-func init() {
-	rootCmd.AddCommand(versionCmd)
-}
-
-var versionCmd = &cobra.Command{
-	Use:   "version",
-	Short: "Print the version number",
-	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Println("File Browser v" + version.Version + "/" + version.CommitSHA)
-	},
-}

backend/common/errors/errors.go

@@ -18,4 +18,7 @@ var (
 	ErrInvalidRequestParams = errors.New("invalid request params")
 	ErrSourceIsParent       = errors.New("source is parent")
 	ErrRootUserDeletion     = errors.New("user with id 1 can't be deleted")
+	ErrNoTotpProvided       = errors.New("OTP code is required for user")
+	ErrNoTotpConfigured     = errors.New("OTP is enforced, but user is not yet configured")
+	ErrUnauthorized         = errors.New("user unauthorized")
 )

backend/common/settings/auth.go

@@ -0,0 +1,108 @@
+package settings
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+type Auth struct {
+	TokenExpirationHours int          `json:"tokenExpirationHours"` // the number of hours until the token expires. Default is 2 hours.
+	Methods              LoginMethods `json:"methods"`
+	Key                  string       `json:"key"`               // the key used to sign the JWT tokens. If not set, a random key will be generated.
+	AdminUsername        string       `json:"adminUsername"`     // the username of the admin user. If not set, the default is "admin".
+	AdminPassword        string       `json:"adminPassword"`     // the password of the admin user. If not set, the default is "admin".
+	ResetAdminOnStart    bool         `json:"resetAdminOnStart"` // if set to true, the admin user will be reset to the default username and password on startup.
+	TotpSecret           string       `json:"totpSecret"`        // secret used to encrypt TOTP secrets
+	AuthMethods          []string     `json:"-"`
+}
+
+type LoginMethods struct {
+	ProxyAuth    ProxyAuthConfig    `json:"proxy" validate:"omitempty"`
+	NoAuth       bool               `json:"noauth"` // if set to true, overrides all other auth methods and disables authentication
+	PasswordAuth PasswordAuthConfig `json:"password" validate:"omitempty"`
+	OidcAuth     OidcConfig         `json:"oidc" validate:"omitempty"`
+}
+
+type PasswordAuthConfig struct {
+	Enabled     bool      `json:"enabled"`
+	MinLength   int       `json:"minLength" validate:"omitempty,min=5"` // minimum pasword length required.
+	Signup      bool      `json:"signup" validate:"omitempty"`          // allow signups on login page if enabled -- not secure.
+	Recaptcha   Recaptcha `json:"recaptcha" validate:"omitempty"`       // recaptcha config, only used if signup is enabled
+	EnforcedOtp bool      `json:"enforcedOtp"`                          // if set to true, TOTP is enforced for all password users users. Otherwise, users can choose to enable TOTP.
+}
+
+type ProxyAuthConfig struct {
+	Enabled           bool   `json:"enabled"`
+	CreateUser        bool   `json:"createUser"`        // create user if not exists
+	Header            string `json:"header"`            // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
+	LogoutRedirectUrl string `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
+}
+
+type Recaptcha struct {
+	Host   string `json:"host" validate:"required"`
+	Key    string `json:"key" validate:"required"`
+	Secret string `json:"secret" validate:"required"`
+}
+
+// OpenID OAuth2.0
+type OidcConfig struct {
+	Enabled           bool                  `json:"enabled"`           // whether to enable OIDC authentication
+	ClientID          string                `json:"clientId"`          // client id of the OIDC application
+	ClientSecret      string                `json:"clientSecret"`      // client secret of the OIDC application
+	IssuerUrl         string                `json:"issuerUrl"`         // authorization URL of the OIDC provider
+	Scopes            string                `json:"scopes"`            // scopes to request from the OIDC provider
+	UserIdentifier    string                `json:"userIdentifier"`    // the user identifier to use for authentication. Default is "username", can be "email" or "username", or "phone"
+	DisableVerifyTLS  bool                  `json:"disableVerifyTLS"`  // disable TLS verification for the OIDC provider. This is insecure and should only be used for testing.
+	LogoutRedirectUrl string                `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
+	CreateUser        bool                  `json:"createUser"`        // create user if not exists
+	AdminGroup        string                `json:"adminGroup"`        // if set, users in this group will be granted admin privileges.
+	Provider          *oidc.Provider        `json:"-"`                 // OIDC provider
+	Verifier          *oidc.IDTokenVerifier `json:"-"`                 // OIDC verifier
+}
+
+// ValidateOidcAuth processes the OIDC callback and retrieves user identity
+func validateOidcAuth() error {
+	oidcCfg := &Config.Auth.Methods.OidcAuth // Use a pointer to modify the original config
+	if !oidcCfg.Enabled {
+		return errors.New("OIDC is not enabled")
+	}
+	if oidcCfg.UserIdentifier == "" {
+		oidcCfg.UserIdentifier = "username"
+	}
+
+	ctx := context.Background()
+
+	// If disableVerifyTLS is true, create a custom HTTP client
+	// and set it in the context for the OIDC provider.
+	if oidcCfg.DisableVerifyTLS {
+		// Create a custom transport with InsecureSkipVerify set to true
+		transport := &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		}
+		customClient := &http.Client{
+			Transport: transport,
+		}
+		// Use oidc.ClientContext to pass the custom client to the OIDC library
+		ctx = oidc.ClientContext(ctx, customClient)
+		// Log that TLS verification is disabled (important for security awareness)
+		logger.Warning("OIDC TLS verification is disabled.")
+	}
+
+	provider, err := oidc.NewProvider(ctx, oidcCfg.IssuerUrl)
+	if err != nil {
+		return fmt.Errorf("url '%v' failed to create OIDC provider: %w", oidcCfg.IssuerUrl, err)
+	}
+	oidcCfg.Provider = provider
+	oidcCfg.Verifier = provider.Verifier(&oidc.Config{ClientID: oidcCfg.ClientID})
+	if oidcCfg.Scopes == "" {
+		oidcCfg.Scopes = "openid email profile"
+	}
+
+	return nil
+}

