Fix typo in Configuration Setup

Beta/v0.8.4 (#1187 )
Co-authored-by: Max <mail@kjmax.com> Co-authored-by: Kurami <kurami32_kbm@proton.me>
2025-09-10 08:56:54 -04:00 · 2025-09-05 18:56:18 -05:00 · 2025-08-28 18:26:29 -05:00 · 2025-08-28 15:04:08 -05:00 · 2025-08-25 10:58:31 -05:00 · 2025-08-22 17:45:44 -05:00
257 changed files with 22479 additions and 6786 deletions
@@ -3,82 +3,114 @@ name: PR Request
 on:
  pull_request:
    branches:
+      - "main"
      - "dev/v*.*.*"
      - "beta/v*.*.*"
      - "stable/v*.*.*"
 jobs:
+  prime_docker_cache:
+    name: Prime docker cache
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Prime Cache
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: _docker/Dockerfile.primecache
+          push: false
+          load: false
+          cache-to: |
+            type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
+  build_frontend:
+    name: Build frontend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+      - name: Build frontend
+        working-directory: frontend
+        run: npm i && npm run build
+      - name: Upload frontend build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: backend/http/dist
+  build_backend:
+    name: Build backend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - name: Build backend
+        working-directory: backend
+        run: go build -o filebrowser .
+      - name: Upload backend build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: filebrowser
+          path: backend/filebrowser
  test_playwright:
-    name: Test Playwright - general
+    needs: [build_backend, build_frontend, prime_docker_cache]
+    name: Test Playwright - ${{ matrix.name }}
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: general
+            dockerfile: ./_docker/Dockerfile.playwright-general
+          - name: proxy
+            dockerfile: ./_docker/Dockerfile.playwright-proxy
+          - name: noauth
+            dockerfile: ./_docker/Dockerfile.playwright-noauth
+          - name: oidc
+            dockerfile: ./_docker/Dockerfile.playwright-oidc
+          - name: sharing
+            dockerfile: ./_docker/Dockerfile.playwright-sharing
    steps:
      - name: Checkout
        uses: actions/checkout@v4
+      - name: Download frontend build
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: frontend/dist
+      - name: Download backend build
+        uses: actions/download-artifact@v4
+        with:
+          name: filebrowser
+          path: backend/
+      - name: Make backend executable
+        run: chmod +x backend/filebrowser
+      - name: Copy frontend build to backend
+        run: |
+          mkdir -p backend/http/embed
+          cp -r frontend/dist/* backend/http/embed
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3.0.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.0.0
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run build
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - working-directory: backend
-        run: go build -o filebrowser .
-      - name: Build
+      - name: Build and Test
+        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
-          file: ./_docker/Dockerfile.playwright-general
-          push: false
-  test_playwright_proxy:
-    name: Test Playwright - proxy
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run build
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - working-directory: backend
-        run: go build -o filebrowser .
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./_docker/Dockerfile.playwright-proxy
-          push: false
-  test_playwright_noauth:
-    name: Test Playwright - noauth
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run build
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - working-directory: backend
-        run: go build -o filebrowser .
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./_docker/Dockerfile.playwright-noauth
+          file: ${{ matrix.dockerfile }}
          push: false
+          load: true
+          cache-from: |
+            type=gha,scope=${{ github.ref_name }}-playwright-base
+            type=gha,scope=main-playwright-base
+          cache-to: |
+            type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
  push_pr_to_registry:
    if: github.event.pull_request.head.repo.fork == false
    name: Build docker image
@@ -111,3 +143,5 @@ jobs:
          build-args: |
            VERSION=${{ steps.meta.outputs.version }}
            REVISION=${{ steps.meta.outputs.revision }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
@@ -48,3 +48,4 @@ yarn-error.log*
 bin/
 build/
 *__debug*
+backend/custom.css
@@ -2,6 +2,202 @@

 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).

