updated with small change (#616)

Co-authored-by: Aaron Ky-Riesenbach <aaron@kyriesenba.ch>

.dockerignore

@@ -1,4 +1,5 @@
 backend/**.db
+backend/tmp
 backend/vendor/**
 frontend/dist/**
 frontend/node_modules/**

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,20 +1,10 @@
 **Description**
-<!--
-Please explain the changes you made here.
-If the feature changes current behaviour, explain why your solution is better.
--->
 
-:rotating_light: Before submitting your PR, please read [community](https://github.com/filebrowser/community), and indicate which issues (in any of the repos) are either fixed or closed by this PR. See [GitHub Help: Closing issues using keywords](https://help.github.com/articles/closing-issues-via-commit-messages/).
+According to the [contributing guide](https://github.com/gtsteffaniak/filebrowser/wiki/Contributing#contributing-as-an-unofficial-contributor), A PR should contain:
 
-- [ ] DO make sure you are requesting to **pull a topic/feature/bugfix branch** (right side). Don't request your master!
-- [ ] DO make sure you are making a pull request against the **master branch** (left side). Also you should start *your branch* off *our master*.
-- [ ] DO make sure that File Browser can be successfully built. See [builds](https://github.com/filebrowser/community/blob/master/builds.md) and [development](https://github.com/filebrowser/community/blob/master/development.md).
-- [ ] DO make sure that related issues are opened in other repositories. I.e., the frontend, caddy plugins or the web page need to be updated accordingly.
-- [ ] AVOID breaking the continuous integration build.
+- [ ] A clear description of why it was opened.
+- [ ] A short title that best describes the change.
+- [ ] Must pass unit and integration tests, which can be run checked locally prior to opening a PR.
+- [ ] Any additional details for functionality not covered by tests.
 
-**Further comments**
-<!--
-If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did, what alternatives you considered, etc.
-
-:heart: Thank you!
--->
+**Additional Details**

.github/workflows/create-dev-branch.yaml

@@ -0,0 +1,58 @@
+name: Create Dev Version
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to create (format: 0.0.0)"
+        required: true
+        type: string
+
+jobs:
+  create-dev-branch:
+    name: Create Dev Branch
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }} # Uses the Personal Access Token
+
+      - name: Validate version format
+        id: validate_version
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ ERROR: Version must be in '0.0.0' format."
+            exit 1
+          fi
+          echo "✅ Version format validated: $VERSION"
+
+      - name: Check if branch already exists
+        id: check_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+
+          if git ls-remote --exit-code origin "$DEV_BRANCH"; then
+            echo "❌ ERROR: Branch '$DEV_BRANCH' already exists!"
+            exit 1
+          fi
+          echo "✅ Branch '$DEV_BRANCH' does not exist."
+
+      - name: Create and push new dev branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+
+          # Fetch latest changes
+          git fetch origin main
+
+          # Create new branch from main
+          git checkout -b "$DEV_BRANCH" origin/main
+
+          # Push branch to remote
+          git push origin "$DEV_BRANCH"
+
+          echo "✅ Successfully created branch '$DEV_BRANCH'!"

.github/workflows/main.yaml

@@ -6,7 +6,7 @@ on:
       - "main"
 
 jobs:
-  test_frontend:
+  test_playwright:
     name: Test Playwright
     runs-on: ubuntu-latest
     steps:
@@ -28,44 +28,5 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile.playwright
+          file: ./_docker/Dockerfile.playwright-general
           push: false
-  push_latest_to_registry:
-    needs: [ test_frontend ]
-    name: Push latest
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Find latest beta tag
-        run: |
-          echo "LATEST_TAG=$(git describe --tags $(git rev-list --tags="*-beta*" --max-count=1))" >> $GITHUB_ENV
-          echo "latest tag is $LATEST_TAG"
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: gtstef/filebrowser
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ env.LATEST_TAG }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./Dockerfile
-          push: true
-          tags: 'gtstef/filebrowser:latest'
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/pr.yaml

@@ -8,8 +8,8 @@ on:
       - "stable/v[0-9]+.[0-9]+.[0-9]+"
 
 jobs:
-  test_frontend:
-    name: Test Playwright
+  test_playwright:
+    name: Test Playwright - general
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -30,7 +30,55 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile.playwright
+          file: ./_docker/Dockerfile.playwright-general
+          push: false
+  test_playwright_proxy:
+    name: Test Playwright - proxy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-proxy
+          push: false
+  test_playwright_noauth:
+    name: Test Playwright - noauth
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-noauth
           push: false
   push_pr_to_registry:
     name: Push PR
@@ -56,8 +104,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile
-          push: true
+          file: ./_docker/Dockerfile
+          push: false # Do not push the image for now
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |

.github/workflows/promote-beta-to-stable.yaml

@@ -0,0 +1,110 @@
+name: Promote Beta to Stable
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to promote (format: 0.0.0)"
+        required: true
+        type: string
+
+jobs:
+  promote-beta-to-stable:
+    name: Promote Beta to Stable
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }} # Uses Personal Access Token for branch operations
+
+      - name: Validate version format
+        id: validate_version
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ ERROR: Version must be in '0.0.0' format."
+            exit 1
+          fi
+          echo "✅ Version format validated: $VERSION"
+
+      - name: Check if beta branch exists
+        id: check_beta_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+
+          if ! git ls-remote --exit-code origin "$BETA_BRANCH"; then
+            echo "❌ ERROR: Beta branch '$BETA_BRANCH' does not exist!"
+            exit 1
+          fi
+          echo "✅ Beta branch '$BETA_BRANCH' exists."
+
+      - name: Check if stable branch already exists
+        id: check_stable_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          if git ls-remote --exit-code origin "$STABLE_BRANCH"; then
+            echo "❌ ERROR: Stable branch '$STABLE_BRANCH' already exists!"
+            exit 1
+          fi
+          echo "✅ Stable branch '$STABLE_BRANCH' does not exist."
+
+      - name: Create and push new stable branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          # Fetch latest changes
+          git fetch origin "$BETA_BRANCH"
+
+          # Create new stable branch from beta branch
+          git checkout -b "$STABLE_BRANCH" origin/"$BETA_BRANCH"
+
+          # Push new stable branch to remote
+          git push origin "$STABLE_BRANCH"
+
+          echo "✅ Successfully created stable branch '$STABLE_BRANCH' from '$BETA_BRANCH'."
+
+      - name: Merge beta into stable
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          # Checkout stable branch
+          git checkout "$STABLE_BRANCH"
+
+          # Merge beta into stable
+          git merge --no-ff "origin/$BETA_BRANCH" -m "Merge $BETA_BRANCH into $STABLE_BRANCH"
+
+          # Push merge changes
+          git push origin "$STABLE_BRANCH"
+
+          echo "✅ Successfully merged '$BETA_BRANCH' into '$STABLE_BRANCH'."
+
+#      - name: Delete beta branch after successful merge
+#        run: |
+#          VERSION="${{ github.event.inputs.version }}"
+#          BETA_BRANCH="beta/v$VERSION"
+#
+#          # Delete beta branch locally and remotely
+#          git branch -d "$BETA_BRANCH"
+#          git push origin --delete "$BETA_BRANCH"
+#
+#          echo "✅ Successfully deleted '$BETA_BRANCH'."
+
+      - name: Create Pull Request to Main
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.PAT }}
+          commit-message: "Promote stable/v${{ github.event.inputs.version }} to main"
+          title: "Promote stable/v${{ github.event.inputs.version }} to main"
+          body: "This PR promotes stable/v${{ github.event.inputs.version }} to the main branch."
+          base: main
+          branch: stable/v${{ github.event.inputs.version }}
+          delete-branch: false

.github/workflows/promote-dev-to-beta.yaml

@@ -0,0 +1,99 @@
+name: Promote Dev to Beta
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to promote (format: 0.0.0)"
+        required: true
+        type: string
+
+jobs:
+  promote-dev-to-beta:
+    name: Promote Dev to Beta
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }} # Uses the Personal Access Token
+
+      - name: Validate version format
+        id: validate_version
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ ERROR: Version must be in 'v0.0.0' format."
+            exit 1
+          fi
+          echo "✅ Version format validated: $VERSION"
+
+      - name: Check if dev branch exists
+        id: check_dev_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+
+          if ! git ls-remote --exit-code origin "$DEV_BRANCH"; then
+            echo "❌ ERROR: Dev branch '$DEV_BRANCH' does not exist!"
+            exit 1
+          fi
+          echo "✅ Dev branch '$DEV_BRANCH' exists."
+
+      - name: Check if beta branch already exists
+        id: check_beta_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+
+          if git ls-remote --exit-code origin "$BETA_BRANCH"; then
+            echo "❌ ERROR: Beta branch '$BETA_BRANCH' already exists!"
+            exit 1
+          fi
+          echo "✅ Beta branch '$BETA_BRANCH' does not exist."
+
+      - name: Create and push new beta branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+          BETA_BRANCH="beta/v$VERSION"
+
+          # Fetch latest changes
+          git fetch origin "$DEV_BRANCH"
+
+          # Create new beta branch from dev branch
+          git checkout -b "$BETA_BRANCH" origin/"$DEV_BRANCH"
+
+          # Push new beta branch to remote
+          git push origin "$BETA_BRANCH"
+
+          echo "✅ Successfully created beta branch '$BETA_BRANCH' from '$DEV_BRANCH'."
+
+      - name: Merge dev into beta
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+          BETA_BRANCH="beta/v$VERSION"
+
+          # Checkout beta branch
+          git checkout "$BETA_BRANCH"
+
+          # Merge dev into beta
+          git merge --no-ff "origin/$DEV_BRANCH" -m "Merge $DEV_BRANCH into $BETA_BRANCH"
+
+          # Push merge changes
+          git push origin "$BETA_BRANCH"
+
+          echo "✅ Successfully merged '$DEV_BRANCH' into '$BETA_BRANCH'."
+
+#      - name: Delete dev branch after successful merge
+#        run: |
+#          VERSION="${{ github.event.inputs.version }}"
+#          DEV_BRANCH="dev/v$VERSION"
+#
+#          # Delete dev branch locally and remotely
+#          git branch -d "$DEV_BRANCH"
+#          git push origin --delete "$DEV_BRANCH"
+#
+#          echo "✅ Successfully deleted '$DEV_BRANCH'."

.github/workflows/regular-tests.yaml

@@ -24,7 +24,7 @@ jobs:
             go-version: 'stable'
       - uses: golangci/golangci-lint-action@v5
         with:
-          version: v1.60
+          version: 'v1.64'
           working-directory: backend
   format-backend:
     runs-on: ubuntu-latest

.github/workflows/release_beta.yaml

@@ -9,8 +9,8 @@ permissions:
   contents: write
 
 jobs:
-  test_frontend:
-    name: Test Playwright
+  test_playwright:
+    name: Test Playwright - regular
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -31,10 +31,10 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile.playwright
+          file: ./_docker/Dockerfile.playwright-general
           push: false
   create_release_tag:
-    needs: [ test_frontend ]
+    needs: [ test_playwright ]
     name: Create Release
     runs-on: ubuntu-latest
     steps:
@@ -56,7 +56,7 @@ jobs:
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
-          target_commitish: ${{ steps.extract_branch.outputs.branch_name }}
+          target_commitish: ${{ github.sha }}
           token: ${{ secrets.PAT }}
           tag_name: ${{ steps.extract_branch.outputs.tag_name }}
           prerelease: false # change this to false when stable gets released
@@ -64,44 +64,3 @@ jobs:
           draft: false
           generate_release_notes: true
           name: ${{ steps.extract_branch.outputs.tag_name }}
-
-  push_release_to_registry:
-    needs: [ test_frontend ]
-    name: Push release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: gtstef/filebrowser
-      - name: Strip v from version number
-        id: modify-json
-        run: |
-          JSON="${{ steps.meta.outputs.tags }}"
-          # Use jq to remove 'v' from the version field
-          JSON=$(echo "$JSON" | sed 's/filebrowser:beta\/v/filebrowser:beta_v/')
-          echo "cleaned_tag=$JSON" >> $GITHUB_OUTPUT
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./Dockerfile
-          push: true
-          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_dev.yaml

@@ -24,18 +24,30 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{ secrets.PAT }}
+      - name: Extract metadata (tags, labels) for Docker and GHCR
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: gtstef/filebrowser
-      - name: Strip v from version number
+          images: |
+            gtstef/filebrowser
+            ghcr.io/gtsteffaniak/filebrowser
+      - name: Modify version names
         id: modify-json
         run: |
-          JSON="${{ steps.meta.outputs.tags }}"
-          # Use jq to remove 'v' from the version field
-          JSON=$(echo "$JSON" | sed 's/filebrowser:dev\/v/filebrowser:dev_v/')
-          echo "cleaned_tag=$JSON" >> $GITHUB_OUTPUT
+          TAGS="${{ steps.meta.outputs.tags }}"
+          # Apply modifications to both docker.io and ghcr.io tags
+          CLEANED_TAGS=$(echo "$TAGS" | sed 's/filebrowser:dev-v/filebrowser:/g' | sed -E 's/(filebrowser:[0-9]+\.[0-9]+\.[0-9]+)/\1-dev/g')
+          # Add dev tag to both registries
+          CLEANED_TAGS="$CLEANED_TAGS,gtstef/filebrowser:dev,ghcr.io/gtsteffaniak/filebrowser:dev"
+          echo "cleaned_tag<<EOF" >> $GITHUB_OUTPUT
+          echo "$CLEANED_TAGS" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
@@ -44,7 +56,7 @@ jobs:
             VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
             REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
           platforms: linux/amd64
-          file: ./Dockerfile
+          file: ./_docker/Dockerfile
           push: true
           tags: ${{ steps.modify-json.outputs.cleaned_tag }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_docker.yaml

@@ -0,0 +1,125 @@
+name: Manual Docker Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "Tag or Branch (format: v0.0.0-beta)"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  push_release_to_registry:
+    name: Push release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }} # Uses the Personal Access Token
+          ref: "${{ github.event.inputs.branch }}"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{ secrets.PAT }}
+      - name: Extract metadata (tags, labels) for Docker and GHCR
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            gtstef/filebrowser
+            ghcr.io/gtsteffaniak/filebrowser
+          tags: |
+            type=raw,value=${{ github.event.inputs.branch }}
+      - name: Modify tags (strip 'v' and add 'beta'/'stable' if needed)
+        id: modify-json
+        run: |
+          JSON='${{ steps.meta.outputs.json }}'
+          MODIFIED_JSON=$(echo "$JSON" | jq '
+            .tags |= map(sub(":v"; ":")) |
+            if any(.tags[]; test("beta")) then
+              .tags += [
+                "gtstef/filebrowser:beta",
+                "ghcr.io/gtsteffaniak/filebrowser:beta",
+                "gtstef/filebrowser:latest",
+                "ghcr.io/gtsteffaniak/filebrowser:latest"
+              ]
+            else . end |
+            if any(.tags[]; test("stable")) then
+              .tags += [
+                "gtstef/filebrowser:stable",
+                "ghcr.io/gtsteffaniak/filebrowser:stable",
+                "gtstef/filebrowser:latest",
+                "ghcr.io/gtsteffaniak/filebrowser:latest"
+              ]
+            else . end
+          ')
+          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
+          echo "$TAGS_CSV" > modified_tags.txt  # Optional debug output
+          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          file: ./_docker/Dockerfile
+          push: true
+          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}
+      - name: Modify version names
+        id: modify-json-media
+        run: |
+          JSON='${{ steps.meta.outputs.json }}'
+          MODIFIED_JSON=$(echo "$JSON" | jq '
+            .tags |= map(
+              sub(":v"; ":") + "-media"
+            ) |
+            if any(.tags[]; test("beta-media")) then
+              .tags += [
+                "gtstef/filebrowser:beta-media",
+                "ghcr.io/gtsteffaniak/filebrowser:beta-media",
+                "gtstef/filebrowser:media",
+                "ghcr.io/gtsteffaniak/filebrowser:media"
+              ]
+            else . end |
+            if any(.tags[]; test("stable-media")) then
+              .tags += [
+                "gtstef/filebrowser:stable-media",
+                "ghcr.io/gtsteffaniak/filebrowser:stable-media",
+                "gtstef/filebrowser:media",
+                "ghcr.io/gtsteffaniak/filebrowser:media"
+              ]
+            else . end
+          ')
+          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
+          echo "$TAGS_CSV" > modified_tags.txt  # Optional debug output
+          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
+      - name: Build and push media image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          file: ./_docker/Dockerfile.media
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.modify-json-media.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_stable.yaml

@@ -9,7 +9,7 @@ permissions:
   contents: write
 
 jobs:
-  test_frontend:
+  test_playwright:
     name: Test Playwright
     runs-on: ubuntu-latest
     steps:
@@ -31,10 +31,10 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile.playwright
+          file: ./_docker/Dockerfile.playwright-general
           push: false
   create_release_tag:
-    needs: [ test_frontend ]
+    needs: [ test_playwright ]
     name: Create Release
     runs-on: ubuntu-latest
     steps:
@@ -56,51 +56,10 @@ jobs:
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
-          target_commitish: ${{ steps.extract_branch.outputs.branch_name }}
+          target_commitish: ${{ github.sha }}
           token: ${{ secrets.PAT }}
           tag_name: ${{ steps.extract_branch.outputs.tag_name }}
           prerelease: false
           draft: false
           generate_release_notes: true
           name: ${{ steps.extract_branch.outputs.tag_name }}
-
-  push_release_to_registry:
-    needs: [ test_frontend ]
-    name: Push release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: gtstef/filebrowser
-      - name: Strip v from version number
-        id: modify-json
-        run: |
-          JSON="${{ steps.meta.outputs.tags }}"
-          # Use jq to remove 'v' from the version field
-          JSON=$(echo "$JSON" | sed 's/filebrowser:stable\/v/filebrowser:/')
-          echo "cleaned_tag=$JSON" >> $GITHUB_OUTPUT
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./Dockerfile
-          push: true
-          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/tag.yaml

@@ -29,3 +29,70 @@ jobs:
           workdir: backend
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  push_release_to_registry:
+    name: Push release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{ secrets.PAT }}
+      - name: Extract metadata (tags, labels) for Docker and GHCR
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            gtstef/filebrowser
+            ghcr.io/gtsteffaniak/filebrowser
+      - name: Modify tags (strip 'v' and add 'beta'/'stable' if needed)
+        id: modify-json
+        run: |
+          JSON='${{ steps.meta.outputs.json }}'
+          MODIFIED_JSON=$(echo "$JSON" | jq '
+            .tags |= map(sub(":v"; ":")) |
+            if any(.tags[]; test("beta")) then
+              .tags += [
+                "gtstef/filebrowser:beta",
+                "ghcr.io/gtsteffaniak/filebrowser:beta",
+                "gtstef/filebrowser:latest",
+                "ghcr.io/gtsteffaniak/filebrowser:latest"
+              ]
+            else . end |
+            if any(.tags[]; test("stable")) then
+              .tags += [
+                "gtstef/filebrowser:stable",
+                "ghcr.io/gtsteffaniak/filebrowser:stable",
+                "gtstef/filebrowser:latest",
+                "ghcr.io/gtsteffaniak/filebrowser:latest"
+              ]
+            else . end
+          ')
+          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
+          echo "$TAGS_CSV" > modified_tags.txt  # Optional debug output
+          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          file: ./_docker/Dockerfile
+          push: true
+          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -9,9 +9,11 @@ rice-box.go
 /backend/filebrowser
 /backend/filebrowser.exe
 /backend/backend.exe
+/backend/tmp
 /frontend/dist
 /frontend/pkg
 /frontend/test-results
+/frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
 /frontend/package-lock.json
 /backend/vendor
@@ -43,3 +45,4 @@ yarn-error.log*
 *.sw*
 bin/
 build/
+*__debug*

CHANGELOG.md

@@ -2,9 +2,306 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
+## v0.7.2-beta
+
+The `media` tags introduced in 0.7.0 have been removed -- all docker images have media enabled now.
+
+  **Notes**:
+  - Reverts enforced user login methods types -- until suitable methods to alter are available.
+  - When updating a user, updating scope always sets to the exact scope specified on updated.
+  - Redirect api messages are INFO instead of WARN
+  - Settings has close button instead of back https://github.com/gtsteffaniak/filebrowser/issues/583
+
+  **Bug Fixes**:
+  - Hover bug when exact timestamp setting enabled https://github.com/gtsteffaniak/filebrowser/issues/585
+
+## v0.7.1-beta
+
+The `media` tags introduced in 0.7.0 have been removed -- all docker images have media enabled now.
+
+  **Notes**:
+  - changes to support jwks url needed for authelia - still needs testing to ensure it works https://github.com/gtsteffaniak/filebrowser/issues/575, added debug logs to help identify any further issues.
+  - added apache license file back https://github.com/gtsteffaniak/filebrowser/discussions/599
+  - updated toggle view icons to better match.
+  - adjusted popup preview position on mobile.
+  - updated createUserDir logic, https://github.com/gtsteffaniak/filebrowser/issues/541
+    - it always creats user dir (even for admins)
+    - scope path must exist if it doesn't end in username, and if it does, the parent dir must exist
+    - enforced user login methods types -- can't be changed. a password user cannot login as oidc, etc.
+
+  **Bug Fixes**:
+  - right click context menu issue https://github.com/gtsteffaniak/filebrowser/issues/598
+  - upload file issue https://github.com/gtsteffaniak/filebrowser/issues/597
+  - defaultUserScope is not respected https://github.com/gtsteffaniak/filebrowser/issues/589
+  - defaultEnabled is not respected https://github.com/gtsteffaniak/filebrowser/issues/603
+  - user has weird navigation barhttps://github.com/gtsteffaniak/filebrowser/issues/593
+  - fix multibutton state issue for close overlay https://github.com/gtsteffaniak/filebrowser/issues/596
+
+## v0.7.0-beta
+
+ **New Features**:
+ - New authentication method: OIDC (OpenID Connect)
+ - UI refresh
+   - Refreshed icons and styles to provide more contrast https://github.com/gtsteffaniak/filebrowser/issues/493
+   - New scrollbar which includes information about the listing https://github.com/gtsteffaniak/filebrowser/issues/304
+   - User-configurable popup previewer and user can control preview size of images.
+   - Enhanced user settings page with more toggle options.
+   - Replaced checkboxes with toggles switches https://github.com/gtsteffaniak/filebrowser/issues/461
+   - Refreshed Breadcrumbs style.
+   - Main navbar icon is multipurpose menu, close, back and animates
+   - Enhanced source info on the UI
+     - User must have permission `realtime: true` property to get realtime events.
+     - Sources shows status of the directory `ready`, `indexing`, and `unavailable`
+   - Top-right overflow menu for deleting / editing files in peview https://github.com/gtsteffaniak/filebrowser/issues/456
+   - Helpful UI animation for drag and drop files, to get feedback where the drop target is.
+   - More consistent theme color https://github.com/gtsteffaniak/filebrowser/issues/538
+ - New file preview types:
+   - Video thumbnails available via new media integration (see configuration wiki for help) https://github.com/gtsteffaniak/filebrowser/issues/351
+   - Office file previews if you have office integration enabled. https://github.com/gtsteffaniak/filebrowser/issues/460
+
+  **Notes**:
+  - sesssionId is now unique per window. Previously it was shared accross browser tabs.
+  - DisableUsedPercentage is a backend property now, so users can't "hack" the information to be shown.
+  - Updated documentation for resources api https://github.com/gtsteffaniak/filebrowser/issues/560
+  - Updated placeholder for scopes https://github.com/gtsteffaniak/filebrowser/issues/475
+  - When user's API permissions are removed, any api keys the user had will be revoked.
+  - `server.enableThumbnails` moved to `server.disablePreviews` defaulting to false.
+  - `server.resizePreview` moved to `server.resizePreviews` (with an "s" at the end)
+
+  **Bug Fixes**:
+  - Nil pointer error when source media is disconnected while running.
+  - Source selection buggy https://github.com/gtsteffaniak/filebrowser/issues/537
+  - Upload folder structure https://github.com/gtsteffaniak/filebrowser/issues/539
+  - Editing files on multiple sources https://github.com/gtsteffaniak/filebrowser/issues/535
+  - Prevent the user from changing the password https://github.com/gtsteffaniak/filebrowser/issues/550
+  - Links in setting page does not navigate to correct location https://github.com/gtsteffaniak/filebrowser/issues/474
+  - Url encoding issue https://github.com/gtsteffaniak/filebrowser/issues/530
+  - Certain file types being treated as folders https://github.com/gtsteffaniak/filebrowser/issues/555
+  - Source name with special characters https://github.com/gtsteffaniak/filebrowser/issues/557
+  - Onlyoffice support on proxy auth https://github.com/gtsteffaniak/filebrowser/issues/559
+  - Downloading with user scope https://github.com/gtsteffaniak/filebrowser/issues/564
+  - User disableSettings property to be respected.
+  - Non admin users updating admin settings.
+  - Right click context issue on safari desktop.
+  - office save file issue.
+
+## v0.6.8-beta
+
+ **New Features**
+ - environment variables are available for certain secrets.
+   - see wiki https://github.com/gtsteffaniak/filebrowser/wiki/Environment-Variables
+   - thanks @aaronkyriesenbach https://github.com/gtsteffaniak/filebrowser/pull/511
+
+ **Notes**:
+ - config validation (see https://github.com/gtsteffaniak/filebrowser/wiki/Full-Config-Example)
+   - fails when config file contains unknown fields (helps spot typos)
+   - some light value validation on certain fields
+   - removed recaptcha -- was disabled and not used before.
+   - moved `recaptcha` and `signup` configs to `auth.methods.password`
+
+ **BugFixes**:
+ - fix scope reset on restart https://github.com/gtsteffaniak/filebrowser/issues/515
+ - Clicking empty space to deselect https://github.com/gtsteffaniak/filebrowser/issues/492
+
+## v0.6.7-beta
+
+ **Notes**:
+ - added full tests for single source example.
+ - adds descriptive error if temp dir can't be created on fatal startup
+ - clears temp directory on shutdown.
+ - removed put settings api (unused)
+ - removed more unused config properties.
+
+ **BugFixes**:
+ - fix url encoding issue for search links when theres only one source https://github.com/gtsteffaniak/filebrowser/issues/501
+ - files with # could have problems, double encoded.
+
+## v0.6.6-beta
+
+ **New Feature**:
+ - limit tar size creation to limit server burden. For example, don't let customers try to download the entire filesystem as a zip. see `server.maxArchiveSize` on config wiki.
+
+ **Notes**:
+ - disableUsedPercentage also hides text and source bar.
+ - share errors show up in logs in more verbose way.
+ - archive creation occurs on disk rather than in memory, use `server.cacheDir` to determine where temp files are stored.
+ - automatically ensures leading slash for scope
+   - https://github.com/gtsteffaniak/filebrowser/issues/472
+   - https://github.com/gtsteffaniak/filebrowser/issues/476
+
+ **BugFixes**:
+ - fix proxy user creation issue https://github.com/gtsteffaniak/filebrowser/issues/478
+ - externalUrl prefix issue fixed for shares. https://github.com/gtsteffaniak/filebrowser/issues/465
+ - fix File Opens Instead of Just Downloading https://github.com/gtsteffaniak/filebrowser/issues/480
+ - fix Download file name https://github.com/gtsteffaniak/filebrowser/issues/481
+
+## v0.6.5-beta
+
+ **Notes**:
+ - added more share and download tests
+
+ **BugFixes**:
+ - fix share download issue https://github.com/gtsteffaniak/filebrowser/issues/465
+ - fix content length size calculation issue when downloading multiple files.
+
+## v0.6.4-beta
+
+ **BugFixes**:
+ - fix preview arow issue. https://github.com/gtsteffaniak/filebrowser/issues/457
+ - fix password change issue.
+ - apply user defaults to publi user on startup https://github.com/gtsteffaniak/filebrowser/issues/451
+
+## v0.6.3-beta
+
+ **Notes**:
+ - windows directories get better naming, root directories like "D:\ get named "D", otherwise base filepath is the name when unselected "D:\path\to\folder" gets named "folder" (just like linux)
+ - `.pdf` files added to default onlyoffice exclusion list.
+
+ **BugFixes**:
+ - windows would not refresh file info automatically when viewing because of path issue.
+ - windows paths without name for "D:\" would cause issues.
+ - share path error https://github.com/gtsteffaniak/filebrowser/issues/429
+ - fix bug where resource content flag would load entire file into memory.
+
+## v0.6.2-beta
+
+ **Notes**:
+ - Added playwright tests for bugfixes for permantent fix for stability.
+    (except onlyoffice since it requires integrations)
+
+ **BugFixes**:
+ - Context menu should only be available inside the folder/files container https://github.com/gtsteffaniak/filebrowser/issues/430
+ - drag and drop files from desktop to browser is fixed.
+ - replace prompt cancel button didn't work.
+ - key events on listing page not working (like delete key)
+ - fixed share viewing issue https://github.com/gtsteffaniak/filebrowser/issues/429
+ - disableUsedPercentage hides entire source https://github.com/gtsteffaniak/filebrowser/issues/438
+ - createUserDir fix for proxy users and new users https://github.com/gtsteffaniak/filebrowser/issues/440
+
+## v0.6.1-beta
+
+ **New Feature**:
+ - download size information is added, including when downloding multiple files in zip/tar.gz. The browser will see the XMB of X GB and will show browser native progress.
+
+ **BugFixes**:
+ - fixed onlyoffice bug https://github.com/gtsteffaniak/filebrowser/issues/418
+ - fixed breadcrumbs bug https://github.com/gtsteffaniak/filebrowser/issues/419
+ - fixed search context bug https://github.com/gtsteffaniak/filebrowser/issues/417
+ - fixed sessionID for search
+
+## v0.6.0-beta
+
+> [!WARNING]
+> This release includes several config changes that could cause issues. Please backup your database file before upgrading.
+
+This release has several changes that should work without issues... however, still backup your database file first and proceed with caution. User permissions and source config changes have been updated -- and the `server.root` paramter is no longer used.
+
+This is a significant step towards a stable release. There shouldn't be any major breaking config changes after this.
+
+ **New Features**:
+  - multiple sources support https://github.com/gtsteffaniak/filebrowser/issues/360
+    - listing view keeps them independant, you switch between the two and the url address will have a prefix `/files/<sourcename>/path/to/file` when there is more than 1 source.
+    - search also happens independantly, with a selection toggle per source. searching current source searches the current scope in the listing view, if you toggle to an alternative source it will search from the source root.
+    - copy/moving is currently only supported within the same source -- that will come in a future release.
+  - `FILEBROWSER_CONFIG` environment variable is respected if no CLI config parameter is provided. https://github.com/gtsteffaniak/filebrowser/issues/413
+
+ **Notes**:
+  - downloads no longer open new window.
+  - swagger updated with auth api help for things like api token.
+    - GET api keys now uses `name` query instead of `key`. eg `GET /api/auth/tokens?name=apikeyname`
+  - user permissions simplified to four permission groups (no config change required):
+    - **removed**  : create, rename, delete, download
+    - **remaining**: admin, modify, share, api
+    - `scope` is deprecated, but still supported, applies to default source. if using multiple sources, set `defaultUserScope` at the [source config](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration#default-source-configuration) instead.
+  - **removed** user rules and commands.
+    - commands feature has never been enabled so just removing the references.
+    - rules will come back in a different form (not applied to the user).
+  - `server.root` is completely removed in favor of `server.sources`
+
+ **BugFixes**:
+  - fix conflict resolution issue https://github.com/gtsteffaniak/filebrowser/issues/384
+  - many user creation page bugfixes.
+  - fix share delete issue https://github.com/gtsteffaniak/filebrowser/issues/408
+
+## v0.5.4-beta
+
+ **BugFixes**:
+  - default scope share issue. @theryecatcher https://github.com/gtsteffaniak/filebrowser/pull/387
+  - drag and drop on empty folders https://github.com/gtsteffaniak/filebrowser/issues/361
+  - preview navigation issue https://github.com/gtsteffaniak/filebrowser/issues/372
+  - auth proxy password length error https://github.com/gtsteffaniak/filebrowser/issues/375
+
+<img width="294" alt="image" src="https://github.com/user-attachments/assets/669bca75-98d4-47c1-838b-1ffee2967d7d" />
+
+## v0.5.3-beta
+
+ **New Features**:
+  - onlyoffice disable filetypes for user specified file types. https://github.com/gtsteffaniak/filebrowser/issues/346
+
+ **Notes**:
+  - navbar/sidebar lightmode style tweaks.
+  - any item that has utf formatted text will get editor.
+  - tweaks to create options on context menu.
+  - removed small delay on preview before detecting the file.
+
+ **BugFixes**:
+  - fix `/files/` prefix loading issue https://github.com/gtsteffaniak/filebrowser/issues/362
+  - fix special characters in filename issue https://github.com/gtsteffaniak/filebrowser/issues/357
+  - fix drag and drop issue https://github.com/gtsteffaniak/filebrowser/issues/361
+  - fix conflict issue with creating same file after deletion.
+  - fix mimetype detection https://github.com/gtsteffaniak/filebrowser/issues/327
+  - subtitles for videos https://github.com/gtsteffaniak/filebrowser/issues/358
+    - supports caption sidecar files : ".vtt", ".srt", ".lrc", ".sbv", ".ass", ".ssa", ".sub", ".smi"
+    - embedded subtitles not yet supported.
+
+## v0.5.2-beta
+
+ **New Features**:
+  - Markdown file preview https://github.com/gtsteffaniak/filebrowser/issues/343
+  - Easy access download button https://github.com/gtsteffaniak/filebrowser/issues/341
+
+ **Notes**:
+  - Adds message about what sharing means when creating a link.
+  - api log duration is now always in milliseconds for consistency.
+  - advanced index config option `fileEndsWith` is now respected.
+  - Added Informative error for missing files for certificate load https://github.com/gtsteffaniak/filebrowser/issues/354
+
+ **BugFixes**:
+  - onlyoffice close window missing files issue https://github.com/gtsteffaniak/filebrowser/issues/345
+  - fixed download link inside file preview
+
+## v0.5.1-beta
+
+ > Note: I changed the [config](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration#example-auth-config) for password auth again... It was a mistake just to make it a boolean, so now you can provide options, going forward this allows for more.
+
+  **New Features**:
+  - password length requirement config via `auth.methods.password.minLength` as a number of characters required.
+
+  **Bugfixes**:
+  - NoAuth error message "resource not found"
+  - CLI user configuration works and simplified see examples in the [Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/CLI)
+
+## v0.5.0-beta
+
+ > Note: This Beta release includes a configuration change: `auth.method` is now deprecated. This is done to allow multiple login methods at once. Auth methods are specified via `auth.methods` instead. see [example on the wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration#example-auth-config).
+
+  **New Features**:
+  - Upload progress notification https://github.com/gtsteffaniak/filebrowser/issues/303
+  - proxy auth auto create user when `auth.methods.proxy.createUser: true` while using proxy auth.
+
+  **Notes**:
+  - Context menu positioning tweaks.
+  - using /tmp cachedir is disabled by default, cache dir can be specified via `server.cacheDir: /tmp` to enable it. https://github.com/gtsteffaniak/filebrowser/issues/326
+
+  **Bugfixes**:
+  - Gracefully shutdown to protect database. https://github.com/gtsteffaniak/filebrowser/issues/317
+  - validates auth method provided before server startup.
+  - fix sidebar disk space usage calculation. https://github.com/gtsteffaniak/filebrowser/issues/315
+  - Fixed proxy auth header support (make sure your proxy and server are secure!). https://github.com/gtsteffaniak/filebrowser/issues/322
+
 ## v0.4.2-beta
 
-  **New Features**
+  **New Features**:
   - Hidden files changes
     - windows hidden file properties are respected -- when running on windows binary (not docker) with NTFS filesystem.
     - windows "system" files are considered hidden.
@@ -19,10 +316,10 @@ All notable changes to this project will be documented in this file. For commit
 
 ## v0.4.1-beta
 
-  **New Features**
+  **New Features**:
   - right-click actions are available on search. https://github.com/gtsteffaniak/filebrowser/issues/273
 
-  **Notes**
+  **Notes**:
   - delete prompt now lists all items that will be affected by delete
   - Debug and logger output tweaks.
 