backend/common/settings/config.go

@@ -0,0 +1,448 @@
+package settings
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/go-playground/validator/v10"
+	"github.com/goccy/go-yaml"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+var Config Settings
+
+const (
+	generatorPath = "/relative/or/absolute/path"
+)
+
+func Initialize(configFile string) {
+	err := loadConfigWithDefaults(configFile)
+	if err != nil {
+		logger.Fatal(err.Error())
+	}
+	err = ValidateConfig(Config)
+	if err != nil {
+		errmsg := "The provided config file failed validation. "
+		errmsg += "If you are seeing this on a config that worked previeously, "
+		errmsg += "please review your config for typos and invalid keys which are no longer supported. "
+		errmsg += "visit https://github.com/gtsteffaniak/filebrowser/wiki/Full-Config-Example for more information."
+		logger.Error(errmsg)
+		time.Sleep(5 * time.Second) // allow sleep time before exiting to give docker/kubernetes time before restarting
+		logger.Fatal(err.Error())
+	}
+	setupLogging()
+	setupAuth()
+	setupSources(false)
+	setupUrls()
+	setupFrontend()
+}
+
+func setupFrontend() {
+	if !Config.Frontend.DisableDefaultLinks {
+		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
+			Text:  fmt.Sprintf("(%v)", version.Version),
+			Title: version.CommitSHA,
+			Url:   "https://github.com/gtsteffaniak/filebrowser/releases/",
+		})
+		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
+			Text: "Help",
+			Url:  "https://github.com/gtsteffaniak/filebrowser/wiki",
+		})
+	}
+}
+
+func getRealPath(path string) string {
+	realPath, err := filepath.Abs(path)
+	if err != nil {
+		logger.Fatalf("could not find configured source path: %v", err)
+	}
+	// check path exists
+	if _, err = os.Stat(realPath); os.IsNotExist(err) {
+		logger.Fatalf("configured source path does not exist: %v", realPath)
+	}
+	return realPath
+}
+
+func setupSources(generate bool) {
+	if len(Config.Server.Sources) == 0 {
+		logger.Fatal("There are no `server.sources` configured. If you have `server.root` configured, please update the config and add at least one `server.sources` with a `path` configured.")
+	} else {
+		for k, source := range Config.Server.Sources {
+			realPath := getRealPath(source.Path)
+			name := filepath.Base(realPath)
+			if name == "\\" {
+				name = strings.Split(realPath, ":")[0]
+			}
+			if generate {
+				source.Path = generatorPath // use placeholder path
+			} else {
+				source.Path = realPath // use absolute path
+			}
+			if source.Name == "" {
+				_, ok := Config.Server.SourceMap[source.Path]
+				if ok {
+					source.Name = name + fmt.Sprintf("-%v", k)
+				} else {
+					source.Name = name
+				}
+				if Config.Server.DefaultSource.Path == "" {
+					Config.Server.DefaultSource = source
+				}
+			}
+			if source.Config.DefaultUserScope == "" {
+				source.Config.DefaultUserScope = "/"
+			}
+			Config.Server.SourceMap[source.Path] = source
+			Config.Server.NameToSource[source.Name] = source
+		}
+	}
+	// clean up the in memory source list to be accurate and unique
+	sourceList := []Source{}
+	defaultScopes := []users.SourceScope{}
+	allSourceNames := []string{}
+	first := true
+	potentialDefaultSource := Config.Server.DefaultSource
+	for _, sourcePathOnly := range Config.Server.Sources {
+		realPath := getRealPath(sourcePathOnly.Path)
+		if generate {
+			realPath = generatorPath // use placeholder path
+		}
+		source, ok := Config.Server.SourceMap[realPath]
+		if ok && !slices.Contains(allSourceNames, source.Name) {
+			if first {
+				potentialDefaultSource = source
+			}
+			first = false
+			sourceList = append(sourceList, source)
+			if source.Config.DefaultEnabled {
+				if Config.Server.DefaultSource.Path == "" {
+					Config.Server.DefaultSource = source
+				}
+				defaultScopes = append(defaultScopes, users.SourceScope{
+					Name:  source.Path,
+					Scope: source.Config.DefaultUserScope,
+				})
+			}
+			allSourceNames = append(allSourceNames, source.Name)
+		} else {
+			logger.Warningf("source %v is not configured correctly, skipping", sourcePathOnly.Path)
+		}
+	}
+	if Config.Server.DefaultSource.Path == "" {
+		Config.Server.DefaultSource = potentialDefaultSource
+	}
+	sourceList2 := []Source{}
+	for _, s := range sourceList {
+		if s.Path == Config.Server.DefaultSource.Path {
+			s.Config.DefaultEnabled = true
+			Config.Server.SourceMap[s.Path] = s
+			Config.Server.NameToSource[s.Name] = s
+		}
+		sourceList2 = append(sourceList2, s)
+	}
+	sourceList = sourceList2
+	Config.UserDefaults.DefaultScopes = defaultScopes
+	Config.Server.Sources = sourceList
+}
+
+func setupUrls() {
+	baseurl := strings.Trim(Config.Server.BaseURL, "/")
+	if baseurl == "" {
+		Config.Server.BaseURL = "/"
+	} else {
+		Config.Server.BaseURL = "/" + baseurl + "/"
+	}
+	Config.Server.InternalUrl = strings.Trim(Config.Server.InternalUrl, "/")
+	Config.Server.ExternalUrl = strings.Trim(Config.Server.ExternalUrl, "/")
+	Config.Integrations.OnlyOffice.Url = strings.Trim(Config.Integrations.OnlyOffice.Url, "/")
+	Config.Integrations.OnlyOffice.InternalUrl = strings.Trim(Config.Integrations.OnlyOffice.InternalUrl, "/")
+}
+
+func setupAuth() {
+	if Config.Auth.Methods.PasswordAuth.Enabled {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "password")
+	}
+	if Config.Auth.Methods.ProxyAuth.Enabled {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "proxy")
+	}
+	if Config.Auth.Methods.OidcAuth.Enabled {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "oidc")
+	}
+	if Config.Auth.Methods.NoAuth {
+		logger.Warning("Configured with no authentication, this is not recommended.")
+		Config.Auth.AuthMethods = []string{"disabled"}
+	}
+	if Config.Auth.Methods.OidcAuth.Enabled {
+		err := validateOidcAuth()
+		if err != nil {
+			logger.Fatalf("Error validating OIDC auth: %v", err)
+		}
+		logger.Info("OIDC Auth configured successfully")
+	}
+
+	// use password auth as default if no auth methods are set
+	if len(Config.Auth.AuthMethods) == 0 {
+		Config.Auth.Methods.PasswordAuth.Enabled = true
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "password")
+	}
+	Config.UserDefaults.LoginMethod = Config.Auth.AuthMethods[0]
+
+}
+
+func setupLogging() {
+	if len(Config.Server.Logging) == 0 {
+		Config.Server.Logging = []LogConfig{
+			{
+				Output: "stdout",
+			},
+		}
+	}
+	for _, logConfig := range Config.Server.Logging {
+		logConfig := logger.JsonConfig{
+			Levels:    logConfig.Levels,
+			ApiLevels: logConfig.ApiLevels,
+			Output:    logConfig.Output,
+			Utc:       logConfig.Utc,
+			NoColors:  logConfig.NoColors,
+			Json:      logConfig.Json,
+		}
+		err := logger.SetupLogger(logConfig)
+		if err != nil {
+			log.Println("[ERROR] Failed to set up logger:", err)
+		}
+	}
+}
+
+func loadConfigWithDefaults(configFile string) error {
+	Config = setDefaults()
+	// Open and read the YAML file
+	yamlFile, err := os.Open(configFile)
+	if err != nil {
+		logger.Warningf("could not open config file '%v', using default settings", configFile)
+		Config.Server.Sources = []Source{
+			{
+				Path: ".",
+			},
+		}
+		loadEnvConfig()
+		return nil
+	}
+	defer yamlFile.Close()
+	stat, err := yamlFile.Stat()
+	if err != nil {
+		return err
+	}
+	yamlData := make([]byte, stat.Size())
+	_, err = yamlFile.Read(yamlData)
+	if err != nil && configFile != "config.yaml" {
+		return fmt.Errorf("could not load specified config file: %v", err.Error())
+	}
+	if err != nil {
+		logger.Warningf("Could not load config file '%v', using default settings: %v", configFile, err)
+	}
+	err = yaml.NewDecoder(strings.NewReader(string(yamlData)), yaml.DisallowUnknownField()).Decode(&Config)
+	if err != nil {
+		return fmt.Errorf("error unmarshaling YAML data: %v", err)
+	}
+	loadEnvConfig()
+	return nil
+}
+
+func ValidateConfig(config Settings) error {
+
+	validate := validator.New()
+	err := validate.Struct(Config)
+	if err != nil {
+		return fmt.Errorf("could not validate config: %v", err)
+	}
+	return nil
+}
+
+func loadEnvConfig() {
+
+	adminPassword, ok := os.LookupEnv("FILEBROWSER_ADMIN_PASSWORD")
+	if ok {
+		logger.Info("Using admin password from FILEBROWSER_ADMIN_PASSWORD environment variable")
+		Config.Auth.AdminPassword = adminPassword
+	}
+	officeSecret, ok := os.LookupEnv("FILEBROWSER_ONLYOFFICE_SECRET")
+	if ok {
+		logger.Info("Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable")
+		Config.Integrations.OnlyOffice.Secret = officeSecret
+	}
+
+	ffmpegPath, ok := os.LookupEnv("FILEBROWSER_FFMPEG_PATH")
+	if ok {
+		Config.Integrations.Media.FfmpegPath = ffmpegPath
+	}
+
+}
+
+func setDefaults() Settings {
+	// get number of CPUs available
+	numCpus := 4 // default to 4 CPUs if runtime.NumCPU() fails or is not available
+	if cpus := runtime.NumCPU(); cpus > 0 {
+		numCpus = cpus
+	}
+	return Settings{
+		Server: Server{
+			Port:               80,
+			NumImageProcessors: numCpus,
+			BaseURL:            "",
+			Database:           "database.db",
+			SourceMap:          map[string]Source{},
+			NameToSource:       map[string]Source{},
+			MaxArchiveSizeGB:   50,
+			CacheDir:           "tmp",
+		},
+		Auth: Auth{
+			AdminUsername:        "admin",
+			AdminPassword:        "admin",
+			TokenExpirationHours: 2,
+			Methods: LoginMethods{
+				PasswordAuth: PasswordAuthConfig{
+					Enabled:   true,
+					MinLength: 5,
+					Signup:    false,
+				},
+			},
+		},
+		Frontend: Frontend{
+			Name: "FileBrowser Quantum",
+		},
+		UserDefaults: UserDefaults{
+			DisableOnlyOfficeExt: ".txt .csv .html .pdf",
+			StickySidebar:        true,
+			LockPassword:         false,
+			ShowHidden:           false,
+			DarkMode:             true,
+			DisableSettings:      false,
+			ViewMode:             "normal",
+			Locale:               "en",
+			GallerySize:          3,
+			ThemeColor:           "var(--blue)",
+			Permissions: users.Permissions{
+				Modify: false,
+				Share:  false,
+				Admin:  false,
+				Api:    false,
+			},
+		},
+	}
+}
+
+func ConvertToBackendScopes(scopes []users.SourceScope) ([]users.SourceScope, error) {
+	if len(scopes) == 0 {
+		return Config.UserDefaults.DefaultScopes, nil
+	}
+	newScopes := []users.SourceScope{}
+	for _, scope := range scopes {
+
+		// first check if its already a path name and keep it
+		source, ok := Config.Server.SourceMap[scope.Name]
+		if ok {
+			if scope.Scope == "" {
+				scope.Scope = source.Config.DefaultUserScope
+			}
+			if !strings.HasPrefix(scope.Scope, "/") {
+				scope.Scope = "/" + scope.Scope
+			}
+			if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
+				scope.Scope = strings.TrimSuffix(scope.Scope, "/")
+			}
+			newScopes = append(newScopes, users.SourceScope{
+				Name:  source.Path, // backend name is path
+				Scope: scope.Scope,
+			})
+			continue
+		}
+
+		// check if its the name of a source and convert it to a path
+		source, ok = Config.Server.NameToSource[scope.Name]
+		if !ok {
+			// source might no longer be configured
+			continue
+		}
+		if scope.Scope == "" {
+			scope.Scope = source.Config.DefaultUserScope
+		}
+		if !strings.HasPrefix(scope.Scope, "/") {
+			scope.Scope = "/" + scope.Scope
+		}
+		if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
+			scope.Scope = strings.TrimSuffix(scope.Scope, "/")
+		}
+		newScopes = append(newScopes, users.SourceScope{
+			Name:  source.Path, // backend name is path
+			Scope: scope.Scope,
+		})
+	}
+	return newScopes, nil
+}
+
+func ConvertToFrontendScopes(scopes []users.SourceScope) []users.SourceScope {
+	newScopes := []users.SourceScope{}
+	for _, scope := range scopes {
+		if source, ok := Config.Server.SourceMap[scope.Name]; ok {
+			// Replace scope.Name with source.Path while keeping the same Scope value
+			newScopes = append(newScopes, users.SourceScope{
+				Name:  source.Name,
+				Scope: scope.Scope,
+			})
+		}
+	}
+	return newScopes
+}
+
+func HasSourceByPath(scopes []users.SourceScope, sourcePath string) bool {
+	for _, scope := range scopes {
+		if scope.Name == sourcePath {
+			return true
+		}
+	}
+	return false
+}
+
+func GetScopeFromSourceName(scopes []users.SourceScope, sourceName string) (string, error) {
+	source, ok := Config.Server.NameToSource[sourceName]
+	if !ok {
+		logger.Debug("Could not get scope from source name: ", sourceName)
+		return "", fmt.Errorf("source with name not found %v", sourceName)
+	}
+	for _, scope := range scopes {
+		if scope.Name == source.Path {
+			return scope.Scope, nil
+		}
+	}
+	logger.Debugf("scope not found for source %v", sourceName)
+	return "", fmt.Errorf("scope not found for source %v", sourceName)
+}
+
+func GetScopeFromSourcePath(scopes []users.SourceScope, sourcePath string) (string, error) {
+	for _, scope := range scopes {
+		if scope.Name == sourcePath {
+			return scope.Scope, nil
+		}
+	}
+	return "", fmt.Errorf("scope not found for source %v", sourcePath)
+}
+
+// assumes backend style scopes
+func GetSources(u *users.User) []string {
+	sources := []string{}
+	for _, scope := range u.Scopes {
+		source, ok := Config.Server.SourceMap[scope.Name]
+		if ok {
+			sources = append(sources, source.Name)
+		}
+	}
+	return sources
+}