+## v0.8.4-beta
+
+ **New Features**:
+ - New media player styles and features
+   - Custom Media Player: enhanced media player using plyr thanks @Kurami32 (see #1160)
+   - Custom Media Player: also adds support for metadata
+   - added embeded video subtitle support (for both native and custom player). @maxbin123 #1072 #1157
+   - Users can disable the customer player and opt of native in profile settings.
+ - Option to disable backend update check via `server.disableUpdateCheck` #1134
+ - added `frontend.favicon` and `frontend.description` for html overrides
+ - onlyoffice is now supported in shares. Both viewing and editing can be configured per-share.
+ - Added only office debug view and wiki to assist with debugging issues #1068 #911 #1074
+ - Dark mode enforcement possible for shared links #1029
+ - added `System & Admin` section to settings
+   - includes a new config viewer to see current running config (hides secrets) #838
+ - added `server.minSearchLength` to allow adjusting the length requirement for search #1174
+
+ **Notes**:
+ - access management: specific folders/files with access are shown instead permission denied for parent folder
+ - navigation no longer appends last location hash which should fix some unwanted navation behavior #1070
+ - altered the context menu style and behavior.
+ - documentation update: comma or Space separated extensions #1138
+ - Files and folders can be created with "/" or "\" on the name #1126
+ - Share management should not be allowed without authentication #1163
+ - Question about customizing session timeout #1184
+
+ **BugFixes**:
+ - access management: delay showing rule changes in the list fixed. #1131
+ - Color names are not localized #1159
+ - rename issues #1170 #1171
+ - some shortcuts not working #1056
+ - Can't copy/paste text on mobile #1168
+ - Can't change between images inside of the share image viewer. #1144
+ - fixed and updated translations with variables always showing english.
+
+## v0.8.3-beta
+
+ **BugFixes**:
+ - fixed search bar style bug in mobile #1147
+
+## v0.8.2-beta
+
+ **New Features**:
+ - added `source.config.denyByDefault` configuration to enable a deny-by-default access rule. A source enabled with this will deny access unless an "allow" rule was specifically created. (Similar to creating a root-level denyAll rule)
+ - allow oidc user source access and permission based on username and groups is fulfilled by denyByDefault source with access rules https://github.com/gtsteffaniak/filebrowser/issues/824
+ - "open parent folder" in context menu and search results https://github.com/gtsteffaniak/filebrowser/issues/1121
+ - added friendly "share not found" page.
+
+ **Notes**:
+ - 8.0 ffmpeg version bundled with docker
+ - go 1.25 upgrade with green tea GC enabled
+ - totp secrets accept non-secure strings, only throwing warning
+ - adjusted download limit so it also counts viewing text "content" of files (like in editor). You can also "disable file viewing" to stop the editor from showing. lower quality file image previews are not counted as downloads.
+ - updated invalid share message to be more clear https://github.com/gtsteffaniak/filebrowser/issues/1120
+
+ **BugFixes**:
+ - fixed /public/static routes issue
+ - shares redirect to login - https://github.com/gtsteffaniak/filebrowser/issues/1109
+ - some static assets not available to anonymous user - https://github.com/gtsteffaniak/filebrowser/issues/1102
+ - more safari style issues https://github.com/gtsteffaniak/filebrowser/issues/1110