@@ -34,13 +331,13 @@ All notable changes to this project will be documented in this file. For commit
 
 ## v0.4.0-beta
 
-  **New Features**
+  **New Features**:
   - Better logging https://github.com/gtsteffaniak/filebrowser/issues/288
     - highly configurable
     - api logs include user
   - onlyOffice support for editing only office files (inspired from https://github.com/filebrowser/filebrowser/pull/2954)
 
-  **Notes**
+  **Notes**:
   - Breadcrumbs will only show on file listing (not on previews or editors)
   - Config file is now optional. It will run with default settings without one and throw a `[WARN ]` message.
   - Added more descriptions to swagger API
@@ -58,7 +355,7 @@ All notable changes to this project will be documented in this file. For commit
 
 ## v0.3.6-beta
 
-  **New Features**
+  **New Features**:
   - Adds "externalUrl" server config https://github.com/gtsteffaniak/filebrowser/issues/272
 
   **Notes**:
@@ -74,7 +371,7 @@ All notable changes to this project will be documented in this file. For commit
 
 ## v0.3.5
 
-  **New Features**
+  **New Features**:
   - More indexing configuration options possible. However consider waiting on using this feature, because I will soon have a full onboarding experience in the UI to manage sources instead.
     - added config file options "sources" in the server config.
     - can enable/disable indexing a specified list of directories/files

Dockerfile

@@ -1,31 +0,0 @@
-FROM golang:1.23-alpine AS base
-ARG VERSION
-ARG REVISION
-WORKDIR /app
-COPY ./backend ./
-#RUN swag init --output swagger/docs
-RUN ln -s swagger /usr/local/go/src/
-RUN go build -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/version.CommitSHA=${REVISION}'" \
-  -o filebrowser .
-
-FROM node:slim AS nbuild
-WORKDIR /app
-COPY ./frontend/package.json ./
-RUN npm i --maxsockets 1
-COPY  ./frontend/ ./
-RUN npm run build-docker
-
-FROM alpine:latest
-ENV FILEBROWSER_NO_EMBEDED="true"
-RUN apk --no-cache add ca-certificates mailcap
-WORKDIR /home/filebrowser
-RUN adduser -D -s /bin/true -u 1000 filebrowser
-USER filebrowser
-COPY --from=base --chown=filebrowser:1000 /app/filebrowser* ./
-COPY --from=nbuild --chown=filebrowser:1000 /app/dist/ ./http/dist/
-USER root
-# exposing default port for auto discovery.
-EXPOSE 80
-ENTRYPOINT [ "./filebrowser" ]

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2018 File Browser contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -1,84 +1,75 @@
-<p align="center">
-  <a href="https://opensource.org/license/apache-2-0/"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License: Apache-2.0"></a>
-</p>
-<p align="center">
-  <img src="frontend/public/img/icons/favicon-256x256.png" width="100" title="Login With Custom URL">
-</p>
-<h3 align="center">FileBrowser Quantum - A modern web-based file manager</h3>
-<p align="center">
-  <img width="800" src="https://github.com/user-attachments/assets/c991fc69-a05b-4f34-b915-0d3cded887a7" title="Main Screenshot">
-</p>
+<div align="center">
+
+  [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
+  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
+  [![latest version](https://img.shields.io/github/release/gtsteffaniak/filebrowser/all.svg)](https://github.com/gtsteffaniak/filebrowser/releases)
+  [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
+  [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
+
+  [![Donate](https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif)](https://www.paypal.com/donate/?business=W5XKNXHJM2WPE&no_recurring=0&currency_code=USD)
+
+  <img width="150" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" title="Logo">
+  <h3>FileBrowser Quantum</h3>
+  The best free self-hosted web-based file manager.
+  <br/><br/>
+  <img width="800" src="https://github.com/user-attachments/assets/95af22fa-7760-4f7b-9c20-51fdcfe8f4ea" title="Main Screenshot">
+</div>
 
 > [!WARNING]
-> There is no stable version yet planned 2025.
+> There is no stable version -- planned for 2025.
 
-FileBrowser Quantum is a fork of the file browser open-source project with the following changes:
+FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:
 
-  1. ✅ Indexes files efficiently. (See [indexing Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) for more info.)
-     - Real-time search results as you type
-     - Search supports file/folder sizes and many file type filters.
-     - Enhanced interactive results that show file/folder sizes.
-  2. ✅ Revamped and simplified GUI navbar and sidebar menu.
-     - Additional compact view mode as well as refreshed view mode styles.
-     - Many graphical and user experience improvements.
-     - right-click context menu
-  3. ✅ Revamped and simplified configuration via `config.yaml` config file.
-  4. ✅ Better listing browsing
-     - Instantly Switches view modes and sort order without reloading data.
-     - Folder sizes are displayed
-     - Navigating remembers the scroll position, navigating back keeps the last scroll position.
-  5. ✅ Developer API support
-     - Ability to create long-live API Tokens.
-     - Helpful Swagger page available at `/swagger` endpoint.
+  1. ✅ Multiple sources support
+  2. ✅ Login support for OIDC, password, and proxy.
+  3. ✅ Revamped UI
+  4. ✅ Simplified configuration via `config.yaml` config file.
+  5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
+     - Real-time search results as you type.
+     - Real-time monitoring and updates in the UI.
+     - Search supports file and folder sizes, along with various filters.
+  6. ✅ Better listing browsing
+     - More file type previews, such as **office** and **video** file previews
+     - Instantly switches view modes and sort order without reloading data.
+     - Folder sizes are displayed.
+     - Navigating remembers the last scroll position.
+  7. ✅ Developer API support
+     - Ability to create long-lived API Tokens.
+     - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.
 
 Notable features that this fork *does not* have (removed):
 
- - ❌ jobs/runners are not supported yet (planned).
- - ❌ per-user rules are not supported yet (planned).
- - ❌ pagination for directory items for extremely large directories.
+ - ❌ jobs are not supported yet (planned).
+ - ❌ rules are not supported yet (planned).
  - ❌ shell commands are completely removed and will not be returned.
- - see feature matrix below for more.
 
 ## About
 
-FileBrowser Quantum provides a file-managing interface within a specified directory
-and can be used to upload, delete, preview, rename, and edit your files.
-It allows the creation of multiple users and each user can have its directory.
+FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.
 
-This repository is a fork of the original [filebrowser](https://github.com/filebrowser/filebrowser)
- with a collection of changes that make this program work better in terms of
- aesthetics and performance. Improved search, simplified UI
- (without removing features) and more secure and up-to-date
- build are just a few examples.
+This version is called "Quantum" because it packs tons of advanced features in a tiny executable file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
 
-FileBrowser Quantum differs significantly from the original.
-There are hundreds of thousands of lines changed and they are generally
-no longer compatible with each other. This has been intentional -- the
-focus of this fork is on a few key principles:
-  - Simplicity and improved user experience
-  - Improving performance and faster feedback when making changes.
-  - Minimize external dependencies and standard library usage.
-  - Of course -- adding much-needed features.
+The goal for this repo is to become the best open-source self-hosted file browsing application that exists -- **all for free**.
+
+This repo will always be free and open-source.
 
 For more, see the [Q&A Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A)
 
 ## Look
 
-The UI has a simple three-component navigation system :
+The UI has a simple three-component navigation system:
 
-  1. (Left) The slide-out action panel button
+  1. (Left) Multi-action button with slide-out panel.
   2. (Middle) The powerful search bar.
   3. (Right) The view change toggle.
 
-All other functions are moved either into the action menu or popup menus.
+All other functions are moved either into the action menu or pop-up menus.
 If the action does not depend on context, it will exist in the slide-out
 action panel. If the action is available based on context, it will show up as
-a popup menu.
+a pop-up menu.
 
 <p align="center">
-  <img width="800" src="https://github.com/user-attachments/assets/2be7a6c5-0f95-4d9f-bc05-484ee71246d8" title="Search GIF">
-  <img width="800" src="https://github.com/user-attachments/assets/f55a6f1f-b930-4399-98b5-94da6e90527a" title="Navigation GIF">
-  <img width="800" src="https://github.com/user-attachments/assets/93b019de-d38f-4aaa-bde3-3ba4e99ecd25" title="Main Screenshot">
+  <img width="1000" src="https://github.com/user-attachments/assets/aa32b05c-f917-47bb-b07f-857edc5e47f7" title="Search GIF">
 </p>
 
 ## Install and Configuration
@@ -99,7 +90,7 @@ Configuration is done via the `config.yaml`, see the [Configuration Wiki](https:
 
 ## Office File Support
 
-See [Office Support Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Office-Support#adding-open-office-integration-for-docker) on how to enable office file editing.
+See [Office Support Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Office-Support#adding-open-office-integration-for-docker) on how to enable office file editing and office related features.
 
 ## Migration from the original filebrowser
 
@@ -107,7 +98,7 @@ See the [Migration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Migrat
 
 ## Comparison Chart
 
- Application Name | <img width="48" src="frontend/public/img/icons/favicon-256x256.png" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
+ Application Name | <img width="48" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
 --- | --- | --- | --- | --- | --- | --- |
 Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
 Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
@@ -119,41 +110,42 @@ S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
 webdav support                | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
 FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Dedicated docs site?          | ❌ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Multiple sources at once      | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Docker image size             | 31 MB  | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
-Min. Memory Requirements      | 128 MB | 128 MB | 128 MB (main image) | 128 MB | ❌ | 4 GB   |
+Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+Docker image size             | 200 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
+Min. Memory Requirements      | 256 MB | 128 MB | 128 MB (main image) | 128 MB | ❌ | 4 GB   |
 has standalone binary         | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
 price                         | free | free | free | free tier | free tier | $99+ |
 rich media preview            | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Advanced Search?              | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
 Indexed Search?               | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
 Content-aware search?         | ❌ | ❌ | ❌ | configurable | ✅ | ✅ |
 Custom job support            | ❌ | ✅ | ❌ | ✅ | ❌ | ✅ |
 Multiple users                | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Single sign-on support        | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Single sign-on support        | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
 LDAP sign-on support          | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
-2FA sign-on support           | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
 Long-live API key support     | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 API documentation page        | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Mobile App                    | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ |
 open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 tags support                  | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ |
-sharable web links?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+shareable web links?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Event-based notifications     | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
 Metrics                       | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
 file space quotas             | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
 text-based files editor       | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-Office file previews          | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
 Themes                        | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
 Branding support              | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
 activity log                  | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
 Comments support              | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
 trash support                 | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
 Starred/pinned files          | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
-Content preview icons         | ✅ | ✅ | ❌ | ❌ | ✅ | ✅ |
 Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
 Share collections of files    | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
 Can archive selected files    | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can browse archive files      | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ 
+Can browse archive files      | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can convert documents         | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can convert videos            | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
+Can convert photos            | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |

_docker/Dockerfile

@@ -0,0 +1,58 @@
+FROM golang:1.24-alpine AS base
+ARG VERSION
+ARG REVISION
+WORKDIR /app
+COPY ./backend ./
+#RUN swag init --output swagger/docs
+RUN ln -s swagger /usr/local/go/src/
+RUN go build -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
+  -o filebrowser .
+
+FROM node:slim AS nbuild
+WORKDIR /app
+COPY ./frontend/package.json ./
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
+RUN npm run build-docker
+
+FROM alpine:latest
+
+RUN apk add --no-cache curl xz && \
+    ARCH=$(uname -m) && \
+    case "$ARCH" in \
+      x86_64)   URL="https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz" ;; \
+      aarch64)  URL="https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-arm64-static.tar.xz" ;; \
+      armv7l)   URL="https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-armhf-static.tar.xz" ;; \
+      *)        echo "Unsupported architecture: $ARCH" && exit 1 ;; \
+    esac && \
+    mkdir -p /tmp/ffmpeg && \
+    curl -L "$URL" | tar -xJ -C /tmp/ffmpeg && \
+    mv /tmp/ffmpeg/ffmpeg-*/ffmpeg /usr/local/bin/ && \
+    mv /tmp/ffmpeg/ffmpeg-*/ffprobe /usr/local/bin/ && \
+    chmod +x /usr/local/bin/ffmpeg /usr/local/bin/ffprobe && \
+    rm -rf /tmp/ffmpeg && \
+    apk del curl xz && \
+    rm -rf /var/cache/apk/*
+
+ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
+ENV FILEBROWSER_NO_EMBEDED="true"
+ENV PATH="$PATH:/home/filebrowser"
+RUN apk --no-cache add ca-certificates mailcap
+RUN adduser -D -s /bin/true -u 1000 filebrowser
+USER filebrowser
+WORKDIR /home/filebrowser
+COPY --from=base --chown=filebrowser:1000 /app/filebrowser* ./
+COPY --from=base --chown=filebrowser:1000 /app/config.media.yaml ./config.yaml
+COPY --from=nbuild --chown=filebrowser:1000 /app/dist/ ./http/dist/
+
+## sanity checks
+RUN [ "filebrowser", "version" ]
+RUN [ "ffmpeg", "-version" ]
+RUN [ "ffprobe", "-version" ]
+
+USER root
+# exposing default port for auto discovery.
+EXPOSE 80
+ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-general

@@ -1,6 +1,8 @@
 FROM gtstef/playwright-base
+WORKDIR /app
+COPY [ "./_docker/src/general/", "./" ]
 WORKDIR /app/frontend
 COPY [ "./frontend/", "./" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser*", "./"]
-RUN ./filebrowser -c filebrowser-playwright.yaml & sleep 2 && cd ../frontend && npx playwright test
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-noauth

@@ -0,0 +1,8 @@
+FROM gtstef/playwright-base
+WORKDIR /app
+COPY [ "./_docker/src/noauth/", "./" ]
+WORKDIR /app/frontend
+COPY [ "./frontend/", "./" ]
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser", "./"]
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-proxy

@@ -0,0 +1,11 @@
+FROM gtstef/playwright-base
+WORKDIR /app
+COPY [ "./_docker/src/proxy/", "./" ]
+WORKDIR /app/frontend
+COPY [ "./frontend/", "./" ]
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser", "./"]
+RUN apt update && apt install nginx -y
+RUN mv default.conf /etc/nginx/conf.d/default.conf
+RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
+RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/docker-compose.yaml

@@ -0,0 +1,16 @@
+services:
+  nginx-proxy-auth:
+    image: nginx
+    container_name: nginx-proxy-auth
+    ports:
+      - "80:80"
+    volumes:
+      - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
+  filebrowser:
+    hostname: filebrowser
+    volumes:
+      - '../frontend:/home/frontend'
+      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
+    build:
+      context: ../
+      dockerfile: ./_docker/Dockerfile

_docker/src/general/backend/config.yaml

@@ -0,0 +1,16 @@
+server:
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+    - path: "."
+      name: "docker"
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"

_docker/src/general/frontend/playwright.config.ts

@@ -10,13 +10,13 @@ import { defineConfig, devices } from "@playwright/test";
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-  globalSetup: "./global-setup",
-  timeout: 6000,
-  testDir: "./tests",
+  globalSetup: "./tests-playwright/global-setup",
+  timeout: 5000,
+  testDir: "./tests-playwright/general",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: Boolean(process.env.CI),
+  forbidOnly: false,
   /* Retry on CI only */
   retries: 2,
   /* Opt out of parallel tests on CI. */
@@ -28,7 +28,7 @@ export default defineConfig({
     actionTimeout: 5000,
     storageState: "loginAuth.json",
     /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
+    baseURL: "http://127.0.0.1/",
 
     /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
     trace: "on-first-retry",

_docker/src/noauth/backend/config.yaml

@@ -0,0 +1,20 @@
+server:
+  port: 80
+  baseURL:  "/files/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+auth:
+  methods:
+    noauth: true
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+userDefaults:
+  permissions:
+   realtime: true

_docker/src/noauth/frontend/playwright.config.ts

@@ -0,0 +1,48 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests-playwright/noauth-setup",
+  timeout: 5000,
+  testDir: "./tests-playwright/noauth",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    storageState: "noauth.json",
+    actionTimeout: 5000,
+    //storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

_docker/src/proxy/backend/config.yaml

@@ -1,10 +1,14 @@
 server:
-  port: 80
+  port: 8080
   baseURL:  "/"
-  root: "../frontend/tests/playwright-files"
-auth:
-  method: password
-  signup: false
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      config:
+        defaultEnabled: true
+        createUserDir: true
+
 frontend:
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
@@ -12,16 +16,20 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
+
+auth:
+  methods:
+    proxy:
+      enabled: true
+      header: "X-Username"
+      createUser: true
+
 userDefaults:
   darkMode: true
   disableSettings: false
-  scope: "."
   singleClick: false
   permissions:
     admin: false
-    create: false
-    rename: false
-    modify: false
-    delete: false
+    modify: true
     share: false
-    download: false
+    api: false

_docker/src/proxy/backend/default.conf

@@ -0,0 +1,19 @@
+
+map $remote_addr $uuid {
+    default "demo-${remote_addr}";
+}
+
+server {
+    listen 80;
+    server_name localhost 127.0.0.1;
+
+    location / {
+        proxy_set_header X-Username $uuid;
+        add_header X-Username $uuid;
+        proxy_pass http://filebrowser:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

_docker/src/proxy/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  //globalSetup: "./global-setup",
+  timeout: 3000,
+  testDir: "./tests-playwright/proxy",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 3000,
+    //storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

backend/.goreleaser.yaml

@@ -6,7 +6,7 @@ builds:
   # Build configuration for darwin and linux
   - id: default
     ldflags: &ldflags
-      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/version.Version={{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/version.CommitSHA={{ .ShortCommit }}
+      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/common/version.Version={{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA={{ .ShortCommit }}
     main: main.go
     binary: filebrowser
     goos:
@@ -35,7 +35,7 @@ builds:
       post:
         - upx {{ .Path }}  # Compress the binary with UPX
 
-  # Build configuration for windows without arm & upx
+  # Build configuration for macos without upx
   - id: macos
     ldflags: *ldflags
     main: main.go
@@ -46,6 +46,16 @@ builds:
       - amd64
       - arm64
 
+  # Build configuration for freebsd without arm & upx
+  - id: freeBSD
+    ldflags: *ldflags
+    main: main.go
+    binary: filebrowser
+    goos:
+      - freebsd
+    goarch:
+      - amd64
+
 archives:
   - name_template: >
       {{- if eq .Os "windows" -}}

backend/adapters/fs/diskcache/file_cache.go

@@ -31,9 +31,10 @@ type FileCache struct {
 
 // NewFileCache creates a new FileCache
 func NewFileCache(dir string) (*FileCache, error) {
-	if err := os.MkdirAll(dir, 0700); err != nil {
+	if err := os.MkdirAll(filepath.Join(dir, "thumbnails", "video"), 0700); err != nil {
 		return nil, fmt.Errorf("can't make directory %s: %v", dir, err)
 	}
+
 	return &FileCache{dir: dir}, nil
 }
 

backend/adapters/fs/files/file_test.go

@@ -7,7 +7,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )
 
 func Test_GetRealPath(t *testing.T) {
@@ -64,7 +66,7 @@ func Test_GetRealPath(t *testing.T) {
 			},
 		},
 	}
-	idx := Index{
+	idx := indexing.Index{
 		Source: settings.Source{
 			Path: trimPrefix,
 		},
@@ -84,33 +86,33 @@ func Test_GetRealPath(t *testing.T) {
 func TestSortItems(t *testing.T) {
 	tests := []struct {
 		name     string
-		input    FileInfo
-		expected FileInfo
+		input    iteminfo.FileInfo
+		expected iteminfo.FileInfo
 	}{
 		{
 			name: "Numeric and Lexicographical Sorting",
-			input: FileInfo{
-				Folders: []ItemInfo{
+			input: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
 					{Name: "10.txt"},
 					{Name: "2.txt"},
 					{Name: "apple"},
 					{Name: "Banana"},
 				},
-				Files: []ItemInfo{
+				Files: []iteminfo.ItemInfo{
 					{Name: "File2.txt"},
 					{Name: "File10.txt"},
 					{Name: "File1"},
 					{Name: "banana"},
 				},
 			},
-			expected: FileInfo{
-				Folders: []ItemInfo{
+			expected: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
 					{Name: "2.txt"},
 					{Name: "10.txt"},
 					{Name: "apple"},
 					{Name: "Banana"},
 				},
-				Files: []ItemInfo{
+				Files: []iteminfo.ItemInfo{
 					{Name: "banana"},
 					{Name: "File1"},
 					{Name: "File10.txt"},
@@ -120,25 +122,25 @@ func TestSortItems(t *testing.T) {
 		},
 		{
 			name: "Only Lexicographical Sorting",
-			input: FileInfo{
-				Folders: []ItemInfo{
+			input: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
 					{Name: "dog.txt"},
 					{Name: "Cat.txt"},
 					{Name: "apple"},
 				},
-				Files: []ItemInfo{
+				Files: []iteminfo.ItemInfo{
 					{Name: "Zebra"},
 					{Name: "apple"},
 					{Name: "cat"},
 				},
 			},
-			expected: FileInfo{
-				Folders: []ItemInfo{
+			expected: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
 					{Name: "apple"},
 					{Name: "Cat.txt"},
 					{Name: "dog.txt"},
 				},
-				Files: []ItemInfo{
+				Files: []iteminfo.ItemInfo{
 					{Name: "apple"},
 					{Name: "cat"},
 					{Name: "Zebra"},
@@ -151,7 +153,7 @@ func TestSortItems(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			test.input.SortItems()
 
-			getNames := func(items []ItemInfo) []string {
+			getNames := func(items []iteminfo.ItemInfo) []string {
 				names := []string{}
 				for _, folder := range items {
 					names = append(names, folder.Name)

backend/adapters/fs/files/files.go

@@ -0,0 +1,304 @@
+package files
+
+import (
+	"crypto/md5"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/hex"
+	"fmt"
+	"hash"
+	"io"
+
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/cache"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+)
+
+func FileInfoFaster(opts iteminfo.FileOptions) (iteminfo.ExtendedFileInfo, error) {
+	response := iteminfo.ExtendedFileInfo{}
+	if opts.Source == "" {
+		opts.Source = settings.Config.Server.DefaultSource.Name
+	}
+	index := indexing.GetIndex(opts.Source)
+	if index == nil {
+		return response, fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	realPath, isDir, err := index.GetRealPath(opts.Path)
+	if err != nil {
+		return response, err
+	}
+	opts.IsDir = isDir
+	// TODO: whats the best way to save trips to disk here?
+	// disabled using cache because its not clear if this is helping or hurting
+	// check if the file exists in the index
+	//info, exists := index.GetReducedMetadata(opts.Path, opts.IsDir)
+	//if exists {
+	//	err := RefreshFileInfo(opts)
+	//	if err != nil {
+	//		return info, err
+	//	}
+	//	if opts.Content {
+	//		content := ""
+	//		content, err = getContent(opts.Path)
+	//		if err != nil {
+	//			return info, err
+	//		}
+	//		info.Content = content
+	//	}
+	//	return info, nil
+	//}
+	err = index.RefreshFileInfo(opts)
+	if err != nil {
+		return response, err
+	}
+	info, exists := index.GetReducedMetadata(opts.Path, opts.IsDir)
+	if !exists {
+		return response, fmt.Errorf("could not get metadata for path: %v", opts.Path)
+	}
+	if opts.Content && strings.HasPrefix(info.Type, "text") {
+		// Check file size
+		if info.Size > 50*1024*1024 { // 50 megabytes in bytes
+			logger.Debug(fmt.Sprintf("Reading large text file contents: "+info.Path, info.Name))
+		}
+		content, err := getContent(realPath)
+		if err != nil {
+			return response, err
+		}
+		response.Content = content
+	}
+	response.FileInfo = *info
+	response.RealPath = realPath
+	response.Source = opts.Source
+	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
+		response.OnlyOfficeId = generateOfficeId(realPath)
+	}
+	if strings.HasPrefix(info.Type, "video") {
+		parentInfo, exists := index.GetReducedMetadata(filepath.Dir(info.Path), true)
+		if exists {
+			response.DetectSubtitles(parentInfo)
+		}
+	}
+	return response, nil
+}
+
+func generateOfficeId(realPath string) string {
+	key, ok := cache.OnlyOffice.Get(realPath).(string)
+	if !ok {
+		timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)
+		documentKey := utils.HashSHA256(realPath + timestamp)
+		cache.OnlyOffice.Set(realPath, documentKey)
+		return documentKey
+	}
+	return key
+}
+
+// Checksum checksums a given File for a given User, using a specific
+// algorithm. The checksums data is saved on File object.
+func GetChecksum(fullPath, algo string) (map[string]string, error) {
+	subs := map[string]string{}
+	reader, err := os.Open(fullPath)
+	if err != nil {
+		return subs, err
+	}
+	defer reader.Close()
+
+	hashFuncs := map[string]hash.Hash{
+		"md5":    md5.New(),
+		"sha1":   sha1.New(),
+		"sha256": sha256.New(),
+		"sha512": sha512.New(),
+	}
+
+	h, ok := hashFuncs[algo]
+	if !ok {
+		return subs, errors.ErrInvalidOption
+	}
+
+	_, err = io.Copy(h, reader)
+	if err != nil {
+		return subs, err
+	}
+	subs[algo] = hex.EncodeToString(h.Sum(nil))
+	return subs, nil
+}
+
+func DeleteFiles(source, absPath string, absDirPath string) error {
+	err := os.RemoveAll(absPath)
+	if err != nil {
+		return err
+	}
+	index := indexing.GetIndex(source)
+	if index == nil {
+		return fmt.Errorf("could not get index: %v ", source)
+	}
+	refreshConfig := iteminfo.FileOptions{Path: index.MakeIndexPath(absDirPath), IsDir: true}
+	err = index.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func MoveResource(sourceIndex, destIndex, realsrc, realdst string) error {
+	err := fileutils.MoveFile(realsrc, realdst)
+	if err != nil {
+		return err
+	}
+	idxSrc := indexing.GetIndex(sourceIndex)
+	if idxSrc == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	idxDst := indexing.GetIndex(destIndex)
+	if idxDst == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	refreshSourceDir := idxSrc.MakeIndexPath(filepath.Dir(realsrc))
+	refreshDestDir := idxDst.MakeIndexPath(filepath.Dir(realdst))
+	// refresh info for source and dest
+	err = idxSrc.RefreshFileInfo(iteminfo.FileOptions{
+		Path:  refreshSourceDir,
+		IsDir: true,
+	})
+	if err != nil {
+		return fmt.Errorf("could not refresh index for source: %v", err)
+	}
+	if refreshSourceDir == refreshDestDir {
+		return nil
+	}
+	refreshConfig := iteminfo.FileOptions{Path: refreshDestDir, IsDir: true}
+	err = idxDst.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return fmt.Errorf("could not refresh index for dest: %v", err)
+	}
+	return nil
+}
+
+func CopyResource(sourceIndex, destIndex, realsrc, realdst string) error {
+	err := fileutils.CopyFile(realsrc, realdst)
+	if err != nil {
+		return err
+	}
+	idxSrc := indexing.GetIndex(sourceIndex)
+	if idxSrc == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	idxDst := indexing.GetIndex(destIndex)
+	if idxDst == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	refreshSourceDir := idxSrc.MakeIndexPath(filepath.Dir(realsrc))
+	refreshDestDir := idxDst.MakeIndexPath(filepath.Dir(realdst))
+	index := indexing.GetIndex(sourceIndex)
+	if index == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	}
+	refreshConfig := iteminfo.FileOptions{Path: refreshSourceDir, IsDir: true}
+	// refresh info for source and dest
+	err = index.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return fmt.Errorf("could not refresh index for source: %v", err)
+	}
+	refreshConfig.Path = refreshDestDir
+	err = index.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return errors.ErrEmptyKey
+	}
+
+	return nil
+}
+
+func WriteDirectory(opts iteminfo.FileOptions) error {
+	idx := indexing.GetIndex(opts.Source)
+	if idx == nil {
+		return fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	realPath, _, _ := idx.GetRealPath(opts.Path)
+	// Ensure the parent directories exist
+	err := os.MkdirAll(realPath, 0775)
+	if err != nil {
+		return err
+	}
+	err = idx.RefreshFileInfo(opts)
+	if err != nil {
+		return errors.ErrEmptyKey
+	}
+	return nil
+}
+
+func WriteFile(opts iteminfo.FileOptions, in io.Reader) error {
+	idx := indexing.GetIndex(opts.Source)
+	if idx == nil {
+		return fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	dst, _, _ := idx.GetRealPath(opts.Path)
+	parentDir := filepath.Dir(dst)
+	// Create the directory and all necessary parents
+	err := os.MkdirAll(parentDir, 0775)
+	if err != nil {
+		return err
+	}
+
+	// Open the file for writing (create if it doesn't exist, truncate if it does)
+	file, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0775)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	// Copy the contents from the reader to the file
+	_, err = io.Copy(file, in)
+	if err != nil {
+		return err
+	}
+	opts.Path = idx.MakeIndexPath(parentDir)
+	opts.IsDir = true
+	return idx.RefreshFileInfo(opts)
+}
+
+// addContent reads and sets content based on the file type.
+func getContent(realPath string) (string, error) {
+	content, err := os.ReadFile(realPath)
+	if err != nil {
+		return "", err
+	}
+	stringContent := string(content)
+	if !utf8.ValidString(stringContent) {
+		return "", nil
+	}
+	if stringContent == "" {
+		return "empty-file-x6OlSil", nil
+	}
+	return stringContent, nil
+}
+
+func IsNamedPipe(mode os.FileMode) bool {
+	return mode&os.ModeNamedPipe != 0
+}
+
+func IsSymlink(mode os.FileMode) bool {
+	return mode&os.ModeSymlink != 0
+}
+
+func Exists(path string) bool {
+	_, err := os.Stat(path)
+	if err == nil {
+		return true
+	}
+	if os.IsNotExist(err) {
+		return false
+	}
+	return false
+}