backend/common/settings/config_test.go

@@ -0,0 +1,101 @@
+package settings
+
+import (
+	"os"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestInitialize(t *testing.T) {
+	type args struct {
+		configFile string
+	}
+	tests := []struct {
+		name string
+		args args
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			Initialize(tt.args.configFile)
+		})
+	}
+}
+
+func Test_setDefaults(t *testing.T) {
+	tests := []struct {
+		name string
+		want Settings
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := setDefaults(); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("setDefaults() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestConfigLoadChanged(t *testing.T) {
+	defaultConfig := setDefaults()
+	err := loadConfigWithDefaults("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	// Use go-cmp to compare the two structs
+	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
+		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
+	}
+}
+
+func TestConfigLoadEnvVars(t *testing.T) {
+	defaultConfig := setDefaults()
+	expectedKey := "MYKEY"
+	// mock environment variables
+	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
+	err := loadConfigWithDefaults("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	if Config.Integrations.OnlyOffice.Secret != expectedKey {
+		t.Errorf("Expected OnlyOffice.Secret to be '%v', got '%s'", expectedKey, Config.Integrations.OnlyOffice.Secret)
+	}
+	// Use go-cmp to compare the two structs
+	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
+		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
+	}
+}
+
+func TestConfigLoadSpecificValues(t *testing.T) {
+	defaultConfig := setDefaults()
+	err := loadConfigWithDefaults("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	testCases := []struct {
+		fieldName string
+		globalVal interface{}
+		newVal    interface{}
+	}{
+		{"Server.Database", Config.Server.Database, defaultConfig.Server.Database},
+	}
+
+	for _, tc := range testCases {
+		if tc.globalVal == tc.newVal {
+			t.Errorf("Differences should have been found:\nConfig.%s: %v \nSetConfig: %v \n", tc.fieldName, tc.globalVal, tc.newVal)
+		}
+	}
+}
+
+func TestInvalidConfig(t *testing.T) {
+	configFile := "./invalidConfig.yaml"
+	err := loadConfigWithDefaults(configFile)
+	if err == nil {
+		t.Fatalf("expected error loading config file %s, got nil", configFile)
+	}
+}