+ - fix public share download issues https://github.com/gtsteffaniak/filebrowser/issues/1118 https://github.com/gtsteffaniak/filebrowser/issues/1089
+ - fixed disable file viewer setting and enforced on backend
+
+## v0.8.1-beta
+
+ **New Features**:
+ - api for generate download link (see swagger) https://github.com/gtsteffaniak/filebrowser/issues/1007
+ - added `source.config.disabled` option to disable a source without removing it from config file.
+ - added `source.config.private` option to designate as private -- currently just means no sharing permitted.
+ - hide share card in share
+ - download count for a share shows up on share management
+
+ **Notes**:
+ - updated description for indexingIntervalMinutes https://github.com/gtsteffaniak/filebrowser/issues/1067
+
+ **BugFixes**:
+ - fixed styling issues https://github.com/gtsteffaniak/filebrowser/issues/1086 https://github.com/gtsteffaniak/filebrowser/issues/1081 https://github.com/gtsteffaniak/filebrowser/issues/1082 https://github.com/gtsteffaniak/filebrowser/issues/1098
+ - fix download limit issue https://github.com/gtsteffaniak/filebrowser/issues/1085
+ - fixed oidc user defaults for new user https://github.com/gtsteffaniak/filebrowser/issues/1071
+ - shares get updated when files moved in ui https://github.com/gtsteffaniak/filebrowser/issues/760
+ - click listing behavior doesn't clear (introduced in 0.8.0) https://github.com/gtsteffaniak/filebrowser/issues/1101
+ - show download count and limit in share list in settings https://github.com/gtsteffaniak/filebrowser/issues/1103
+ - fix windows alt+arrow movement issue https://github.com/gtsteffaniak/filebrowser/issues/1094
+ - nav memory issue for filenames with brackets https://github.com/gtsteffaniak/filebrowser/issues/1092
+ - files with "+"" in name issue https://github.com/gtsteffaniak/filebrowser/issues/1089
+ - fixed editor bug in share view https://github.com/gtsteffaniak/filebrowser/issues/1084
+ - other share related issues https://github.com/gtsteffaniak/filebrowser/issues/1087 https://github.com/gtsteffaniak/filebrowser/issues/1064
+
+
+## v0.8.0-beta
+
+  This is a major release, new features and changes could introduce breaking behavior. Here are the known potentially breaking changes:
+
+  - all public api and share url's get a `/public` prefix, making it easier to use with a reverse proxy. Any existing share link will still work but get redirected.
+  - a small change to styling you may need to update your custom styling, for example the id `#input` was renamed `#search-input`
+
+ **New Features**:
+ - New access control system. You can add new allow / deny / denyAll rules for users/groups for specific paths on specific sources.
+   - groups currently only works with provided oidc groups, but will add a full group management option for manual creation. https://github.com/gtsteffaniak/filebrowser/issues/545
+ - share view changes -- now aligns with the standard listing view. This means files can be viewed and edited (if permission allows) just like a normal listing.
+ - many share links customization enhancements
+   - only share to certain authenticated users https://github.com/gtsteffaniak/filebrowser/issues/656 https://github.com/gtsteffaniak/filebrowser/issues/985
+   - one-time download links
+   - customize share theme https://github.com/gtsteffaniak/filebrowser/issues/827 https://github.com/gtsteffaniak/filebrowser/issues/1029
+   - share link public changes https://github.com/gtsteffaniak/filebrowser/issues/473
+   - shares can be modified/configured after creation.
+   - download throttling for shares
+
+ **Notes**:
+ - hover effect on list/compact view https://github.com/gtsteffaniak/filebrowser/issues/1036
+
+ **BugFixes**:
+ - fix new file "true" content issue https://github.com/gtsteffaniak/filebrowser/issues/1048
+ - editor allows device default popup https://github.com/gtsteffaniak/filebrowser/issues/1049
+
+## v0.7.18-beta
+
+ **Notes**:
+ - desktop context menu "select multiple" enabled as optional user default (#1000)
+ - onlyoffice readonly document types (".pages", ".numbers", ".key") list (#1018)
+ - onlyoffice tweaks to make more consistent, added logging (#1015)
+
+ **BugFixes**:
+ - fix lightBackground issue (#1021)
+ - fix user save issues (#1020, #1027)
+ - fix image preview cache issue (#989)
+ - fix file/folder count issue (#989)
+ - only first file was upload on drag-n-drop (#1024)
+
+## v0.7.17-beta
+
+See an example of custom css styling that uses the reduce-rounded-corners.css by default and allows users to choose other themes. You can add your own themes as well that users can choose from in profile settings:
+
+```
+frontend:
+  styling:
+    lightBackground: "#f0f0f0"   # or names of css colors
+    darkBackground: "#121212"
+    customCSS: "custom.css"  # custom css file always applies first, then user themes on top of that.
+    customThemes:
+      "default": # if "default" is specified as the name, it will be the default option
+        description: "Reduce rounded corners"
+        css: "reduce-rounded-corners.css" # path to css file to use
+      "original":
+        description: "Original rounded theme"
+        css: ""  # you could default to no styling changes this way.
+```
+
+ **New Features**:
+ - more custom styling options (thanks @mordilloSan for #997)
+   - background colors can be easily set in config
+   - provided an example `reduce-rounded-corners.css` available by default in docker. (#986, #837)
+   - added feature to specify multiple css themes that users can choose from in profile settings
+ - swipe between photos on mobile (#825)
+
+ **Notes**:
+ - changed partition calculations on linux for total disk size (#982)
+ - upload conflict detection for folders offers "replace all" if the folder already exists in target location.
+
+ **BugFixes**:
+ - TOTP prompt not showing generated code issue https://github.com/gtsteffaniak/filebrowser/issues/996
+ - select mulitple deselect on mobile (#1002)
+ - viewing svg images.
+
+## v0.7.16-beta
+
+ **Notes**:
+ - more server logging for uploads when debug logging is enabled
+
+ **BugFixes**:
+ - fix onlyoffice integration viewing bug (#990)
+ - fix uploading files with exec permissions (#984)
+ - fix redirect on no source path (#989)
+ - refresh file info on rename (#989)
+ - listing refreshes when uploads finish (#989)
+ - disable edit mode for certain onlyoffice files (#971)
+
+## v0.7.15-beta
+
+ **New Features**:
+ - added userDefault `disableViewingExt`. The new properties apply to all files, not just office.
+ - code blocks in markdown viewer have line numbers and each line is highlightable
+
+ **Notes**:
+ - replaced `disableOfficePreviewExt` with more generally applicable `disablePreviewExt` to disable preview for any specific file type.
+ - more tooltip descriptions for settings options
+
+ **BugFixes**:
+ - fix chinese and other language error (#972, #969)
+ - fix docker dockerfile for `docker run` (#973)
+ - fix double slash href on single source (#968)
+ - fix sources named "files" or "share" issue (#949, #574)
+ - focus input field on popups (#976)
+ - hopeful fix for size calculation (#982)
+ - edit button is not working on .md files (#983)
+
 ## v0.7.14-beta