backend/adapters/fs/files/mime.go

@@ -0,0 +1,612 @@
+package files
+
+// This file contains code primarily sourced from::
+// github.com/kataras/iris
+
+import (
+	"mime"
+)
+
+const (
+	// ContentBinaryHeaderValue header value for binary data.
+	ContentBinaryHeaderValue = "application/octet-stream"
+	// ContentWebassemblyHeaderValue header value for web assembly files.
+	ContentWebassemblyHeaderValue = "application/wasm"
+	// ContentHTMLHeaderValue is the  string of text/html response header's content type value.
+	ContentHTMLHeaderValue = "text/html"
+	// ContentJSONHeaderValue header value for JSON data.
+	ContentJSONHeaderValue = "application/json"
+	// ContentJSONProblemHeaderValue header value for JSON API problem error.
+	// Read more at: https://tools.ietf.org/html/rfc7807
+	ContentJSONProblemHeaderValue = "application/problem+json"
+	// ContentXMLProblemHeaderValue header value for XML API problem error.
+	// Read more at: https://tools.ietf.org/html/rfc7807
+	ContentXMLProblemHeaderValue = "application/problem+xml"
+	// ContentJavascriptHeaderValue header value for JSONP & Javascript data.
+	ContentJavascriptHeaderValue = "text/javascript"
+	// ContentTextHeaderValue header value for Text data.
+	ContentTextHeaderValue = "text/plain"
+	// ContentXMLHeaderValue header value for XML data.
+	ContentXMLHeaderValue = "text/xml"
+	// ContentXMLUnreadableHeaderValue obsolete header value for XML.
+	ContentXMLUnreadableHeaderValue = "application/xml"
+	// ContentMarkdownHeaderValue custom key/content type, the real is the text/html.
+	ContentMarkdownHeaderValue = "text/markdown"
+	// ContentYAMLHeaderValue header value for YAML data.
+	ContentYAMLHeaderValue = "application/x-yaml"
+	// ContentYAMLTextHeaderValue header value for YAML plain text.
+	ContentYAMLTextHeaderValue = "text/yaml"
+	// ContentProtobufHeaderValue header value for Protobuf messages data.
+	ContentProtobufHeaderValue = "application/x-protobuf"
+	// ContentMsgPackHeaderValue header value for MsgPack data.
+	ContentMsgPackHeaderValue = "application/msgpack"
+	// ContentMsgPack2HeaderValue alternative header value for MsgPack data.
+	ContentMsgPack2HeaderValue = "application/x-msgpack"
+	// ContentFormHeaderValue header value for post form data.
+	ContentFormHeaderValue = "application/x-www-form-urlencoded"
+	// ContentFormMultipartHeaderValue header value for post multipart form data.
+	ContentFormMultipartHeaderValue = "multipart/form-data"
+	// ContentMultipartRelatedHeaderValue header value for multipart related data.
+	ContentMultipartRelatedHeaderValue = "multipart/related"
+	// ContentGRPCHeaderValue Content-Type header value for gRPC.
+	ContentGRPCHeaderValue = "application/grpc"
+)
+
+var types = map[string]string{
+	".3dm":       "x-world/x-3dmf",
+	".3dmf":      "x-world/x-3dmf",
+	".7z":        "application/x-7z-compressed",
+	".a":         "application/octet-stream",
+	".aab":       "application/x-authorware-bin",
+	".aam":       "application/x-authorware-map",
+	".aas":       "application/x-authorware-seg",
+	".abc":       "text/vndabc",
+	".ace":       "application/x-ace-compressed",
+	".acgi":      "text/html",
+	".afl":       "video/animaflex",
+	".ai":        "application/postscript",
+	".aif":       "audio/aiff",
+	".aifc":      "audio/aiff",
+	".aiff":      "audio/aiff",
+	".aim":       "application/x-aim",
+	".aip":       "text/x-audiosoft-intra",
+	".alz":       "application/x-alz-compressed",
+	".ani":       "application/x-navi-animation",
+	".aos":       "application/x-nokia-9000-communicator-add-on-software",
+	".aps":       "application/mime",
+	".apk":       "application/vnd.android.package-archive",
+	".arc":       "application/x-arc-compressed",
+	".arj":       "application/arj",
+	".art":       "image/x-jg",
+	".asf":       "video/x-ms-asf",
+	".asm":       "text/x-asm",
+	".asp":       "text/asp",
+	".asx":       "application/x-mplayer2",
+	".au":        "audio/basic",
+	".avi":       "video/x-msvideo",
+	".avs":       "video/avs-video",
+	".bcpio":     "application/x-bcpio",
+	".bin":       "application/mac-binary",
+	".bmp":       "image/bmp",
+	".boo":       "application/book",
+	".book":      "application/book",
+	".boz":       "application/x-bzip2",
+	".bsh":       "application/x-bsh",
+	".bz2":       "application/x-bzip2",
+	".bz":        "application/x-bzip",
+	".c++":       ContentTextHeaderValue,
+	".c":         "text/x-c",
+	".cab":       "application/vnd.ms-cab-compressed",
+	".cat":       "application/vndms-pkiseccat",
+	".cc":        "text/x-c",
+	".ccad":      "application/clariscad",
+	".cco":       "application/x-cocoa",
+	".cdf":       "application/cdf",
+	".cer":       "application/pkix-cert",
+	".cha":       "application/x-chat",
+	".chat":      "application/x-chat",
+	".chrt":      "application/vnd.kde.kchart",
+	".class":     "application/java",
+	".com":       ContentTextHeaderValue,
+	".conf":      ContentTextHeaderValue,
+	".cpio":      "application/x-cpio",
+	".cpp":       "text/x-c",
+	".cpt":       "application/mac-compactpro",
+	".crl":       "application/pkcs-crl",
+	".crt":       "application/pkix-cert",
+	".crx":       "application/x-chrome-extension",
+	".csh":       "text/x-scriptcsh",
+	".css":       "text/css",
+	".csv":       "text/csv",
+	".cxx":       ContentTextHeaderValue,
+	".dar":       "application/x-dar",
+	".dcr":       "application/x-director",
+	".deb":       "application/x-debian-package",
+	".deepv":     "application/x-deepv",
+	".def":       ContentTextHeaderValue,
+	".der":       "application/x-x509-ca-cert",
+	".dif":       "video/x-dv",
+	".dir":       "application/x-director",
+	".divx":      "video/divx",
+	".dl":        "video/dl",
+	".dmg":       "application/x-apple-diskimage",
+	".doc":       "application/msword",
+	".dot":       "application/msword",
+	".dp":        "application/commonground",
+	".drw":       "application/drafting",
+	".dump":      "application/octet-stream",
+	".dv":        "video/x-dv",
+	".dvi":       "application/x-dvi",
+	".dwf":       "drawing/x-dwf=(old)",
+	".dwg":       "application/acad",
+	".dxf":       "application/dxf",
+	".dxr":       "application/x-director",
+	".el":        "text/x-scriptelisp",
+	".elc":       "application/x-bytecodeelisp=(compiled=elisp)",
+	".eml":       "message/rfc822",
+	".env":       "application/x-envoy",
+	".eps":       "application/postscript",
+	".es":        "application/x-esrehber",
+	".etx":       "text/x-setext",
+	".evy":       "application/envoy",
+	".exe":       "application/octet-stream",
+	".f77":       "text/x-fortran",
+	".f90":       "text/x-fortran",
+	".f":         "text/x-fortran",
+	".fdf":       "application/vndfdf",
+	".fif":       "application/fractals",
+	".fli":       "video/fli",
+	".flo":       "image/florian",
+	".flv":       "video/x-flv",
+	".flx":       "text/vndfmiflexstor",
+	".fmf":       "video/x-atomic3d-feature",
+	".for":       "text/x-fortran",
+	".fpx":       "image/vndfpx",
+	".frl":       "application/freeloader",
+	".funk":      "audio/make",
+	".g3":        "image/g3fax",
+	".g":         ContentTextHeaderValue,
+	".gif":       "image/gif",
+	".gl":        "video/gl",
+	".gsd":       "audio/x-gsm",
+	".gsm":       "audio/x-gsm",
+	".gsp":       "application/x-gsp",
+	".gss":       "application/x-gss",
+	".gtar":      "application/x-gtar",
+	".gz":        "application/x-compressed",
+	".gzip":      "application/x-gzip",
+	".h":         "text/x-h",
+	".hdf":       "application/x-hdf",
+	".help":      "application/x-helpfile",
+	".hgl":       "application/vndhp-hpgl",
+	".hh":        "text/x-h",
+	".hlb":       "text/x-script",
+	".hlp":       "application/hlp",
+	".hpg":       "application/vndhp-hpgl",
+	".hpgl":      "application/vndhp-hpgl",
+	".hqx":       "application/binhex",
+	".hta":       "application/hta",
+	".htc":       "text/x-component",
+	".htm":       "text/html",
+	".html":      "text/html",
+	".htmls":     "text/html",
+	".htt":       "text/webviewhtml",
+	".htx":       "text/html",
+	".ice":       "x-conference/x-cooltalk",
+	".ico":       "image/x-icon",
+	".ics":       "text/calendar",
+	".icz":       "text/calendar",
+	".idc":       ContentTextHeaderValue,
+	".ief":       "image/ief",
+	".iefs":      "image/ief",
+	".iges":      "application/iges",
+	".igs":       "application/iges",
+	".ima":       "application/x-ima",
+	".imap":      "application/x-httpd-imap",
+	".inf":       "application/inf",
+	".ins":       "application/x-internett-signup",
+	".ip":        "application/x-ip2",
+	".isu":       "video/x-isvideo",
+	".it":        "audio/it",
+	".iv":        "application/x-inventor",
+	".ivr":       "i-world/i-vrml",
+	".ivy":       "application/x-livescreen",
+	".jam":       "audio/x-jam",
+	".jav":       "text/x-java-source",
+	".java":      "text/x-java-source",
+	".jcm":       "application/x-java-commerce",
+	".jfif-tbnl": "image/jpeg",
+	".jfif":      "image/jpeg",
+	".jnlp":      "application/x-java-jnlp-file",
+	".jpe":       "image/jpeg",
+	".jpeg":      "image/jpeg",
+	".jpg":       "image/jpeg",
+	".jps":       "image/x-jps",
+	".js":        ContentJavascriptHeaderValue,
+	".mjs":       ContentJavascriptHeaderValue,
+	".json":      ContentJSONHeaderValue,
+	".vue":       ContentJavascriptHeaderValue,
+	".jut":       "image/jutvision",
+	".kar":       "audio/midi",
+	".karbon":    "application/vnd.kde.karbon",
+	".kfo":       "application/vnd.kde.kformula",
+	".flw":       "application/vnd.kde.kivio",
+	".kml":       "application/vnd.google-earth.kml+xml",
+	".kmz":       "application/vnd.google-earth.kmz",
+	".kon":       "application/vnd.kde.kontour",
+	".kpr":       "application/vnd.kde.kpresenter",
+	".kpt":       "application/vnd.kde.kpresenter",
+	".ksp":       "application/vnd.kde.kspread",
+	".kwd":       "application/vnd.kde.kword",
+	".kwt":       "application/vnd.kde.kword",
+	".ksh":       "text/x-scriptksh",
+	".la":        "audio/nspaudio",
+	".lam":       "audio/x-liveaudio",
+	".latex":     "application/x-latex",
+	".lha":       "application/lha",
+	".lhx":       "application/octet-stream",
+	".list":      ContentTextHeaderValue,
+	".lma":       "audio/nspaudio",
+	".log":       ContentTextHeaderValue,
+	".lsp":       "text/x-scriptlisp",
+	".lst":       ContentTextHeaderValue,
+	".lsx":       "text/x-la-asf",
+	".ltx":       "application/x-latex",
+	".lzh":       "application/octet-stream",
+	".lzx":       "application/lzx",
+	".m1v":       "video/mpeg",
+	".m2a":       "audio/mpeg",
+	".m2v":       "video/mpeg",
+	".m3u":       "audio/x-mpegurl",
+	".m":         "text/x-m",
+	".man":       "application/x-troff-man",
+	".manifest":  "text/cache-manifest",
+	".map":       "application/x-navimap",
+	".mar":       ContentTextHeaderValue,
+	".mbd":       "application/mbedlet",
+	".mc$":       "application/x-magic-cap-package-10",
+	".mcd":       "application/mcad",
+	".mcf":       "text/mcf",
+	".mcp":       "application/netmc",
+	".me":        "application/x-troff-me",
+	".mht":       "message/rfc822",
+	".mhtml":     "message/rfc822",
+	".mid":       "application/x-midi",
+	".midi":      "application/x-midi",
+	".mif":       "application/x-frame",
+	".mime":      "message/rfc822",
+	".mjf":       "audio/x-vndaudioexplosionmjuicemediafile",
+	".mjpg":      "video/x-motion-jpeg",
+	".mm":        "application/base64",
+	".mme":       "application/base64",
+	".mod":       "audio/mod",
+	".moov":      "video/quicktime",
+	".mov":       "video/quicktime",
+	".movie":     "video/x-sgi-movie",
+	".mp2":       "audio/mpeg",
+	".mp3":       "audio/mpeg",
+	".mp4":       "video/mp4",
+	".mpa":       "audio/mpeg",
+	".mpc":       "application/x-project",
+	".mpe":       "video/mpeg",
+	".mpeg":      "video/mpeg",
+	".mpg":       "video/mpeg",
+	".mpga":      "audio/mpeg",
+	".mpp":       "application/vndms-project",
+	".mpt":       "application/x-project",
+	".mpv":       "application/x-project",
+	".mpx":       "application/x-project",
+	".mrc":       "application/marc",
+	".ms":        "application/x-troff-ms",
+	".mv":        "video/x-sgi-movie",
+	".my":        "audio/make",
+	".mzz":       "application/x-vndaudioexplosionmzz",
+	".nap":       "image/naplps",
+	".naplps":    "image/naplps",
+	".nc":        "application/x-netcdf",
+	".ncm":       "application/vndnokiaconfiguration-message",
+	".nif":       "image/x-niff",
+	".niff":      "image/x-niff",
+	".nix":       "application/x-mix-transfer",
+	".nsc":       "application/x-conference",
+	".nvd":       "application/x-navidoc",
+	".o":         "application/octet-stream",
+	".oda":       "application/oda",
+	".odb":       "application/vnd.oasis.opendocument.database",
+	".odc":       "application/vnd.oasis.opendocument.chart",
+	".odf":       "application/vnd.oasis.opendocument.formula",
+	".odg":       "application/vnd.oasis.opendocument.graphics",
+	".odi":       "application/vnd.oasis.opendocument.image",
+	".odm":       "application/vnd.oasis.opendocument.text-master",
+	".odp":       "application/vnd.oasis.opendocument.presentation",
+	".ods":       "application/vnd.oasis.opendocument.spreadsheet",
+	".odt":       "application/vnd.oasis.opendocument.text",
+	".oga":       "audio/ogg",
+	".ogg":       "audio/ogg",
+	".ogv":       "video/ogg",
+	".omc":       "application/x-omc",
+	".omcd":      "application/x-omcdatamaker",
+	".omcr":      "application/x-omcregerator",
+	".otc":       "application/vnd.oasis.opendocument.chart-template",
+	".otf":       "application/vnd.oasis.opendocument.formula-template",
+	".otg":       "application/vnd.oasis.opendocument.graphics-template",
+	".oth":       "application/vnd.oasis.opendocument.text-web",
+	".oti":       "application/vnd.oasis.opendocument.image-template",
+	".otm":       "application/vnd.oasis.opendocument.text-master",
+	".otp":       "application/vnd.oasis.opendocument.presentation-template",
+	".ots":       "application/vnd.oasis.opendocument.spreadsheet-template",
+	".ott":       "application/vnd.oasis.opendocument.text-template",
+	".p10":       "application/pkcs10",
+	".p12":       "application/pkcs-12",
+	".p7a":       "application/x-pkcs7-signature",
+	".p7c":       "application/pkcs7-mime",
+	".p7m":       "application/pkcs7-mime",
+	".p7r":       "application/x-pkcs7-certreqresp",
+	".p7s":       "application/pkcs7-signature",
+	".p":         "text/x-pascal",
+	".part":      "application/pro_eng",
+	".pas":       "text/pascal",
+	".pbm":       "image/x-portable-bitmap",
+	".pcl":       "application/vndhp-pcl",
+	".pct":       "image/x-pict",
+	".pcx":       "image/x-pcx",
+	".pdb":       "chemical/x-pdb",
+	".pdf":       "application/pdf",
+	".pfunk":     "audio/make",
+	".pgm":       "image/x-portable-graymap",
+	".pic":       "image/pict",
+	".pict":      "image/pict",
+	".pkg":       "application/x-newton-compatible-pkg",
+	".pko":       "application/vndms-pkipko",
+	".pl":        "text/x-scriptperl",
+	".plx":       "application/x-pixclscript",
+	".pm4":       "application/x-pagemaker",
+	".pm5":       "application/x-pagemaker",
+	".pm":        "text/x-scriptperl-module",
+	".png":       "image/png",
+	".pnm":       "application/x-portable-anymap",
+	".pot":       "application/mspowerpoint",
+	".pov":       "model/x-pov",
+	".ppa":       "application/vndms-powerpoint",
+	".ppm":       "image/x-portable-pixmap",
+	".pps":       "application/mspowerpoint",
+	".ppt":       "application/mspowerpoint",
+	".ppz":       "application/mspowerpoint",
+	".pre":       "application/x-freelance",
+	".prt":       "application/pro_eng",
+	".ps":        "application/postscript",
+	".psd":       "application/octet-stream",
+	".pvu":       "paleovu/x-pv",
+	".pwz":       "application/vndms-powerpoint",
+	".py":        "text/x-scriptphyton",
+	".pyc":       "application/x-bytecodepython",
+	".qcp":       "audio/vndqcelp",
+	".qd3":       "x-world/x-3dmf",
+	".qd3d":      "x-world/x-3dmf",
+	".qif":       "image/x-quicktime",
+	".qt":        "video/quicktime",
+	".qtc":       "video/x-qtc",
+	".qti":       "image/x-quicktime",
+	".qtif":      "image/x-quicktime",
+	".ra":        "audio/x-pn-realaudio",
+	".ram":       "audio/x-pn-realaudio",
+	".rar":       "application/x-rar-compressed",
+	".ras":       "application/x-cmu-raster",
+	".rast":      "image/cmu-raster",
+	".rexx":      "text/x-scriptrexx",
+	".rf":        "image/vndrn-realflash",
+	".rgb":       "image/x-rgb",
+	".rm":        "application/vndrn-realmedia",
+	".rmi":       "audio/mid",
+	".rmm":       "audio/x-pn-realaudio",
+	".rmp":       "audio/x-pn-realaudio",
+	".rng":       "application/ringing-tones",
+	".rnx":       "application/vndrn-realplayer",
+	".roff":      "application/x-troff",
+	".rp":        "image/vndrn-realpix",
+	".rpm":       "audio/x-pn-realaudio-plugin",
+	".rt":        "text/vndrn-realtext",
+	".rtf":       "text/richtext",
+	".rtx":       "text/richtext",
+	".rv":        "video/vndrn-realvideo",
+	".s":         "text/x-asm",
+	".s3m":       "audio/s3m",
+	".s7z":       "application/x-7z-compressed",
+	".saveme":    "application/octet-stream",
+	".sbk":       "application/x-tbook",
+	".scm":       "text/x-scriptscheme",
+	".sdml":      ContentTextHeaderValue,
+	".sdp":       "application/sdp",
+	".sdr":       "application/sounder",
+	".sea":       "application/sea",
+	".set":       "application/set",
+	".sgm":       "text/x-sgml",
+	".sgml":      "text/x-sgml",
+	".sh":        "text/x-scriptsh",
+	".shar":      "application/x-bsh",
+	".shtml":     "text/x-server-parsed-html",
+	".sid":       "audio/x-psid",
+	".skd":       "application/x-koan",
+	".skm":       "application/x-koan",
+	".skp":       "application/x-koan",
+	".skt":       "application/x-koan",
+	".sit":       "application/x-stuffit",
+	".sitx":      "application/x-stuffitx",
+	".sl":        "application/x-seelogo",
+	".smi":       "application/smil",
+	".smil":      "application/smil",
+	".snd":       "audio/basic",
+	".sol":       "application/solids",
+	".spc":       "text/x-speech",
+	".spl":       "application/futuresplash",
+	".spr":       "application/x-sprite",
+	".sprite":    "application/x-sprite",
+	".spx":       "audio/ogg",
+	".src":       "application/x-wais-source",
+	".srt":       "text/plain",
+	".sbv":       "text/plain",
+	".ssa":       "text/plain",
+	".ssi":       "text/x-server-parsed-html",
+	".ssm":       "application/streamingmedia",
+	".sst":       "application/vndms-pkicertstore",
+	".step":      "application/step",
+	".stl":       "application/sla",
+	".stp":       "application/step",
+	".sv4cpio":   "application/x-sv4cpio",
+	".sv4crc":    "application/x-sv4crc",
+	".svf":       "image/vnddwg",
+	".svg":       "image/svg+xml",
+	".svr":       "application/x-world",
+	".swf":       "application/x-shockwave-flash",
+	".t":         "application/x-troff",
+	".talk":      "text/x-speech",
+	".tar":       "application/x-tar",
+	".tbk":       "application/toolbook",
+	".tcl":       "text/x-scripttcl",
+	".tcsh":      "text/x-scripttcsh",
+	".tex":       "application/x-tex",
+	".texi":      "application/x-texinfo",
+	".texinfo":   "application/x-texinfo",
+	".text":      ContentTextHeaderValue,
+	".tgz":       "application/gnutar",
+	".tif":       "image/tiff",
+	".tiff":      "image/tiff",
+	".tr":        "application/x-troff",
+	".tsi":       "audio/tsp-audio",
+	".tsp":       "application/dsptype",
+	".tsv":       "text/tab-separated-values",
+	".turbot":    "image/florian",
+	".txt":       ContentTextHeaderValue,
+	".uil":       "text/x-uil",
+	".uni":       "text/uri-list",
+	".unis":      "text/uri-list",
+	".unv":       "application/i-deas",
+	".uri":       "text/uri-list",
+	".uris":      "text/uri-list",
+	".ustar":     "application/x-ustar",
+	".uu":        "text/x-uuencode",
+	".uue":       "text/x-uuencode",
+	".vcd":       "application/x-cdlink",
+	".vcf":       "text/x-vcard",
+	".vcard":     "text/x-vcard",
+	".vcs":       "text/x-vcalendar",
+	".vda":       "application/vda",
+	".vdo":       "video/vdo",
+	".vew":       "application/groupwise",
+	".viv":       "video/vivo",
+	".vivo":      "video/vivo",
+	".vmd":       "application/vocaltec-media-desc",
+	".vmf":       "application/vocaltec-media-file",
+	".voc":       "audio/voc",
+	".vos":       "video/vosaic",
+	".vox":       "audio/voxware",
+	".vqe":       "audio/x-twinvq-plugin",
+	".vqf":       "audio/x-twinvq",
+	".vql":       "audio/x-twinvq-plugin",
+	".vrml":      "application/x-vrml",
+	".vrt":       "x-world/x-vrt",
+	".vsd":       "application/x-visio",
+	".vst":       "application/x-visio",
+	".vsw":       "application/x-visio",
+	".w60":       "application/wordperfect60",
+	".w61":       "application/wordperfect61",
+	".w6w":       "application/msword",
+	".wav":       "audio/wav",
+	".wb1":       "application/x-qpro",
+	".wbmp":      "image/vnd.wap.wbmp",
+	".web":       "application/vndxara",
+	".wiz":       "application/msword",
+	".wk1":       "application/x-123",
+	".wmf":       "windows/metafile",
+	".wml":       "text/vnd.wap.wml",
+	".wmlc":      "application/vnd.wap.wmlc",
+	".wmls":      "text/vnd.wap.wmlscript",
+	".wmlsc":     "application/vnd.wap.wmlscriptc",
+	".word":      "application/msword",
+	".wp5":       "application/wordperfect",
+	".wp6":       "application/wordperfect",
+	".wp":        "application/wordperfect",
+	".wpd":       "application/wordperfect",
+	".wq1":       "application/x-lotus",
+	".wri":       "application/mswrite",
+	".wrl":       "application/x-world",
+	".wrz":       "model/vrml",
+	".wsc":       "text/scriplet",
+	".wsrc":      "application/x-wais-source",
+	".wtk":       "application/x-wintalk",
+	".x-png":     "image/png",
+	".xbm":       "image/x-xbitmap",
+	".xdr":       "video/x-amt-demorun",
+	".xgz":       "xgl/drawing",
+	".xif":       "image/vndxiff",
+	".xl":        "application/excel",
+	".xla":       "application/excel",
+	".xlb":       "application/excel",
+	".xlc":       "application/excel",
+	".xld":       "application/excel",
+	".xlk":       "application/excel",
+	".xll":       "application/excel",
+	".xlm":       "application/excel",
+	".xls":       "application/excel",
+	".xlt":       "application/excel",
+	".xlv":       "application/excel",
+	".xlw":       "application/excel",
+	".xm":        "audio/xm",
+	".xml":       ContentXMLHeaderValue,
+	".xmz":       "xgl/movie",
+	".xpix":      "application/x-vndls-xpix",
+	".xpm":       "image/x-xpixmap",
+	".xsr":       "video/x-amt-showrun",
+	".xwd":       "image/x-xwd",
+	".xyz":       "chemical/x-pdb",
+	".z":         "application/x-compress",
+	".zip":       "application/zip",
+	".zoo":       "application/octet-stream",
+	".zsh":       "text/x-scriptzsh",
+	".docx":      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	".docm":      "application/vnd.ms-word.document.macroEnabled.12",
+	".dotx":      "application/vnd.openxmlformats-officedocument.wordprocessingml.template",
+	".dotm":      "application/vnd.ms-word.template.macroEnabled.12",
+	".xlsx":      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	".xlsm":      "application/vnd.ms-excel.sheet.macroEnabled.12",
+	".xltx":      "application/vnd.openxmlformats-officedocument.spreadsheetml.template",
+	".xltm":      "application/vnd.ms-excel.template.macroEnabled.12",
+	".xlsb":      "application/vnd.ms-excel.sheet.binary.macroEnabled.12",
+	".xlam":      "application/vnd.ms-excel.addin.macroEnabled.12",
+	".pptx":      "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	".pptm":      "application/vnd.ms-powerpoint.presentation.macroEnabled.12",
+	".ppsx":      "application/vnd.openxmlformats-officedocument.presentationml.slideshow",
+	".ppsm":      "application/vnd.ms-powerpoint.slideshow.macroEnabled.12",
+	".potx":      "application/vnd.openxmlformats-officedocument.presentationml.template",
+	".potm":      "application/vnd.ms-powerpoint.template.macroEnabled.12",
+	".ppam":      "application/vnd.ms-powerpoint.addin.macroEnabled.12",
+	".sldx":      "application/vnd.openxmlformats-officedocument.presentationml.slide",
+	".sldm":      "application/vnd.ms-powerpoint.slide.macroEnabled.12",
+	".thmx":      "application/vnd.ms-officetheme",
+	".onetoc":    "application/onenote",
+	".onetoc2":   "application/onenote",
+	".onetmp":    "application/onenote",
+	".onepkg":    "application/onenote",
+	".xpi":       "application/x-xpinstall",
+	".wasm":      "application/wasm",
+	".m4a":       "audio/mp4",
+	".flac":      "audio/x-flac",
+	".amr":       "audio/amr",
+	".aac":       "audio/aac",
+	".opus":      "video/ogg",
+	".m4v":       "video/mp4",
+	".mkv":       "video/x-matroska",
+	".caf":       "audio/x-caf",
+	".m3u8":      "application/x-mpegURL",
+	".mpd":       "application/dash+xml",
+	".webp":      "image/webp",
+	".epub":      "application/epub+zip",
+}
+
+//nolint:gochecknoinits
+func init() {
+	for ext, typ := range types {
+		// skip errors
+		_ = mime.AddExtensionType(ext, typ)
+	}
+}

backend/adapters/fs/files/user.go

@@ -0,0 +1,64 @@
+package files
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// MakeUserDir makes the user directory according to settings.
+func MakeUserDir(fullPath string) error {
+	if err := os.MkdirAll(fullPath, os.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func MakeUserDirs(u *users.User, disableScopeChange bool) error {
+	cleanedUserName := users.CleanUsername(u.Username)
+	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
+		return fmt.Errorf("create user: invalid user for home dir creation: [%s]", u.Username)
+	}
+	for i, scope := range u.Scopes {
+		source, ok := settings.Config.Server.SourceMap[scope.Name]
+		if !ok {
+			return fmt.Errorf("create user: source not found: %s", scope.Name)
+		}
+		// create directory and append user name
+		if filepath.Base(scope.Scope) != cleanedUserName && source.Config.CreateUserDir && !disableScopeChange {
+			fullPath := filepath.Join(source.Path, scope.Scope, cleanedUserName)
+			parentDir := filepath.Join(source.Path, scope.Scope)
+			// validate that scope path exists
+			if !Exists(parentDir) {
+				return fmt.Errorf("create user: scope path does not exist: %s", scope.Scope)
+			}
+			scope.Scope = filepath.Join(scope.Scope, cleanedUserName)
+			err := MakeUserDir(fullPath)
+			if err != nil {
+				return fmt.Errorf("create user: failed to create user home dir: %s", err)
+			}
+		} else if filepath.Base(scope.Scope) == cleanedUserName && source.Config.CreateUserDir {
+			// create directory exactly as specified
+			fullPath := filepath.Join(source.Path, scope.Scope)
+			parentDir := filepath.Dir(fullPath)
+			if !Exists(parentDir) {
+				return fmt.Errorf("create user: scope folder does not exist: %s", parentDir)
+			}
+			err := MakeUserDir(fullPath)
+			if err != nil {
+				return fmt.Errorf("create user: failed to create user home dir: %s", err)
+			}
+		} else {
+			// just assigning scope to path provided, so just check that it exists
+			path := filepath.Join(source.Path, scope.Scope)
+			if !Exists(path) {
+				return fmt.Errorf("create user: scope folder does not exist: %s", path)
+			}
+		}
+		u.Scopes[i] = scope
+	}
+	return nil
+}

backend/adapters/fs/fileutils/file.go

@@ -6,30 +6,34 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 )
 
 // MoveFile moves a file from src to dst.
 // By default, the rename system call is used. If src and dst point to different volumes,
 // the file copy is used as a fallback.
 func MoveFile(src, dst string) error {
-	fmt.Println("moving", src, dst)
-	if os.Rename(src, dst) == nil {
+	err := os.Rename(src, dst)
+	if err == nil {
 		return nil
 	}
-	fmt.Println("copyfile instead", src, dst)
 
 	// fallback
-	err := CopyFile(src, dst)
+	err = CopyFile(src, dst)
 	if err != nil {
-		fmt.Println("ok it errored too", err)
+		logger.Error(fmt.Sprintf("CopyFile failed %v %v %v ", src, dst, err))
+		return err
+	}
+
+	go func() {
+		err = os.RemoveAll(src)
+		if err != nil {
+			logger.Error(fmt.Sprintf("os.Remove failed %v %v ", src, err))
+		}
+	}()
 
-		_ = os.Remove(dst)
-		return err
-	}
-	fmt.Println("removing", src)
-	if err := os.Remove(src); err != nil {
-		return err
-	}
 	return nil
 }
 
@@ -172,3 +176,20 @@ func CommonPrefix(sep byte, paths ...string) string {
 
 	return string(c)
 }
+
+func ClearCacheDir() {
+	cacheDir := settings.Config.Server.CacheDir
+	entries, err := os.ReadDir(cacheDir)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed clear cache dir: %v", err))
+	}
+
+	for _, entry := range entries {
+		path := filepath.Join(cacheDir, entry.Name())
+		err = os.RemoveAll(path)
+		if err != nil {
+			logger.Error(fmt.Sprintf("failed clear cache dir: %v", err))
+		}
+	}
+
+}

backend/auth/auth.go

@@ -2,8 +2,14 @@ package auth
 
 import (
 	"net/http"
+	"sync"
 
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+var (
+	revokedApiKeyList map[string]bool
+	revokeMu          sync.Mutex
 )
 
 // Auther is the authentication interface.
@@ -13,3 +19,14 @@ type Auther interface {
 	// LoginPage indicates if this auther needs a login page.
 	LoginPage() bool
 }
+
+func IsRevokedApiKey(key string) bool {
+	_, exists := revokedApiKeyList[key]
+	return exists
+}
+
+func RevokeAPIKey(key string) {
+	revokeMu.Lock()
+	delete(revokedApiKeyList, key)
+	revokeMu.Unlock()
+}

backend/auth/hook.go

@@ -8,10 +8,10 @@ import (
 	"os/exec"
 	"strings"
 
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 type hookCred struct {
@@ -39,6 +39,7 @@ func (a *HookAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error
 
 	err := json.NewDecoder(r.Body).Decode(&cred)
 	if err != nil {
+		logger.Error("decode body error")
 		return nil, os.ErrPermission
 	}
 
@@ -59,11 +60,19 @@ func (a *HookAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error
 		}
 		return u, nil
 	case "block":
+		logger.Error("block error")
+
 		return nil, os.ErrPermission
 	case "pass":
-		u, err := a.Users.Get(a.Server.Root, a.Cred.Username)
-		if err != nil || !users.CheckPwd(a.Cred.Password, u.Password) {
-			return nil, os.ErrPermission
+		logger.Error("pass error")
+
+		u, err := a.Users.Get(a.Cred.Username)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get user from store: %v", err)
+		}
+		err = users.CheckPwd(cred.Password, u.Password)
+		if err != nil {
+			return nil, err
 		}
 		return u, nil
 	default:
@@ -138,7 +147,7 @@ func (a *HookAuth) GetValues(s string) {
 
 // SaveUser updates the existing user or creates a new one when not found
 func (a *HookAuth) SaveUser() (*users.User, error) {
-	u, err := a.Users.Get(a.Server.Root, a.Cred.Username)
+	u, err := a.Users.Get(a.Cred.Username)
 	if err != nil && err != errors.ErrNotExist {
 		return nil, err
 	}
@@ -146,34 +155,33 @@ func (a *HookAuth) SaveUser() (*users.User, error) {
 	if u == nil {
 		// create user with the provided credentials
 		d := &users.User{
+			NonAdminEditable: users.NonAdminEditable{
+				Password:    a.Cred.Password,
+				Locale:      a.Settings.UserDefaults.Locale,
+				ViewMode:    a.Settings.UserDefaults.ViewMode,
+				SingleClick: a.Settings.UserDefaults.SingleClick,
+				ShowHidden:  a.Settings.UserDefaults.ShowHidden,
+			},
 			Username:    a.Cred.Username,
-			Password:    a.Cred.Password,
-			Scope:       a.Settings.UserDefaults.Scope,
-			Locale:      a.Settings.UserDefaults.Locale,
-			ViewMode:    a.Settings.UserDefaults.ViewMode,
-			SingleClick: a.Settings.UserDefaults.SingleClick,
-			Sorting:     a.Settings.UserDefaults.Sorting,
-			Perm:        a.Settings.UserDefaults.Perm,
-			Commands:    a.Settings.UserDefaults.Commands,
-			ShowHidden:  a.Settings.UserDefaults.ShowHidden,
+			Permissions: a.Settings.UserDefaults.Permissions,
 		}
 		u = a.GetUser(d)
 
-		userHome, err := a.Settings.MakeUserDir(u.Username, u.Scope, a.Server.Root)
-		if err != nil {
-			return nil, fmt.Errorf("user: failed to mkdir user home dir: [%s]", userHome)
-		}
-		u.Scope = userHome
-		logger.Debug(fmt.Sprintf("user: %s, home dir: [%s].", u.Username, userHome))
-
-		err = a.Users.Save(u)
+		err = a.Users.Save(u, false)
 		if err != nil {
 			return nil, err
 		}
-	} else if p := !users.CheckPwd(a.Cred.Password, u.Password); len(a.Fields.Values) > 1 || p {
+		return u, nil
+	}
+	err = users.CheckPwd(a.Cred.Password, u.Password)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(a.Fields.Values) > 1 {
 		u = a.GetUser(u)
 		// update user with provided fields
-		err := a.Users.Update(u)
+		err := a.Users.Update(u, u.Permissions.Admin)
 		if err != nil {
 			return nil, err
 		}
@@ -185,32 +193,24 @@ func (a *HookAuth) SaveUser() (*users.User, error) {
 // GetUser returns a User filled with hook values or provided defaults
 func (a *HookAuth) GetUser(d *users.User) *users.User {
 	// adds all permissions when user is admin
-	isAdmin := d.Perm.Admin
+	isAdmin := d.Permissions.Admin
 	perms := users.Permissions{
-		Admin:    isAdmin,
-		Execute:  isAdmin || d.Perm.Execute,
-		Create:   isAdmin || d.Perm.Create,
-		Rename:   isAdmin || d.Perm.Rename,
-		Modify:   isAdmin || d.Perm.Modify,
-		Delete:   isAdmin || d.Perm.Delete,
-		Share:    isAdmin || d.Perm.Share,
-		Download: isAdmin || d.Perm.Download,
+		Admin:  isAdmin,
+		Modify: isAdmin || d.Permissions.Modify,
+		Share:  isAdmin || d.Permissions.Share,
 	}
 	user := users.User{
-		ID:          d.ID,
-		Username:    d.Username,
-		Password:    d.Password,
-		Scope:       d.Scope,
-		Locale:      d.Locale,
-		ViewMode:    d.ViewMode,
-		SingleClick: d.SingleClick,
-		Sorting: users.Sorting{
-			Asc: d.Sorting.Asc,
-			By:  d.Sorting.By,
+		NonAdminEditable: users.NonAdminEditable{
+			Password:    d.Password,
+			Locale:      a.Fields.GetString("user.locale", d.Locale),
+			ViewMode:    a.Fields.GetString("user.viewMode", d.ViewMode),
+			SingleClick: a.Fields.GetBoolean("user.singleClick", d.SingleClick),
+			ShowHidden:  a.Fields.GetBoolean("user.showHidden", d.ShowHidden),
 		},
-		Commands:     d.Commands,
-		ShowHidden:   d.ShowHidden,
-		Perm:         perms,
+		ID:           d.ID,
+		Username:     d.Username,
+		Scopes:       d.Scopes,
+		Permissions:  perms,
 		LockPassword: true,
 	}
 
@@ -231,16 +231,11 @@ var validHookFields = []string{
 	"user.singleClick",
 	"user.sorting.by",
 	"user.sorting.asc",
-	"user.commands",
 	"user.showHidden",
 	"user.perm.admin",
-	"user.perm.execute",
-	"user.perm.create",
-	"user.perm.rename",
 	"user.perm.modify",
-	"user.perm.delete",
 	"user.perm.share",
-	"user.perm.download",
+	"user.perm.api",
 }
 
 // IsValid checks if the provided field is on the valid fields list

backend/auth/json.go

@@ -2,13 +2,14 @@ package auth
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/url"
 	"os"
 	"strings"
 
-	"github.com/gtsteffaniak/filebrowser/backend/files"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 type jsonCred struct {
@@ -27,10 +28,12 @@ func (a JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.User,
 	var cred jsonCred
 
 	if r.Body == nil {
+		logger.Error("nil body error")
 		return nil, os.ErrPermission
 	}
 	err := json.NewDecoder(r.Body).Decode(&cred)
 	if err != nil {
+		logger.Error("decode body error")
 		return nil, os.ErrPermission
 	}
 
@@ -46,9 +49,13 @@ func (a JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.User,
 			return nil, os.ErrPermission
 		}
 	}
-	u, err := userStore.Get(files.RootPaths["default"], cred.Username)
-	if err != nil || !users.CheckPwd(cred.Password, u.Password) {
-		return nil, os.ErrPermission
+	u, err := userStore.Get(cred.Username)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get user from store: %v", err)
+	}
+	err = users.CheckPwd(cred.Password, u.Password)
+	if err != nil {
+		return nil, err
 	}
 
 	return u, nil

backend/auth/none.go

@@ -3,8 +3,7 @@ package auth
 import (
 	"net/http"
 
-	"github.com/gtsteffaniak/filebrowser/backend/files"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // MethodNoAuth is used to identify no auth.
@@ -15,7 +14,7 @@ type NoAuth struct{}
 
 // Auth uses authenticates user 1.
 func (a NoAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
-	return usr.Get(files.RootPaths["default"], uint(1))
+	return usr.Get(uint(1))
 }
 
 // LoginPage tells that no auth doesn't require a login page.

backend/auth/proxy.go

@@ -4,9 +4,8 @@ import (
 	"net/http"
 	"os"
 
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/files"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // MethodProxyAuth is used to identify no auth.
@@ -20,7 +19,7 @@ type ProxyAuth struct {
 // Auth authenticates the user via an HTTP header.
 func (a ProxyAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
 	username := r.Header.Get(a.Header)
-	user, err := usr.Get(files.RootPaths["default"], username)
+	user, err := usr.Get(username)
 	if err == errors.ErrNotExist {
 		return nil, os.ErrPermission
 	}

backend/auth/storage.go

@@ -1,7 +1,7 @@
 package auth
 
 import (
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // StorageBackend is a storage backend for auth storage.
@@ -17,8 +17,25 @@ type Storage struct {
 }
 