backend/common/settings/generator.go

@@ -0,0 +1,255 @@
+package settings
+
+import (
+	"bytes"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// commentsMap[typeName][fieldName] = combined doc+inline comment text
+type commentsMap map[string]map[string]string
+
+// collectComments parses all Go source in the directory of srcPath and returns commentsMap.
+func collectComments(srcPath string) (commentsMap, error) {
+	// parse entire package so we capture comments on all types
+	dir := filepath.Dir(srcPath)
+	fset := token.NewFileSet()
+	pkgs, err := parser.ParseDir(fset, dir, nil, parser.ParseComments)
+	if err != nil {
+		return nil, err
+	}
+	out := make(commentsMap)
+	for _, pkg := range pkgs {
+		for _, file := range pkg.Files {
+			for _, decl := range file.Decls {
+				gen, ok := decl.(*ast.GenDecl)
+				if !ok || gen.Tok != token.TYPE {
+					continue
+				}
+				for _, spec := range gen.Specs {
+					ts, ok := spec.(*ast.TypeSpec)
+					if !ok {
+						continue
+					}
+					st, ok := ts.Type.(*ast.StructType)
+					if !ok {
+						continue
+					}
+					m := make(map[string]string)
+					out[ts.Name.Name] = m
+					for _, field := range st.Fields.List {
+						if len(field.Names) == 0 {
+							continue
+						}
+						name := field.Names[0].Name
+						var parts []string
+						if field.Doc != nil {
+							parts = append(parts, strings.TrimSpace(field.Doc.Text()))
+						}
+						if field.Comment != nil {
+							parts = append(parts, strings.TrimSpace(field.Comment.Text()))
+						}
+						if len(parts) > 0 {
+							m[name] = strings.Join(parts, " : ")
+						}
+					}
+				}
+			}
+		}
+	}
+	return out, nil
+}
+
+// buildNode constructs a yaml.Node for any Go value, injecting comments on struct fields.
+func buildNode(v reflect.Value, comm commentsMap) (*yaml.Node, error) {
+	// Dereference pointers
+	if v.Kind() == reflect.Ptr {
+		if v.IsNil() {
+			return &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!null", Value: "null"}, nil
+		}
+		return buildNode(v.Elem(), comm)
+	}
+
+	switch v.Kind() {
+	case reflect.Struct:
+		rt := v.Type()
+		typeName := rt.Name()
+		mapNode := &yaml.Node{Kind: yaml.MappingNode}
+		for i := 0; i < rt.NumField(); i++ {
+			sf := rt.Field(i)
+
+			// skip unexported or omitted fields
+			if sf.PkgPath != "" {
+				continue
+			}
+			if yamlTag := sf.Tag.Get("yaml"); yamlTag == "-" {
+				continue
+			}
+			if jsonTag := sf.Tag.Get("json"); jsonTag == "-" {
+				continue
+			}
+
+			// determine key: yaml tag > json tag > field name
+			yamlTag := sf.Tag.Get("yaml")
+			jsonTag := sf.Tag.Get("json")
+			var keyName string
+			if yamlTag != "" && yamlTag != "-" {
+				keyName = strings.Split(yamlTag, ",")[0]
+			} else if jsonTag != "" && jsonTag != "-" {
+				keyName = strings.Split(jsonTag, ",")[0]
+			} else {
+				keyName = sf.Name
+			}
+
+			keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: keyName}
+
+			// attach validate and comments inline
+			var parts []string
+			if cm := comm[typeName][sf.Name]; cm != "" {
+				parts = append(parts, cm)
+			}
+			if vt := sf.Tag.Get("validate"); vt != "" {
+				parts = append(parts, fmt.Sprintf(" validate:%s", vt))
+			}
+
+			if len(parts) > 0 {
+				keyNode.LineComment = strings.Join(parts, " ")
+			}
+
+			valNode, err := buildNode(v.Field(i), comm)
+			if err != nil {
+				return nil, err
+			}
+			mapNode.Content = append(mapNode.Content, keyNode, valNode)
+		}
+		return mapNode, nil
+
+	case reflect.Slice, reflect.Array:
+		seq := &yaml.Node{Kind: yaml.SequenceNode}
+		// for non-struct slices, render inline [] via flow style
+		if v.Type().Elem().Kind() != reflect.Struct {
+			seq.Style = yaml.FlowStyle
+		}
+		// placeholder for empty slice of structs
+		if v.Len() == 0 && v.Type().Elem().Kind() == reflect.Struct {
+			zero := reflect.Zero(v.Type().Elem())
+			n, err := buildNode(zero, comm)
+			if err != nil {
+				return nil, err
+			}
+			seq.Content = append(seq.Content, n)
+			return seq, nil
+		}
+		for i := 0; i < v.Len(); i++ {
+			n, err := buildNode(v.Index(i), comm)
+			if err != nil {
+				return nil, err
+			}
+			seq.Content = append(seq.Content, n)
+		}
+		return seq, nil
+
+	default:
+		n := &yaml.Node{}
+		if err := n.Encode(v.Interface()); err != nil {
+			return nil, err
+		}
+		return n, nil
+	}
+}
+
+func GenerateYaml() {
+	_ = loadConfigWithDefaults("")
+	Config.Server.Sources = []Source{
+		{
+			Path: ".",
+		},
+	}
+
+	setupLogging()
+	setupAuth()
+	setupSources(true)
+	setupUrls()
+	setupFrontend()
+	input := "common/settings/settings.go" // "path to Go source file or directory containing structs"
+	output := "generated.yaml"             // "output YAML file"
+
+	comm, err := collectComments(input)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error parsing comments: %v\n", err)
+		os.Exit(1)
+	}
+
+	node, err := buildNode(reflect.ValueOf(Config), comm)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error building YAML node: %v\n", err)
+		os.Exit(1)
+	}
+
+	doc := &yaml.Node{Kind: yaml.DocumentNode}
+	doc.Content = []*yaml.Node{node}
+
+	var rawBuf bytes.Buffer
+	enc := yaml.NewEncoder(&rawBuf)
+	enc.SetIndent(2)
+	if err := enc.Encode(doc); err != nil {
+		fmt.Fprintf(os.Stderr, "error encoding YAML: %v\n", err)
+		os.Exit(1)
+	}
+
+	aligned := alignComments(rawBuf.String())
+
+	if err := os.WriteFile(output, []byte(aligned), 0644); err != nil {
+		fmt.Fprintf(os.Stderr, "error writing YAML: %v\n", err)
+		os.Exit(1)
+	}
+	fmt.Printf("Generated YAML with comments: %s\n", output)
+}
+
+// formatLine applies padding to a single line so its comment starts at a target column.
+func formatLine(line string) string {
+	const targetCol = 42
+	const defaultPadding = 1
+
+	idx := strings.Index(line, "#")
+	// If there's no comment, do nothing.
+	if idx == -1 {
+		return line
+	}
+
+	// Separate the content (before #) from the comment (from # onwards).
+	contentPart := line[:idx]
+	commentPart := line[idx:]
+
+	// The YAML encoder adds a space; trim it so we measure only the content length.
+	trimmedContent := strings.TrimRight(contentPart, " ")
+
+	// If the content already extends past our target column, just add a single space.
+	if len(trimmedContent) >= targetCol {
+		return trimmedContent + strings.Repeat(" ", defaultPadding) + commentPart
+	}
+
+	// Otherwise, calculate the needed padding to reach the target column and add it.
+	paddingNeeded := targetCol - len(trimmedContent)
+	return trimmedContent + strings.Repeat(" ", paddingNeeded) + commentPart
+}
+
+// alignComments formats each line of the YAML string independently.
+func alignComments(input string) string {
+	lines := strings.Split(input, "\n")
+	outputLines := make([]string, len(lines))
+
+	for i, line := range lines {
+		outputLines[i] = formatLine(line)
+	}
+
+	return strings.Join(outputLines, "\n")
+}

backend/common/settings/invalidConfig.yaml

@@ -6,20 +6,16 @@ server:
   tlsCert: ""
   enableThumbnails: false
   resizePreview: true
-  typeDetectionByHeader: true
-  port: 8080
+  port: 80
   baseURL: "/"
-  address: ""
-  log: "stdout"
   database: "mydb.db"
-  root: "/srv"
+  root: "."
 auth:
   recaptcha:
     host: ""
     key: ""
     secret: ""
   header: ""
-  method: json
   command: ""
   signup: false
   shell: ""
@@ -48,5 +44,4 @@ userDefaults:
     delete: true
     share: true
     download: true
-  hideDotfiles: false
   dateFormat: false

backend/common/settings/settings.go

@@ -0,0 +1,67 @@
+//go:generate go run ./tools/yaml.go -input=common/settings/settings.go -output=config.generated.yaml
+package settings
+
+import (
+	"crypto/rand"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+const DefaultUsersHomeBasePath = "/users"
+
+// AuthMethod describes an authentication method.
+type AuthMethod string
+
+// GenerateKey generates a key of 512 bits.
+func GenerateKey() ([]byte, error) {
+	b := make([]byte, 64) //nolint:gomnd
+	_, err := rand.Read(b)
+	// Note that err == nil only if we read len(b) bytes.
+	if err != nil {
+		return nil, err
+	}
+
+	return b, nil
+}
+
+func GetSettingsConfig(nameType string, Value string) string {
+	return nameType + Value
+}
+
+func AdminPerms() users.Permissions {
+	return users.Permissions{
+		Modify: true,
+		Share:  true,
+		Admin:  true,
+		Api:    true,
+	}
+}
+
+// Apply applies the default options to a user.
+func ApplyUserDefaults(u *users.User) {
+	u.StickySidebar = Config.UserDefaults.StickySidebar
+	u.DisableSettings = Config.UserDefaults.DisableSettings
+	u.DarkMode = Config.UserDefaults.DarkMode
+	u.Locale = Config.UserDefaults.Locale
+	u.ViewMode = Config.UserDefaults.ViewMode
+	u.SingleClick = Config.UserDefaults.SingleClick
+	u.Permissions = Config.UserDefaults.Permissions
+	u.Preview = Config.UserDefaults.Preview
+	u.ShowHidden = Config.UserDefaults.ShowHidden
+	u.DateFormat = Config.UserDefaults.DateFormat
+	u.DisableOnlyOfficeExt = Config.UserDefaults.DisableOnlyOfficeExt
+	u.ThemeColor = Config.UserDefaults.ThemeColor
+	u.GallerySize = Config.UserDefaults.GallerySize
+	u.QuickDownload = Config.UserDefaults.QuickDownload
+	u.LockPassword = Config.UserDefaults.LockPassword
+	if len(u.Scopes) == 0 {
+		for _, source := range Config.Server.Sources {
+			if source.Config.DefaultEnabled {
+				u.Scopes = append(u.Scopes, users.SourceScope{
+					Name:  source.Path, // backend name is path
+					Scope: source.Config.DefaultUserScope,
+				})
+			}
+		}
+	}
+}

backend/common/settings/storage.go

@@ -1,8 +1,7 @@
 package settings
 
 import (
-	"github.com/gtsteffaniak/filebrowser/errors"
-	"github.com/gtsteffaniak/filebrowser/rules"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 )
 
 // StorageBackend is a settings storage backend.
@@ -29,20 +28,9 @@ func (s *Storage) Get() (*Settings, error) {
 	if err != nil {
 		return nil, err
 	}
-	if set.Server.UserHomeBasePath == "" {
-		set.Server.UserHomeBasePath = DefaultUsersHomeBasePath
-	}
 	return set, nil
 }
 
-var defaultEvents = []string{
-	"save",
-	"copy",
-	"rename",
-	"upload",
-	"delete",
-}
-
 // Save saves the settings for the current instance.
 func (s *Storage) Save(set *Settings) error {
 	if len(set.Auth.Key) == 0 {
@@ -53,36 +41,10 @@ func (s *Storage) Save(set *Settings) error {
 		set.UserDefaults.Locale = "en"
 	}
 