 **Notes**:
@@ -15,7 +211,6 @@ All notable changes to this project will be documented in this file. For commit
 - trailing slash source name issue https://github.com/gtsteffaniak/filebrowser/issues/920
 - image lazy loading issue causing all items to get previews at one time, not just whats in view.

- 
 ## v0.7.13-beta

 **New Features**:
@@ -4,7 +4,7 @@ Thank you for your interest in contributing to FileBrowser Quantum! This guide w

 ## Prerequisites

- **Go 1.24+** (see `backend/go.mod`)
+- **Go 1.25+** (see `backend/go.mod`)
 - **Node.js 18.0.0+** with npm 7.0.0+ (see `frontend/package.json`)
 - **Docker** (optional, for containerized development)
 - **Git**
@@ -31,8 +31,8 @@ cd filebrowser
 # 2. Initial setup - installs dependencies and creates test config
 make setup

-# 3. Run in development mode
-make run
+# 3. Run in development mode with hot-reloading
+make dev
 ```

 `make setup` installs all dependencies and creates a test configuration file.
@@ -52,14 +52,14 @@ make run
 - **Framework**: Vue 3 + Vite + TypeScript
 - **State**: Custom store in `frontend/src/store/`
 - **API Client**: Axios-based in `frontend/src/api/`
- **i18n**: 25+ languages with English as master
+- **i18n**: 25+ languages with English as main
 - **Components**: Feature-based organization

 ## Development Commands

 ### Essential Commands
 ```bash
-make run          # Start development server
+make dev          # Start development server with hot-reloading
 make test         # Run all tests
 make lint         # Check code quality
 make check-all    # Lint + tests
@@ -70,12 +70,12 @@ make build          # Build Docker image
 ```

 ### Frontend Development
+
+Note: consider using make commands above instead.
 ```bash
 cd frontend
-npm run dev       # Dev server with hot reload
 npm run lint:fix  # Auto-fix linting issues
-npm run typecheck # TypeScript validation
-npm run i18n:sync # Sync translations
+npm run i18n:sync # Sync translations changes
 ```

 ## Testing
@@ -128,12 +128,11 @@ make build-backend   # Build Go binary with embedded assets

 ### Docker
 ```bash
-make build       # Full image with ffmpeg (~200MB)
-make run-proxy   # Docker Compose with nginx proxy
+make build       # Full image with ffmpeg and muPDF
 ```

 ### Configuration
- **Test Config**: `backend/test_config.yaml` Auto-generated after running `make setup` 
+- **Test Config**: `backend/test_config.yaml` Auto-generated after running `make setup`

 ## Contributing

@@ -141,7 +140,7 @@ make run-proxy   # Docker Compose with nginx proxy

 1. Fork and create a feature branch
 2. Make your changes following the code standards
-3. Run `make run` to build and run with your changes
+3. Run `make dev` to build and run with your changes. Supports hot-reloading frontend and backend changes.
 4. When ready, run `make check-all` to verify tests and linting
 5. Submit PR with a clear description

@@ -175,16 +174,6 @@ cd frontend && rm -rf node_modules && npm install
 cd backend && go mod tidy && go clean -modcache
 ```

-**Debugging:**
-```bash
-# Backend with debug logs
-cd backend
-FILEBROWSER_NO_EMBEDDED=true go run -tags mupdf . -c test_config.yaml --log-level debug
-
-# API documentation
-# Visit /swagger endpoint when running
-```
-
 **Authentication Issues:**

 Always first enable debug logging in your config file if you have issues.
@@ -22,7 +22,7 @@

 ## About

-FileBrowser Quantum provides an easy way to access and manage your files from the web. It has has a web page interface that allows you to create secure shared links, users with their own specific permissions and settings, and offers a great viewing experience for many file types.
+FileBrowser Quantum provides an easy way to access and manage your files from the web. It has has a modern responsive interface that has many advanced features to manage users, access, sharing, and file preview and editing.

 This version is called "Quantum" because it packs tons of advanced features into a tiny easy to run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.

@@ -36,7 +36,7 @@ FileBrowser Quantum is a massive fork of the file browser open-source project wi

  1. ✅ Multiple sources support
  2. ✅ Login support for OIDC, password + 2FA, and proxy.
-  3. ✅ Revamped UI
+  3. ✅ Beautiful, Responsive, and Customizable user interface.
  4. ✅ Simplified configuration via `config.yaml` config file.
  5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
     - Real-time search results as you type.
@@ -47,14 +47,19 @@ FileBrowser Quantum is a massive fork of the file browser open-source project wi
     - Instantly switches view modes and sort order without reloading data.
     - Folder sizes are displayed.
     - Navigating remembers the last scroll position.
-  7. ✅ Developer API support
+  7. ✅ Highly configurable and customizable sharing options, incuding:
+     - share expiration time
+     - users who can access share (including anonymous)
+     - styling and themes
+     - file viewing, editing, and uploading permissions
+  8. ✅ Directory-level access control that can be scoped to user or group.
+  8. ✅ Developer API support
     - Ability to create long-lived API Tokens.
     - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.

 Notable features that this fork *does not* have (removed):

 - :construction: jobs are not supported yet.
- - :construction: rules are not supported yet.
 - ❌ shell commands are completely removed and will not be returned.