 // NewStorage creates a auth storage from a backend.
-func NewStorage(back StorageBackend, userStore *users.Storage) *Storage {
-	return &Storage{back: back, users: userStore}
+func NewStorage(back StorageBackend, userStore *users.Storage) (*Storage, error) {
+	store := &Storage{back: back, users: userStore}
+	err := store.Save(&JSONAuth{})
+	if err != nil {
+		return nil, err
+	}
+	err = store.Save(&ProxyAuth{})
+	if err != nil {
+		return nil, err
+	}
+	err = store.Save(&HookAuth{})
+	if err != nil {
+		return nil, err
+	}
+	err = store.Save(&NoAuth{})
+	if err != nil {
+		return nil, err
+	}
+	return store, nil
 }
 
 // Get wraps a StorageBackend.Get.

backend/benchmark_results.txt

@@ -5,8 +5,8 @@
 ?   	github.com/gtsteffaniak/filebrowser/backend/auth	[no test files]
 ?   	github.com/gtsteffaniak/filebrowser/backend/cmd	[no test files]
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/diskcache	0.005s
-?   	github.com/gtsteffaniak/filebrowser/backend/errors	[no test files]
+ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/diskcache	0.005s
+?   	github.com/gtsteffaniak/filebrowser/backend/common/errors	[no test files]
 /home/graham/git/filebrowser /home/graham/git/filebrowser
 /home/graham/git/filebrowser/files/file.go /home/graham/git/filebrowser
 /home/graham/git/filebrowser/mnt/doesnt/exist /home/graham/git/filebrowser
@@ -22,7 +22,7 @@ ok  	github.com/gtsteffaniak/filebrowser/backend/diskcache	0.005s
 2025/01/04 14:04:56 Next scan in 1m0s
 goos: linux
 goarch: amd64
-pkg: github.com/gtsteffaniak/filebrowser/backend/files
+pkg: github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files
 cpu: 11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz
 BenchmarkFillIndex-8                     	2025/01/04 14:04:57 Initializing index and assessing file system complexity
 2025/01/04 14:04:57 Starting full scan
@@ -44,23 +44,23 @@ BenchmarkSearchAllIndexes-8              	2025/01/04 14:04:59 Initializing index
 2025/01/04 14:04:59 Next scan in 1m0s
       10	    766822 ns/op	   34230 B/op	     900 allocs/op
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/files	5.094s
+ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files	5.094s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/fileutils	0.002s
+ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils	0.002s
 PASS
 ok  	github.com/gtsteffaniak/filebrowser/backend/http	0.184s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/img	0.123s
+ok  	github.com/gtsteffaniak/filebrowser/backend/preview/img	0.123s
 PASS
 ok  	github.com/gtsteffaniak/filebrowser/backend/runner	0.004s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/settings	0.005s
-?   	github.com/gtsteffaniak/filebrowser/backend/share	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/storage	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/storage/bolt	[no test files]
+ok  	github.com/gtsteffaniak/filebrowser/backend/common/settings	0.005s
+?   	github.com/gtsteffaniak/filebrowser/backend/database/share	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/database/storage	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt	[no test files]
 ?   	github.com/gtsteffaniak/filebrowser/backend/swagger/docs	[no test files]
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/users	0.003s
+ok  	github.com/gtsteffaniak/filebrowser/backend/database/users	0.003s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/utils	0.002s
-?   	github.com/gtsteffaniak/filebrowser/backend/version	[no test files]
+ok  	github.com/gtsteffaniak/filebrowser/backend/common/utils	0.002s
+?   	github.com/gtsteffaniak/filebrowser/backend/common/version	[no test files]

backend/cmd/cli.go

@@ -0,0 +1,127 @@
+package cmd
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+var (
+	configPath string
+)
+
+// return bool to indicate if the program should continue running
+func runCLI() bool {
+	// Global flags
+	var help bool
+	// Override the default usage output to use generalUsage()
+	flag.Usage = generalUsage
+	flag.StringVar(&configPath, "c", "", "Path to the config file, default: config.yaml")
+	flag.BoolVar(&help, "h", false, "Get help about commands")
+
+	if configPath == "" {
+		configPath = os.Getenv("FILEBROWSER_CONFIG")
+	}
+
+	if configPath == "" {
+		configPath = "config.yaml"
+	}
+
+	// Parse global flags (before subcommands)
+	flag.Parse() // print generalUsage on error
+
+	// Show help if requested
+	if help {
+		generalUsage()
+		return false
+	}
+
+	// Create a new FlagSet for the 'set' subcommand
+	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
+	var user, scope, dbConfig string
+	var asAdmin bool
+
+	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
+	setCmd.BoolVar(&asAdmin, "a", false, "Create user as admin user, used in combination with -u")
+	setCmd.StringVar(&scope, "s", "", "Specify a user scope, otherwise default user config scope is used")
+	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
+
+	// Parse subcommand flags only if a subcommand is specified
+	if len(os.Args) > 1 {
+		switch os.Args[1] {
+		case "set":
+			err := setCmd.Parse(os.Args[2:])
+			if err != nil {
+				setCmd.PrintDefaults()
+				os.Exit(1)
+			}
+			userInfo := strings.Split(user, ",")
+			if len(userInfo) < 2 {
+				fmt.Printf("not enough info to create user: \"set -u username,password\", only provided %v\n", userInfo)
+				setCmd.PrintDefaults()
+				os.Exit(1)
+			}
+			username := userInfo[0]
+			password := userInfo[1]
+			ok := getStore(dbConfig)
+			if !ok {
+				logger.Fatal("could not load db info")
+			}
+			user, err := store.Users.Get(username)
+			if err != nil {
+				newUser := users.User{
+					Username: username,
+					NonAdminEditable: users.NonAdminEditable{
+						Password: password,
+					},
+				}
+				for _, source := range settings.Config.Server.SourceMap {
+					if source.Config.DefaultEnabled {
+						newUser.Scopes = append(newUser.Scopes, users.SourceScope{
+							Name:  source.Name,
+							Scope: source.Config.DefaultUserScope,
+						})
+					}
+				}
+
+				// Create the user logic
+				if asAdmin {
+					logger.Info(fmt.Sprintf("Creating user as admin: %s\n", username))
+				} else {
+					logger.Info(fmt.Sprintf("Creating non-admin user: %s\n", username))
+				}
+				err = storage.CreateUser(newUser, asAdmin)
+				if err != nil {
+					logger.Error(fmt.Sprintf("could not create user: %v", err))
+				}
+				return false
+			}
+			user.Password = password
+			if asAdmin {
+				user.Permissions.Admin = true
+			}
+			err = store.Users.Save(user, true)
+			if err != nil {
+				logger.Error(fmt.Sprintf("could not update user: %v", err))
+			}
+			fmt.Printf("successfully updated user: %s\n", username)
+			return false
+
+		case "version":
+			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
+	Version        : %v
+	Commit         : %v
+	Release Info   : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
+	`, version.Version, version.CommitSHA, version.Version)
+			return false
+		}
+	}
+	return true
+}

backend/cmd/office.go

@@ -0,0 +1,21 @@
+package cmd
+
+import (
+	"net/http"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+)
+
+// healthcheck attempt to save test file against configured url
+func validateOfficeIntegration() {
+	if settings.Config.Integrations.OnlyOffice.Url != "" {
+		// get url health
+		// get request against the url
+		_, err := http.NewRequest("GET", settings.Config.Integrations.OnlyOffice.Url, nil)
+		if err != nil {
+			logger.Warning("Could not create request to only office Url, make sure its valid and running")
+			return
+		}
+	}
+}

backend/cmd/root.go

@@ -1,33 +1,36 @@
 package cmd
 
 import (
-	"flag"
+	"context"
 	"fmt"
 	"os"
-	"strings"
+	"os/signal"
+	"syscall"
 
-	"github.com/gtsteffaniak/filebrowser/backend/diskcache"
-	"github.com/gtsteffaniak/filebrowser/backend/files"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
 	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
-	"github.com/gtsteffaniak/filebrowser/backend/img"
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/preview"
 	"github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
 	"github.com/swaggo/swag"
 
-	"github.com/gtsteffaniak/filebrowser/backend/users"
-	"github.com/gtsteffaniak/filebrowser/backend/version"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 )
 
-func getStore(config string) (*storage.Storage, bool) {
+var store *storage.Storage
+
+func getStore(configFile string) bool {
 	// Use the config file (global flag)
-	settings.Initialize(config)
-	store, hasDB, err := storage.InitializeDb(settings.Config.Server.Database)
+	settings.Initialize(configFile)
+	s, hasDB, err := storage.InitializeDb(settings.Config.Server.Database)
 	if err != nil {
 		logger.Fatal(fmt.Sprintf("could not load db info: %v", err))
 	}
-	return store, hasDB
+	store = s
+	return hasDB
 }
 
 func generalUsage() {
@@ -44,130 +47,80 @@ commands:
 }
 
 func StartFilebrowser() {
-	// Global flags
-	var configPath string
-	var help bool
-	// Override the default usage output to use generalUsage()
-	flag.Usage = generalUsage
-	flag.StringVar(&configPath, "c", "config.yaml", "Path to the config file, default: config.yaml")
-	flag.BoolVar(&help, "h", false, "Get help about commands")
-
-	// Parse global flags (before subcommands)
-	flag.Parse() // print generalUsage on error
-
-	// Show help if requested
-	if help {
-		generalUsage()
+	keepGoing := runCLI()
+	if !keepGoing {
 		return
 	}
+	// Create context and channels for graceful shutdown
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 
-	// Create a new FlagSet for the 'set' subcommand
-	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
-	var user, scope, dbConfig string
-	var asAdmin bool
+	signalChan := make(chan os.Signal, 1)
+	signal.Notify(signalChan, syscall.SIGINT, syscall.SIGTERM)
 
-	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
-	setCmd.BoolVar(&asAdmin, "a", false, "Create user as admin user, used in combination with -u")
-	setCmd.StringVar(&scope, "s", "", "Specify a user scope, otherwise default user config scope is used")
-	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
-
-	// Parse subcommand flags only if a subcommand is specified
-	if len(os.Args) > 1 {
-		switch os.Args[1] {
-		case "set":
-			err := setCmd.Parse(os.Args)
-			if err != nil {
-				setCmd.PrintDefaults()
-				os.Exit(1)
-			}
-			userInfo := strings.Split(user, ",")
-			if len(userInfo) < 2 {
-				fmt.Println("not enough info to create user: \"set -u username,password\"")
-				setCmd.PrintDefaults()
-				os.Exit(1)
-			}
-			username := userInfo[0]
-			password := userInfo[1]
-			getStore(dbConfig)
-			// Create the user logic
-			if asAdmin {
-				logger.Info(fmt.Sprintf("Creating user as admin: %s\n", username))
-			} else {
-				logger.Info(fmt.Sprintf("Creating non-admin user: %s\n", username))
-			}
-			newUser := users.User{
-				Username: username,
-				Password: password,
-			}
-			if scope != "" {
-				newUser.Scope = scope
-			}
-			err = storage.CreateUser(newUser, asAdmin)
-			if err != nil {
-				logger.Fatal(fmt.Sprintf("could not create user: %v", err))
-			}
-			return
-		case "version":
-			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
-Version        : %v
-Commit         : %v
-Release Info   : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
-`, version.Version, version.CommitSHA, version.Version)
-			return
-		}
-	}
-	store, dbExists := getStore(configPath)
+	done := make(chan struct{})             // Signals server has stopped
+	shutdownComplete := make(chan struct{}) // Signals shutdown process is complete
+	dbExists := getStore(configPath)
 	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
 	if !dbExists {
 		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
 	}
-	sources := []string{}
-	for _, v := range settings.Config.Server.Sources {
-		sources = append(sources, v.Name+": "+v.Path)
+	sourceList := []string{}
+	for path, source := range settings.Config.Server.SourceMap {
+		sourceList = append(sourceList, fmt.Sprintf("%v: %v", source.Name, path))
 	}
 	logger.Info(fmt.Sprintf("Initializing FileBrowser Quantum (%v)", version.Version))
 	logger.Info(fmt.Sprintf("Using Config file        : %v", configPath))
-	logger.Debug(fmt.Sprintf("Embeded frontend         : %v", os.Getenv("FILEBROWSER_NO_EMBEDED") != "true"))
+	logger.Info(fmt.Sprintf("Auth Methods             : %v", settings.Config.Auth.AuthMethods))
 	logger.Info(database)
-	logger.Info(fmt.Sprintf("Sources                  : %v", sources))
+	logger.Info(fmt.Sprintf("Sources                  : %v", sourceList))
 	serverConfig := settings.Config.Server
 	swagInfo := docs.SwaggerInfo
 	swagInfo.BasePath = serverConfig.BaseURL
 	swag.Register(docs.SwaggerInfo.InstanceName(), swagInfo)
 	// initialize indexing and schedule indexing ever n minutes (default 5)
-	sourceConfigs := settings.Config.Server.Sources
-	if len(sourceConfigs) == 0 {
+	if len(settings.Config.Server.SourceMap) == 0 {
 		logger.Fatal("No sources configured, exiting...")
 	}
-	for _, source := range sourceConfigs {
-		go files.Initialize(source)
+	for _, source := range settings.Config.Server.SourceMap {
+		go indexing.Initialize(source, false)
 	}
-	if err := rootCMD(store, &serverConfig); err != nil {
-		logger.Fatal(fmt.Sprintf("Error starting filebrowser: %v", err))
+	validateUserInfo()
+	validateOfficeIntegration()
+	// Start the rootCMD in a goroutine
+	go func() {
+		if err := rootCMD(ctx, store, &serverConfig, shutdownComplete); err != nil {
+			logger.Fatal(fmt.Sprintf("Error starting filebrowser: %v", err))
+		}
+		close(done) // Signal that the server has stopped
+	}()
+	// Wait for a shutdown signal or the server to stop
+	select {
+	case <-signalChan:
+		logger.Info("Received shutdown signal. Shutting down gracefully...")
+		cancel() // Trigger context cancellation
+	case <-done:
+		logger.Info("Server stopped unexpectedly. Shutting down...")
 	}
+	fileutils.ClearCacheDir()
+
+	<-shutdownComplete // Ensure we don't exit prematurely
+	// Wait for the server to stop
+	logger.Info("Shutdown complete.")
 }
 
-func rootCMD(store *storage.Storage, serverConfig *settings.Server) error {
+func rootCMD(ctx context.Context, store *storage.Storage, serverConfig *settings.Server, shutdownComplete chan struct{}) error {
 	if serverConfig.NumImageProcessors < 1 {
 		logger.Fatal("Image resize workers count could not be < 1")
 	}
-	imgSvc := img.New(serverConfig.NumImageProcessors)
-
-	cacheDir := "/tmp"
-	var fileCache diskcache.Interface
-
-	// Use file cache if cacheDir is specified
-	if cacheDir != "" {
-		var err error
-		fileCache, err = diskcache.NewFileCache(cacheDir)
-		if err != nil {
-			logger.Fatal(fmt.Sprintf("failed to create file cache: %v", err))
-		}
-	} else {
-		// No-op cache if no cacheDir is specified
-		fileCache = diskcache.NewNoOp()
+	cacheDir := settings.Config.Server.CacheDir
+	numWorkers := settings.Config.Server.NumImageProcessors
+	ffpmpegPath := settings.Config.Integrations.Media.FfmpegPath
+	// setup disk cache
+	err := preview.Start(numWorkers, ffpmpegPath, cacheDir)
+	if err != nil {
+		logger.Fatal(fmt.Sprintf("Error starting preview service: %v", err))
 	}
-	fbhttp.StartHttp(imgSvc, store, fileCache)
-
+	fbhttp.StartHttp(ctx, store, shutdownComplete)
 	return nil
 }

backend/cmd/user.go

@@ -0,0 +1,187 @@
+package cmd
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+var createBackup = []bool{}
+
+func validateUserInfo() {
+	// update source info for users if names/sources/paths might have changed
+	usersList, err := store.Users.Gets()
+	if err != nil {
+		logger.Fatal(fmt.Sprintf("could not load users: %v", err))
+	}
+	for _, user := range usersList {
+		updateUser := false
+		if user.Username == "publicUser" {
+			settings.ApplyUserDefaults(user)
+			updateUser = true
+		}
+		if updateUserScopes(user) {
+			updateUser = true
+		}
+		if updatePermissions(user) {
+			updateUser = true
+		}
+		if updatePreviewSettings(user) {
+			updateUser = true
+		}
+		if updateLoginType(user) {
+			updateUser = true
+		}
+		if updateUser {
+			if len(createBackup) == 1 {
+				logger.Warning("Incompatible user settings detected, creating backup of database before converting.")
+				err = fileutils.CopyFile(settings.Config.Server.Database, fmt.Sprintf("%s.bak", settings.Config.Server.Database))
+				if err != nil {
+					logger.Fatal(fmt.Sprintf("Unable to create automatic backup of database due to error: %v", err))
+				}
+			}
+			err := store.Users.Save(user, false)
+			if err != nil {
+				logger.Error(fmt.Sprintf("could not update user: %v", err))
+			}
+		}
+	}
+}
+
+func updateUserScopes(user *users.User) bool {
+	updateUser := false
+	finalScopes := []users.SourceScope{}
+	seenNames := make(map[string]bool)
+
+	// Step 1: Start by including all existing scopes, updating Name if source.Path matches
+	for _, existingScope := range user.Scopes {
+		if existingScope.Scope != "/" {
+			existingScope.Scope = strings.TrimSuffix(existingScope.Scope, "/")
+		}
+		if existingScope.Scope == "" {
+			updateUser = true
+			continue
+		}
+		if !seenNames[existingScope.Name] {
+			finalScopes = append(finalScopes, existingScope)
+			seenNames[existingScope.Name] = true
+		}
+	}
+
+	// Step 2: Add missing scopes from SourceMap if admin or DefaultEnabled
+	for _, source := range settings.Config.Server.SourceMap {
+		if seenNames[source.Path] {
+			continue
+		}
+		// Check if scope exists already via path
+		scopePath, _ := settings.GetScopeFromSourcePath(user.Scopes, source.Path)
+		if scopePath == "" {
+			// must be new scope for user
+			// If user has no access, skip unless default-enabled
+			if !source.Config.DefaultEnabled {
+				continue
+			}
+			// Determine scope path
+			if scopePath == "" {
+				scopePath = source.Config.DefaultUserScope
+			}
+			if scopePath == "" {
+				scopePath = "/"
+			}
+			if scopePath != "/" {
+				scopePath = strings.TrimSuffix(scopePath, "/")
+			}
+		}
+
+		// Add new scope
+		finalScopes = append(finalScopes, users.SourceScope{
+			Scope: scopePath,
+			Name:  source.Path,
+		})
+		seenNames[source.Path] = true
+		updateUser = true
+	}
+
+	// Step 3: If no scopes, apply default
+	if len(finalScopes) == 0 {
+		defaultScope := users.SourceScope{
+			Scope: settings.Config.Server.DefaultSource.Config.DefaultUserScope,
+			Name:  settings.Config.Server.DefaultSource.Path,
+		}
+		finalScopes = append(finalScopes, defaultScope)
+		updateUser = true
+	}
+
+	// Step 4: Assign only if different
+	if !scopesEqual(user.Scopes, finalScopes) {
+		user.Scopes = finalScopes
+		updateUser = true
+	}
+
+	return updateUser
+}
+
+// scopesEqual does a deep comparison to avoid unnecessary writes
+func scopesEqual(a, b []users.SourceScope) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i].Scope != b[i].Scope || a[i].Name != b[i].Name {
+			return false
+		}
+	}
+	return true
+}
+
+// func to convert legacy user with perm key to permissions
+func updatePermissions(user *users.User) bool {
+	updateUser := false
+	// if any keys are true, set the permissions to true
+	if user.Perm.Api {
+		user.Permissions.Api = true
+		user.Perm.Api = false
+		updateUser = true
+	}
+	if user.Perm.Admin {
+		user.Permissions.Admin = true
+		user.Perm.Admin = false
+		updateUser = true
+	}
+	if user.Perm.Modify {
+		user.Permissions.Modify = true
+		user.Perm.Modify = false
+		updateUser = true
+	}
+	if user.Perm.Share {
+		user.Permissions.Share = true
+		user.Perm.Share = false
+		updateUser = true
+	}
+	if updateUser {
+		createBackup = append(createBackup, true)
+	}
+	return updateUser
+}
+
+func updateLoginType(user *users.User) bool {
+	if user.LoginMethod == "" {
+		user.LoginMethod = users.LoginMethodPassword
+		return true
+	}
+	return false
+}
+
+func updatePreviewSettings(user *users.User) bool {
+	// if user hasn't been updated yet
+	if user.LoginMethod == "" {
+		user.Preview.Image = true
+		user.Preview.PopUp = true
+		return true
+	}
+	return false
+}

backend/common/cache/cache.go

@@ -8,8 +8,9 @@ import (
 var (
 	DiskUsage     = NewCache(30*time.Second, 24*time.Hour)
 	RealPath      = NewCache(48*time.Hour, 72*time.Hour)
-	SearchResults = NewCache(15*time.Second, time.Hour)
+	SearchResults = NewCache(15*time.Second, 1*time.Hour)
 	OnlyOffice    = NewCache(48*time.Hour, 1*time.Hour)
+	JwtCache      = NewCache(1*time.Hour, 72*time.Hour)
 )
 
 func NewCache(expires time.Duration, cleanup time.Duration) *KeyCache {

backend/common/logger/write.go

@@ -96,7 +96,8 @@ func Log(level string, msg string, prefix, api bool, color string) {
 }
 
 func Api(msg string, statusCode int) {
-	if statusCode >= 300 && statusCode < 500 {
+	// redirects are not warnings anymore
+	if statusCode > 302 && statusCode < 500 {
 		Log(levels.WARNING, msg, false, true, YELLOW)
 	} else if statusCode >= 500 {
 		Log(levels.ERROR, msg, false, true, RED)
@@ -110,7 +111,7 @@ func Debug(msg string) {
 	if len(loggers) > 0 {
 		Log(levels.DEBUG, msg, true, false, GRAY)
 	} else {
-		log.Println("[DEBUG]: " + msg)
+		log.Println("[DEBUG] ", msg)
 	}
 }
 
@@ -126,7 +127,7 @@ func Warning(msg string) {
 	if len(loggers) > 0 {
 		Log(levels.WARNING, msg, true, false, YELLOW)
 	} else {
-		log.Println("[WARN ]: " + msg)
+		log.Println("[WARN ] ", msg)
 	}
 }
 
@@ -134,7 +135,7 @@ func Error(msg string) {
 	if len(loggers) > 0 {
 		Log(levels.ERROR, msg, true, false, RED)
 	} else {
-		log.Println("[ERROR] : ", msg)
+		log.Println("[ERROR]", msg)
 	}
 }
 
@@ -142,5 +143,5 @@ func Fatal(msg string) {
 	if len(loggers) > 0 {
 		Log(levels.FATAL, msg, true, false, RED)
 	}
-	log.Fatal("[FATAL] : ", msg)
+	log.Fatal("[FATAL] ", msg)
 }

backend/common/settings/auth.go

@@ -0,0 +1,49 @@
+package settings
+
+type Auth struct {
+	TokenExpirationHours int          `json:"tokenExpirationHours"` // the number of hours until the token expires. Default is 2 hours.
+	Methods              LoginMethods `json:"methods"`
+	Key                  string       `json:"key"`           // the key used to sign the JWT tokens. If not set, a random key will be generated.
+	AdminUsername        string       `json:"adminUsername"` // the username of the admin user. If not set, the default is "admin".
+	AdminPassword        string       `json:"adminPassword"` // the password of the admin user. If not set, the default is "admin".
+	AuthMethods          []string     `json:"-"`
+}
+
+type LoginMethods struct {
+	ProxyAuth    ProxyAuthConfig    `json:"proxy" validate:"omitempty"`
+	NoAuth       bool               `json:"noauth"` // if set to true, overrides all other auth methods and disables authentication
+	PasswordAuth PasswordAuthConfig `json:"password" validate:"omitempty"`
+	OidcAuth     OidcConfig         `json:"oidc" validate:"omitempty"`
+}
+
+type PasswordAuthConfig struct {
+	Enabled   bool      `json:"enabled"`
+	MinLength int       `json:"minLength" validate:"omitempty,min=5"`
+	Signup    bool      `json:"signup" validate:"omitempty"`    // currently not used by filebrowser
+	Recaptcha Recaptcha `json:"recaptcha" validate:"omitempty"` // recaptcha config, only used if signup is enabled
+}
+
+type ProxyAuthConfig struct {
+	Enabled    bool   `json:"enabled"`
+	CreateUser bool   `json:"createUser"` // create user if not exists
+	Header     string `json:"header"`     // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
+}
+
+type Recaptcha struct {
+	Host   string `json:"host" validate:"required"`
+	Key    string `json:"key" validate:"required"`
+	Secret string `json:"secret" validate:"required"`
+}
+
+// OpenID OAuth2.0
+type OidcConfig struct {
+	Enabled          bool   `json:"enabled"`                              // whether to enable OIDC authentication
+	ClientID         string `json:"clientId" validate:"required"`         // client id of the OIDC application
+	ClientSecret     string `json:"clientSecret" validate:"required"`     // client secret of the OIDC application
+	AuthorizationUrl string `json:"authorizationUrl" validate:"required"` // authorization URL of the OIDC provider
+	TokenUrl         string `json:"tokenUrl" validate:"required"`         // token URL of the OIDC provider
+	UserInfoUrl      string `json:"userInfoUrl" validate:"required"`      // user info URL of the OIDC provider
+	Scopes           string `json:"scopes" validate:"required"`           // space separated list of scopes to request from the OIDC provider
+	UserIdentifier   string `json:"userIdentifier"`                       // optional: which attribute should be used as the username? options: email, username, name, phone_number, sub
+	JwksUrl          string `json:"jwksUrl"`                              // currently not used by filebrowser
+}

backend/common/settings/config.go

@@ -0,0 +1,400 @@
+package settings
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/go-playground/validator/v10"
+	"github.com/goccy/go-yaml"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+var Config Settings
+
+func Initialize(configFile string) {
+	err := loadConfigWithDefaults(configFile)
+	if err != nil {
+		logger.Fatal(err.Error())
+	}
+	err = ValidateConfig(Config)
+	if err != nil {
+		errmsg := "the provided config file failed validation. "
+		errmsg += "If you are seeing this on a config that worked previeously, "
+		errmsg += "this is because v0.6.8 requires a fully validated config to run. "
+		errmsg += "Please review your config for typos and invalid keys which are no longer supported. "
+		errmsg += "visit https://github.com/gtsteffaniak/filebrowser/wiki/Full-Config-Example for more information."
+		logger.Error(errmsg)
+		logger.Fatal(err.Error())
+	}
+	setupLogging()
+	setupAuth()
+	setupSources()
+	setupUrls()
+	setupFrontend()
+}
+
+func setupFrontend() {
+	if !Config.Frontend.DisableDefaultLinks {
+		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
+			Text:  fmt.Sprintf("(%v)", version.Version),
+			Title: version.CommitSHA,
+			Url:   "https://github.com/gtsteffaniak/filebrowser/releases/",
+		})
+		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
+			Text: "Help",
+			Url:  "https://github.com/gtsteffaniak/filebrowser/wiki",
+		})
+	}
+}
+
+func getRealPath(path string) string {
+	realPath, err := filepath.Abs(path)
+	if err != nil {
+		logger.Fatal(fmt.Sprintf("could not find configured source path: %v", err))
+	}
+	// check path exists
+	if _, err = os.Stat(realPath); os.IsNotExist(err) {
+		logger.Fatal(fmt.Sprintf("configured source path does not exist: %v", realPath))
+	}
+	return realPath
+}
+
+func setupSources() {
+	if len(Config.Server.Sources) == 0 {
+		logger.Fatal("There are no `server.sources` configured. If you have `server.root` configured, please update the config and add at least one `server.sources` with a `path` configured.")
+	} else {
+		for k, source := range Config.Server.Sources {
+			realPath := getRealPath(source.Path)
+			name := filepath.Base(realPath)
+			if name == "\\" {
+				name = strings.Split(realPath, ":")[0]
+			}
+			source.Path = realPath // use absolute path
+			if source.Name == "" {
+				_, ok := Config.Server.SourceMap[source.Path]
+				if ok {
+					source.Name = name + fmt.Sprintf("-%v", k)
+				} else {
+					source.Name = name
+				}
+				if Config.Server.DefaultSource.Path == "" {
+					Config.Server.DefaultSource = source
+				}
+			}
+			if source.Config.DefaultUserScope == "" {
+				source.Config.DefaultUserScope = "/"
+			}
+			Config.Server.SourceMap[source.Path] = source
+			Config.Server.NameToSource[source.Name] = source
+		}
+	}
+	// clean up the in memory source list to be accurate and unique
+	sourceList := []Source{}
+	defaultScopes := []users.SourceScope{}
+	allSourceNames := []string{}
+	first := true
+	potentialDefaultSource := Config.Server.DefaultSource
+	for _, sourcePathOnly := range Config.Server.Sources {
+		realPath := getRealPath(sourcePathOnly.Path)
+		source, ok := Config.Server.SourceMap[realPath]
+		if ok && !slices.Contains(allSourceNames, source.Name) {
+			if first {
+				potentialDefaultSource = source
+			}
+			first = false
+			sourceList = append(sourceList, source)
+			if source.Config.DefaultEnabled {
+				if Config.Server.DefaultSource.Path == "" {
+					Config.Server.DefaultSource = source
+				}
+				defaultScopes = append(defaultScopes, users.SourceScope{
+					Name:  source.Path,
+					Scope: source.Config.DefaultUserScope,
+				})
+			}
+			allSourceNames = append(allSourceNames, source.Name)
+		} else {
+			logger.Warning(fmt.Sprintf("source %v is not configured correctly, skipping", sourcePathOnly.Path))
+		}
+	}
+	if Config.Server.DefaultSource.Path == "" {
+		Config.Server.DefaultSource = potentialDefaultSource
+	}
+	Config.UserDefaults.DefaultScopes = defaultScopes
+	Config.Server.Sources = sourceList
+}
+
+func setupUrls() {
+	baseurl := strings.Trim(Config.Server.BaseURL, "/")
+	if baseurl == "" {
+		Config.Server.BaseURL = "/"
+	} else {
+		Config.Server.BaseURL = "/" + baseurl + "/"
+	}
+	Config.Server.InternalUrl = strings.Trim(Config.Server.InternalUrl, "/")
+	Config.Server.ExternalUrl = strings.Trim(Config.Server.ExternalUrl, "/")
+	Config.Integrations.OnlyOffice.Url = strings.Trim(Config.Integrations.OnlyOffice.Url, "/")
+	Config.Integrations.OnlyOffice.InternalUrl = strings.Trim(Config.Integrations.OnlyOffice.InternalUrl, "/")
+}
+
+func setupAuth() {
+	if Config.Auth.Methods.PasswordAuth.Enabled {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "Password")
+	}
+	if Config.Auth.Methods.ProxyAuth.Enabled {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "Proxy")
+	}
+	if Config.Auth.Methods.OidcAuth.Enabled {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "OIDC")
+	}
+	if Config.Auth.Methods.NoAuth {
+		logger.Warning("Configured with no authentication, this is not recommended.")
+		Config.Auth.AuthMethods = []string{"Disabled"}
+	}
+	// use password auth as default if no auth methods are set
+	if len(Config.Auth.AuthMethods) == 0 {
+		Config.Auth.Methods.PasswordAuth.Enabled = true
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "Password")
+	}
+}
+
+func setupLogging() {
+	if len(Config.Server.Logging) == 0 {
+		Config.Server.Logging = []LogConfig{
+			{
+				Output: "stdout",
+			},
+		}
+	}
+	for _, logConfig := range Config.Server.Logging {
+		err := logger.SetupLogger(
+			logConfig.Output,
+			logConfig.Levels,
+			logConfig.ApiLevels,
+			logConfig.NoColors,
+		)
+		if err != nil {
+			log.Println("[ERROR] Failed to set up logger:", err)
+		}
+	}
+}
+
+func loadConfigWithDefaults(configFile string) error {
+	Config = setDefaults()
+	// Open and read the YAML file
+	yamlFile, err := os.Open(configFile)
+	if err != nil {
+		return err
+	}
+	defer yamlFile.Close()
+	stat, err := yamlFile.Stat()
+	if err != nil {
+		return err
+	}
+	yamlData := make([]byte, stat.Size())
+	_, err = yamlFile.Read(yamlData)
+	if err != nil && configFile != "config.yaml" {
+		return fmt.Errorf("could not load specified config file: %v", err.Error())
+	}
+	if err != nil {
+		logger.Warning(fmt.Sprintf("Could not load config file '%v', using default settings: %v", configFile, err))
+	}
+	err = yaml.NewDecoder(strings.NewReader(string(yamlData)), yaml.DisallowUnknownField()).Decode(&Config)
+	if err != nil {
+		return fmt.Errorf("error unmarshaling YAML data: %v", err)
+	}
+	loadEnvConfig()
+	return nil
+}
+
+func ValidateConfig(config Settings) error {
+
+	validate := validator.New()
+	err := validate.Struct(Config)
+	if err != nil {
+		return fmt.Errorf("could not validate config: %v", err)
+	}
+	return nil
+}
+
+func loadEnvConfig() {
+
+	adminPassword, ok := os.LookupEnv("FILEBROWSER_ADMIN_PASSWORD")
+	if ok {
+		logger.Info("Using admin password from FILEBROWSER_ADMIN_PASSWORD environment variable")
+		Config.Auth.AdminPassword = adminPassword
+	}
+	officeSecret, ok := os.LookupEnv("FILEBROWSER_ONLYOFFICE_SECRET")
+	if ok {
+		logger.Info("Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable")
+		Config.Integrations.OnlyOffice.Secret = officeSecret
+	}
+
+	ffmpegPath, ok := os.LookupEnv("FILEBROWSER_FFMPEG_PATH")
+	if ok {
+		Config.Integrations.Media.FfmpegPath = ffmpegPath
+	}
+
+}
+
+func setDefaults() Settings {
+	return Settings{
+		Server: Server{
+			Port:               80,
+			NumImageProcessors: 4,
+			BaseURL:            "",
+			Database:           "database.db",
+			SourceMap:          map[string]Source{},
+			NameToSource:       map[string]Source{},
+			MaxArchiveSizeGB:   50,
+			CacheDir:           "tmp",
+		},
+		Auth: Auth{
+			AdminUsername:        "admin",
+			AdminPassword:        "admin",
+			TokenExpirationHours: 2,
+			Methods: LoginMethods{
+				PasswordAuth: PasswordAuthConfig{
+					Enabled:   true,
+					MinLength: 5,
+					Signup:    false,
+				},
+			},
+		},
+		Frontend: Frontend{
+			Name: "FileBrowser Quantum",
+		},
+		UserDefaults: UserDefaults{
+			DisableOnlyOfficeExt: ".txt .csv .html .pdf",
+			StickySidebar:        true,
+			LockPassword:         false,
+			ShowHidden:           false,
+			DarkMode:             true,
+			DisableSettings:      false,
+			ViewMode:             "normal",
+			Locale:               "en",
+			GallerySize:          3,
+			ThemeColor:           "var(--blue)",
+			Permissions: users.Permissions{
+				Modify: false,
+				Share:  false,
+				Admin:  false,
+				Api:    false,
+			},
+		},
+	}
+}
+
+func ConvertToBackendScopes(scopes []users.SourceScope) ([]users.SourceScope, error) {
+	if len(scopes) == 0 {
+		return Config.UserDefaults.DefaultScopes, nil
+	}
+	newScopes := []users.SourceScope{}
+	for _, scope := range scopes {
+
+		// first check if its already a path name and keep it
+		source, ok := Config.Server.SourceMap[scope.Name]
+		if ok {
+			if scope.Scope == "" {
+				scope.Scope = source.Config.DefaultUserScope
+			}
+			if !strings.HasPrefix(scope.Scope, "/") {
+				scope.Scope = "/" + scope.Scope
+			}
+			if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
+				scope.Scope = strings.TrimSuffix(scope.Scope, "/")
+			}
+			newScopes = append(newScopes, users.SourceScope{
+				Name:  source.Path, // backend name is path
+				Scope: scope.Scope,
+			})
+			continue
+		}
+
+		// check if its the name of a source and convert it to a path
+		source, ok = Config.Server.NameToSource[scope.Name]
+		if !ok {
+			// source might no longer be configured
+			continue
+		}
+		if scope.Scope == "" {
+			scope.Scope = source.Config.DefaultUserScope
+		}
+		if !strings.HasPrefix(scope.Scope, "/") {
+			scope.Scope = "/" + scope.Scope
+		}
+		if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
+			scope.Scope = strings.TrimSuffix(scope.Scope, "/")
+		}
+		newScopes = append(newScopes, users.SourceScope{
+			Name:  source.Path, // backend name is path
+			Scope: scope.Scope,
+		})
+	}
+	return newScopes, nil
+}
+
+func ConvertToFrontendScopes(scopes []users.SourceScope) []users.SourceScope {
+	newScopes := []users.SourceScope{}
+	for _, scope := range scopes {
+		if source, ok := Config.Server.SourceMap[scope.Name]; ok {
+			// Replace scope.Name with source.Path while keeping the same Scope value
+			newScopes = append(newScopes, users.SourceScope{
+				Name:  source.Name,
+				Scope: scope.Scope,
+			})
+		}
+	}
+	return newScopes
+}
+
+func HasSourceByPath(scopes []users.SourceScope, sourcePath string) bool {
+	for _, scope := range scopes {
+		if scope.Name == sourcePath {
+			return true
+		}
+	}
+	return false
+}
+
+func GetScopeFromSourceName(scopes []users.SourceScope, sourceName string) (string, error) {
+	source, ok := Config.Server.NameToSource[sourceName]
+	if !ok {
+		logger.Debug(fmt.Sprint("Could not get scope from source name: ", sourceName))
+		return "", fmt.Errorf("source with name not found %v", sourceName)
+	}
+	for _, scope := range scopes {
+		if scope.Name == source.Path {
+			return scope.Scope, nil
+		}
+	}
+	logger.Debug(fmt.Sprintf("scope not found for source %v", sourceName))
+	return "", fmt.Errorf("scope not found for source %v", sourceName)
+}
+
+func GetScopeFromSourcePath(scopes []users.SourceScope, sourcePath string) (string, error) {
+	for _, scope := range scopes {
+		if scope.Name == sourcePath {
+			return scope.Scope, nil
+		}
+	}
+	return "", fmt.Errorf("scope not found for source %v", sourcePath)
+}
+
+// assumes backend style scopes
+func GetSources(u *users.User) []string {
+	sources := []string{}
+	for _, scope := range u.Scopes {
+		source, ok := Config.Server.SourceMap[scope.Name]
+		if ok {
+			sources = append(sources, source.Name)
+		}
+	}
+	return sources
+}