-	if set.UserDefaults.Commands == nil {
-		set.UserDefaults.Commands = []string{}
-	}
-
 	if set.UserDefaults.ViewMode == "" {
 		set.UserDefaults.ViewMode = "normal"
 	}
 
-	if set.Rules == nil {
-		set.Rules = []rules.Rule{}
-	}
-
-	if set.Shell == nil {
-		set.Shell = []string{}
-	}
-
-	if set.Commands == nil {
-		set.Commands = map[string][]string{}
-	}
-
-	for _, event := range defaultEvents {
-		if _, ok := set.Commands["before_"+event]; !ok {
-			set.Commands["before_"+event] = []string{}
-		}
-
-		if _, ok := set.Commands["after_"+event]; !ok {
-			set.Commands["after_"+event] = []string{}
-		}
-	}
-
 	err := s.back.Save(set)
 	if err != nil {
 		return err
@@ -98,6 +60,5 @@ func (s *Storage) GetServer() (*Server, error) {
 
 // SaveServer wraps StorageBackend.SaveServer and adds some verification.
 func (s *Storage) SaveServer(ser *Server) error {
-	ser.Clean()
 	return s.back.SaveServer(ser)
 }

backend/common/settings/structs.go

@@ -0,0 +1,134 @@
+package settings
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+type AllowedMethods string
+
+const (
+	ProxyAuth    AllowedMethods = "proxyAuth"
+	NoAuth       AllowedMethods = "noAuth"
+	PasswordAuth AllowedMethods = "passwordAuth"
+)
+
+type Settings struct {
+	Server       Server       `json:"server"`
+	Auth         Auth         `json:"auth"`
+	Frontend     Frontend     `json:"frontend"`
+	UserDefaults UserDefaults `json:"userDefaults"`
+	Integrations Integrations `json:"integrations"`
+}
+
+type Server struct {
+	NumImageProcessors           int         `json:"numImageProcessors"`           // number of concurrent image processing jobs used to create previews, default is number of cpu cores available.
+	Socket                       string      `json:"socket"`                       // socket to listen on
+	TLSKey                       string      `json:"tlsKey"`                       // path to TLS key
+	TLSCert                      string      `json:"tlsCert"`                      // path to TLS cert
+	DisablePreviews              bool        `json:"disablePreviews"`              // disable all previews thumbnails, simple icons will be used
+	DisableResize                bool        `json:"disablePreviewResize"`         // disable resizing of previews for faster loading over slow connections
+	DisableTypeDetectionByHeader bool        `json:"disableTypeDetectionByHeader"` // disable type detection by header, useful if filesystem is slow.
+	Port                         int         `json:"port"`                         // port to listen on
+	BaseURL                      string      `json:"baseURL"`                      // base URL for the server, the subpath that the server is running on.
+	Logging                      []LogConfig `json:"logging"`
+	DebugMedia                   bool        `json:"debugMedia"` // output ffmpeg stdout for media integration -- careful can produces lots of output!
+	Database                     string      `json:"database"`   // path to the database file
+	Sources                      []Source    `json:"sources" validate:"required,dive"`
+	ExternalUrl                  string      `json:"externalUrl"`    // used by share links if set
+	InternalUrl                  string      `json:"internalUrl"`    // used by integrations if set, this is the url that an integration service will use to communicate with filebrowser
+	CacheDir                     string      `json:"cacheDir"`       // path to the cache directory, used for thumbnails and other cached files
+	MaxArchiveSizeGB             int64       `json:"maxArchiveSize"` // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
+	// not exposed to config
+	SourceMap      map[string]Source `json:"-" validate:"omitempty"` // uses realpath as key
+	NameToSource   map[string]Source `json:"-" validate:"omitempty"` // uses name as key
+	DefaultSource  Source            `json:"-" validate:"omitempty"`
+	MuPdfAvailable bool              `json:"-"` // used internally if compiled with mupdf support
+}
+
+type Integrations struct {
+	OnlyOffice OnlyOffice `json:"office" validate:"omitempty"`
+	Media      Media      `json:"media" validate:"omitempty"`
+}
+
+// onlyoffice secret is stored in the local.json file
+// docker exec <containerID> /var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/local.json 'services.CoAuthoring.secret.session.string'
+type OnlyOffice struct {
+	Url         string `json:"url" validate:"required"` // The URL to the OnlyOffice Document Server, needs to be accessible to the user.
+	InternalUrl string `json:"internalUrl"`             // An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
+	Secret      string `json:"secret" validate:"required"`
+}
+
+type Media struct {
+	FfmpegPath string `json:"ffmpegPath"` // path to ffmpeg directory with ffmpeg and ffprobe (eg. /usr/local/bin)
+}
+
+type LogConfig struct {
+	Levels    string `json:"levels"`    // separated list of log levels to enable. (eg. "info|warning|error|debug")
+	ApiLevels string `json:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
+	Output    string `json:"output"`    // output location. (eg. "stdout" or "path/to/file.log")
+	NoColors  bool   `json:"noColors"`  // disable colors in the output
+	Json      bool   `json:"json"`      // output in json format, currently not supported
+	Utc       bool   `json:"utc"`       // use UTC time in the output instead of local time
+}
+
+type Source struct {
+	Path   string       `json:"path" validate:"required"` // file system path. (Can be relative)
+	Name   string       `json:"name"`                     // display name
+	Config SourceConfig `json:"config"`
+}
+
+type SourceConfig struct {
+	IndexingInterval      uint32      `json:"indexingInterval"`      // optional manual overide interval in seconds to re-index the source
+	Disabled              bool        `json:"disabled"`              // disable the indexing of this source
+	MaxWatchers           int         `json:"maxWatchers"`           // number of concurrent watchers to use for this source, currently not supported
+	NeverWatch            []string    `json:"neverWatchPaths"`       // paths to never watch, relative to the source path (eg. "/folder/file.txt")
+	IgnoreHidden          bool        `json:"ignoreHidden"`          // ignore hidden files and folders.
+	IgnoreZeroSizeFolders bool        `json:"ignoreZeroSizeFolders"` // ignore folders with 0 size
+	Exclude               IndexFilter `json:"exclude"`               // exclude files and folders from indexing, if include is not set
+	Include               IndexFilter `json:"include"`               // include files and folders from indexing, if exclude is not set
+	DefaultUserScope      string      `json:"defaultUserScope"`      // default "/" should match folders under path
+	DefaultEnabled        bool        `json:"defaultEnabled"`        // should be added as a default source for new users?
+	CreateUserDir         bool        `json:"createUserDir"`         // create a user directory for each user
+}
+
+type IndexFilter struct {
+	Files        []string `json:"files"`        // array of file names to include/exclude
+	Folders      []string `json:"folders"`      // array of folder names to include/exclude
+	FileEndsWith []string `json:"fileEndsWith"` // array of file names to include/exclude (eg "a.jpg")
+}
+
+type Frontend struct {
+	Name                  string         `json:"name"`                  // display name
+	DisableDefaultLinks   bool           `json:"disableDefaultLinks"`   // disable default links in the sidebar
+	DisableUsedPercentage bool           `json:"disableUsedPercentage"` // disable used percentage for the sources in the sidebar
+	ExternalLinks         []ExternalLink `json:"externalLinks"`
+}
+
+type ExternalLink struct {
+	Text  string `json:"text" validate:"required"` // the text to display on the link
+	Title string `json:"title"`                    // the title to display on hover
+	Url   string `json:"url" validate:"required"`  // the url to link to
+}
+
+// UserDefaults is a type that holds the default values
+// for some fields on User.
+type UserDefaults struct {
+	StickySidebar           bool                `json:"stickySidebar"`             // keep sidebar open when navigating
+	DarkMode                bool                `json:"darkMode"`                  // should dark mode be enabled
+	Locale                  string              `json:"locale"`                    // language to use: eg. de, en, or fr
+	ViewMode                string              `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
+	SingleClick             bool                `json:"singleClick"`               // open directory on single click, also enables middle click to open in new tab
+	ShowHidden              bool                `json:"showHidden"`                // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	DateFormat              bool                `json:"dateFormat"`                // when false, the date is relative, when true, the date is an exact timestamp
+	GallerySize             int                 `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
+	ThemeColor              string              `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+	QuickDownload           bool                `json:"quickDownload"`             // show icon to download in one click
+	DisableOnlyOfficeExt    string              `json:"disableOnlyOfficeExt"`      // comma separated list of file extensions to disable onlyoffice preview for
+	DisableOfficePreviewExt string              `json:"disableOfficePreviewExt"`   // comma separated list of file extensions to disable office preview for
+	LockPassword            bool                `json:"lockPassword"`              // disable the user from changing their password
+	DisableSettings         bool                `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
+	Preview                 users.Preview       `json:"preview"`
+	DefaultScopes           []users.SourceScope `json:"-"`
+	Permissions             users.Permissions   `json:"permissions"`
+	LoginMethod             string              `json:"loginMethod,omitempty"` // login method to use: eg. password, proxy, oidc
+}