 > [!WARNING]
@@ -1,4 +1,4 @@
-FROM gtstef/ffmpeg:7.1.1-decode AS ffmpeg
+FROM gtstef/ffmpeg:8.0-decode AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION
@@ -6,6 +6,7 @@ WORKDIR /app
 COPY ./backend ./
 RUN apk update && apk add --no-cache gcc musl-dev upx
 ENV CGO_ENABLED=1
+ENV GOEXPERIMENT=greenteagc
 RUN go build -tags mupdf,musl -ldflags="-w -s \
  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
@@ -15,6 +16,9 @@ RUN upx filebrowser
 FROM node:lts-slim AS nbuild
 WORKDIR /app
 COPY ./frontend/package.json ./
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
+    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
 RUN npm i --maxsockets 1
 COPY  ./frontend/ ./
 RUN npm run build-docker
@@ -23,15 +27,16 @@ FROM alpine:latest
 COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
 ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
 ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
-ENV FILEBROWSER_NO_EMBEDED="true"
 ENV PATH="$PATH:/home/filebrowser"
 RUN apk --no-cache add ca-certificates mailcap tzdata
 RUN adduser -D -s /bin/true -u 1000 filebrowser
 USER filebrowser
 WORKDIR /home/filebrowser
-COPY --from=base --chown=filebrowser:1000 /app/filebrowser ./
-COPY --from=base --chown=filebrowser:1000 /app/config.yaml ./data/config.yaml
-COPY --from=nbuild --chown=filebrowser:1000 /app/dist/ ./http/dist/
+# copy config to two locations for compatibility
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "/app/config.yaml", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 RUN [ "ffmpeg", "-version" ]
@@ -1,4 +1,4 @@
 FROM node:22-slim
 WORKDIR /app/frontend
-RUN npm i @playwright/test
+RUN npm i @playwright/test oauth2-mock-server @types/node
 RUN npx playwright install --with-deps firefox
@@ -1,8 +1,18 @@
 FROM gtstef/playwright-base
 WORKDIR /app
+
+# Copy setup scripts first to leverage caching
 COPY [ "./_docker/src/general/", "./" ]
+
 WORKDIR /app/frontend
-COPY [ "./frontend/", "./" ]
+COPY [ "./_docker/src/general/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+RUN ./filebrowser set -u testuser1,testuser1
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,8 +1,16 @@
 FROM gtstef/playwright-base
 WORKDIR /app
+
+# Copy setup scripts first to leverage caching
 COPY [ "./_docker/src/noauth/", "./" ]
+
 WORKDIR /app/frontend
-COPY [ "./frontend/", "./" ]
+COPY [ "./frontend/tests", "./tests" ]
+
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -0,0 +1,13 @@
+FROM gtstef/playwright-base
+
+COPY [ "./_docker/src/oidc/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
+WORKDIR /app/backend/
+RUN mkdir -p ./http/dist
+COPY [ "./_docker/src/oidc/backend/", "./"]
+COPY ["./backend/filebrowser", "./"]
+COPY [ "./backend/http/embed/", "./http/dist/"]
+# Run tests
+WORKDIR /app/frontend
+RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -2,10 +2,13 @@ FROM gtstef/playwright-base
 WORKDIR /app
 COPY [ "./_docker/src/proxy/", "./" ]
 WORKDIR /app/frontend
-COPY [ "./frontend/", "./" ]
+COPY [ "./frontend/tests", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
+RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
 RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
 RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -0,0 +1,17 @@
+FROM gtstef/playwright-base
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/sharing/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./_docker/src/sharing/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -0,0 +1 @@
+FROM gtstef/playwright-base
@@ -4,6 +4,7 @@ ARG REVISION
 WORKDIR /app
 COPY ./backend ./
 RUN apk update && apk add upx
+ENV GOEXPERIMENT=greenteagc
 RUN go build -ldflags="-w -s \
  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
@@ -13,21 +14,24 @@ RUN upx filebrowser
 FROM node:lts-slim AS nbuild
 WORKDIR /app
 COPY ./frontend/package.json ./
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
+    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
 RUN npm i --maxsockets 1
 COPY  ./frontend/ ./
 RUN npm run build-docker