backend/common/settings/config_test.go

@@ -0,0 +1,101 @@
+package settings
+
+import (
+	"os"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestInitialize(t *testing.T) {
+	type args struct {
+		configFile string
+	}
+	tests := []struct {
+		name string
+		args args
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			Initialize(tt.args.configFile)
+		})
+	}
+}
+
+func Test_setDefaults(t *testing.T) {
+	tests := []struct {
+		name string
+		want Settings
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := setDefaults(); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("setDefaults() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestConfigLoadChanged(t *testing.T) {
+	defaultConfig := setDefaults()
+	err := loadConfigWithDefaults("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	// Use go-cmp to compare the two structs
+	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
+		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
+	}
+}
+
+func TestConfigLoadEnvVars(t *testing.T) {
+	defaultConfig := setDefaults()
+	expectedKey := "MYKEY"
+	// mock environment variables
+	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
+	err := loadConfigWithDefaults("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	if Config.Integrations.OnlyOffice.Secret != expectedKey {
+		t.Errorf("Expected OnlyOffice.Secret to be '%v', got '%s'", expectedKey, Config.Integrations.OnlyOffice.Secret)
+	}
+	// Use go-cmp to compare the two structs
+	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
+		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
+	}
+}
+
+func TestConfigLoadSpecificValues(t *testing.T) {
+	defaultConfig := setDefaults()
+	err := loadConfigWithDefaults("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("error loading config file: %v", err)
+	}
+	testCases := []struct {
+		fieldName string
+		globalVal interface{}
+		newVal    interface{}
+	}{
+		{"Server.Database", Config.Server.Database, defaultConfig.Server.Database},
+	}
+
+	for _, tc := range testCases {
+		if tc.globalVal == tc.newVal {
+			t.Errorf("Differences should have been found:\nConfig.%s: %v \nSetConfig: %v \n", tc.fieldName, tc.globalVal, tc.newVal)
+		}
+	}
+}
+
+func TestInvalidConfig(t *testing.T) {
+	configFile := "./invalidConfig.yaml"
+	err := loadConfigWithDefaults(configFile)
+	if err == nil {
+		t.Fatalf("expected error loading config file %s, got nil", configFile)
+	}
+}

backend/common/settings/invalidConfig.yaml

@@ -16,7 +16,6 @@ auth:
     key: ""
     secret: ""
   header: ""
-  method: json
   command: ""
   signup: false
   shell: ""

backend/common/settings/settings.go

@@ -1,9 +1,10 @@
+//go:generate go run ./tools/yaml.go -input=common/settings/settings.go -output=config.generated.yaml
 package settings
 
 import (
 	"crypto/rand"
 
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 const DefaultUsersHomeBasePath = "/users"
@@ -29,30 +30,37 @@ func GetSettingsConfig(nameType string, Value string) string {
 
 func AdminPerms() users.Permissions {
 	return users.Permissions{
-		Create:   true,
-		Rename:   true,
-		Modify:   true,
-		Delete:   true,
-		Share:    true,
-		Download: true,
-		Admin:    true,
-		Api:      true,
+		Modify: true,
+		Share:  true,
+		Admin:  true,
+		Api:    true,
 	}
 }
 
 // Apply applies the default options to a user.
-func ApplyUserDefaults(u users.User) users.User {
+func ApplyUserDefaults(u *users.User) {
 	u.StickySidebar = Config.UserDefaults.StickySidebar
 	u.DisableSettings = Config.UserDefaults.DisableSettings
 	u.DarkMode = Config.UserDefaults.DarkMode
-	u.Scope = Config.UserDefaults.Scope
 	u.Locale = Config.UserDefaults.Locale
 	u.ViewMode = Config.UserDefaults.ViewMode
 	u.SingleClick = Config.UserDefaults.SingleClick
-	u.Perm = Config.UserDefaults.Perm
-	u.Sorting = Config.UserDefaults.Sorting
-	u.Commands = Config.UserDefaults.Commands
+	u.Permissions = Config.UserDefaults.Permissions
 	u.ShowHidden = Config.UserDefaults.ShowHidden
 	u.DateFormat = Config.UserDefaults.DateFormat
-	return u
+	u.DisableOnlyOfficeExt = Config.UserDefaults.DisableOnlyOfficeExt
+	u.ThemeColor = Config.UserDefaults.ThemeColor
+	u.GallerySize = Config.UserDefaults.GallerySize
+	u.QuickDownload = Config.UserDefaults.QuickDownload
+	u.LockPassword = Config.UserDefaults.LockPassword
+	if len(u.Scopes) == 0 {
+		for _, source := range Config.Server.Sources {
+			if source.Config.DefaultEnabled {
+				u.Scopes = append(u.Scopes, users.SourceScope{
+					Name:  source.Path, // backend name is path
+					Scope: source.Config.DefaultUserScope,
+				})
+			}
+		}
+	}
 }

backend/common/settings/storage.go

@@ -1,8 +1,7 @@
 package settings
 
 import (
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 )
 
 // StorageBackend is a settings storage backend.
@@ -29,20 +28,9 @@ func (s *Storage) Get() (*Settings, error) {
 	if err != nil {
 		return nil, err
 	}
-	if set.Server.UserHomeBasePath == "" {
-		set.Server.UserHomeBasePath = DefaultUsersHomeBasePath
-	}
 	return set, nil
 }
 
-var defaultEvents = []string{
-	"save",
-	"copy",
-	"rename",
-	"upload",
-	"delete",
-}
-
 // Save saves the settings for the current instance.
 func (s *Storage) Save(set *Settings) error {
 	if len(set.Auth.Key) == 0 {
@@ -53,32 +41,10 @@ func (s *Storage) Save(set *Settings) error {
 		set.UserDefaults.Locale = "en"
 	}
 
-	if set.UserDefaults.Commands == nil {
-		set.UserDefaults.Commands = []string{}
-	}
-
 	if set.UserDefaults.ViewMode == "" {
 		set.UserDefaults.ViewMode = "normal"
 	}
 
-	if set.Rules == nil {
-		set.Rules = []users.Rule{}
-	}
-
-	if set.Commands == nil {
-		set.Commands = map[string][]string{}
-	}
-
-	for _, event := range defaultEvents {
-		if _, ok := set.Commands["before_"+event]; !ok {
-			set.Commands["before_"+event] = []string{}
-		}
-
-		if _, ok := set.Commands["after_"+event]; !ok {
-			set.Commands["after_"+event] = []string{}
-		}
-	}
-
 	err := s.back.Save(set)
 	if err != nil {
 		return err

backend/common/settings/structs.go

@@ -0,0 +1,129 @@
+package settings
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+type AllowedMethods string
+
+const (
+	ProxyAuth    AllowedMethods = "proxyAuth"
+	NoAuth       AllowedMethods = "noAuth"
+	PasswordAuth AllowedMethods = "passwordAuth"
+)
+
+type Settings struct {
+	Server       Server       `json:"server"`
+	Auth         Auth         `json:"auth"`
+	Frontend     Frontend     `json:"frontend"`
+	UserDefaults UserDefaults `json:"userDefaults"`
+	Integrations Integrations `json:"integrations"`
+}
+
+type Server struct {
+	NumImageProcessors           int         `json:"numImageProcessors"`           // number of concurrent image processing jobs
+	Socket                       string      `json:"socket"`                       // socket to listen on
+	TLSKey                       string      `json:"tlsKey"`                       // path to TLS key
+	TLSCert                      string      `json:"tlsCert"`                      // path to TLS cert
+	DisablePreviews              bool        `json:"disablePreviews"`              // disable all previews thumbnails, simple icons will be used
+	DisableResize                bool        `json:"disablePreviewResize"`         // disable resizing of previews for faster loading over slow connections
+	DisableTypeDetectionByHeader bool        `json:"disableTypeDetectionByHeader"` // disable type detection by header, useful if filesystem is slow.
+	Port                         int         `json:"port"`                         // port to listen on
+	BaseURL                      string      `json:"baseURL"`                      // base URL for the server, the subpath that the server is running on.
+	Logging                      []LogConfig `json:"logging"`
+	Database                     string      `json:"database"` // path to the database file
+	Sources                      []Source    `json:"sources" validate:"required,dive"`
+	ExternalUrl                  string      `json:"externalUrl"`    // used by share links if set
+	InternalUrl                  string      `json:"internalUrl"`    // used by integrations if set, this is the url that an integration service will use to communicate with filebrowser
+	CacheDir                     string      `json:"cacheDir"`       // path to the cache directory, used for thumbnails and other cached files
+	MaxArchiveSizeGB             int64       `json:"maxArchiveSize"` // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
+	// not exposed to config
+	SourceMap     map[string]Source `json:"-" validate:"omitempty"` // uses realpath as key
+	NameToSource  map[string]Source `json:"-" validate:"omitempty"` // uses name as key
+	DefaultSource Source            `json:"-" validate:"omitempty"`
+}
+
+type Integrations struct {
+	OnlyOffice OnlyOffice `json:"office" validate:"omitempty"`
+	Media      Media      `json:"media" validate:"omitempty"`
+}
+
+// onlyoffice secret is stored in the local.json file
+// docker exec <containerID> /var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/local.json 'services.CoAuthoring.secret.session.string'
+type OnlyOffice struct {
+	Url         string `json:"url" validate:"required"` // The URL to the OnlyOffice Document Server, needs to be accessible to the user.
+	InternalUrl string `json:"internalUrl"`             // An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
+	Secret      string `json:"secret" validate:"required"`
+}
+
+type Media struct {
+	FfmpegPath string `json:"ffmpegPath"` // path to ffmpeg directory with ffmpeg and ffprobe (eg. /usr/local/bin)
+}
+
+type LogConfig struct {
+	Levels    string `json:"levels"`    // separated list of log levels to enable. (eg. "info|warning|error|debug")
+	ApiLevels string `json:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
+	Output    string `json:"output"`    // output location. (eg. "stdout" or "path/to/file.log")
+	NoColors  bool   `json:"noColors"`  // disable colors in the output
+	Json      bool   `json:"json"`      // output in json format, currently not supported
+}
+
+type Source struct {
+	Path   string       `json:"path" validate:"required"` // file system path. (Can be relative)
+	Name   string       `json:"name"`                     // display name
+	Config SourceConfig `json:"config"`
+}
+
+type SourceConfig struct {
+	IndexingInterval      uint32      `json:"indexingInterval"`      // optional manual overide interval in seconds to re-index the source
+	Disabled              bool        `json:"disabled"`              // disable the indexing of this source
+	MaxWatchers           int         `json:"maxWatchers"`           // number of concurrent watchers to use for this source, currently not supported
+	NeverWatch            []string    `json:"neverWatchPaths"`       // paths to never watch, relative to the source path (eg. "/folder/file.txt")
+	IgnoreHidden          bool        `json:"ignoreHidden"`          // ignore hidden files and folders.
+	IgnoreZeroSizeFolders bool        `json:"ignoreZeroSizeFolders"` // ignore folders with 0 size
+	Exclude               IndexFilter `json:"exclude"`               // exclude files and folders from indexing, if include is not set
+	Include               IndexFilter `json:"include"`               // include files and folders from indexing, if exclude is not set
+	DefaultUserScope      string      `json:"defaultUserScope"`      // default "/" should match folders under path
+	DefaultEnabled        bool        `json:"defaultEnabled"`        // should be added as a default source for new users?
+	CreateUserDir         bool        `json:"createUserDir"`         // create a user directory for each user
+}
+
+type IndexFilter struct {
+	Files        []string `json:"files"`        // array of file names to include/exclude
+	Folders      []string `json:"folders"`      // array of folder names to include/exclude
+	FileEndsWith []string `json:"fileEndsWith"` // array of file names to include/exclude (eg "a.jpg")
+}
+
+type Frontend struct {
+	Name                  string         `json:"name"`                  // display name
+	DisableDefaultLinks   bool           `json:"disableDefaultLinks"`   // disable default links in the sidebar
+	DisableUsedPercentage bool           `json:"disableUsedPercentage"` // disable used percentage for the sources in the sidebar
+	ExternalLinks         []ExternalLink `json:"externalLinks"`
+}
+
+type ExternalLink struct {
+	Text  string `json:"text" validate:"required"` // the text to display on the link
+	Title string `json:"title"`                    // the title to display on hover
+	Url   string `json:"url" validate:"required"`  // the url to link to
+}
+
+// UserDefaults is a type that holds the default values
+// for some fields on User.
+type UserDefaults struct {
+	PreviewOptions       users.PreviewOptions `json:"preview"`
+	StickySidebar        bool                 `json:"stickySidebar"`
+	DarkMode             bool                 `json:"darkMode"`
+	LockPassword         bool                 `json:"lockPassword"`
+	DisableSettings      bool                 `json:"disableSettings,omitempty"`
+	Locale               string               `json:"locale"`
+	ViewMode             string               `json:"viewMode"`
+	GallerySize          int                  `json:"gallerySize"`
+	SingleClick          bool                 `json:"singleClick"`
+	Permissions          users.Permissions    `json:"permissions"`
+	ShowHidden           bool                 `json:"showHidden"`
+	DateFormat           bool                 `json:"dateFormat"`
+	ThemeColor           string               `json:"themeColor"`
+	QuickDownload        bool                 `json:"quickDownload"`
+	DisableOnlyOfficeExt string               `json:"disableOnlyOfficeExt"`
+	DefaultScopes        []users.SourceScope  `json:"-"`
+}

backend/common/settings/validConfig.yaml

@@ -0,0 +1,35 @@
+server:
+  numImageProcessors: 4
+  socket: ""
+  tlsKey: ""
+  tlsCert: ""
+  disablePreviews: false
+  disablePreviewResize: false
+  port: 80
+  baseURL: "/"
+  database: "mydb.db"
+  sources:
+    - path: "."
+integrations:
+  office:
+    url: "http://localhost:9052"
+    secret: 6H1H7GzUk2alRkNxAPav0W02g8JS5oUd
+auth:
+  methods:
+    password:
+      enabled: true
+frontend:
+  name: ""
+  disableUsedPercentage: true
+userDefaults:
+  locale: ""
+  viewMode: ""
+  darkMode: true
+  disableSettings: false
+  singleClick: true
+  permissions:
+    admin: true
+    modify: true
+    share: true
+    api: true
+  dateFormat: false

backend/common/utils/main.go

@@ -6,11 +6,15 @@ import (
 	"encoding/hex"
 	"fmt"
 	math "math/rand"
+	"os"
+	"path/filepath"
 	"reflect"
+	"runtime"
 	"strings"
 	"time"
 
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )
 
 func CheckErr(source string, err error) {
@@ -19,13 +23,13 @@ func CheckErr(source string, err error) {
 	}
 }
 
-func GenerateKey() []byte {
+func GenerateKey() string {
 	b := make([]byte, 64)
 	_, err := rand.Read(b)
 	if err != nil {
-		return nil
+		return ""
 	}
-	return b
+	return string(b)
 }
 
 // CapitalizeFirst returns the input string with the first letter capitalized.
@@ -92,3 +96,51 @@ func HashSHA256(data string) string {
 	bytes := sha256.Sum256([]byte(data))
 	return hex.EncodeToString(bytes[:])
 }
+
+func GetLastComponent(path string) string {
+	if path == "" {
+		return ""
+	}
+	path = strings.TrimSuffix(path, "/") // Remove trailing slash if any
+	lastSlash := strings.LastIndex(path, "/")
+	if lastSlash == -1 {
+		return path // No parent directory for a relative path without slashes
+	}
+	return path[lastSlash+1:]
+}
+
+func JoinPathAsUnix(parts ...string) string {
+	joinedPath := filepath.Join(parts...)
+	if runtime.GOOS == "windows" {
+		joinedPath = strings.ReplaceAll(joinedPath, "\\", "/")
+	}
+	return joinedPath
+}
+
+// ResolveSymlinks resolves symlinks in the given path and returns
+// the final resolved path, whether it's a directory (considering bundle logic), and any error.
+func ResolveSymlinks(path string) (string, bool, error) {
+	for {
+		// Get the file info using os.Lstat to handle symlinks
+		info, err := os.Lstat(path)
+		if err != nil {
+			return path, false, fmt.Errorf("could not stat path: %s, %v", path, err)
+		}
+
+		// Check if the path is a symlink
+		if info.Mode()&os.ModeSymlink != 0 {
+			// Read the symlink target
+			target, err := os.Readlink(path)
+			if err != nil {
+				return path, false, fmt.Errorf("could not read symlink: %s, %v", path, err)
+			}
+
+			// Resolve the symlink's target relative to its directory
+			path = filepath.Join(filepath.Dir(path), target)
+		} else {
+			// Not a symlink, check with bundle-aware directory logic
+			isDir := iteminfo.IsDirectory(info)
+			return path, isDir, nil
+		}
+	}
+}

backend/common/utils/mocks.go

@@ -1,17 +1,19 @@
-package files
+package utils
 
 import (
 	"time"
 
 	"math/rand"
+
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )
 
-func CreateMockData(numDirs, numFilesPerDir int) FileInfo {
-	dir := FileInfo{}
+func CreateMockData(numDirs, numFilesPerDir int) iteminfo.FileInfo {
+	dir := iteminfo.FileInfo{}
 	dir.Path = "/here/is/your/mock/dir"
 	for i := 0; i < numDirs; i++ {
-		newFile := ItemInfo{
-			Name:    "file-" + getRandomTerm() + getRandomExtension(),
+		newFile := iteminfo.ItemInfo{
+			Name:    "file-" + GetRandomTerm() + GetRandomExtension(),
 			Size:    rand.Int63n(1000),                                          // Random size
 			ModTime: time.Now().Add(-time.Duration(rand.Intn(100)) * time.Hour), // Random mod time
 			Type:    "blob",
@@ -20,8 +22,8 @@ func CreateMockData(numDirs, numFilesPerDir int) FileInfo {
 	}
 	// Simulating files and directories with FileInfo
 	for j := 0; j < numFilesPerDir; j++ {
-		newFile := ItemInfo{
-			Name:    "file-" + getRandomTerm() + getRandomExtension(),
+		newFile := iteminfo.ItemInfo{
+			Name:    "file-" + GetRandomTerm() + GetRandomExtension(),
 			Size:    rand.Int63n(1000),                                          // Random size
 			ModTime: time.Now().Add(-time.Duration(rand.Intn(100)) * time.Hour), // Random mod time
 			Type:    "blob",
@@ -31,16 +33,16 @@ func CreateMockData(numDirs, numFilesPerDir int) FileInfo {
 	return dir
 }
 
-func generateRandomPath(levels int) string {
+func GenerateRandomPath(levels int) string {
 	rand.New(rand.NewSource(time.Now().UnixNano()))
 	dirName := "srv"
 	for i := 0; i < levels; i++ {
-		dirName += "/" + getRandomTerm()
+		dirName += "/" + GetRandomTerm()
 	}
 	return dirName
 }
 
-func getRandomTerm() string {
+func GetRandomTerm() string {
 	wordbank := []string{
 		"hi", "test", "other", "name",
 		"cool", "things", "more", "items",
@@ -51,7 +53,7 @@ func getRandomTerm() string {
 	return wordbank[index]
 }
 
-func getRandomExtension() string {
+func GetRandomExtension() string {
 	wordbank := []string{
 		".txt", ".mp3", ".mov", ".doc",
 		".mp4", ".bak", ".zip", ".jpg",
@@ -61,11 +63,11 @@ func getRandomExtension() string {
 	return wordbank[index]
 }
 
-func generateRandomSearchTerms(numTerms int) []string {
+func GenerateRandomSearchTerms(numTerms int) []string {
 	// Generate random search terms
 	searchTerms := make([]string, numTerms)
 	for i := 0; i < numTerms; i++ {
-		searchTerms[i] = getRandomTerm()
+		searchTerms[i] = GetRandomTerm()
 	}
 	return searchTerms
 }

backend/config.media.yaml

@@ -0,0 +1,11 @@
+server:
+  logging:
+    - levels: "info|warning|error"
+  sources:
+    - path: "/srv"
+userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    highQuality: true

backend/config.yaml

@@ -1,20 +1,22 @@
 server:
   port: 80
   baseURL:  "/"
-  root: "/srv"
-auth:
-  method: password
-  signup: false
+  logging:
+    - levels: "info|warning|error"
+  sources:
+    - path: "/srv"
 userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: false
+    office: false
+    highQuality: false
   darkMode: true
   disableSettings: false
-  scope: "."
   singleClick: false
   permissions:
     admin: false
-    create: false
-    rename: false
     modify: false
-    delete: false
     share: false
-    download: false
+    api: false

backend/database/share/share.go

@@ -10,6 +10,7 @@ type CreateBody struct {
 type Link struct {
 	Hash         string `json:"hash" storm:"id,index"`
 	Path         string `json:"path" storm:"index"`
+	Source       string `json:"source" storm:"index"`
 	UserID       uint   `json:"userID"`
 	Expire       int64  `json:"expire"`
 	PasswordHash string `json:"password_hash,omitempty"`

backend/database/share/storage.go

@@ -3,7 +3,7 @@ package share
 import (
 	"time"
 
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 )
 
 // StorageBackend is the interface to implement for a share storage.
@@ -11,8 +11,8 @@ type StorageBackend interface {
 	All() ([]*Link, error)
 	FindByUserID(id uint) ([]*Link, error)
 	GetByHash(hash string) (*Link, error)
-	GetPermanent(path string, id uint) (*Link, error)
-	Gets(path string, id uint) ([]*Link, error)
+	GetPermanent(path, source string, id uint) (*Link, error)
+	Gets(path, source string, id uint) ([]*Link, error)
 	Save(s *Link) error
 	Delete(hash string) error
 }
@@ -85,13 +85,13 @@ func (s *Storage) GetByHash(hash string) (*Link, error) {
 }
 
 // GetPermanent wraps a StorageBackend.GetPermanent
-func (s *Storage) GetPermanent(path string, id uint) (*Link, error) {
-	return s.back.GetPermanent(path, id)
+func (s *Storage) GetPermanent(path, source string, id uint) (*Link, error) {
+	return s.back.GetPermanent(path, source, id)
 }
 
 // Gets wraps a StorageBackend.Gets
-func (s *Storage) Gets(path string, id uint) ([]*Link, error) {
-	links, err := s.back.Gets(path, id)
+func (s *Storage) Gets(sourcePath, source string, id uint) ([]*Link, error) {
+	links, err := s.back.Gets(sourcePath, source, id)
 
 	if err != nil {
 		return nil, err

backend/database/storage/bolt/auth.go

@@ -1,9 +1,9 @@
 package bolt
 
 import (
-	"github.com/asdine/storm/v3"
+	storm "github.com/asdine/storm/v3"
 	"github.com/gtsteffaniak/filebrowser/backend/auth"
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 )
 
 type authBackend struct {

backend/database/storage/bolt/bolt.go

@@ -1,12 +1,12 @@
 package bolt
 
 import (
-	"github.com/asdine/storm/v3"
+	storm "github.com/asdine/storm/v3"
 
 	"github.com/gtsteffaniak/filebrowser/backend/auth"
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/share"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // NewStorage creates a storage.Storage based on Bolt DB.
@@ -14,6 +14,9 @@ func NewStorage(db *storm.DB) (*auth.Storage, *users.Storage, *share.Storage, *s
 	userStore := users.NewStorage(usersBackend{db: db})
 	shareStore := share.NewStorage(shareBackend{db: db})
 	settingsStore := settings.NewStorage(settingsBackend{db: db})
-	authStore := auth.NewStorage(authBackend{db: db}, userStore)
+	authStore, err := auth.NewStorage(authBackend{db: db}, userStore)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
 	return authStore, userStore, shareStore, settingsStore, nil
 }

backend/database/storage/bolt/config.go

@@ -1,8 +1,8 @@
 package bolt
 
 import (
-	"github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
+	storm "github.com/asdine/storm/v3"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 )
 
 type settingsBackend struct {

backend/database/storage/bolt/share.go

@@ -4,12 +4,12 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/asdine/storm/v3"
+	storm "github.com/asdine/storm/v3"
 	"github.com/asdine/storm/v3/q"
 
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
-	"github.com/gtsteffaniak/filebrowser/backend/share"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
 )
 
 type shareBackend struct {
@@ -46,27 +46,21 @@ func (s shareBackend) GetByHash(hash string) (*share.Link, error) {
 	return &v, err
 }
 
-func (s shareBackend) GetPermanent(path string, id uint) (*share.Link, error) {
+func (s shareBackend) GetPermanent(path, source string, id uint) (*share.Link, error) {
 	var v share.Link
-	err := s.db.Select(q.Eq("Path", path), q.Eq("Expire", 0), q.Eq("UserID", id)).First(&v)
-	if err == storm.ErrNotFound {
-		return nil, errors.ErrNotExist
-	}
-
-	return &v, err
+	// TODO remove legacy and return notfound errors
+	_ = s.db.Select(q.Eq("Path", path), q.Eq("Source", source), q.Eq("Expire", 0), q.Eq("UserID", id)).First(&v)
+	return &v, nil
 }
 
-func (s shareBackend) Gets(path string, id uint) ([]*share.Link, error) {
+func (s shareBackend) Gets(path, sourcePath string, id uint) ([]*share.Link, error) {
 	var v []*share.Link
-	err := s.db.Select(q.Eq("Path", path), q.Eq("UserID", id)).Find(&v)
-	if err == storm.ErrNotFound {
-		return v, errors.ErrNotExist
-	}
-
+	_ = s.db.Select(q.Eq("Path", path), q.Eq("Source", sourcePath), q.Eq("UserID", id)).Find(&v)
 	filteredList := []*share.Link{}
-	// automatically delete and clear expired shares
+	var err error
+	// through and filter out expired share
 	for i := range v {
-		if v[i].Expire < time.Now().Unix() {
+		if v[i].Expire < time.Now().Unix() && v[i].Expire != 0 {
 			err = s.Delete(v[i].PasswordHash)
 			if err != nil {
 				logger.Error(fmt.Sprintf("expired share could not be deleted: %v", err.Error()))
@@ -75,7 +69,6 @@ func (s shareBackend) Gets(path string, id uint) ([]*share.Link, error) {
 			filteredList = append(filteredList, v[i])
 		}
 	}
-
 	return filteredList, err
 }
 

backend/database/storage/bolt/users.go

@@ -0,0 +1,261 @@
+package bolt
+
+import (
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+
+	storm "github.com/asdine/storm/v3"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+type usersBackend struct {
+	db *storm.DB
+}
+
+func (st usersBackend) GetBy(i interface{}) (user *users.User, err error) {
+	user = &users.User{}
+
+	var arg string
+	var val interface{}
+	switch i := i.(type) {
+	case uint:
+		val = i
+		arg = "ID"
+	case int:
+		val = uint(i)
+	case string:
+		arg = "Username"
+		val = i
+	default:
+		return nil, errors.ErrInvalidDataType
+	}
+
+	err = st.db.One(arg, val, user)
+
+	if err != nil {
+		if err == storm.ErrNotFound {
+			return nil, errors.ErrNotExist
+		}
+		return nil, err
+	}
+
+	return
+}
+
+func (st usersBackend) Gets() ([]*users.User, error) {
+	var allUsers []*users.User
+	err := st.db.All(&allUsers)
+	if err == storm.ErrNotFound {
+		return nil, errors.ErrNotExist
+	}
+	if err != nil {
+		return allUsers, err
+	}
+	return allUsers, err
+}
+
+func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...string) error {
+	existingUser, err := st.GetBy(user.ID)
+	if err != nil {
+		return err
+	}
+
+	fields, err = parseFields(user, fields, actorIsAdmin)
+	if err != nil {
+		return err
+	}
+
+	if !slices.Contains(fields, "Password") {
+		user.Password = existingUser.Password
+	} else {
+		if existingUser.LockPassword {
+			return fmt.Errorf("password cannot be changed when lock password is enabled")
+		}
+	}
+
+	if !actorIsAdmin {
+		err := checkRestrictedFields(existingUser, fields)
+		if err != nil {
+			return err
+		}
+	}
+
+	if len(fields) == 0 {
+		return fmt.Errorf("no fields to update")
+	}
+
+	// converting scopes to map of paths intead of names (names can change)
+	if slices.Contains(fields, "Scopes") {
+		adjustedScopes, err := settings.ConvertToBackendScopes(user.Scopes)
+		if err != nil {
+			return err
+		}
+		user.Scopes = adjustedScopes
+		err = files.MakeUserDirs(user, true)
+		if err != nil {
+			return err
+		}
+	}
+	// Use reflection to access struct fields
+	userFields := reflect.ValueOf(user).Elem() // Get struct value
+	for _, field := range fields {
+		// Get the corresponding field using reflection
+		fieldValue := userFields.FieldByName(field)
+		if !fieldValue.IsValid() {
+			return fmt.Errorf("invalid field: %s", field)
+		}
+
+		// Ensure the field is settable
+		if !fieldValue.CanSet() {
+			return fmt.Errorf("cannot set value of field: %s", field)
+		}
+
+		// Get the value to be stored
+		val := fieldValue.Interface()
+		// Update the database
+		if err := st.db.UpdateField(existingUser, field, val); err != nil {
+			return fmt.Errorf("failed to update user field: %s, error: %v", field, err)
+		}
+	}
+
+	// last revoke api keys if needed.
+	if existingUser.Permissions.Api && !user.Permissions.Api && slices.Contains(fields, "Permissions") {
+		for _, key := range existingUser.ApiKeys {
+			auth.RevokeAPIKey(key.Key) // add to blacklist
+		}
+	}
+	return nil
+}
+
+func (st usersBackend) Save(user *users.User, changePass bool) error {
+	if user.LoginMethod == "" {
+		user.LoginMethod = users.LoginMethodPassword
+	}
+	logger.Debug(fmt.Sprintf("Saving user [%s] changepass: %v", user.Username, changePass))
+	if user.LoginMethod == users.LoginMethodPassword && changePass {
+		err := checkPassword(user.Password)
+		if err != nil {
+			return err
+		}
+		pass, err := users.HashPwd(user.Password)
+		if err != nil {
+			return err
+		}
+		user.Password = pass
+	}
+
+	// converting scopes to map of paths intead of names (names can change)
+	adjustedScopes, err := settings.ConvertToBackendScopes(user.Scopes)
+	if err != nil {
+		return err
+	}
+	user.Scopes = adjustedScopes
+	err = files.MakeUserDirs(user, false)
+	if err != nil {
+		logger.Error(err.Error())
+	}
+	err = st.db.Save(user)
+	if err == storm.ErrAlreadyExists {
+		return errors.ErrExist
+	}
+	return err
+}
+
+func (st usersBackend) DeleteByID(id uint) error {
+	return st.db.DeleteStruct(&users.User{ID: id})
+}
+
+func (st usersBackend) DeleteByUsername(username string) error {
+	user, err := st.GetBy(username)
+	if err != nil {
+		return err
+	}
+
+	return st.db.DeleteStruct(user)
+}
+
+// Define a function to check for restricted fields
+func checkRestrictedFields(existingUser *users.User, fields []string) error {
+	// Get a list of allowed fields from NonAdminEditable
+	allowed := getNonAdminEditableFieldNames()
+	for _, field := range fields {
+		if !slices.Contains(allowed, field) {
+			return fmt.Errorf("non-admins cannot modify field: %s", field)
+		}
+	}
+
+	return nil
+}
+
+// Helper to return list of field names from NonAdminEditable struct
+func getNonAdminEditableFieldNames() []string {
+	var names []string
+	t := reflect.TypeOf(users.NonAdminEditable{})
+	for i := 0; i < t.NumField(); i++ {
+		names = append(names, t.Field(i).Name)
+	}
+	return names
+}
+
+func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string, error) {
+	// If `Which` is not specified, default to updating all fields
+	if len(fields) == 0 || fields[0] == "all" {
+		fields = []string{}
+		v := reflect.ValueOf(user)
+		if v.Kind() == reflect.Ptr {
+			v = v.Elem()
+		}
+		t := v.Type()
+
+		// Dynamically populate fields to update
+		for i := 0; i < t.NumField(); i++ {
+			field := t.Field(i)
+			// which=all can't update password
+			if strings.ToLower(field.Name) != "password" && strings.ToLower(field.Name) != "id" && strings.ToLower(field.Name) != "username" {
+				fields = append(fields, field.Name)
+			}
+		}
+	}
+	newfields := []string{}
+	for _, field := range fields {
+		capitalField := utils.CapitalizeFirst(field)
+		if capitalField == "Scopes" {
+			if !actorIsAdmin {
+				continue
+			}
+		}
+		if capitalField == "Password" {
+			if user.LoginMethod != users.LoginMethodPassword {
+				return nil, fmt.Errorf("password cannot be changed when login method is not password")
+			}
+			err := checkPassword(user.Password)
+			if err != nil {
+				return nil, fmt.Errorf("password does not meet complexity requirements")
+			}
+			value, err := users.HashPwd(user.Password)
+			if err != nil {
+				logger.Error(err.Error())
+			}
+			user.Password = value
+		}
+		newfields = append(newfields, capitalField)
+	}
+
+	return newfields, nil
+}
+
+func checkPassword(password string) error {
+	if len(password) < settings.Config.Auth.Methods.PasswordAuth.MinLength {
+		return fmt.Errorf("password must be at least %d characters long", settings.Config.Auth.Methods.PasswordAuth.MinLength)
+	}
+	return nil
+}

backend/database/storage/bolt/utils.go

@@ -1,9 +1,9 @@
 package bolt
 
 import (
-	"github.com/asdine/storm/v3"
+	storm "github.com/asdine/storm/v3"
 