backend/common/settings/validConfig.yaml

@@ -0,0 +1,35 @@
+server:
+  numImageProcessors: 4
+  socket: ""
+  tlsKey: ""
+  tlsCert: ""
+  disablePreviews: false
+  disablePreviewResize: false
+  port: 80
+  baseURL: "/"
+  database: "mydb.db"
+  sources:
+    - path: "."
+integrations:
+  office:
+    url: "http://localhost:9052"
+    secret: 6H1H7GzUk2alRkNxAPav0W02g8JS5oUd
+auth:
+  methods:
+    password:
+      enabled: true
+frontend:
+  name: ""
+  disableUsedPercentage: true
+userDefaults:
+  locale: ""
+  viewMode: ""
+  darkMode: true
+  disableSettings: false
+  singleClick: true
+  permissions:
+    admin: true
+    modify: true
+    share: true
+    api: true
+  dateFormat: false

backend/common/utils/cache.go

@@ -0,0 +1,15 @@
+package utils
+
+import (
+	"time"
+
+	"github.com/gtsteffaniak/go-cache/cache"
+)
+
+var (
+	DiskUsageCache     = cache.NewCache(30*time.Second, 24*time.Hour)
+	RealPathCache      = cache.NewCache(48*time.Hour, 72*time.Hour)
+	SearchResultsCache = cache.NewCache(15*time.Second, 1*time.Hour)
+	OnlyOfficeCache    = cache.NewCache(48*time.Hour, 1*time.Hour)
+	JwtCache           = cache.NewCache(1*time.Hour, 72*time.Hour)
+)

backend/common/utils/main.go

@@ -0,0 +1,146 @@
+package utils
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	math "math/rand"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+func CheckErr(source string, err error) {
+	if err != nil {
+		logger.Fatalf("%s: %v", source, err)
+	}
+}
+
+func GenerateKey() string {
+	b := make([]byte, 64)
+	_, err := rand.Read(b)
+	if err != nil {
+		return ""
+	}
+	return string(b)
+}
+
+// CapitalizeFirst returns the input string with the first letter capitalized.
+func CapitalizeFirst(s string) string {
+	if len(s) == 0 {
+		return s // Return the empty string as is
+	}
+	return strings.ToUpper(string(s[0])) + s[1:]
+}
+
+func InsecureRandomIdentifier(length int) string {
+	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
+	math.New(math.NewSource(time.Now().UnixNano()))
+	result := make([]byte, length)
+	for i := range result {
+		result[i] = charset[math.Intn(len(charset))]
+	}
+	return string(result)
+}
+
+func PrintStructFields(v interface{}) {
+	val := reflect.ValueOf(v)
+	typ := reflect.TypeOf(v)
+
+	// Ensure the input is a struct
+	if val.Kind() != reflect.Struct {
+		logger.Debug("Provided value is not a struct")
+		return
+	}
+
+	// Iterate over the fields of the struct
+	for i := 0; i < val.NumField(); i++ {
+		field := val.Field(i)
+		fieldType := typ.Field(i)
+
+		// Convert field value to string, if possible
+		fieldValue := fmt.Sprintf("%v", field.Interface())
+
+		// Limit to 50 characters
+		if len(fieldValue) > 100 {
+			fieldValue = fieldValue[:100] + "..."
+		}
+
+		logger.Debugf("Field: %s, %s\n", fieldType.Name, fieldValue)
+	}
+}
+
+func GetParentDirectoryPath(path string) string {
+	if path == "/" || path == "" {
+		return ""
+	}
+	path = strings.TrimSuffix(path, "/") // Remove trailing slash if any
+	lastSlash := strings.LastIndex(path, "/")
+	if lastSlash == -1 {
+		return "" // No parent directory for a relative path without slashes
+	}
+	if lastSlash == 0 {
+		return "/" // If the last slash is the first character, return root
+	}
+	return path[:lastSlash]
+}
+
+func HashSHA256(data string) string {
+	bytes := sha256.Sum256([]byte(data))
+	return hex.EncodeToString(bytes[:])
+}
+
+func GetLastComponent(path string) string {
+	if path == "" {
+		return ""
+	}
+	path = strings.TrimSuffix(path, "/") // Remove trailing slash if any
+	lastSlash := strings.LastIndex(path, "/")
+	if lastSlash == -1 {
+		return path // No parent directory for a relative path without slashes
+	}
+	return path[lastSlash+1:]
+}
+
+func JoinPathAsUnix(parts ...string) string {
+	joinedPath := filepath.Join(parts...)
+	if runtime.GOOS == "windows" {
+		joinedPath = strings.ReplaceAll(joinedPath, "\\", "/")
+	}
+	return joinedPath
+}
+
+// ResolveSymlinks resolves symlinks in the given path and returns
+// the final resolved path, whether it's a directory (considering bundle logic), and any error.
+func ResolveSymlinks(path string) (string, bool, error) {
+	for {
+		// Get the file info using os.Lstat to handle symlinks
+		info, err := os.Lstat(path)
+		if err != nil {
+			return path, false, fmt.Errorf("could not stat path: %s, %v", path, err)
+		}
+
+		// Check if the path is a symlink
+		if info.Mode()&os.ModeSymlink != 0 {
+			// Read the symlink target
+			target, err := os.Readlink(path)
+			if err != nil {
+				return path, false, fmt.Errorf("could not read symlink: %s, %v", path, err)
+			}
+
+			// Resolve the symlink's target relative to its directory
+			path = filepath.Join(filepath.Dir(path), target)
+		} else {
+			// Not a symlink, check with bundle-aware directory logic
+			isDir := iteminfo.IsDirectory(info)
+			return path, isDir, nil
+		}
+	}
+}

backend/common/utils/main_test.go

@@ -0,0 +1,59 @@
+package utils
+
+import (
+	"testing"
+)
+
+func TestGetParentDirectoryPath(t *testing.T) {
+	tests := []struct {
+		input          string
+		expectedOutput string
+	}{
+		{input: "/", expectedOutput: ""},                                              // Root directory
+		{input: "/subfolder", expectedOutput: "/"},                                    // Single subfolder
+		{input: "/sub/sub/", expectedOutput: "/sub"},                                  // Nested subfolder with trailing slash
+		{input: "/subfolder/", expectedOutput: "/"},                                   // Relative path with trailing slash
+		{input: "", expectedOutput: ""},                                               // Empty string treated as root
+		{input: "/sub/subfolder", expectedOutput: "/sub"},                             // Double slash in path
+		{input: "/sub/subfolder/deep/nested/", expectedOutput: "/sub/subfolder/deep"}, // Double slash in path
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			actualOutput := GetParentDirectoryPath(test.input)
+			if actualOutput != test.expectedOutput {
+				t.Errorf("\n\tinput %q\n\texpected %q\n\tgot %q",
+					test.input, test.expectedOutput, actualOutput)
+			}
+		})
+	}
+}
+
+func TestCapitalizeFirst(t *testing.T) {
+	tests := []struct {
+		input          string
+		expectedOutput string
+	}{
+		{input: "", expectedOutput: ""},                               // Empty string
+		{input: "a", expectedOutput: "A"},                             // Single lowercase letter
+		{input: "A", expectedOutput: "A"},                             // Single uppercase letter
+		{input: "hello", expectedOutput: "Hello"},                     // All lowercase
+		{input: "Hello", expectedOutput: "Hello"},                     // Already capitalized
+		{input: "123hello", expectedOutput: "123hello"},               // Non-alphabetic first character
+		{input: "hELLO", expectedOutput: "HELLO"},                     // Mixed case
+		{input: " hello", expectedOutput: " hello"},                   // Leading space, no capitalization
+		{input: "hello world", expectedOutput: "Hello world"},         // Phrase with spaces
+		{input: " hello world", expectedOutput: " hello world"},       // Phrase with leading space
+		{input: "123 hello world", expectedOutput: "123 hello world"}, // Numbers before text
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			actualOutput := CapitalizeFirst(test.input)
+			if actualOutput != test.expectedOutput {
+				t.Errorf("\n\tinput %q\n\texpected %q\n\tgot %q",
+					test.input, test.expectedOutput, actualOutput)
+			}
+		})
+	}
+}