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 )
 
 func get(db *storm.DB, name string, to interface{}) error {

backend/database/storage/storage.go

@@ -5,16 +5,15 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/asdine/storm/v3"
+	storm "github.com/asdine/storm/v3"
 	"github.com/gtsteffaniak/filebrowser/backend/auth"
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/files"
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/share"
-	"github.com/gtsteffaniak/filebrowser/backend/storage/bolt"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
-	"github.com/gtsteffaniak/filebrowser/backend/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // Storage is a storage powered by a Backend which makes the necessary
@@ -41,7 +40,7 @@ func InitializeDb(path string) (*Storage, bool, error) {
 		return nil, exists, err
 	}
 
-	err = bolt.Save(db, "version", 2) //nolint:gomnd
+	err = bolt.Save(db, "version", 2)
 	if err != nil {
 		return nil, exists, err
 	}
@@ -80,56 +79,43 @@ func dbExists(path string) (bool, error) {
 
 func quickSetup(store *Storage) {
 	settings.Config.Auth.Key = utils.GenerateKey()
-	if settings.Config.Auth.Method == "noauth" {
-		err := store.Auth.Save(&auth.NoAuth{})
-		utils.CheckErr("store.Auth.Save", err)
-	} else {
-		settings.Config.Auth.Method = "password"
-		err := store.Auth.Save(&auth.JSONAuth{})
-		utils.CheckErr("store.Auth.Save", err)
-	}
 	err := store.Settings.Save(&settings.Config)
 	utils.CheckErr("store.Settings.Save", err)
 	err = store.Settings.SaveServer(&settings.Config.Server)
 	utils.CheckErr("store.Settings.SaveServer", err)
-	user := settings.ApplyUserDefaults(users.User{})
+	user := &users.User{}
+	settings.ApplyUserDefaults(user)
 	user.Username = settings.Config.Auth.AdminUsername
 	user.Password = settings.Config.Auth.AdminPassword
-	user.Perm.Admin = true
-	user.Scope = "./"
-	user.DarkMode = true
-	user.ViewMode = "normal"
+	user.Permissions.Admin = true
+	user.Scopes = []users.SourceScope{}
+	for _, val := range settings.Config.Server.Sources {
+		user.Scopes = append(user.Scopes, users.SourceScope{
+			Name:  val.Path, // backend name is path
+			Scope: "",
+		})
+	}
 	user.LockPassword = false
-	user.Perm = settings.AdminPerms()
-	err = store.Users.Save(&user)
+	user.Permissions = settings.AdminPerms()
+	logger.Debug(fmt.Sprintf("Creating user as admin: %v %v", user.Username, user.Password))
+	err = store.Users.Save(user, true)
 	utils.CheckErr("store.Users.Save", err)
 }
 
 // create new user
 func CreateUser(userInfo users.User, asAdmin bool) error {
+	newUser := &userInfo
 	// must have username or password to create
 	if userInfo.Username == "" || userInfo.Password == "" {
 		return errors.ErrInvalidRequestParams
 	}
-	newUser := settings.ApplyUserDefaults(userInfo)
+	logger.Debug(fmt.Sprintf("Creating user: %v %v", userInfo.Username, userInfo.Scopes))
+	settings.ApplyUserDefaults(newUser)
 	if asAdmin {
-		newUser.Perm = settings.AdminPerms()
+		userInfo.Permissions = settings.AdminPerms()
 	}
-	// create new home directory
-	userHome, err := settings.Config.MakeUserDir(newUser.Username, newUser.Scope, files.RootPaths["default"])
-	if err != nil {
-		logger.Error(fmt.Sprintf("create user: failed to mkdir user home dir: [%s]", userHome))
-		return err
-	}
-	newUser.Scope = userHome
-	logger.Debug(fmt.Sprintf("user: %s, home dir: [%s].", newUser.Username, userHome))
-	idx := files.GetIndex("default")
-	_, _, err = idx.GetRealPath(newUser.Scope)
-	if err != nil {
-		logger.Error(fmt.Sprintf("user path is not valid: %v", newUser.Scope))
-		return nil
-	}
-	err = store.Users.Save(&newUser)
+	// create new home directories
+	err := store.Users.Save(newUser, true)
 	if err != nil {
 		return err
 	}

backend/database/users/password.go

@@ -11,7 +11,6 @@ func HashPwd(password string) (string, error) {
 }
 
 // CheckPwd checks if a password is correct.
-func CheckPwd(password, hash string) bool {
-	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
-	return err == nil
+func CheckPwd(password, hash string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
 }

backend/database/users/storage.go

@@ -4,31 +4,29 @@ import (
 	"sync"
 	"time"
 
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 )
 
 // StorageBackend is the interface to implement for a users storage.
 type StorageBackend interface {
 	GetBy(interface{}) (*User, error)
 	Gets() ([]*User, error)
-	Save(u *User) error
-	Update(u *User, fields ...string) error
+	Save(u *User, changePass bool) error
+	Update(u *User, adminActor bool, fields ...string) error
 	DeleteByID(uint) error
 	DeleteByUsername(string) error
 }
 
 // Store is an interface for user storage.
 type Store interface {
-	Get(baseScope string, id interface{}) (user *User, err error)
-	Gets(baseScope string) ([]*User, error)
-	Update(user *User, fields ...string) error
-	Save(user *User) error
+	Get(id interface{}) (user *User, err error)
+	Gets() ([]*User, error)
+	Update(user *User, adminActor bool, fields ...string) error
+	Save(user *User, changePass bool) error
 	Delete(id interface{}) error
 	LastUpdate(id uint) int64
 	AddApiKey(username uint, name string, key AuthToken) error
 	DeleteApiKey(username uint, name string) error
-	AddRule(username string, rule Rule) error
-	DeleteRule(username string, ruleID string) error
 }
 
 // Storage is a users storage.
@@ -49,7 +47,7 @@ func NewStorage(back StorageBackend) *Storage {
 // Get allows you to get a user by its name or username. The provided
 // id must be a string for username lookup or a uint for id lookup. If id
 // is neither, a ErrInvalidDataType will be returned.
-func (s *Storage) Get(baseScope string, id interface{}) (user *User, err error) {
+func (s *Storage) Get(id interface{}) (user *User, err error) {
 	user, err = s.back.GetBy(id)
 	if err != nil {
 		return
@@ -58,7 +56,7 @@ func (s *Storage) Get(baseScope string, id interface{}) (user *User, err error)
 }
 
 // Gets gets a list of all users.
-func (s *Storage) Gets(baseScope string) ([]*User, error) {
+func (s *Storage) Gets() ([]*User, error) {
 	users, err := s.back.Gets()
 	if err != nil {
 		return nil, err
@@ -67,8 +65,8 @@ func (s *Storage) Gets(baseScope string) ([]*User, error) {
 }
 
 // Update updates a user in the database.
-func (s *Storage) Update(user *User, fields ...string) error {
-	err := s.back.Update(user, fields...)
+func (s *Storage) Update(user *User, adminIActor bool, fields ...string) error {
+	err := s.back.Update(user, adminIActor, fields...)
 	if err != nil {
 		return err
 	}
@@ -79,25 +77,8 @@ func (s *Storage) Update(user *User, fields ...string) error {
 	return nil
 }
 
-// AddRule adds a rule to the user's rules list and updates the user in the database.
-func (s *Storage) AddRule(userID string, rule Rule) error {
-	user, err := s.Get("", userID)
-	if err != nil {
-		return err
-	}
-
-	user.Rules = append(user.Rules, rule)
-
-	err = s.Update(user, "Rules")
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
 func (s *Storage) AddApiKey(userID uint, name string, key AuthToken) error {
-	user, err := s.Get("", userID)
+	user, err := s.Get(userID)
 	if err != nil {
 		return err
 	}
@@ -106,7 +87,7 @@ func (s *Storage) AddApiKey(userID uint, name string, key AuthToken) error {
 		user.ApiKeys = make(map[string]AuthToken)
 	}
 	user.ApiKeys[name] = key
-	err = s.Update(user, "ApiKeys")
+	err = s.Update(user, true, "ApiKeys")
 	if err != nil {
 		return err
 	}
@@ -115,7 +96,7 @@ func (s *Storage) AddApiKey(userID uint, name string, key AuthToken) error {
 }
 
 func (s *Storage) DeleteApiKey(userID uint, name string) error {
-	user, err := s.Get("", userID)
+	user, err := s.Get(userID)
 	if err != nil {
 		return err
 	}
@@ -124,32 +105,7 @@ func (s *Storage) DeleteApiKey(userID uint, name string) error {
 		user.ApiKeys = make(map[string]AuthToken)
 	}
 	delete(user.ApiKeys, name)
-	err = s.Update(user, "ApiKeys")
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// DeleteRule deletes a rule specified by ID from the user's rules list and updates the user in the database.
-func (s *Storage) DeleteRule(userID string, ruleID string) error {
-	user, err := s.Get("", userID)
-	if err != nil {
-		return err
-	}
-
-	// Find and remove the rule with the specified ID
-	var updatedRules []Rule
-	for _, r := range user.Rules {
-		if r.Id != ruleID {
-			updatedRules = append(updatedRules, r)
-		}
-	}
-
-	user.Rules = updatedRules
-
-	err = s.Update(user, "Rules")
+	err = s.Update(user, true, "ApiKeys")
 	if err != nil {
 		return err
 	}
@@ -158,8 +114,8 @@ func (s *Storage) DeleteRule(userID string, ruleID string) error {
 }
 
 // Save saves the user in a storage.
-func (s *Storage) Save(user *User) error {
-	return s.back.Save(user)
+func (s *Storage) Save(user *User, changePass bool) error {
+	return s.back.Save(user, changePass)
 }
 
 // Delete allows you to delete a user by its name or username. The provided

backend/database/users/users.go

@@ -0,0 +1,104 @@
+package users
+
+import (
+	"strings"
+
+	jwt "github.com/golang-jwt/jwt/v4"
+)
+
+const ()
+
+type LoginMethod string
+
+const (
+	LoginMethodPassword LoginMethod = "password"
+	LoginMethodProxy    LoginMethod = "proxy"
+	LoginMethodOidc     LoginMethod = "oidc"
+)
+
+type AuthToken struct {
+	Key                  string      `json:"key"`
+	Name                 string      `json:"name"`
+	Created              int64       `json:"createdAt"`
+	Expires              int64       `json:"expiresAt"`
+	BelongsTo            uint        `json:"belongsTo"`
+	Permissions          Permissions `json:"Permissions"`
+	jwt.RegisteredClaims `json:"-"`
+}
+
+type Permissions struct {
+	Api      bool `json:"api"`
+	Admin    bool `json:"admin"`
+	Modify   bool `json:"modify"`
+	Share    bool `json:"share"`
+	Realtime bool `json:"realtime"`
+}
+
+// SortingSettings represents the sorting settings.
+type Sorting struct {
+	By  string `json:"by"`
+	Asc bool   `json:"asc"`
+}
+
+type PreviewOptions struct {
+	HighQuality bool `json:"highQuality"`
+	Image       bool `json:"image"`
+	Video       bool `json:"video"`
+	Office      bool `json:"office"`
+	PopUp       bool `json:"popup"`
+}
+
+// User describes a user.
+type User struct {
+	NonAdminEditable
+	DisableSettings bool                 `json:"disableSettings"`
+	ID              uint                 `storm:"id,increment" json:"id"`
+	Username        string               `storm:"unique" json:"username"`
+	Scopes          []SourceScope        `json:"scopes"`
+	Scope           string               `json:"scope,omitempty"`
+	LockPassword    bool                 `json:"lockPassword"`
+	Permissions     Permissions          `json:"permissions"`
+	ApiKeys         map[string]AuthToken `json:"apiKeys,omitempty"`
+	LoginMethod     LoginMethod          `json:"loginMethod"`
+	// legacy for migration purposes... og filebrowser has perm attribute
+	Perm Permissions `json:"perm,omitzero"`
+}
+
+type SourceScope struct {
+	Name  string `json:"name"`
+	Scope string `json:"scope"`
+}
+
+type NonAdminEditable struct {
+	Preview              PreviewOptions `json:"preview"`
+	StickySidebar        bool           `json:"stickySidebar"`
+	DarkMode             bool           `json:"darkMode"`
+	Password             string         `json:"password,omitempty"`
+	Locale               string         `json:"locale"`
+	ViewMode             string         `json:"viewMode"`
+	SingleClick          bool           `json:"singleClick"`
+	Sorting              Sorting        `json:"sorting"`
+	ShowHidden           bool           `json:"showHidden"`
+	DateFormat           bool           `json:"dateFormat"`
+	GallerySize          int            `json:"gallerySize"`
+	ThemeColor           string         `json:"themeColor"`
+	QuickDownload        bool           `json:"quickDownload"`
+	DisableOnlyOfficeExt string         `json:"disableOnlyOfficeExt"`
+}
+
+var PublicUser = User{
+	NonAdminEditable: NonAdminEditable{
+		Password: "publicUser", // temp user not registered
+		ViewMode: "normal",
+	},
+	Username:     "publicUser", // temp user not registered
+	LockPassword: true,
+	Permissions:  Permissions{},
+}
+
+func CleanUsername(s string) string {
+	// Remove any trailing space to avoid ending on -
+	s = strings.Trim(s, " ")
+	s = strings.Replace(s, "..", "", -1)
+	return s
+}

backend/docker-config.yaml

@@ -1,2 +0,0 @@
-server:
-  root: "/srv"

backend/events/eventRouter.go

@@ -0,0 +1,140 @@
+package events
+
+import (
+	"sync"
+)
+
+type EventMessage struct {
+	EventType string `json:"eventType"`
+	Message   string `json:"message"`
+}
+
+type sourceEvent struct {
+	source string
+	event  EventMessage
+}
+
+type userEvent struct {
+	event EventMessage
+	users []string
+}
+
+var (
+	BroadcastChan     = make(chan EventMessage, 100)
+	userEventChan     = make(chan userEvent, 100)
+	debounceInputChan = make(chan EventMessage, 100)
+	sourceUpdateChan  = make(chan sourceEvent, 100)
+
+	userClientsMu   sync.RWMutex
+	userClients     = make(map[string][]chan EventMessage)
+	sourceClientsMu sync.RWMutex
+	sourceClients   = make(map[string]map[chan EventMessage]struct{})
+)
+
+func init() {
+	go handleUserEvents()
+	go handleSourceUpdates() // Add this
+
+}
+
+func handleUserEvents() {
+	for ue := range userEventChan {
+		for _, user := range ue.users {
+			userClientsMu.RLock()
+			conns := userClients[user]
+			userClientsMu.RUnlock()
+
+			for _, ch := range conns {
+				select {
+				case ch <- ue.event:
+				default:
+				}
+			}
+		}
+	}
+}
+
+func Register(username string, sources []string) chan EventMessage {
+	ch := make(chan EventMessage, 10)
+
+	userClientsMu.Lock()
+	userClients[username] = append(userClients[username], ch)
+	userClientsMu.Unlock()
+
+	sourceClientsMu.Lock()
+	for _, source := range sources {
+		if sourceClients[source] == nil {
+			sourceClients[source] = make(map[chan EventMessage]struct{})
+		}
+		sourceClients[source][ch] = struct{}{}
+	}
+	sourceClientsMu.Unlock()
+
+	return ch
+}
+
+func Unregister(username string, ch chan EventMessage) {
+	userClientsMu.Lock()
+	conns := userClients[username]
+	for i, c := range conns {
+		if c == ch {
+			userClients[username] = append(conns[:i], conns[i+1:]...)
+			break
+		}
+	}
+	if len(userClients[username]) == 0 {
+		delete(userClients, username)
+	}
+	userClientsMu.Unlock()
+
+	sourceClientsMu.Lock()
+	for source, clients := range sourceClients {
+		delete(clients, ch)
+		if len(clients) == 0 {
+			delete(sourceClients, source)
+		}
+	}
+	sourceClientsMu.Unlock()
+
+	close(ch)
+}
+
+func SendToUsers(eventType, message string, users []string) {
+	userEventChan <- userEvent{
+		event: EventMessage{EventType: eventType, Message: message},
+		users: users,
+	}
+}
+
+func SendSourceUpdate(source string, message string) {
+	sourceUpdateChan <- sourceEvent{
+		source: source,
+		event: EventMessage{
+			EventType: "sourceUpdate",
+			Message:   message,
+		},
+	}
+}
+
+func DebouncedBroadcast(eventType, message string) {
+	debounceInputChan <- EventMessage{
+		EventType: eventType,
+		Message:   message,
+	}
+}
+
+func handleSourceUpdates() {
+	for update := range sourceUpdateChan {
+		sourceClientsMu.RLock()
+		clients := sourceClients[update.source]
+		sourceClientsMu.RUnlock()
+
+		for ch := range clients {
+			select {
+			case ch <- update.event:
+			default:
+				// Optional: log dropped message
+			}
+		}
+	}
+}

backend/files/conditions.go

@@ -1,280 +0,0 @@
-package files
-
-import (
-	"mime"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"strings"
-)
-
-var typeRegexp = regexp.MustCompile(`type:(\S+)`)
-var AllFiletypeOptions = []string{
-	"image",
-	"audio",
-	"archive",
-	"video",
-	"doc",
-	"text",
-}
-
-// Document file extensions
-var documentTypes = []string{
-	// Common Document Formats
-	".doc", ".docx", // Microsoft Word
-	".pdf", // Portable Document Format
-	".odt", // OpenDocument Text
-	".rtf", // Rich Text Format
-	".conf",
-	".bash_history",
-	".gitignore",
-	".htpasswd",
-	".profile",
-	".dockerignore",
-	".editorconfig",
-
-	// Presentation Formats
-	".ppt", ".pptx", // Microsoft PowerPoint
-	".odp", // OpenDocument Presentation
-
-	// google docs
-	".gdoc",
-
-	// google sheet
-	".gsheet",
-
-	// Spreadsheet Formats
-	".xls", ".xlsx", // Microsoft Excel
-	".ods", // OpenDocument Spreadsheet
-
-	// Other Document Formats
-	".epub", // Electronic Publication
-	".mobi", // Amazon Kindle
-	".fb2",  // FictionBook
-}
-
-var onlyOfficeSupported = []string{
-	".doc", ".docm", ".docx", ".dot", ".dotm", ".dotx", ".epub",
-	".fb2", ".fodt", ".htm", ".html", ".mht", ".mhtml", ".odt",
-	".ott", ".rtf", ".stw", ".sxw", ".txt", ".wps", ".wpt", ".xml",
-	".csv", ".et", ".ett", ".fods", ".ods", ".ots", ".sxc", ".xls",
-	".xlsb", ".xlsm", ".xlsx", ".xlt", ".xltm", ".xltx", ".dps",
-	".dpt", ".fodp", ".odp", ".otp", ".pot", ".potm", ".potx",
-	".pps", ".ppsm", ".ppsx", ".ppt", ".pptm", ".pptx", ".sxi",
-	".djvu", ".docxf", ".oform", ".oxps", ".pdf", ".xps",
-}
-
-// Text-based file extensions
-var textTypes = []string{
-	// Common Text Formats
-	".txt",
-	".md", // Markdown
-
-	// Scripting and Programming Languages
-	".sh",        // Bash script
-	".py",        // Python
-	".js",        // JavaScript
-	".ts",        // TypeScript
-	".php",       // PHP
-	".rb",        // Ruby
-	".go",        // Go
-	".java",      // Java
-	".c", ".cpp", // C/C++
-	".cs",    // C#
-	".swift", // Swift
-
-	// Configuration Files
-	".yaml", ".yml", // YAML
-	".json", // JSON
-	".xml",  // XML
-	".ini",  // INI
-	".toml", // TOML
-	".cfg",  // Configuration file
-
-	// Other Text-Based Formats
-	".css",          // Cascading Style Sheets
-	".html", ".htm", // HyperText Markup Language
-	".sql", // SQL
-	".csv", // Comma-Separated Values
-	".tsv", // Tab-Separated Values
-	".log", // Log file
-	".bat", // Batch file
-	".ps1", // PowerShell script
-	".tex", // LaTeX
-	".bib", // BibTeX
-}
-
-// Compressed file extensions
-var compressedFile = []string{
-	".7z",
-	".rar",
-	".zip",
-	".tar",
-	".gz",
-	".xz",
-	".bz2",
-	".tgz",  // tar.gz
-	".tbz2", // tar.bz2
-	".lzma",
-	".lz4",
-	".zstd",
-}
-
-type SearchOptions struct {
-	Conditions  map[string]bool
-	LargerThan  int
-	SmallerThan int
-	Terms       []string
-}
-
-func extendedMimeTypeCheck(extension string) string {
-	if isDoc(extension) {
-		return "application/document"
-	}
-	if isText(extension) {
-		return "text/plain"
-	}
-	return "blob"
-}
-
-func ParseSearch(value string) SearchOptions {
-	opts := SearchOptions{
-		Conditions: map[string]bool{
-			"exact": strings.Contains(value, "case:exact"),
-		},
-		Terms: []string{},
-	}
-
-	// removes the options from the value
-	value = strings.Replace(value, "case:exact", "", -1)
-	value = strings.TrimSpace(value)
-
-	types := typeRegexp.FindAllStringSubmatch(value, -1)
-	for _, filterType := range types {
-		if len(filterType) == 1 {
-			continue
-		}
-		filter := filterType[1]
-		switch filter {
-		case "image":
-			opts.Conditions["image"] = true
-		case "audio", "music":
-			opts.Conditions["audio"] = true
-		case "video":
-			opts.Conditions["video"] = true
-		case "doc":
-			opts.Conditions["doc"] = true
-		case "archive":
-			opts.Conditions["archive"] = true
-		case "folder":
-			opts.Conditions["dir"] = true
-		case "file":
-			opts.Conditions["dir"] = false
-		}
-		if len(filter) < 8 {
-			continue
-		}
-		if strings.HasPrefix(filter, "largerThan=") {
-			opts.Conditions["larger"] = true
-			size := strings.TrimPrefix(filter, "largerThan=")
-			opts.LargerThan = updateSize(size)
-		}
-		if strings.HasPrefix(filter, "smallerThan=") {
-			opts.Conditions["smaller"] = true
-			size := strings.TrimPrefix(filter, "smallerThan=")
-			opts.SmallerThan = updateSize(size)
-		}
-	}
-
-	if len(types) > 0 {
-		// Remove the fields from the search value
-		value = typeRegexp.ReplaceAllString(value, "")
-	}
-
-	if value == "" {
-		return opts
-	}
-
-	// if the value starts with " and finishes what that character, we will
-	// only search for that term
-	if value[0] == '"' && value[len(value)-1] == '"' {
-		unique := strings.TrimPrefix(value, "\"")
-		unique = strings.TrimSuffix(unique, "\"")
-
-		opts.Terms = []string{unique}
-		return opts
-	}
-	value = strings.TrimSpace(value)
-	opts.Terms = strings.Split(value, "|")
-	return opts
-}
-
-func toInt(str string) int {
-	val, err := strconv.Atoi(str)
-	if err != nil {
-		return 0
-	}
-	return val
-}
-
-func updateSize(given string) int {
-	size := toInt(given)
-	if size == 0 {
-		return 100
-	} else {
-		return size
-	}
-}
-
-func IsMatchingType(extension string, matchType string) bool {
-	mimetype := mime.TypeByExtension(extension)
-	if strings.HasPrefix(mimetype, matchType) {
-		return true
-	}
-	switch matchType {
-	case "doc":
-		return isDoc(extension)
-	case "text":
-		return isText(extension)
-	case "archive":
-		return isArchive(extension)
-	}
-	return false
-}
-
-func isText(extension string) bool {
-	for _, typefile := range textTypes {
-		if extension == typefile {
-			return true
-		}
-	}
-	return false
-}
-
-func isDoc(extension string) bool {
-	for _, typefile := range documentTypes {
-		if extension == typefile {
-			return true
-		}
-	}
-	return false
-}
-
-func isArchive(extension string) bool {
-	for _, typefile := range compressedFile {
-		if extension == typefile {
-			return true
-		}
-	}
-	return false
-}
-
-func isOnlyOffice(name string) bool {
-	extention := filepath.Ext(name)
-	for _, typefile := range onlyOfficeSupported {
-		if extention == typefile {
-			return true
-		}
-	}
-	return false
-}

backend/files/file.go

@@ -1,458 +0,0 @@
-package files
-
-import (
-	"crypto/md5"
-	"crypto/sha1"
-	"crypto/sha256"
-	"crypto/sha512"
-	"encoding/hex"
-	"fmt"
-	"hash"
-	"io"
-	"mime"
-	"net/http"
-
-	"os"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-	"unicode/utf8"
-
-	"github.com/gtsteffaniak/filebrowser/backend/cache"
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
-	"github.com/gtsteffaniak/filebrowser/backend/utils"
-)
-
-var (
-	pathMutexes   = make(map[string]*sync.Mutex)
-	pathMutexesMu sync.Mutex // Mutex to protect the pathMutexes map
-)
-
-type ItemInfo struct {
-	Name    string    `json:"name"`     // name of the file
-	Size    int64     `json:"size"`     // length in bytes for regular files
-	ModTime time.Time `json:"modified"` // modification time
-	Type    string    `json:"type"`     // type of the file, either "directory" or a file mimetype
-	Hidden  bool      `json:"hidden"`   // whether the file is hidden
-}
-
-// FileInfo describes a file.
-// reduced item is non-recursive reduced "Items", used to pass flat items array
-type FileInfo struct {
-	ItemInfo
-	Files   []ItemInfo `json:"files"`   // files in the directory
-	Folders []ItemInfo `json:"folders"` // folders in the directory
-	Path    string     `json:"path"`    // path scoped to the associated index
-}
-
-// for efficiency, a response will be a pointer to the data
-// extra calculated fields can be added here
-type ExtendedFileInfo struct {
-	*FileInfo
-	Content      string            `json:"content,omitempty"`      // text content of a file, if requested
-	Subtitles    []string          `json:"subtitles,omitempty"`    // subtitles for video files
-	Checksums    map[string]string `json:"checksums,omitempty"`    // checksums for the file
-	Token        string            `json:"token,omitempty"`        // token for the file -- used for sharing
-	OnlyOfficeId string            `json:"onlyOfficeId,omitempty"` // id for onlyoffice files
-	Source       string            `json:"source"`                 // associated index source for the file
-	RealPath     string            `json:"-"`
-}
-
-// FileOptions are the options when getting a file info.
-type FileOptions struct {
-	Path       string // realpath
-	Source     string
-	IsDir      bool
-	Modify     bool
-	Expand     bool
-	ReadHeader bool
-	Checker    users.Checker
-	Content    bool
-}
-
-func (f FileOptions) Components() (string, string) {
-	return filepath.Dir(f.Path), filepath.Base(f.Path)
-}
-
-func FileInfoFaster(opts FileOptions) (ExtendedFileInfo, error) {
-	response := ExtendedFileInfo{}
-	if opts.Source == "" {
-		opts.Source = "default"
-	}
-	index := GetIndex(opts.Source)
-	if index == nil {
-		return response, fmt.Errorf("could not get index: %v ", opts.Source)
-	}
-	opts.Path = index.makeIndexPath(opts.Path)
-	// Lock access for the specific path
-	pathMutex := getMutex(opts.Path)
-	pathMutex.Lock()
-	defer pathMutex.Unlock()
-	if !opts.Checker.Check(opts.Path) {
-		return response, os.ErrPermission
-	}
-
-	realPath, isDir, err := index.GetRealPath(opts.Path)
-	if err != nil {
-		return response, err
-	}
-	opts.IsDir = isDir
-	// TODO : whats the best way to save trips to disk here?
-	// disabled using cache because its not clear if this is helping or hurting
-	// check if the file exists in the index
-	//info, exists := index.GetReducedMetadata(opts.Path, opts.IsDir)
-	//if exists {
-	//	err := RefreshFileInfo(opts)
-	//	if err != nil {
-	//		return info, err
-	//	}
-	//	if opts.Content {
-	//		content := ""
-	//		content, err = getContent(opts.Path)
-	//		if err != nil {
-	//			return info, err
-	//		}
-	//		info.Content = content
-	//	}
-	//	return info, nil
-	//}
-
-	err = index.RefreshFileInfo(opts)
-	if err != nil {
-		return response, err
-	}
-	info, exists := index.GetReducedMetadata(opts.Path, opts.IsDir)
-	if !exists {
-		return response, err
-	}
-	if opts.Content {
-		content, err := getContent("default", opts.Path)
-		if err != nil {
-			return response, err
-		}
-		response.Content = content
-	}
-	response.FileInfo = info
-	response.RealPath = realPath
-	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && isOnlyOffice(info.Name) {
-		response.OnlyOfficeId = generateOfficeId(realPath)
-	}
-	return response, nil
-}
-
-func generateOfficeId(realPath string) string {
-	key, ok := cache.OnlyOffice.Get(realPath).(string)
-	if !ok {
-		timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)
-		documentKey := utils.HashSHA256(realPath + timestamp)
-		cache.OnlyOffice.Set(realPath, documentKey)
-		return documentKey
-	}
-	return key
-}
-
-// Checksum checksums a given File for a given User, using a specific
-// algorithm. The checksums data is saved on File object.
-func GetChecksum(fullPath, algo string) (map[string]string, error) {
-	subs := map[string]string{}
-	reader, err := os.Open(fullPath)
-	if err != nil {
-		return subs, err
-	}
-	defer reader.Close()
-
-	hashFuncs := map[string]hash.Hash{
-		"md5":    md5.New(),
-		"sha1":   sha1.New(),
-		"sha256": sha256.New(),
-		"sha512": sha512.New(),
-	}
-
-	h, ok := hashFuncs[algo]
-	if !ok {
-		return subs, errors.ErrInvalidOption
-	}
-
-	_, err = io.Copy(h, reader)
-	if err != nil {
-		return subs, err
-	}
-	subs[algo] = hex.EncodeToString(h.Sum(nil))
-	return subs, nil
-}
-
-func DeleteFiles(source, absPath string, dirPath string) error {
-	err := os.RemoveAll(absPath)
-	if err != nil {
-		return err
-	}
-	index := GetIndex(source)
-	refreshConfig := FileOptions{Path: dirPath, IsDir: true}
-	err = index.RefreshFileInfo(refreshConfig)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func MoveResource(source, realsrc, realdst string, isSrcDir bool) error {
-	err := fileutils.MoveFile(realsrc, realdst)
-	if err != nil {
-		return err
-	}
-	index := GetIndex(source)
-	// refresh info for source and dest
-	err = index.RefreshFileInfo(FileOptions{
-		Path:  realsrc,
-		IsDir: isSrcDir,
-	})
-	if err != nil {
-		return fmt.Errorf("could not refresh index for source: %v", err)
-	}
-	refreshConfig := FileOptions{Path: realdst, IsDir: true}
-	if !isSrcDir {
-		refreshConfig.Path = filepath.Dir(realdst)
-	}
-	err = index.RefreshFileInfo(refreshConfig)
-	if err != nil {
-		return fmt.Errorf("could not refresh index for dest: %v", err)
-	}
-	return nil
-}
-
-func CopyResource(source, realsrc, realdst string, isSrcDir bool) error {
-	err := fileutils.CopyFile(realsrc, realdst)
-	if err != nil {
-		return err
-	}
-	index := GetIndex(source)
-	refreshConfig := FileOptions{Path: realdst, IsDir: true}
-	if !isSrcDir {
-		refreshConfig.Path = filepath.Dir(realdst)
-	}
-	err = index.RefreshFileInfo(refreshConfig)
-	if err != nil {
-		return errors.ErrEmptyKey
-	}
-	return nil
-}
-
-func WriteDirectory(opts FileOptions) error {
-	idx := GetIndex(opts.Source)
-	realPath, _, _ := idx.GetRealPath(opts.Path)
-	// Ensure the parent directories exist
-	err := os.MkdirAll(realPath, 0775)
-	if err != nil {
-		return err
-	}
-	err = idx.RefreshFileInfo(opts)
-	if err != nil {
-		return errors.ErrEmptyKey
-	}
-	return nil
-}
-
-func WriteFile(opts FileOptions, in io.Reader) error {
-	idx := GetIndex(opts.Source)
-	dst, _, _ := idx.GetRealPath(opts.Path)
-	parentDir := filepath.Dir(dst)
-	// Create the directory and all necessary parents
-	err := os.MkdirAll(parentDir, 0775)
-	if err != nil {
-		return err
-	}
-
-	// Open the file for writing (create if it doesn't exist, truncate if it does)
-	file, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0775)
-	if err != nil {
-		return err
-	}
-	defer file.Close()
-
-	// Copy the contents from the reader to the file
-	_, err = io.Copy(file, in)
-	if err != nil {
-		return err
-	}
-	opts.Path = parentDir
-	opts.IsDir = true
-	return idx.RefreshFileInfo(opts)
-}
-
-// resolveSymlinks resolves symlinks in the given path
-func resolveSymlinks(path string) (string, bool, error) {
-	for {
-		// Get the file info using os.Lstat to handle symlinks
-		info, err := os.Lstat(path)
-		if err != nil {
-			return path, false, fmt.Errorf("could not stat path: %s, %v", path, err)
-		}
-
-		// Check if the path is a symlink
-		if info.Mode()&os.ModeSymlink != 0 {
-			// Read the symlink target
-			target, err := os.Readlink(path)
-			if err != nil {
-				return path, false, fmt.Errorf("could not read symlink: %s, %v", path, err)
-			}
-
-			// Resolve the symlink's target relative to its directory
-			// This ensures the resolved path is absolute and correctly calculated
-			path = filepath.Join(filepath.Dir(path), target)
-		} else {
-			// Not a symlink, so return the resolved path and whether it's a directory
-			isDir := info.IsDir()
-			return path, isDir, nil
-		}
-	}
-}
-
-// addContent reads and sets content based on the file type.
-func getContent(source, path string) (string, error) {
-	idx := GetIndex(source)
-	realPath, _, err := idx.GetRealPath(path)
-	if err != nil {
-		return "", err
-	}
-
-	content, err := os.ReadFile(realPath)
-	if err != nil {
-		return "", err
-	}
-	stringContent := string(content)
-	if !utf8.ValidString(stringContent) {
-		return "", nil
-	}
-	if stringContent == "" {
-		return "empty-file-x6OlSil", nil
-	}
-	return stringContent, nil
-}
-
-// DetectType detects the MIME type of a file and updates the ItemInfo struct.
-func (i *ItemInfo) DetectType(realPath string, saveContent bool) {
-	name := i.Name
-	ext := filepath.Ext(name)
-
-	// Attempt MIME detection by file extension
-	i.Type = strings.Split(mime.TypeByExtension(ext), ";")[0]
-	if i.Type == "" {
-		i.Type = extendedMimeTypeCheck(ext)
-	}
-	if i.Type == "blob" {
-		// Read only the first 512 bytes for efficient MIME detection
-		file, err := os.Open(realPath)
-		if err != nil {
-
-		} else {
-			defer file.Close()
-			buffer := make([]byte, 512)
-			n, _ := file.Read(buffer) // Ignore errors from Read
-			i.Type = strings.Split(http.DetectContentType(buffer[:n]), ";")[0]
-		}
-	}
-}
-
-// TODO add subtitles back
-// detectSubtitles detects subtitles for video files.
-//func (i *FileInfo) detectSubtitles(path string) {
-//	if i.Type != "video" {
-//		return
-//	}
-//	parentDir := filepath.Dir(path)
-//	fileName := filepath.Base(path)
-//	i.Subtitles = []string{}
-//	ext := filepath.Ext(fileName)
-//	dir, err := os.Open(parentDir)
-//	if err != nil {
-//		// Directory must have been deleted, remove it from the index
-//		return
-//	}
-//	defer dir.Close() // Ensure directory handle is closed
-//
-//	files, err := dir.Readdir(-1)
-//	if err != nil {
-//		return
-//	}
-//
-//	base := strings.TrimSuffix(fileName, ext)
-//	subtitleExts := []string{".vtt", ".txt", ".srt", ".lrc"}
-//
-//	for _, f := range files {
-//		if f.IsDir() || !strings.HasPrefix(f.Name(), base) {
-//			continue
-//		}
-//
-//		for _, subtitleExt := range subtitleExts {
-//			if strings.HasSuffix(f.Name(), subtitleExt) {
-//				i.Subtitles = append(i.Subtitles, filepath.Join(parentDir, f.Name()))
-//				break
-//			}
-//		}
-//	}
-//}
-
-func IsNamedPipe(mode os.FileMode) bool {
-	return mode&os.ModeNamedPipe != 0
-}
-
-func IsSymlink(mode os.FileMode) bool {
-	return mode&os.ModeSymlink != 0
-}
-
-func getMutex(path string) *sync.Mutex {
-	// Lock access to pathMutexes map
-	pathMutexesMu.Lock()
-	defer pathMutexesMu.Unlock()
-
-	// Create a mutex for the path if it doesn't exist
-	if pathMutexes[path] == nil {
-		pathMutexes[path] = &sync.Mutex{}
-	}
-
-	return pathMutexes[path]
-}
-
-func Exists(path string) bool {
-	_, err := os.Stat(path)
-	if err == nil {
-		return true
-	}
-	if os.IsNotExist(err) {
-		return false
-	}
-	return false
-}
-
-func (info *FileInfo) SortItems() {
-	sort.Slice(info.Folders, func(i, j int) bool {
-		nameWithoutExt := strings.Split(info.Folders[i].Name, ".")[0]
-		nameWithoutExt2 := strings.Split(info.Folders[j].Name, ".")[0]
-		// Convert strings to integers for numeric sorting if both are numeric
-		numI, errI := strconv.Atoi(nameWithoutExt)
-		numJ, errJ := strconv.Atoi(nameWithoutExt2)
-		if errI == nil && errJ == nil {
-			return numI < numJ
-		}
-		// Fallback to case-insensitive lexicographical sorting
-		return strings.ToLower(info.Folders[i].Name) < strings.ToLower(info.Folders[j].Name)
-	})
-	sort.Slice(info.Files, func(i, j int) bool {
-		nameWithoutExt := strings.Split(info.Files[i].Name, ".")[0]
-		nameWithoutExt2 := strings.Split(info.Files[j].Name, ".")[0]
-		// Convert strings to integers for numeric sorting if both are numeric
-		numI, errI := strconv.Atoi(nameWithoutExt)
-		numJ, errJ := strconv.Atoi(nameWithoutExt2)
-		if errI == nil && errJ == nil {
-			return numI < numJ
-		}
-		// Fallback to case-insensitive lexicographical sorting
-		return strings.ToLower(info.Files[i].Name) < strings.ToLower(info.Files[j].Name)
-	})
-}