backend/common/utils/mocks.go

@@ -0,0 +1,73 @@
+package utils
+
+import (
+	"time"
+
+	"math/rand"
+
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+)
+
+func CreateMockData(numDirs, numFilesPerDir int) iteminfo.FileInfo {
+	dir := iteminfo.FileInfo{}
+	dir.Path = "/here/is/your/mock/dir"
+	for i := 0; i < numDirs; i++ {
+		newFile := iteminfo.ItemInfo{
+			Name:    "file-" + GetRandomTerm() + GetRandomExtension(),
+			Size:    rand.Int63n(1000),                                          // Random size
+			ModTime: time.Now().Add(-time.Duration(rand.Intn(100)) * time.Hour), // Random mod time
+			Type:    "blob",
+		}
+		dir.Folders = append(dir.Folders, newFile)
+	}
+	// Simulating files and directories with FileInfo
+	for j := 0; j < numFilesPerDir; j++ {
+		newFile := iteminfo.ItemInfo{
+			Name:    "file-" + GetRandomTerm() + GetRandomExtension(),
+			Size:    rand.Int63n(1000),                                          // Random size
+			ModTime: time.Now().Add(-time.Duration(rand.Intn(100)) * time.Hour), // Random mod time
+			Type:    "blob",
+		}
+		dir.Files = append(dir.Files, newFile)
+	}
+	return dir
+}
+
+func GenerateRandomPath(levels int) string {
+	rand.New(rand.NewSource(time.Now().UnixNano()))
+	dirName := "srv"
+	for i := 0; i < levels; i++ {
+		dirName += "/" + GetRandomTerm()
+	}
+	return dirName
+}
+
+func GetRandomTerm() string {
+	wordbank := []string{
+		"hi", "test", "other", "name",
+		"cool", "things", "more", "items",
+	}
+	rand.New(rand.NewSource(time.Now().UnixNano()))
+
+	index := rand.Intn(len(wordbank))
+	return wordbank[index]
+}
+
+func GetRandomExtension() string {
+	wordbank := []string{
+		".txt", ".mp3", ".mov", ".doc",
+		".mp4", ".bak", ".zip", ".jpg",
+	}
+	rand.New(rand.NewSource(time.Now().UnixNano()))
+	index := rand.Intn(len(wordbank))
+	return wordbank[index]
+}
+
+func GenerateRandomSearchTerms(numTerms int) []string {
+	// Generate random search terms
+	searchTerms := make([]string, numTerms)
+	for i := 0; i < numTerms; i++ {
+		searchTerms[i] = GetRandomTerm()
+	}
+	return searchTerms
+}

backend/common/version/version.go

@@ -0,0 +1,7 @@
+package version
+
+var (
+	// Dynamically updated during build via build args
+	Version   = "untracked"
+	CommitSHA = "untracked"
+)

backend/config.media.yaml

@@ -0,0 +1,11 @@
+server:
+  logging:
+    - levels: "info|warning|error"
+  sources:
+    - path: "/srv"
+userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    highQuality: true

backend/config.yaml

@@ -0,0 +1,22 @@
+server:
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|warning|error"
+  sources:
+    - path: "/srv"
+userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: false
+    office: false
+    highQuality: false
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: false
+    share: false
+    api: false

backend/database/share/share.go

@@ -10,6 +10,7 @@ type CreateBody struct {
 type Link struct {
 	Hash         string `json:"hash" storm:"id,index"`
 	Path         string `json:"path" storm:"index"`
+	Source       string `json:"source" storm:"index"`
 	UserID       uint   `json:"userID"`
 	Expire       int64  `json:"expire"`
 	PasswordHash string `json:"password_hash,omitempty"`

backend/database/share/storage.go

@@ -3,7 +3,7 @@ package share
 import (
 	"time"
 
-	"github.com/gtsteffaniak/filebrowser/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 )
 
 // StorageBackend is the interface to implement for a share storage.
@@ -11,8 +11,8 @@ type StorageBackend interface {
 	All() ([]*Link, error)
 	FindByUserID(id uint) ([]*Link, error)
 	GetByHash(hash string) (*Link, error)
-	GetPermanent(path string, id uint) (*Link, error)
-	Gets(path string, id uint) ([]*Link, error)
+	GetPermanent(path, source string, id uint) (*Link, error)
+	Gets(path, source string, id uint) ([]*Link, error)
 	Save(s *Link) error
 	Delete(hash string) error
 }
@@ -85,13 +85,13 @@ func (s *Storage) GetByHash(hash string) (*Link, error) {
 }
 
 // GetPermanent wraps a StorageBackend.GetPermanent
-func (s *Storage) GetPermanent(path string, id uint) (*Link, error) {
-	return s.back.GetPermanent(path, id)
+func (s *Storage) GetPermanent(path, source string, id uint) (*Link, error) {
+	return s.back.GetPermanent(path, source, id)
 }
 
 // Gets wraps a StorageBackend.Gets
-func (s *Storage) Gets(path string, id uint) ([]*Link, error) {
-	links, err := s.back.Gets(path, id)
+func (s *Storage) Gets(sourcePath, source string, id uint) ([]*Link, error) {
+	links, err := s.back.Gets(sourcePath, source, id)
 
 	if err != nil {
 		return nil, err

backend/database/storage/bolt/auth.go

@@ -1,9 +1,9 @@
 package bolt
 
 import (
-	"github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/auth"
-	"github.com/gtsteffaniak/filebrowser/errors"
+	storm "github.com/asdine/storm/v3"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 )
 
 type authBackend struct {
@@ -28,5 +28,5 @@ func (s authBackend) Get(t string) (auth.Auther, error) {
 }
 
 func (s authBackend) Save(a auth.Auther) error {
-	return save(s.db, "auther", a)
+	return Save(s.db, "auther", a)
 }

backend/database/storage/bolt/bolt.go

@@ -0,0 +1,22 @@
+package bolt
+
+import (
+	storm "github.com/asdine/storm/v3"
+
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// NewStorage creates a storage.Storage based on Bolt DB.
+func NewStorage(db *storm.DB) (*auth.Storage, *users.Storage, *share.Storage, *settings.Storage, error) {
+	userStore := users.NewStorage(usersBackend{db: db})
+	shareStore := share.NewStorage(shareBackend{db: db})
+	settingsStore := settings.NewStorage(settingsBackend{db: db})
+	authStore, err := auth.NewStorage(authBackend{db: db}, userStore)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	return authStore, userStore, shareStore, settingsStore, nil
+}

backend/database/storage/bolt/config.go

@@ -1,8 +1,8 @@
 package bolt
 
 import (
-	"github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/settings"
+	storm "github.com/asdine/storm/v3"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 )
 
 type settingsBackend struct {
@@ -15,17 +15,17 @@ func (s settingsBackend) Get() (*settings.Settings, error) {
 }
 
 func (s settingsBackend) Save(set *settings.Settings) error {
-	return save(s.db, "settings", set)
+	return Save(s.db, "settings", set)
 }
 
 func (s settingsBackend) GetServer() (*settings.Server, error) {
 	server := &settings.Server{
-		Port:               8080,
+		Port:               80,
 		NumImageProcessors: 1,
 	}
 	return server, get(s.db, "server", server)
 }
 
 func (s settingsBackend) SaveServer(server *settings.Server) error {
-	return save(s.db, "server", server)
+	return Save(s.db, "server", server)
 }

backend/database/storage/bolt/share.go

@@ -0,0 +1,84 @@
+package bolt
+
+import (
+	"time"
+
+	storm "github.com/asdine/storm/v3"
+	"github.com/asdine/storm/v3/q"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+type shareBackend struct {
+	db *storm.DB
+}
+
+func (s shareBackend) All() ([]*share.Link, error) {
+	var v []*share.Link
+	err := s.db.All(&v)
+	if err == storm.ErrNotFound {
+		return v, errors.ErrNotExist
+	}
+
+	return v, err
+}
+
+func (s shareBackend) FindByUserID(id uint) ([]*share.Link, error) {
+	var v []*share.Link
+	err := s.db.Select(q.Eq("UserID", id)).Find(&v)
+	if err == storm.ErrNotFound {
+		return v, errors.ErrNotExist
+	}
+
+	return v, err
+}
+
+func (s shareBackend) GetByHash(hash string) (*share.Link, error) {
+	var v share.Link
+	err := s.db.One("Hash", hash, &v)
+	if err == storm.ErrNotFound {
+		return nil, errors.ErrNotExist
+	}
+
+	return &v, err
+}
+
+func (s shareBackend) GetPermanent(path, source string, id uint) (*share.Link, error) {
+	var v share.Link
+	// TODO remove legacy and return notfound errors
+	_ = s.db.Select(q.Eq("Path", path), q.Eq("Source", source), q.Eq("Expire", 0), q.Eq("UserID", id)).First(&v)
+	return &v, nil
+}
+
+func (s shareBackend) Gets(path, sourcePath string, id uint) ([]*share.Link, error) {
+	var v []*share.Link
+	_ = s.db.Select(q.Eq("Path", path), q.Eq("Source", sourcePath), q.Eq("UserID", id)).Find(&v)
+	filteredList := []*share.Link{}
+	var err error
+	// through and filter out expired share
+	for i := range v {
+		if v[i].Expire < time.Now().Unix() && v[i].Expire != 0 {
+			err = s.Delete(v[i].PasswordHash)
+			if err != nil {
+				logger.Errorf("expired share could not be deleted: %v", err.Error())
+			}
+		} else {
+			filteredList = append(filteredList, v[i])
+		}
+	}
+	return filteredList, err
+}
+
+func (s shareBackend) Save(l *share.Link) error {
+	return s.db.Save(l)
+}
+
+func (s shareBackend) Delete(hash string) error {
+	err := s.db.DeleteStruct(&share.Link{Hash: hash})
+	if err == storm.ErrNotFound {
+		return nil
+	}
+	return err
+}