backend/files/indexingSchedule.go

@@ -1,126 +0,0 @@
-package files
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
-)
-
-// schedule in minutes
-var scanSchedule = []time.Duration{
-	5 * time.Minute, // 5 minute quick scan & 25 minutes for a full scan
-	10 * time.Minute,
-	20 * time.Minute, // [3] element is 20 minutes, reset anchor for full scan
-	40 * time.Minute,
-	1 * time.Hour,
-	2 * time.Hour,
-	3 * time.Hour,
-	4 * time.Hour, // 4 hours for quick scan & 20 hours for a full scan
-}
-
-func (idx *Index) newScanner(origin string) {
-	fullScanAnchor := 3
-	fullScanCounter := 0 // every 5th scan is a full scan
-	for {
-		// Determine sleep time with modifiers
-		fullScanCounter++
-		sleepTime := scanSchedule[idx.currentSchedule] + idx.SmartModifier
-		if idx.assessment == "simple" {
-			sleepTime = scanSchedule[idx.currentSchedule] - idx.SmartModifier
-		}
-		if idx.Source.Config.IndexingInterval > 0 {
-			sleepTime = time.Duration(idx.Source.Config.IndexingInterval) * time.Minute
-		}
-
-		// Log and sleep before indexing
-		logger.Debug(fmt.Sprintf("Next scan in %v", sleepTime))
-		time.Sleep(sleepTime)
-
-		idx.scannerMu.Lock()
-		if fullScanCounter == 5 {
-			idx.RunIndexing(origin, false) // Full scan
-			fullScanCounter = 0
-		} else {
-			idx.RunIndexing(origin, true) // Quick scan
-		}
-		idx.scannerMu.Unlock()
-
-		// Adjust schedule based on file changes
-		if idx.FilesChangedDuringIndexing {
-			// Move to at least the full-scan anchor or reduce interval
-			if idx.currentSchedule > fullScanAnchor {
-				idx.currentSchedule = fullScanAnchor
-			} else if idx.currentSchedule > 0 {
-				idx.currentSchedule--
-			}
-		} else {
-			// Increment toward the longest interval if no changes
-			if idx.currentSchedule < len(scanSchedule)-1 {
-				idx.currentSchedule++
-			}
-		}
-		if idx.assessment == "simple" && idx.currentSchedule > 3 {
-			idx.currentSchedule = 3
-		}
-		// Ensure `currentSchedule` stays within bounds
-		if idx.currentSchedule < 0 {
-			idx.currentSchedule = 0
-		} else if idx.currentSchedule >= len(scanSchedule) {
-			idx.currentSchedule = len(scanSchedule) - 1
-		}
-	}
-}
-
-func (idx *Index) RunIndexing(origin string, quick bool) {
-	prevNumDirs := idx.NumDirs
-	prevNumFiles := idx.NumFiles
-	if quick {
-		logger.Debug("Starting quick scan")
-	} else {
-		logger.Debug("Starting full scan")
-		idx.NumDirs = 0
-		idx.NumFiles = 0
-	}
-	startTime := time.Now()
-	idx.FilesChangedDuringIndexing = false
-	// Perform the indexing operation
-	err := idx.indexDirectory("/", quick, true)
-	if err != nil {
-		logger.Error(fmt.Sprintf("Error during indexing: %v", err))
-	}
-	firstRun := idx.LastIndexed == time.Time{}
-	// Update the LastIndexed time
-	idx.LastIndexed = time.Now()
-	idx.indexingTime = int(time.Since(startTime).Seconds())
-	if !quick {
-		// update smart indexing
-		if idx.indexingTime < 3 || idx.NumDirs < 10000 {
-			idx.assessment = "simple"
-			idx.SmartModifier = 4 * time.Minute
-		} else if idx.indexingTime > 120 || idx.NumDirs > 500000 {
-			idx.assessment = "complex"
-			modifier := idx.indexingTime / 10 // seconds
-			idx.SmartModifier = time.Duration(modifier) * time.Minute
-		} else {
-			idx.assessment = "normal"
-		}
-		if firstRun {
-			logger.Info(fmt.Sprintf("Index assessment         : complexity=%v directories=%v files=%v", idx.assessment, idx.NumDirs, idx.NumFiles))
-		} else {
-			logger.Debug(fmt.Sprintf("Index assessment         : complexity=%v directories=%v files=%v", idx.assessment, idx.NumDirs, idx.NumFiles))
-		}
-		if idx.NumDirs != prevNumDirs || idx.NumFiles != prevNumFiles {
-			idx.FilesChangedDuringIndexing = true
-		}
-	}
-	if firstRun {
-		logger.Info(fmt.Sprintf("Time spent indexing      : %v seconds", idx.indexingTime))
-	} else {
-		logger.Debug(fmt.Sprintf("Time spent indexing      : %v seconds", idx.indexingTime))
-	}
-}
-
-func (idx *Index) setupIndexingScanners() {
-	go idx.newScanner("/")
-}

backend/files/sync.go

@@ -1,75 +0,0 @@
-package files
-
-import (
-	"path/filepath"
-)
-
-// UpdateFileMetadata updates the FileInfo for the specified directory in the index.
-func (idx *Index) UpdateMetadata(info *FileInfo) bool {
-	idx.mu.Lock()
-	defer idx.mu.Unlock()
-	idx.Directories[info.Path] = info
-	return true
-}
-
-// GetMetadataInfo retrieves the FileInfo from the specified directory in the index.
-func (idx *Index) GetReducedMetadata(target string, isDir bool) (*FileInfo, bool) {
-	idx.mu.Lock()
-	defer idx.mu.Unlock()
-	checkDir := idx.makeIndexPath(target)
-	if !isDir {
-		checkDir = idx.makeIndexPath(filepath.Dir(target))
-	}
-	dir, exists := idx.Directories[checkDir]
-	if !exists {
-		return nil, false
-	}
-
-	if isDir {
-		return dir, true
-	}
-	// handle file
-	if checkDir == "/" {
-		checkDir = ""
-	}
-	baseName := filepath.Base(target)
-	for _, item := range dir.Files {
-		if item.Name == baseName {
-			return &FileInfo{
-				Path:     checkDir + "/" + item.Name,
-				ItemInfo: item,
-			}, true
-		}
-	}
-	return nil, false
-
-}
-
-// GetMetadataInfo retrieves the FileInfo from the specified directory in the index.
-func (idx *Index) GetMetadataInfo(target string, isDir bool) (*FileInfo, bool) {
-	idx.mu.RLock()
-	defer idx.mu.RUnlock()
-	checkDir := idx.makeIndexPath(target)
-	if !isDir {
-		checkDir = idx.makeIndexPath(filepath.Dir(target))
-	}
-	dir, exists := idx.Directories[checkDir]
-	return dir, exists
-}
-
-func (idx *Index) RemoveDirectory(path string) {
-	idx.mu.Lock()
-	defer idx.mu.Unlock()
-	idx.NumDeleted++
-	delete(idx.Directories, path)
-}
-
-func GetIndex(name string) *Index {
-	indexesMutex.Lock()
-	defer indexesMutex.Unlock()
-	index, ok := indexes[name]
-	if !ok {
-		return nil
-	}
-	return index
-}

backend/go.mod

@@ -1,48 +1,247 @@
 module github.com/gtsteffaniak/filebrowser/backend
 
-go 1.22.5
+go 1.24.0
 
 require (
 	github.com/asdine/storm/v3 v3.2.1
 	github.com/disintegration/imaging v1.6.2
 	github.com/dsoprea/go-exif/v3 v3.0.1
-	github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568
-	github.com/goccy/go-yaml v1.15.15
-	github.com/golang-jwt/jwt/v4 v4.5.1
-	github.com/google/go-cmp v0.6.0
+	github.com/go-playground/validator/v10 v10.26.0
+	github.com/goccy/go-yaml v1.17.1
+	github.com/golang-jwt/jwt/v4 v4.5.2
+	github.com/google/go-cmp v0.7.0
 	github.com/shirou/gopsutil/v3 v3.24.5
-	github.com/spf13/afero v1.11.0
-	github.com/stretchr/testify v1.9.0
+	github.com/spf13/afero v1.14.0
+	github.com/stretchr/testify v1.10.0
 	github.com/swaggo/http-swagger v1.3.4
 	github.com/swaggo/swag v1.16.4
-	golang.org/x/crypto v0.32.0
-	golang.org/x/image v0.23.0
-	golang.org/x/sys v0.29.0
-	golang.org/x/text v0.21.0
+	golang.org/x/crypto v0.38.0
+	golang.org/x/image v0.27.0
+	golang.org/x/sys v0.33.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
+	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
+	4d63.com/gochecknoglobals v0.2.2 // indirect
+	github.com/4meepo/tagalign v1.4.2 // indirect
+	github.com/Abirdcfly/dupword v0.1.3 // indirect
+	github.com/Antonboom/errname v1.0.0 // indirect
+	github.com/Antonboom/nilnil v1.0.1 // indirect
+	github.com/Antonboom/testifylint v1.5.2 // indirect
+	github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect
+	github.com/Crocmagnon/fatcontext v0.7.1 // indirect
+	github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
+	github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 // indirect
 	github.com/KyleBanks/depth v1.2.1 // indirect
+	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
+	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
+	github.com/alexkohler/nakedret/v2 v2.0.5 // indirect
+	github.com/alexkohler/prealloc v1.0.0 // indirect
+	github.com/alingse/asasalint v0.0.11 // indirect
+	github.com/alingse/nilnesserr v0.1.2 // indirect
+	github.com/ashanbrown/forbidigo v1.6.0 // indirect
+	github.com/ashanbrown/makezero v1.2.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bkielbasa/cyclop v1.2.3 // indirect
+	github.com/blizzy78/varnamelen v0.8.0 // indirect
+	github.com/bombsimon/wsl/v4 v4.5.0 // indirect
+	github.com/breml/bidichk v0.3.2 // indirect
+	github.com/breml/errchkjson v0.4.0 // indirect
+	github.com/butuzov/ireturn v0.3.1 // indirect
+	github.com/butuzov/mirror v1.3.0 // indirect
+	github.com/catenacyber/perfsprint v0.8.2 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.2 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/charithe/durationcheck v0.0.10 // indirect
+	github.com/chavacava/garif v0.1.0 // indirect
+	github.com/ckaznocha/intrange v0.3.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/curioswitch/go-reassign v0.3.0 // indirect
+	github.com/daixiang0/gci v0.13.5 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
+	github.com/denis-tingaikin/go-header v0.5.0 // indirect
 	github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
 	github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 // indirect
+	github.com/ettle/strcase v0.2.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/fatih/structtag v1.2.0 // indirect
+	github.com/firefart/nonamedreturns v1.0.5 // indirect
+	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/fzipp/gocyclo v0.6.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
+	github.com/ghostiam/protogetter v0.3.9 // indirect
+	github.com/go-critic/go-critic v0.12.0 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/spec v0.21.0 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/golang/geo v0.0.0-20230421003525-6adc56603217 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-toolsmith/astcast v1.1.0 // indirect
+	github.com/go-toolsmith/astcopy v1.1.0 // indirect
+	github.com/go-toolsmith/astequal v1.2.0 // indirect
+	github.com/go-toolsmith/astfmt v1.1.0 // indirect
+	github.com/go-toolsmith/astp v1.1.0 // indirect
+	github.com/go-toolsmith/strparse v1.1.0 // indirect
+	github.com/go-toolsmith/typep v1.1.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/goccy/go-json v0.10.3 // indirect
+	github.com/gofrs/flock v0.12.1 // indirect
+	github.com/golang/geo v0.0.0-20250505201543-5b58c72585db // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
+	github.com/golangci/go-printf-func-name v0.1.0 // indirect
+	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
+	github.com/golangci/golangci-lint v1.64.8 // indirect
+	github.com/golangci/misspell v0.6.0 // indirect
+	github.com/golangci/plugin-module-register v0.1.1 // indirect
+	github.com/golangci/revgrep v0.8.0 // indirect
+	github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed // indirect
+	github.com/gordonklaus/ineffassign v0.1.0 // indirect
+	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
+	github.com/gostaticanalysis/comment v1.5.0 // indirect
+	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
+	github.com/gostaticanalysis/nilerr v0.1.1 // indirect
+	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
+	github.com/hashicorp/go-version v1.7.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hexops/gotextdiff v1.0.3 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jgautheron/goconst v1.7.1 // indirect
+	github.com/jingyugao/rowserrcheck v1.1.1 // indirect
+	github.com/jjti/go-spancheck v0.6.4 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/julz/importas v0.2.0 // indirect
+	github.com/karamaru-alpha/copyloopvar v1.2.1 // indirect
+	github.com/kisielk/errcheck v1.9.0 // indirect
+	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
+	github.com/kulti/thelper v0.6.3 // indirect
+	github.com/kunwardeep/paralleltest v1.0.10 // indirect
+	github.com/lasiar/canonicalheader v1.1.2 // indirect
+	github.com/ldez/exptostd v0.4.2 // indirect
+	github.com/ldez/gomoddirectives v0.6.1 // indirect
+	github.com/ldez/grignotin v0.9.0 // indirect
+	github.com/ldez/tagliatelle v0.7.1 // indirect
+	github.com/ldez/usetesting v0.4.2 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/leonklingele/grouper v1.1.2 // indirect
+	github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.3 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/httprc/v3 v3.0.0-beta2 // indirect
+	github.com/lestrrat-go/iter v1.0.2 // indirect
+	github.com/lestrrat-go/jwx v1.2.31 // indirect
+	github.com/lestrrat-go/jwx/v3 v3.0.1 // indirect
+	github.com/lestrrat-go/option v1.0.1 // indirect
+	github.com/macabu/inamedparam v0.1.3 // indirect
+	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/maratori/testableexamples v1.0.0 // indirect
+	github.com/maratori/testpackage v1.1.1 // indirect
+	github.com/matoous/godox v1.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/mgechev/revive v1.7.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/moricho/tparallel v0.3.2 // indirect
+	github.com/nakabonne/nestif v0.3.1 // indirect
+	github.com/nishanths/exhaustive v0.12.0 // indirect
+	github.com/nishanths/predeclared v0.2.2 // indirect
+	github.com/nunnatsa/ginkgolinter v0.19.1 // indirect
+	github.com/olekukonko/tablewriter v0.0.5 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/polyfloyd/go-errorlint v1.7.1 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/prometheus/client_golang v1.12.1 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.32.1 // indirect
+	github.com/prometheus/procfs v0.7.3 // indirect
+	github.com/quasilyte/go-ruleguard v0.4.3-0.20240823090925-0fe6f58b47b1 // indirect
+	github.com/quasilyte/go-ruleguard/dsl v0.3.22 // indirect
+	github.com/quasilyte/gogrep v0.5.0 // indirect
+	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
+	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
+	github.com/raeperd/recvcheck v0.2.0 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/ryancurrah/gomodguard v1.3.5 // indirect
+	github.com/ryanrolds/sqlclosecheck v0.5.1 // indirect
+	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
+	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
+	github.com/sashamelentyev/usestdlibvars v1.28.0 // indirect
+	github.com/securego/gosec/v2 v2.22.2 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/sivchari/containedctx v1.0.3 // indirect
+	github.com/sivchari/tenv v1.12.1 // indirect
+	github.com/sonatard/noctx v0.1.0 // indirect
+	github.com/sourcegraph/go-diff v0.7.0 // indirect
+	github.com/spf13/cast v1.5.0 // indirect
+	github.com/spf13/cobra v1.9.1 // indirect
+	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/viper v1.12.0 // indirect
+	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
+	github.com/stbenjam/no-sprintf-host-port v0.2.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/swaggo/files v1.0.1 // indirect
+	github.com/tdakkota/asciicheck v0.4.1 // indirect
+	github.com/tetafro/godot v1.5.0 // indirect
+	github.com/timakin/bodyclose v0.0.0-20241017074812-ed6a65f985e3 // indirect
+	github.com/timonwong/loggercheck v0.10.1 // indirect
+	github.com/tomarrell/wrapcheck/v2 v2.10.0 // indirect
+	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
+	github.com/ultraware/funlen v0.2.0 // indirect
+	github.com/ultraware/whitespace v0.2.0 // indirect
+	github.com/urfave/cli/v2 v2.3.0 // indirect
+	github.com/uudashr/gocognit v1.2.0 // indirect
+	github.com/uudashr/iface v1.3.1 // indirect
+	github.com/xen0n/gosmopolitan v1.2.2 // indirect
+	github.com/yagipy/maintidx v1.0.0 // indirect
+	github.com/yeya24/promlinter v0.3.0 // indirect
+	github.com/ykadowak/zerologlint v0.1.5 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	go.etcd.io/bbolt v1.3.11 // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/tools v0.29.0 // indirect
+	gitlab.com/bosi/decorder v0.4.2 // indirect
+	go-simpler.org/musttag v0.13.0 // indirect
+	go-simpler.org/sloglint v0.9.0 // indirect
+	go.etcd.io/bbolt v1.4.0 // indirect
+	go.uber.org/atomic v1.7.0 // indirect
+	go.uber.org/automaxprocs v1.6.0 // indirect
+	go.uber.org/multierr v1.6.0 // indirect
+	go.uber.org/zap v1.24.0 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/net v0.40.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/tools v0.33.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	honnef.co/go/tools v0.6.1 // indirect
+	mvdan.cc/gofumpt v0.7.0 // indirect
+	mvdan.cc/unparam v0.0.0-20240528143540-8a5130ca722f // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
+)
+
+tool (
+	github.com/golangci/golangci-lint/cmd/golangci-lint
+	github.com/swaggo/swag/cmd/swag
 )

backend/http/api.go

@@ -7,34 +7,49 @@ import (
 	"strings"
 	"time"
 
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
+// createApiKeyHandler creates an API key for the user.
+// @Summary Create API key
+// @Description Create an API key with specified name, duration, and permissions.
+// @Tags API Keys
+// @Accept json
+// @Produce json
+// @Param name query string true "Name of the API key"
+// @Param days query string true "Duration of the API key in days"
+// @Param permissions query string true "Permissions for the API key (comma-separated)"
+// @Success 200 {object} HttpResponse "Token created successfully, resoponse contains json object with token key"
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 404 {object} map[string]string "Not found"
+// @Failure 409 {object} map[string]string "Conflict"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/createApiKey [post]
 func createApiKeyHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	name := r.URL.Query().Get("name")
 	durationStr := r.URL.Query().Get("days")
 	permissionsStr := r.URL.Query().Get("permissions")
 
+	if !d.user.Permissions.Api {
+		return http.StatusForbidden, fmt.Errorf("user does not have permission to create api keys")
+	}
+
 	if name == "" {
-		return http.StatusInternalServerError, fmt.Errorf("api name must be valid")
+		return http.StatusBadRequest, fmt.Errorf("api name must be valid")
 	}
 	if durationStr == "" {
-		return http.StatusInternalServerError, fmt.Errorf("api duration must be valid")
+		return http.StatusBadRequest, fmt.Errorf("api duration must be valid")
 	}
 	if permissionsStr == "" {
-		return http.StatusInternalServerError, fmt.Errorf("api permissions must be valid")
+		return http.StatusBadRequest, fmt.Errorf("api permissions must be valid")
 	}
 	// Parse permissions from the query parameter
 	permissions := users.Permissions{
-		Api:      strings.Contains(permissionsStr, "api") && d.user.Perm.Api,
-		Admin:    strings.Contains(permissionsStr, "admin") && d.user.Perm.Admin,
-		Execute:  strings.Contains(permissionsStr, "execute") && d.user.Perm.Execute,
-		Create:   strings.Contains(permissionsStr, "create") && d.user.Perm.Create,
-		Rename:   strings.Contains(permissionsStr, "rename") && d.user.Perm.Rename,
-		Modify:   strings.Contains(permissionsStr, "modify") && d.user.Perm.Modify,
-		Delete:   strings.Contains(permissionsStr, "delete") && d.user.Perm.Delete,
-		Share:    strings.Contains(permissionsStr, "share") && d.user.Perm.Share,
-		Download: strings.Contains(permissionsStr, "download") && d.user.Perm.Download,
+		Api:    strings.Contains(permissionsStr, "api") && d.user.Permissions.Api,
+		Admin:  strings.Contains(permissionsStr, "admin") && d.user.Permissions.Admin,
+		Modify: strings.Contains(permissionsStr, "modify") && d.user.Permissions.Modify,
+		Share:  strings.Contains(permissionsStr, "share") && d.user.Permissions.Share,
 	}
 
 	// Convert the duration string to an int64
@@ -45,7 +60,6 @@ func createApiKeyHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 
 	// Here we assume the duration is in seconds; convert to time.Duration
 	duration := time.Duration(durationInt) * time.Hour * 24
-
 	// get request body like:
 	token, err := makeSignedTokenAPI(d.user, name, duration, permissions)
 	if err != nil {
@@ -61,8 +75,22 @@ func createApiKeyHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 	return renderJSON(w, r, response)
 }
 
+// deleteApiKeyHandler deletes an API key for the user.
+// @Summary Delete API key
+// @Description Delete an API key with specified name.
+// @Tags API Keys
+// @Accept json
+// @Produce json
+// @Param name query string true "Name of the API key to delete"
+// @Success 200 {object} HttpResponse "API key deleted successfully"
+// @Failure 404 {object} map[string]string "Not found"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/deleteApiKey [delete]
 func deleteApiKeyHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	name := r.URL.Query().Get("name")
+	if !d.user.Permissions.Api {
+		return http.StatusForbidden, fmt.Errorf("user does not have permission to delete api keys")
+	}
 
 	keyInfo, ok := d.user.ApiKeys[name]
 	if !ok {
@@ -74,7 +102,7 @@ func deleteApiKeyHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		return http.StatusNotFound, err
 	}
 
-	revokeAPIKey(keyInfo.Key) // add to blacklist
+	auth.RevokeAPIKey(keyInfo.Key) // add to blacklist
 	response := HttpResponse{
 		Message: "successfully deleted api key from user",
 	}
@@ -89,8 +117,22 @@ type AuthTokenMin struct {
 	Permissions users.Permissions `json:"Permissions"`
 }
 
+// listApiKeysHandler lists all API keys or retrieves details for a specific key.
+// @Summary List API keys
+// @Description List all API keys or retrieve details for a specific key.
+// @Tags API Keys
+// @Accept json
+// @Produce json
+// @Param name query string false "Name of the API to retrieve details"
+// @Success 200 {object} AuthTokenMin "List of API keys or specific key details"
+// @Failure 404 {object} map[string]string "Not found"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/listApiKeys [get]
 func listApiKeysHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	key := r.URL.Query().Get("key")
+	key := r.URL.Query().Get("name")
+	if !d.user.Permissions.Api {
+		return http.StatusForbidden, fmt.Errorf("user does not have permission to list api keys")
+	}
 
 	if key != "" {
 		keyInfo, ok := d.user.ApiKeys[key]

backend/http/auth.go

@@ -4,29 +4,25 @@ import (
 	"encoding/json"
 	libError "errors"
 	"fmt"
+	"io"
 	"net/http"
 	"net/url"
-	"os"
 	"strings"
-	"sync"
 	"time"
 
-	"github.com/golang-jwt/jwt/v4"
+	jwt "github.com/golang-jwt/jwt/v4"
 	"github.com/golang-jwt/jwt/v4/request"
+	"github.com/lestrrat-go/jwx/v3/jwk"
 	"golang.org/x/crypto/bcrypt"
 
-	"github.com/gtsteffaniak/filebrowser/backend/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/files"
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/share"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
-	"github.com/gtsteffaniak/filebrowser/backend/utils"
-)
-
-var (
-	revokedApiKeyList map[string]bool
-	revokeMu          sync.Mutex
+	"github.com/gtsteffaniak/filebrowser/backend/common/cache"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // first checks for cookie
@@ -74,22 +70,105 @@ func extractToken(r *http.Request) (string, error) {
 	return "", request.ErrNoTokenInRequest
 }
 
+func setupProxyUser(r *http.Request, data *requestContext, proxyUser string) (*users.User, error) {
+	var err error
+	// Retrieve the user from the store and store it in the context
+	data.user, err = store.Users.Get(proxyUser)
+	if err != nil {
+		if err.Error() != "the resource does not exist" {
+			return nil, err
+		}
+		if config.Auth.Methods.ProxyAuth.CreateUser {
+			hashpass, err := users.HashPwd(proxyUser)
+			if err != nil {
+				return nil, err
+			}
+			err = storage.CreateUser(users.User{
+				LoginMethod: users.LoginMethodProxy,
+				Username:    proxyUser,
+				NonAdminEditable: users.NonAdminEditable{
+					Password: hashpass, // hashed password that can't actually be used
+				},
+			}, false)
+			if err != nil {
+				return nil, err
+			}
+			data.user, err = store.Users.Get(proxyUser)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			return nil, fmt.Errorf("proxy authentication failed - no user found")
+		}
+	}
+	if data.user.LoginMethod != users.LoginMethodProxy {
+		logger.Warning(fmt.Sprintf("user %s is not allowed to login with proxy authentication, bypassing and updating login method", data.user.Username))
+		data.user.LoginMethod = users.LoginMethodProxy
+		// Perform the user update
+		err := store.Users.Update(data.user, true, "LoginMethod")
+		if err != nil {
+			logger.Debug(err.Error())
+		}
+		//return nil, fmt.Errorf("user %s is not allowed to login with proxy authentication", proxyUser)
+	}
+	return data.user, nil
+}
+
+// loginHandler handles user authentication via password.
+// @Summary User login
+// @Description Authenticate a user with a username and password.
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Success 200 {string} string "JWT token for authentication"
+// @Failure 403 {object} map[string]string "Forbidden - authentication failed"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/login [post]
 func loginHandler(w http.ResponseWriter, r *http.Request) {
+	proxyUser := r.Header.Get(config.Auth.Methods.ProxyAuth.Header)
+	if config.Auth.Methods.ProxyAuth.Enabled && proxyUser != "" {
+		user, err := setupProxyUser(r, &requestContext{}, proxyUser)
+		if err != nil {
+			http.Error(w, err.Error(), 403)
+			return
+		}
+		status, err := printToken(w, r, user) // Pass the data object
+		if err != nil {
+			http.Error(w, http.StatusText(status), status)
+		}
+		return
+	}
+	if !config.Auth.Methods.PasswordAuth.Enabled {
+		http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+		return
+	}
+	// currently only supports user/pass
 	// Get the authentication method from the settings
-	auther, err := store.Auth.Get(config.Auth.Method)
+	auther, err := store.Auth.Get("password")
 	if err != nil {
 		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
 		return
 	}
+
 	// Authenticate the user based on the request
 	user, err := auther.Auth(r, store.Users)
-	if err == os.ErrPermission {
+	if err != nil {
+		logger.Debug(err.Error())
 		http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
 		return
-	} else if err != nil {
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
 	}
+	if user.LoginMethod != users.LoginMethodPassword {
+		logger.Warning(fmt.Sprintf("user %s is not allowed to login with password authentication, bypassing and updating login method", user.Username))
+		user.LoginMethod = users.LoginMethodPassword
+		// Perform the user update
+		err = store.Users.Update(user, true, "LoginMethod")
+		if err != nil {
+			logger.Debug(err.Error())
+		}
+		//http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+		//return
+	}
+
 	status, err := printToken(w, r, user) // Pass the data object
 	if err != nil {
 		http.Error(w, http.StatusText(status), status)
@@ -101,8 +180,21 @@ type signupBody struct {
 	Password string `json:"password"`
 }
 
+// signupHandler registers a new user account.
+// @Summary User signup
+// @Description Register a new user account with a username and password.
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Param body body signupBody true "User signup details"
+// @Success 201 {string} string "User created successfully"
+// @Failure 400 {object} map[string]string "Bad request - invalid input"
+// @Failure 405 {object} map[string]string "Method not allowed - signup is disabled"
+// @Failure 409 {object} map[string]string "Conflict - user already exists"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/signup [post]
 func signupHandler(w http.ResponseWriter, r *http.Request) {
-	if !settings.Config.Auth.Signup {
+	if !settings.Config.Auth.Methods.PasswordAuth.Signup {
 		http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)
 		return
 	}
@@ -123,20 +215,12 @@ func signupHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
 		return
 	}
-
-	user := settings.ApplyUserDefaults(users.User{})
+	user := &users.User{}
+	settings.ApplyUserDefaults(user)
 	user.Username = info.Username
 	user.Password = info.Password
 
-	userHome, err := config.MakeUserDir(user.Username, user.Scope, files.RootPaths["default"])
-	if err != nil {
-		logger.Error(fmt.Sprintf("create user: failed to mkdir user home dir: [%s]", userHome))
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
-	}
-	user.Scope = userHome
-	logger.Debug(fmt.Sprintf("new user: %s, home dir: [%s].", user.Username, userHome))
-	err = store.Users.Save(&user)
+	err = store.Users.Save(user, true)
 	if err == errors.ErrExist {
 		http.Error(w, http.StatusText(http.StatusConflict), http.StatusConflict)
 		return
@@ -146,14 +230,23 @@ func signupHandler(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// renewHandler refreshes the authentication token for a logged-in user.
+// @Summary Renew authentication token
+// @Description Refresh the authentication token for a logged-in user.
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Success 200 {string} string "New JWT token generated"
+// @Failure 401 {object} map[string]string "Unauthorized - invalid token"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/renew [post]
 func renewHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	// check if x-auth header is present and token is
 	return printToken(w, r, d.user)
 }
 
 func printToken(w http.ResponseWriter, _ *http.Request, user *users.User) (int, error) {
-
-	signed, err := makeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), time.Hour*time.Duration(config.Auth.TokenExpirationHours), user.Perm)
+	signed, err := makeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), time.Hour*time.Duration(config.Auth.TokenExpirationHours), user.Permissions)
 	if err != nil {
 		if strings.Contains(err.Error(), "key already exists with same name") {
 			return http.StatusConflict, err
@@ -167,17 +260,6 @@ func printToken(w http.ResponseWriter, _ *http.Request, user *users.User) (int,
 	return 0, nil
 }
 