backend/database/storage/bolt/users.go

@@ -0,0 +1,277 @@
+package bolt
+
+import (
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+
+	storm "github.com/asdine/storm/v3"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+type usersBackend struct {
+	db *storm.DB
+}
+
+func (st usersBackend) GetBy(i interface{}) (user *users.User, err error) {
+	user = &users.User{}
+
+	var arg string
+	var val interface{}
+	switch i := i.(type) {
+	case uint:
+		val = i
+		arg = "ID"
+	case int:
+		val = uint(i)
+		arg = "ID"
+	case string:
+		arg = "Username"
+		val = i
+	default:
+		return nil, errors.ErrInvalidDataType
+	}
+
+	err = st.db.One(arg, val, user)
+
+	if err != nil {
+		if err == storm.ErrNotFound {
+			return nil, errors.ErrNotExist
+		}
+		return nil, err
+	}
+
+	return
+}
+
+func (st usersBackend) Gets() ([]*users.User, error) {
+	var allUsers []*users.User
+	err := st.db.All(&allUsers)
+	if err == storm.ErrNotFound {
+		return nil, errors.ErrNotExist
+	}
+	if err != nil {
+		return allUsers, err
+	}
+	return allUsers, err
+}
+
+func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...string) error {
+	existingUser, err := st.GetBy(user.ID)
+	if err != nil {
+		return err
+	}
+	passwordUser := existingUser.LoginMethod == users.LoginMethodPassword
+	enforcedOtp := settings.Config.Auth.Methods.PasswordAuth.EnforcedOtp
+	if passwordUser && enforcedOtp && !user.OtpEnabled {
+		return errors.ErrNoTotpConfigured
+	}
+	fields, err = parseFields(user, fields, actorIsAdmin)
+	if err != nil {
+		return err
+	}
+
+	if !slices.Contains(fields, "Password") {
+		user.Password = existingUser.Password
+	} else {
+		if existingUser.LockPassword {
+			return fmt.Errorf("password cannot be changed when lock password is enabled")
+		}
+	}
+
+	if !actorIsAdmin {
+		err := checkRestrictedFields(existingUser, fields)
+		if err != nil {
+			return err
+		}
+	}
+
+	if len(fields) == 0 {
+		return fmt.Errorf("no fields to update")
+	}
+
+	// converting scopes to map of paths intead of names (names can change)
+	if slices.Contains(fields, "Scopes") {
+		adjustedScopes, err := settings.ConvertToBackendScopes(user.Scopes)
+		if err != nil {
+			return err
+		}
+		user.Scopes = adjustedScopes
+		err = files.MakeUserDirs(user, true)
+		if err != nil {
+			return err
+		}
+	}
+	// Use reflection to access struct fields
+	userFields := reflect.ValueOf(user).Elem() // Get struct value
+	for _, field := range fields {
+		// Get the corresponding field using reflection
+		fieldValue := userFields.FieldByName(field)
+		if !fieldValue.IsValid() {
+			return fmt.Errorf("invalid field: %s", field)
+		}
+
+		// Ensure the field is settable
+		if !fieldValue.CanSet() {
+			return fmt.Errorf("cannot set value of field: %s", field)
+		}
+
+		// Get the value to be stored
+		val := fieldValue.Interface()
+		if field == "OtpEnabled" {
+			otpEnabled, _ := val.(bool)
+			if otpEnabled {
+				continue
+			}
+			field = "TOTPSecret" // if otp is disabled, we also want to clear the TOTPSecret
+			val = ""             // clear the TOTPSecret
+		}
+		// Update the database
+		if err := st.db.UpdateField(existingUser, field, val); err != nil {
+			return fmt.Errorf("failed to update user field: %s, error: %v", field, err)
+		}
+	}
+
+	// last revoke api keys if needed.
+	if existingUser.Permissions.Api && !user.Permissions.Api && slices.Contains(fields, "Permissions") {
+		for _, key := range existingUser.ApiKeys {
+			auth.RevokeAPIKey(key.Key) // add to blacklist
+		}
+	}
+	return nil
+}
+
+func (st usersBackend) Save(user *users.User, changePass, disableScopeChange bool) error {
+	if user.LoginMethod == "" {
+		user.LoginMethod = users.LoginMethodPassword
+	}
+	logger.Debugf("Saving user [%s] changepass: %v", user.Username, changePass)
+	if user.LoginMethod == users.LoginMethodPassword && changePass {
+		err := checkPassword(user.Password)
+		if err != nil {
+			return err
+		}
+		pass, err := users.HashPwd(user.Password)
+		if err != nil {
+			return err
+		}
+		user.Password = pass
+	}
+
+	// converting scopes to map of paths intead of names (names can change)
+	adjustedScopes, err := settings.ConvertToBackendScopes(user.Scopes)
+	if err != nil {
+		return err
+	}
+	user.Scopes = adjustedScopes
+	err = files.MakeUserDirs(user, disableScopeChange)
+	if err != nil {
+		logger.Error(err.Error())
+	}
+	err = st.db.Save(user)
+	if err == storm.ErrAlreadyExists {
+		return fmt.Errorf("user with provided username already exists")
+	}
+	return err
+}
+
+func (st usersBackend) DeleteByID(id uint) error {
+	return st.db.DeleteStruct(&users.User{ID: id})
+}
+
+func (st usersBackend) DeleteByUsername(username string) error {
+	user, err := st.GetBy(username)
+	if err != nil {
+		return err
+	}
+
+	return st.db.DeleteStruct(user)
+}
+
+// Define a function to check for restricted fields
+func checkRestrictedFields(existingUser *users.User, fields []string) error {
+	// Get a list of allowed fields from NonAdminEditable
+	allowed := getNonAdminEditableFieldNames()
+	for _, field := range fields {
+		if !slices.Contains(allowed, field) {
+			return fmt.Errorf("non-admins cannot modify field: %s", field)
+		}
+	}
+
+	return nil
+}
+
+// Helper to return list of field names from NonAdminEditable struct
+func getNonAdminEditableFieldNames() []string {
+	var names []string
+	t := reflect.TypeOf(users.NonAdminEditable{})
+	for i := 0; i < t.NumField(); i++ {
+		names = append(names, t.Field(i).Name)
+	}
+	return names
+}
+
+func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string, error) {
+	// If `Which` is not specified, default to updating all fields
+	if len(fields) == 0 || fields[0] == "all" {
+		fields = []string{}
+		v := reflect.ValueOf(user)
+		if v.Kind() == reflect.Ptr {
+			v = v.Elem()
+		}
+		t := v.Type()
+
+		// Dynamically populate fields to update
+		for i := 0; i < t.NumField(); i++ {
+			field := t.Field(i)
+			// which=all can't update password
+			switch strings.ToLower(field.Name) {
+			case "id", "username", "loginmethod", "password", "apikeys", "totpenabled", "totpsecret", "totpnonce":
+				// Skip these fields
+				continue
+			}
+			fields = append(fields, field.Name)
+		}
+	}
+	newfields := []string{}
+	for _, field := range fields {
+		capitalField := utils.CapitalizeFirst(field)
+		if capitalField == "Scopes" {
+			if !actorIsAdmin {
+				continue
+			}
+		}
+		if capitalField == "Password" {
+			if user.LoginMethod != users.LoginMethodPassword {
+				return nil, fmt.Errorf("password cannot be changed when login method is not password")
+			}
+			err := checkPassword(user.Password)
+			if err != nil {
+				return nil, fmt.Errorf("password does not meet complexity requirements")
+			}
+			value, err := users.HashPwd(user.Password)
+			if err != nil {
+				logger.Error(err.Error())
+			}
+			user.Password = value
+		}
+		newfields = append(newfields, capitalField)
+	}
+
+	return newfields, nil
+}
+
+func checkPassword(password string) error {
+	if len(password) < settings.Config.Auth.Methods.PasswordAuth.MinLength {
+		return fmt.Errorf("password must be at least %d characters long", settings.Config.Auth.Methods.PasswordAuth.MinLength)
+	}
+	return nil
+}