-func isRevokedApiKey(key string) bool {
-	_, exists := revokedApiKeyList[key]
-	return exists
-}
-
-func revokeAPIKey(key string) {
-	revokeMu.Lock()
-	delete(revokedApiKeyList, key)
-	revokeMu.Unlock()
-}
-
 func makeSignedTokenAPI(user *users.User, name string, duration time.Duration, perms users.Permissions) (users.AuthToken, error) {
 	_, ok := user.ApiKeys[name]
 	if ok {
@@ -198,7 +280,7 @@ func makeSignedTokenAPI(user *users.User, name string, duration time.Duration, p
 		},
 	}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claim)
-	tokenString, err := token.SignedString(config.Auth.Key)
+	tokenString, err := token.SignedString([]byte(config.Auth.Key))
 	if err != nil {
 		return claim, err
 	}
@@ -240,3 +322,347 @@ func authenticateShareRequest(r *http.Request, l *share.Link) (int, error) {
 	}
 	return 200, nil
 }
+
+// userInfo struct to hold user claims from either UserInfo or ID token
+type userInfo struct {
+	Name              string `json:"name"`
+	PreferredUsername string `json:"preferred_username"`
+	Email             string `json:"email"`
+	Sub               string `json:"sub"`
+	Phone             string `json:"phone_number"`
+}
+
+// getKeySet fetches the JWKS from the given URL, using the provided cache.
+func getKeySet(jwksUrl string) (jwk.Set, error) {
+	// Check cache first
+	value := cache.JwtCache.Get(jwksUrl)
+	jwks, ok := value.(jwk.Set)
+	if ok {
+		return jwks, nil
+	}
+	logger.Debug("JWKS not found in cache for, fetching...")
+	// Fetch the JWKS from the URL
+	resp, err := http.Get(jwksUrl)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch JWKS from %s: %v", jwksUrl, err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		bodyBytes, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("failed to fetch JWKS from %s: received status code %d with body: %s", jwksUrl, resp.StatusCode, string(bodyBytes))
+	}
+
+	// Decode the JWKS using jwk.ParseReader
+	jwks, err = jwk.ParseReader(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode JWKS: %v", err)
+	}
+
+	// Store in cache. Assuming your cache handles expiration (e.g., 1 hour).
+	cache.JwtCache.Set(jwksUrl, jwks) // Store the jwk.Set
+	return jwks, nil                  // Return the jwk.Set after type assertion
+}
+
+// oidcCallbackHandler handles the OIDC callback after the user authenticates with the provider.
+// It exchanges the authorization code for tokens, then attempts to verify the ID token using JWKS
+// if configured, falling back to the UserInfo endpoint if necessary.
+func oidcCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	code := r.URL.Query().Get("code")
+	// state := r.URL.Query().Get("state") // You might want to validate the state parameter for CSRF protection
+
+	origin := r.Header.Get("Origin")
+	if origin == "" {
+		origin = fmt.Sprintf("%s://%s", getScheme(r), r.Host)
+	}
+
+	redirectURI := fmt.Sprintf("%s/api/auth/oidc/callback", origin)
+
+	// Step 1: Exchange the code for tokens
+	data := url.Values{}
+	data.Set("grant_type", "authorization_code")
+	data.Set("code", code)
+	data.Set("client_id", config.Auth.Methods.OidcAuth.ClientID)
+	data.Set("client_secret", config.Auth.Methods.OidcAuth.ClientSecret)
+	data.Set("redirect_uri", redirectURI)
+
+	req, _ := http.NewRequest("POST", config.Auth.Methods.OidcAuth.TokenUrl, strings.NewReader(data.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	client := &http.Client{} // Consider using a client with a timeout
+	resp, err := client.Do(req)
+	if err != nil {
+		logger.Debug(fmt.Sprintf("failed to send token request: %v", err))
+		return 500, fmt.Errorf("token request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		logger.Debug(fmt.Sprintf("failed to fetch token: %v %v", resp.StatusCode, string(body)))
+		return 500, fmt.Errorf("failed to fetch token: %v %v", resp.StatusCode, string(body))
+	}
+
+	// Decode the token response, expecting access_token and potentially id_token
+	var tokenResp struct {
+		AccessToken string `json:"access_token"`
+		IDToken     string `json:"id_token"` // OIDC providers include id_token here
+	}
+
+	if err = json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
+		logger.Debug(fmt.Sprintf("failed to parse token response: %v", err))
+		return 500, fmt.Errorf("failed to parse token response: %v", err)
+	}
+
+	var userdata userInfo       // This will hold the user claims, using the original struct
+	useUserInfoEndpoint := true // Flag to determine if we need to call the UserInfo endpoint
+
+	// Step 2: Process ID Token if available and JWKS URL is configured
+	if tokenResp.IDToken != "" && config.Auth.Methods.OidcAuth.JwksUrl != "" {
+		logger.Debug(fmt.Sprintf("ID token received `%v` attempting to verify using JWKS URL", tokenResp.IDToken))
+		// getKeySet now returns jwk.Set (interface)
+		var jwks jwk.Set
+		jwks, err = getKeySet(config.Auth.Methods.OidcAuth.JwksUrl)
+		if err != nil {
+			// Log the error but don't fail yet, try UserInfo endpoint as a fallback
+			logger.Warning("Failed to fetch or decode JWKS: %v. Falling back to UserInfo endpoint. Ensure your OidcAuth.JwksUrl is correct.")
+		} else {
+			var token *jwt.Token
+			// Parse the ID token. We need to provide a key function to `jwt.Parse`
+			// that looks up the key in the JWKS based on the token's `kid`.
+			token, err = jwt.Parse(tokenResp.IDToken, func(token *jwt.Token) (interface{}, error) {
+				switch alg := token.Method.Alg(); alg {
+				case "RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512", "EdDSA":
+					// accepted
+				default:
+					logger.Debug(fmt.Sprintf("unsupported signing method recieved `%v`", alg))
+					return nil, fmt.Errorf("unsupported signing method recieved: %v", alg)
+				}
+				// Find the key in the JWKS that matches the token's kid (Key ID)
+				keyID, ok := token.Header["kid"].(string)
+				if !ok {
+					logger.Debug("kid header not found in ID token")
+					return nil, fmt.Errorf("kid header not found in ID token")
+				}
+				// Use the jwk.Set interface to find the key
+				// LookupKeyID returns a slice of jwk.Key and a boolean indicating if any keys were found.
+				key, found := jwks.LookupKeyID(keyID) // Called on the jwk.Set interface
+				if !found {
+					logger.Debug(fmt.Sprintf("key with kid %s not found in JWKS", keyID))
+					return nil, fmt.Errorf("key with kid %s not found in JWKS", keyID)
+				}
+				// Return the public key from the first matching JWK
+				// In a real scenario, you might need more sophisticated key selection logic.
+				// The jwk.Key interface has a PublicKey() method to get the public key.
+				publicKey, publicKeyErr := key.PublicKey()
+				if publicKeyErr != nil {
+					logger.Debug(fmt.Sprintf("failed to get public key from JWK: %v", publicKeyErr))
+					return nil, fmt.Errorf("failed to get public key from JWK: %v", err)
+				}
+				return publicKey, nil
+			})
+
+			if err != nil {
+				// Log the verification error but fall back to UserInfo endpoint
+				logger.Error(fmt.Sprintf("failed to parse or verify ID token: %v. Falling back to UserInfo endpoint.", err))
+			} else if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
+				logger.Debug("ID token verified successfully, claims extracted.")
+
+				// --- IMPORTANT OIDC VALIDATION ---
+				// In a production application, you MUST perform additional validations on the ID token claims:
+				// - Issuer (iss): Must match the expected issuer URL.
+				// - Audience (aud): Must contain your client ID.
+				// - Expiration Time (exp): Token must not be expired (jwt.Parse handles this if clock skew is accounted for).
+				// - Issued At Time (iat): Token must not be issued in the future.
+				// - Nonce (nonce): If a nonce was sent in the authorization request, it must match the 'nonce' claim in the ID token.
+				// - Authorized Party (azp): If 'aud' has multiple values, 'azp' must be present and equal to your client ID.
+				// - at_hash and c_hash: If the access token or authorization code were issued, validate their hashes if present in the ID token.
+				// A dedicated OIDC library handles these validations correctly and securely.
+				// This simplified example only verifies the signature and basic validity.
+				// --- END IMPORTANT OIDC VALIDATION ---
+
+				// Populate the userInfo struct from the ID token claims (map)
+				if name, ok := claims["name"].(string); ok {
+					userdata.Name = name
+				}
+				if preferredUsername, ok := claims["preferred_username"].(string); ok {
+					userdata.PreferredUsername = preferredUsername
+				}
+				if email, ok := claims["email"].(string); ok {
+					userdata.Email = email
+				}
+				if sub, ok := claims["sub"].(string); ok {
+					userdata.Sub = sub
+				}
+				if phone, ok := claims["phone_number"].(string); ok {
+					userdata.Phone = phone
+				}
+
+				useUserInfoEndpoint = false // Successfully processed ID token, no need for UserInfo endpoint
+
+			} else {
+				// ID token signature verification failed or token is invalid for other reasons
+				logger.Error("id token signature verification failed or token is invalid. Falling back to UserInfo endpoint.")
+			}
+		}
+	}
+
+	// Step 3: Use the access token to fetch user info from the UserInfo URL if needed
+	// This step is skipped if the ID token was successfully processed and verified.
+	if useUserInfoEndpoint {
+		userInfoURL := config.Auth.Methods.OidcAuth.UserInfoUrl
+		req, _ = http.NewRequest("GET", userInfoURL, nil)
+		req.Header.Set("Authorization", "Bearer "+tokenResp.AccessToken)
+
+		resp, err = client.Do(req)
+		if err != nil {
+			return 500, fmt.Errorf("failed to fetch user info: %v", err)
+		}
+		defer resp.Body.Close()
+
+		if resp.StatusCode != http.StatusOK {
+			bodyBytes, _ := io.ReadAll(resp.Body)
+			return 500, fmt.Errorf("failed to fetch user info: received status code %d with body: %s", resp.StatusCode, string(bodyBytes))
+		}
+
+		// Decode the UserInfo response directly into the original userdata struct
+		if err = json.NewDecoder(resp.Body).Decode(&userdata); err != nil {
+			return 500, fmt.Errorf("failed to parse user info: %v", err)
+		}
+	}
+
+	// Now userdata contains claims from either the verified ID token or the UserInfo endpoint.
+	// Proceed with logging in the user based on the extracted claims.
+	return loginWithOidcUser(w, r, userdata)
+}
+
+// oidcLoginHandler redirects the user to the OIDC provider's authorization endpoint.
+// This function remains largely the same, but includes the 'fb_redirect' parameter
+// to redirect the user back to the original page after successful login.
+func oidcLoginHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if config.Auth.Methods.OidcAuth.Enabled {
+		origin := r.Header.Get("Origin")
+		if origin == "" {
+			origin = fmt.Sprintf("%s://%s", getScheme(r), r.Host)
+		}
+
+		// Generate a nonce for CSRF protection (optional but recommended)
+		// You should store this nonce and validate it in the callback handler.
+		nonce := utils.InsecureRandomIdentifier(16)
+		// For state parameter, you might include the nonce and the original redirect URL
+		state := fmt.Sprintf("%s:%s", nonce, r.URL.Query().Get("fb_redirect")) // Example state parameter structure
+
+		redirectURI := fmt.Sprintf("%s/api/auth/oidc/callback", origin)
+
+		// Construct the authorization URL
+		authURL := fmt.Sprintf("%s?client_id=%s&response_type=code&scope=%s&redirect_uri=%s&redirect_uris=%s&state=%s",
+			config.Auth.Methods.OidcAuth.AuthorizationUrl,
+			url.QueryEscape(config.Auth.Methods.OidcAuth.ClientID),
+			url.QueryEscape(config.Auth.Methods.OidcAuth.Scopes),
+			url.QueryEscape(redirectURI),
+			url.QueryEscape(redirectURI),
+			url.QueryEscape(state), // Use the state parameter
+		)
+
+		// Redirect the user to the OIDC provider
+		http.Redirect(w, r, authURL, http.StatusFound)
+		return 0, nil // Indicate that the request has been handled by the redirect
+	}
+
+	// OIDC authentication is not enabled
+	return http.StatusForbidden, fmt.Errorf("oidc authentication is not enabled")
+}
+
+// loginWithOidcUser extracts the username from the user claims (userInfo)
+// based on the configured UserIdentifier and logs the user into the application.
+// It creates a new user if one doesn't exist.
+func loginWithOidcUser(w http.ResponseWriter, r *http.Request, userInfo userInfo) (int, error) {
+	username := userInfo.PreferredUsername
+	switch config.Auth.Methods.OidcAuth.UserIdentifier {
+	case "email":
+		username = userInfo.Email
+	case "username":
+		username = userInfo.PreferredUsername
+	}
+	// Retrieve the user from the store and store it in the context
+	user, err := store.Users.Get(username)
+	if err != nil {
+		if err.Error() != "the resource does not exist" {
+			return http.StatusInternalServerError, err
+		}
+		hashpass := ""
+		hashpass, err = users.HashPwd(username) // hashed password that can't actually be used, gets double hashed
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+		err = storage.CreateUser(users.User{
+			LoginMethod: users.LoginMethodOidc,
+			Username:    username,
+			NonAdminEditable: users.NonAdminEditable{
+				Password: hashpass, // hashed password that can't actually be used
+			},
+		}, false)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+		user, err = store.Users.Get(username)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+	}
+	if user.LoginMethod != users.LoginMethodOidc {
+		logger.Warning(fmt.Sprintf("user %s is not allowed to login with oidc authentication, bypassing and updating login method", user.Username))
+		user.LoginMethod = users.LoginMethodOidc
+		err = store.Users.Update(user, true, "LoginMethod")
+		if err != nil {
+			logger.Debug(err.Error())
+		}
+		//return http.StatusForbidden, fmt.Errorf("user %s is not allowed to login with OIDC", username)
+	}
+	signed, err := makeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), time.Hour*time.Duration(config.Auth.TokenExpirationHours), user.Permissions)
+	if err != nil {
+		// Handle potential errors during token generation
+		if strings.Contains(err.Error(), "key already exists with same name") {
+			return http.StatusConflict, fmt.Errorf("token name conflict: %v", err)
+		}
+		return http.StatusInternalServerError, fmt.Errorf("failed to generate authentication token for user %s: %v", username, err)
+	}
+
+	// Set the authentication token as an HTTP cookie
+	cookie := &http.Cookie{
+		Name:   "auth",                        // The name of your auth cookie
+		Value:  signed.Key,                    // The generated token value
+		Domain: strings.Split(r.Host, ":")[0], // Set domain to the host without port
+		Path:   "/",                           // Make the cookie available to the whole site
+		// Secure: true, // Recommended: Set to true in production with HTTPS
+		// HttpOnly: true, // Recommended: Set to true to prevent client-side script access
+		Expires: time.Now().Add(time.Hour * time.Duration(config.Auth.TokenExpirationHours)), // Set cookie expiration
+	}
+	http.SetCookie(w, cookie)
+
+	// Set the authenticated user in the request context or response writer
+	// This allows subsequent handlers to access the current user.
+	setUserInResponseWriter(w, user)
+
+	// Redirect the user to the page they were trying to access before login,
+	// or to the root ("/") if no specific redirect was requested.
+	// The 'fb_redirect' parameter is extracted from the 'state' parameter for security.
+	state := r.URL.Query().Get("state")
+	fbRedirect := "/" // Default redirect path
+	if state != "" {
+		// Assuming state is in the format "nonce:fb_redirect"
+		parts := strings.SplitN(state, ":", 2)
+		if len(parts) == 2 {
+			// TODO: Validate the nonce part against the stored nonce for CSRF protection
+			// For this example, we'll just extract the redirect part
+			extractedRedirect := parts[1]
+			if extractedRedirect != "" {
+				fbRedirect = extractedRedirect
+			}
+		}
+	}
+
+	http.Redirect(w, r, fbRedirect, http.StatusFound)
+
+	// Return 0 to indicate that the response has been handled by the redirect
+	return 0, nil
+}

backend/http/httpEvents.go

@@ -0,0 +1,80 @@
+package http
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/events"
+)
+
+type messenger struct {
+	flusher http.Flusher
+	writer  io.Writer
+}
+
+// expects message with double quotes around string
+func (msgr messenger) sendEvent(eventType, message string) error {
+	_, err := fmt.Fprintf(msgr.writer, "data: {\"eventType\":\"%s\",\"message\":%s}\n\n", eventType, message)
+	if err != nil {
+		return err
+	}
+	msgr.flusher.Flush()
+	return nil
+}
+
+func sseHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !d.user.Permissions.Realtime {
+		return http.StatusForbidden, fmt.Errorf("realtime is disabled for this user")
+	}
+
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+
+	sessionId := r.URL.Query().Get("sessionId")
+	username := d.user.Username
+
+	f, ok := w.(http.Flusher)
+	if !ok {
+		logger.Debug(fmt.Sprintf("error: ResponseWriter does not support Flusher. User: %s, SessionId: %s", username, sessionId))
+		return http.StatusInternalServerError, fmt.Errorf("streaming not supported")
+	}
+
+	msgr := messenger{flusher: f, writer: w}
+	clientGone := r.Context().Done()
+
+	// Initial ack
+	if err := msgr.sendEvent("acknowledge", "\"connection established\""); err != nil {
+		return http.StatusInternalServerError, fmt.Errorf("error sending message: %v, user: %s, SessionId: %s", err, username, sessionId)
+	}
+
+	// Register this client with the events system
+	sendChan := events.Register(username, settings.GetSources(d.user))
+	defer events.Unregister(username, sendChan)
+
+	for {
+		select {
+		case <-d.ctx.Done():
+			_ = msgr.sendEvent("notification", "\"the server is shutting down\"")
+			return http.StatusOK, nil
+
+		case <-clientGone:
+			logger.Debug(fmt.Sprintf("client disconnected. user: %s, SessionId: %s", username, sessionId))
+			return http.StatusOK, nil
+
+		case msg := <-events.BroadcastChan:
+			if err := msgr.sendEvent(msg.EventType, msg.Message); err != nil {
+				return http.StatusInternalServerError, fmt.Errorf("error sending broadcast: %v, user: %s", err, username)
+			}
+
+		case msg := <-sendChan:
+			if err := msgr.sendEvent(msg.EventType, msg.Message); err != nil {
+				return http.StatusInternalServerError, fmt.Errorf("error sending targeted message: %v, user: %s", err, username)
+			}
+		}
+	}
+}

backend/http/httpJobs.go

@@ -0,0 +1,24 @@
+package http
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+)
+
+func getJobsHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	sources := settings.GetSources(d.user)
+	reducedIndexes := map[string]indexing.ReducedIndex{}
+	for _, source := range sources {
+		reducedIndex, err := indexing.GetIndexInfo(source)
+		if err != nil {
+			logger.Debug(fmt.Sprintf("error getting index info: %v", err))
+			continue
+		}
+		reducedIndexes[source] = reducedIndex
+	}
+	return renderJSON(w, r, reducedIndexes)
+}

backend/http/httpRouter.go

@@ -1,6 +1,7 @@
 package http
 
 import (
+	"context"
 	"crypto/tls"
 	"embed"
 	"fmt"
@@ -8,13 +9,13 @@ import (
 	"net/http"
 	"os"
 	"text/template"
+	"time"
 
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
-	"github.com/gtsteffaniak/filebrowser/backend/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/storage"
-	"github.com/gtsteffaniak/filebrowser/backend/version"
-
-	httpSwagger "github.com/swaggo/http-swagger" // http-swagger middleware
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	// http-swagger middleware
 )
 
 // Embed the files in the frontend/dist directory
@@ -36,20 +37,14 @@ func (d dirFS) Open(name string) (fs.File, error) {
 }
 
 var (
-	store     *storage.Storage
-	config    *settings.Settings
-	fileCache FileCache
-	imgSvc    ImgService
-	assetFs   fs.FS
+	store   *storage.Storage
+	config  *settings.Settings
+	assetFs fs.FS
 )
 
-func StartHttp(Service ImgService, storage *storage.Storage, cache FileCache) {
-
+func StartHttp(ctx context.Context, storage *storage.Storage, shutdownComplete chan struct{}) {
 	store = storage
-	fileCache = cache
-	imgSvc = Service
 	config = &settings.Config
-
 	var err error
 
 	if embeddedFS {
@@ -84,6 +79,8 @@ func StartHttp(Service ImgService, storage *storage.Storage, cache FileCache) {
 	api.HandleFunc("GET /auth/token", withUser(createApiKeyHandler))
 	api.HandleFunc("DELETE /auth/token", withUser(deleteApiKeyHandler))
 	api.HandleFunc("GET /auth/tokens", withUser(listApiKeysHandler))
+	api.HandleFunc("GET /auth/oidc/callback", wrapHandler(oidcCallbackHandler))
+	api.HandleFunc("GET /auth/oidc/login", wrapHandler(oidcLoginHandler))
 
 	// Resources routes
 	api.HandleFunc("GET /resources", withUser(resourceGetHandler))
@@ -91,7 +88,6 @@ func StartHttp(Service ImgService, storage *storage.Storage, cache FileCache) {
 	api.HandleFunc("POST /resources", withUser(resourcePostHandler))
 	api.HandleFunc("PUT /resources", withUser(resourcePutHandler))
 	api.HandleFunc("PATCH /resources", withUser(resourcePatchHandler))
-	api.HandleFunc("GET /usage", withUser(diskUsage))
 	api.HandleFunc("GET /raw", withUser(rawHandler))
 	api.HandleFunc("GET /preview", withUser(previewHandler))
 	if version.Version == "testing" || version.Version == "untracked" {
@@ -101,21 +97,31 @@ func StartHttp(Service ImgService, storage *storage.Storage, cache FileCache) {
 
 	// Share routes
 	api.HandleFunc("GET /shares", withPermShare(shareListHandler))
-	api.HandleFunc("GET /share", withPermShare(shareGetsHandler))
+	api.HandleFunc("GET /share", withPermShare(shareGetHandler))
 	api.HandleFunc("POST /share", withPermShare(sharePostHandler))
 	api.HandleFunc("DELETE /share", withPermShare(shareDeleteHandler))
 
 	// Public routes
 	api.HandleFunc("GET /public/publicUser", publicUserGetHandler)
-	api.HandleFunc("GET /public/dl", withHashFile(rawHandler))
+	api.HandleFunc("GET /public/dl", withHashFile(publicRawHandler))
 	api.HandleFunc("GET /public/share", withHashFile(publicShareHandler))
+	api.HandleFunc("GET /public/preview", withHashFile(publicPreviewHandler))
 
 	// Settings routes
 	api.HandleFunc("GET /settings", withAdmin(settingsGetHandler))
-	api.HandleFunc("PUT /settings", withAdmin(settingsPutHandler))
+
+	// Events routes
+	api.HandleFunc("GET /events", withUser(func(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+		d.ctx = ctx // Pass the parent context to ensure proper shutdown
+		return sseHandler(w, r, d)
+	}))
+
+	// Job routes
+	api.HandleFunc("GET /jobs/{action}/{target}", withUser(getJobsHandler))
 
 	api.HandleFunc("GET /onlyoffice/config", withUser(onlyofficeClientConfigGetHandler))
 	api.HandleFunc("POST /onlyoffice/callback", withUser(onlyofficeCallbackHandler))
+	api.HandleFunc("GET /onlyoffice/getToken", withUser(onlyofficeGetTokenHandler))
 
 	api.HandleFunc("GET /search", withUser(searchHandler))
 	apiPath := config.Server.BaseURL + "api"
@@ -129,62 +135,78 @@ func StartHttp(Service ImgService, storage *storage.Storage, cache FileCache) {
 	router.HandleFunc(fmt.Sprintf("GET %vhealth", config.Server.BaseURL), healthHandler)
 
 	// Swagger
-	router.Handle(fmt.Sprintf("%vswagger/", config.Server.BaseURL),
-		httpSwagger.Handler(
-			httpSwagger.URL(config.Server.BaseURL+"swagger/doc.json"), //The url pointing to API definition
-			httpSwagger.DeepLinking(true),
-			httpSwagger.DocExpansion("none"),
-			httpSwagger.DomID("swagger-ui"),
-		),
-	)
+	router.Handle(fmt.Sprintf("%vswagger/", config.Server.BaseURL), withUser(swaggerHandler))
 
 	var scheme string
 	port := ""
-
-	// Determine whether to use HTTPS (TLS) or HTTP
-	if config.Server.TLSCert != "" && config.Server.TLSKey != "" {
-		// Load the TLS certificate and key
-		cer, err := tls.LoadX509KeyPair(config.Server.TLSCert, config.Server.TLSKey)
-		if err != nil {
-			logger.Fatal(fmt.Sprintf("could not load certificate: %v", err))
-		}
-
-		// Create a custom TLS listener
-		tlsConfig := &tls.Config{
-			MinVersion:   tls.VersionTLS12,
-			Certificates: []tls.Certificate{cer},
-		}
-
-		// Set HTTPS scheme and default port for TLS
-		scheme = "https"
-
-		// Listen on TCP and wrap with TLS
-		listener, err := tls.Listen("tcp", fmt.Sprintf(":%v", config.Server.Port), tlsConfig)
-		if err != nil {
-			logger.Fatal(fmt.Sprintf("could not start TLS server: %v", err))
-		}
-		if config.Server.Port != 443 {
-			port = fmt.Sprintf(":%d", config.Server.Port)
-		}
-		// Build the full URL with host and port
-		fullURL := fmt.Sprintf("%s://localhost%s%s", scheme, port, config.Server.BaseURL)
-		logger.Info(fmt.Sprintf("Running at               : %s", fullURL))
-		err = http.Serve(listener, muxWithMiddleware(router))
-		if err != nil {
-			logger.Fatal(fmt.Sprintf("could not start server: %v", err))
-		}
-	} else {
-		// Set HTTP scheme and the default port for HTTP
-		scheme = "http"
-		if config.Server.Port != 80 {
-			port = fmt.Sprintf(":%d", config.Server.Port)
-		}
-		// Build the full URL with host and port
-		fullURL := fmt.Sprintf("%s://localhost%s%s", scheme, port, config.Server.BaseURL)
-		logger.Info(fmt.Sprintf("Running at               : %s", fullURL))
-		err := http.ListenAndServe(fmt.Sprintf(":%v", config.Server.Port), muxWithMiddleware(router))
-		if err != nil {
-			logger.Fatal(fmt.Sprintf("could not start server: %v", err))
-		}
+	srv := &http.Server{
+		Addr:    fmt.Sprintf(":%v", config.Server.Port),
+		Handler: muxWithMiddleware(router),
 	}
+	go func() {
+		// Determine whether to use HTTPS (TLS) or HTTP
+		if config.Server.TLSCert != "" && config.Server.TLSKey != "" {
+			// Load the TLS certificate and key
+			cer, err := tls.LoadX509KeyPair(config.Server.TLSCert, config.Server.TLSKey)
+			if err != nil {
+				logger.Fatal(fmt.Sprintf("Could not load certificate: %v", err))
+			}
+
+			// Create a custom TLS configuration
+			tlsConfig := &tls.Config{
+				MinVersion:   tls.VersionTLS12,
+				Certificates: []tls.Certificate{cer},
+			}
+
+			// Set HTTPS scheme and default port for TLS
+			scheme = "https"
+			if config.Server.Port != 443 {
+				port = fmt.Sprintf(":%d", config.Server.Port)
+			}
+
+			// Build the full URL with host and port
+			fullURL := fmt.Sprintf("%s://localhost%s%s", scheme, port, config.Server.BaseURL)
+			logger.Info(fmt.Sprintf("Running at               : %s", fullURL))
+
+			// Create a TLS listener and serve
+			listener, err := tls.Listen("tcp", srv.Addr, tlsConfig)
+			if err != nil {
+				logger.Fatal(fmt.Sprintf("Could not start TLS server: %v", err))
+			}
+			if err := srv.Serve(listener); err != nil && err != http.ErrServerClosed {
+				logger.Fatal(fmt.Sprintf("Server error: %v", err))
+			}
+		} else {
+			// Set HTTP scheme and the default port for HTTP
+			scheme = "http"
+			if config.Server.Port != 80 {
+				port = fmt.Sprintf(":%d", config.Server.Port)
+			}
+
+			// Build the full URL with host and port
+			fullURL := fmt.Sprintf("%s://localhost%s%s", scheme, port, config.Server.BaseURL)
+			logger.Info(fmt.Sprintf("Running at               : %s", fullURL))
+
+			// Start HTTP server
+			if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+				logger.Fatal(fmt.Sprintf("Server error: %v", err))
+			}
+		}
+	}()
+
+	// Wait for context cancellation to shut down the server
+	<-ctx.Done()
+	logger.Info("Shutting down HTTP server...")
+
+	// Graceful shutdown with a timeout - 30 seconds, in case downloads are happening
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if err := srv.Shutdown(shutdownCtx); err != nil {
+		logger.Error(fmt.Sprintf("HTTP server forced to shut down: %v", err))
+	} else {
+		logger.Info("HTTP server shut down gracefully.")
+	}
+
+	// Signal that shutdown is complete
+	close(shutdownComplete)
 }

backend/http/middleware.go

@@ -2,25 +2,30 @@ package http
 
 import (
 	"compress/gzip"
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"path/filepath"
 	"strings"
 	"time"
 
-	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/files"
-	"github.com/gtsteffaniak/filebrowser/backend/logger"
-	"github.com/gtsteffaniak/filebrowser/backend/runner"
-	"github.com/gtsteffaniak/filebrowser/backend/users"
+	jwt "github.com/golang-jwt/jwt/v4"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )
 
 type requestContext struct {
-	user *users.User
-	*runner.Runner
-	raw   interface{}
-	token string
+	user     *users.User
+	raw      interface{}
+	fileInfo iteminfo.ExtendedFileInfo
+	path     string
+	token    string
+	share    *share.Link
+	ctx      context.Context
 }
 
 type HttpResponse struct {
@@ -39,13 +44,14 @@ func withHashFileHelper(fn handleFunc) handleFunc {
 	return func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
 		path := r.URL.Query().Get("path")
 		hash := r.URL.Query().Get("hash")
+		// Retrieve the user (using the public user by default)
 		data.user = &users.PublicUser
-
 		// Get the file link by hash
 		link, err := store.Share.GetByHash(hash)
 		if err != nil {
 			return http.StatusNotFound, fmt.Errorf("share not found")
 		}
+		data.share = link
 		// Authenticate the share request if needed
 		var status int
 		if link.Hash != "" {
@@ -54,24 +60,29 @@ func withHashFileHelper(fn handleFunc) handleFunc {
 				return status, fmt.Errorf("could not authenticate share request")
 			}
 		}
-		// Retrieve the user (using the public user by default)
-		user := &users.PublicUser
+		data.path = strings.TrimSuffix(link.Path, "/") + "/" + strings.TrimPrefix(path, "/")
+		if path == "" || path == "/" {
+			data.path = link.Path
+		}
 
+		source, ok := config.Server.SourceMap[link.Source]
+		if !ok {
+			return http.StatusNotFound, fmt.Errorf("source not found")
+		}
 		// Get file information with options
-		file, err := FileInfoFasterFunc(files.FileOptions{
-			Path:    filepath.Join(user.Scope, link.Path+"/"+path),
-			Modify:  user.Perm.Modify,
-			Expand:  true,
-			Checker: user, // Call your checker function here
+		file, err := FileInfoFasterFunc(iteminfo.FileOptions{
+			Path:   data.path,
+			Source: source.Name,
+			Modify: false,
+			Expand: true,
 		})
 		file.Token = link.Token
 		if err != nil {
+			logger.Error(fmt.Sprintf("error fetching file info for share. hash=%v path=%v error=%v", hash, data.path, err))
 			return errToStatus(err), fmt.Errorf("error fetching share from server")
 		}
-
 		// Set the file info in the `data` object
 		data.raw = file
-
 		// Call the next handler with the data
 		return fn(w, r, data)
 	}
@@ -81,11 +92,9 @@ func withHashFileHelper(fn handleFunc) handleFunc {
 func withAdminHelper(fn handleFunc) handleFunc {
 	return withUserHelper(func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
 		// Ensure the user has admin permissions
-		if !data.user.Perm.Admin {
+		if !data.user.Permissions.Admin {
 			return http.StatusForbidden, nil
 		}
-
-		// Proceed to the actual handler if the user is admin
 		return fn(w, r, data)
 	})
 }
@@ -93,24 +102,34 @@ func withAdminHelper(fn handleFunc) handleFunc {
 // Middleware to retrieve and authenticate user
 func withUserHelper(fn handleFunc) handleFunc {
 	return func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
-		if config.Auth.Method == "noauth" {
+		if config.Auth.Methods.NoAuth {
 			var err error
 			// Retrieve the user from the store and store it in the context
-			data.user, err = store.Users.Get(files.RootPaths["default"], "admin")
+			data.user, err = store.Users.Get(uint(1))
 			if err != nil {
+				logger.Error(fmt.Sprintf("no auth: %v", err))
 				return http.StatusInternalServerError, err
 			}
 			return fn(w, r, data)
 		}
+		proxyUser := r.Header.Get(config.Auth.Methods.ProxyAuth.Header)
+		if config.Auth.Methods.ProxyAuth.Enabled && proxyUser != "" {
+			user, err := setupProxyUser(r, data, proxyUser)
+			if err != nil {
+				return http.StatusForbidden, err
+			}
+			data.user = user
+			setUserInResponseWriter(w, data.user)
+			return fn(w, r, data)
+		}
 		keyFunc := func(token *jwt.Token) (interface{}, error) {
-			return config.Auth.Key, nil
+			return []byte(config.Auth.Key), nil
 		}
 		tokenString, err := extractToken(r)
 		if err != nil {
 			return http.StatusUnauthorized, err
 		}
 		data.token = tokenString
-
 		var tk users.AuthToken
 		token, err := jwt.ParseWithClaims(tokenString, &tk, keyFunc)
 		if err != nil {
@@ -119,7 +138,7 @@ func withUserHelper(fn handleFunc) handleFunc {
 		if !token.Valid {
 			return http.StatusUnauthorized, fmt.Errorf("invalid token")
 		}
-		if isRevokedApiKey(tk.Key) || tk.Expires < time.Now().Unix() {
+		if auth.IsRevokedApiKey(tk.Key) || tk.Expires < time.Now().Unix() {
 			return http.StatusUnauthorized, fmt.Errorf("token expired or revoked")
 		}
 		// Check if the token is about to expire and send a header to renew it
@@ -128,7 +147,7 @@ func withUserHelper(fn handleFunc) handleFunc {
 		}
 
 		// Retrieve the user from the store and store it in the context
-		data.user, err = store.Users.Get(files.RootPaths["default"], tk.BelongsTo)
+		data.user, err = store.Users.Get(tk.BelongsTo)
 		if err != nil {
 			return http.StatusInternalServerError, err
 		}
@@ -144,7 +163,7 @@ func withUserHelper(fn handleFunc) handleFunc {
 func withSelfOrAdminHelper(fn handleFunc) handleFunc {
 	return withUserHelper(func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
 		// Check if the current user is the same as the requested user or if they are an admin
-		if !data.user.Perm.Admin {
+		if !data.user.Permissions.Admin {
 			return http.StatusForbidden, nil
 		}
 		// Call the actual handler function with the updated context
@@ -154,13 +173,10 @@ func withSelfOrAdminHelper(fn handleFunc) handleFunc {
 
 func wrapHandler(fn handleFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		data := &requestContext{
-			Runner: &runner.Runner{Enabled: config.Server.EnableExec, Settings: config},
-		}
+		data := &requestContext{}
 
 		// Call the actual handler function and get status code and error
 		status, err := fn(w, r, data)
-
 		// Handle the error case if there is one
 		if err != nil {
 			// Create an error response in JSON format
@@ -183,7 +199,7 @@ func wrapHandler(fn handleFunc) http.HandlerFunc {
 
 			// Write the JSON error response
 			if _, writeErr := w.Write(errorBytes); writeErr != nil {
-				logger.Error(fmt.Sprintf("Error writing error response: %v", writeErr))
+				logger.Debug(fmt.Sprintf("Error writing error response: %v", writeErr))
 			}
 			return
 		}
@@ -197,7 +213,7 @@ func wrapHandler(fn handleFunc) http.HandlerFunc {
 
 func withPermShareHelper(fn handleFunc) handleFunc {
 	return withUserHelper(func(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-		if !d.user.Perm.Share {
+		if !d.user.Permissions.Share {
 			return http.StatusForbidden, nil
 		}
 		return fn(w, r, d)
@@ -273,7 +289,6 @@ func setUserInResponseWriter(w http.ResponseWriter, user *users.User) {
 // LoggingMiddleware logs each request and its status code.
 func LoggingMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-
 		start := time.Now()
 
 		// Wrap the ResponseWriter to capture the status code.
@@ -291,13 +306,14 @@ func LoggingMiddleware(next http.Handler) http.Handler {
 		if len(truncUser) > 12 {
 			truncUser = truncUser[:10] + ".."
 		}
+		duration := time.Since(start)
 		logger.Api(
 			fmt.Sprintf("%-7s | %3d | %-15s | %-12s | %-12s | \"%s\"",
 				r.Method,
 				wrappedWriter.StatusCode, // Captured status code
 				r.RemoteAddr,
 				truncUser,
-				time.Since(start).String(),
+				fmt.Sprintf("%vms", duration.Milliseconds()),
 				fullURL), wrappedWriter.StatusCode)
 	})
 }
@@ -335,3 +351,19 @@ func acceptsGzip(r *http.Request) bool {
 	ae := r.Header.Get("Accept-Encoding")
 	return ae != "" && strings.Contains(ae, "gzip")
 }
+
+func (w *ResponseWriterWrapper) Flush() {
+	if flusher, ok := w.ResponseWriter.(http.Flusher); ok {
+		flusher.Flush()
+	}
+}
+
+func getScheme(r *http.Request) string {
+	if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" {
+		return proto
+	}
+	if r.TLS != nil {
+		return "https"
+	}
+	return "http"
+}