 FROM alpine:latest
-ENV FILEBROWSER_NO_EMBEDED="true"
 ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
 ENV PATH="$PATH:/home/filebrowser"
 RUN apk --no-cache add ca-certificates mailcap tzdata
 RUN adduser -D -s /bin/true -u 1000 filebrowser
 USER filebrowser
 WORKDIR /home/filebrowser
-COPY --from=base --chown=filebrowser:1000 /app/filebrowser ./
-COPY --from=base --chown=filebrowser:1000 /app/config.yaml ./data/config.yaml
-COPY --from=nbuild --chown=filebrowser:1000 /app/dist/ ./http/dist/
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 USER root
@@ -6,6 +6,7 @@ services:
      - "80:80"
    volumes:
      - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
+      - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
  filebrowser:
    hostname: filebrowser
    volumes:
@@ -10,9 +10,9 @@ import { defineConfig, devices } from "@playwright/test";
 * See https://playwright.dev/docs/test-configuration.
 */
 export default defineConfig({
-  globalSetup: "./tests-playwright/global-setup",
-  timeout: 5000,
-  testDir: "./tests-playwright/general",
+  globalSetup: "./tests/playwright/global-setup",
+  timeout: 10000,
+  testDir: "./tests/playwright/general",
  /* Run tests in files in parallel */
  fullyParallel: false,
  /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -20,7 +20,7 @@ export default defineConfig({
  /* Retry on CI only */
  retries: 2,
  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
+  workers: 1,
  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
  reporter: "line",
  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
@@ -10,9 +10,9 @@ import { defineConfig, devices } from "@playwright/test";
 * See https://playwright.dev/docs/test-configuration.
 */
 export default defineConfig({
-  globalSetup: "./tests-playwright/noauth-setup",
-  timeout: 5000,
-  testDir: "./tests-playwright/noauth",
+  globalSetup: "./tests/playwright/noauth-setup",
+  timeout: 10000,
+  testDir: "./tests/playwright/noauth",
  /* Run tests in files in parallel */
  fullyParallel: false,
  /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -0,0 +1,38 @@
+server:
+  logging:
+    - levels: "info|error|warning|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      config:
+        defaultEnabled: true
+        createUserDir: true
+
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+
+auth:
+  methods:
+    password:
+      enabled: false
+    oidc:
+      enabled: true
+      createUser: true
+      clientId: "vyBrzOmcrU3OokiWEZoObdGBscw0eYPNJauBtOJr"
+      clientSecret: "gIMKbkEcckUhlGrnE2Vxi8eZhEcfxQqfwFgM0ATzk4DciHGrW2YRtQfqcpRTsmzrxEETkKvZ8yeK3sfoXnUV1IQTzqK7wxw3lEMtmeXi5clj0h7nH1rVGFq2Q3HL8zUe"
+      issuerUrl: "http://localhost:8080"
+      adminGroup: "Admins"
+
+userDefaults:
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: false
+    api: false
@@ -0,0 +1,60 @@
+
+import { OAuth2Server } from 'oauth2-mock-server';
+
+// This is a list of pre-defined users. You can add more users here.
+// The filebrowser application will use this data when a user logs in.
+const users = {
+  // Default user
+  johndoe: {
+    sub: 'johndoe',
+    preferred_username: 'johndoe',
+    email: 'johndoe@example.com',
+    groups: ['Admins', 'Users'],
+  },
+  // Another example user
+  testuser: {
+    sub: 'testuser',
+    preferred_username: 'testuser',
+    email: 'testuser@example.com',
+    groups: ['Users'],
+  },
+};
+
+const server = new OAuth2Server();
+
+// Generate a new RSA key for the server.
+await server.issuer.keys.generate('RS256');
+
+/**
+ * This hook is called before the ID token is signed.
+ * We're using it to add claims to the ID token.
+ * This is the primary way the application will get user information.
+ */
+server.service.on('beforeIdTokenSigning', (token, req) => {
+  // By default, the mock server uses 'johndoe' as the subject.
+  const user = users[token.payload.sub] || users.johndoe;
+  console.log(`[ID Token] Customizing token for user: ${user.sub}`);
+  Object.assign(token.payload, user);
+});
+
+
+/**
+ * This hook is called before the userinfo response is sent.
+ * We're using it to provide user claims when the application calls the /userinfo endpoint.
+ */
+server.service.on('beforeUserinfo', (userInfoResponse, req) => {
+    const user = users.johndoe;
+    console.log(`[UserInfo] Customizing userinfo for user: ${user.sub}`);
+    userInfoResponse.body = user;
+});
+
+
+const port = 8080;
+const host = '0.0.0.0'; // Bind to 0.0.0.0 to be accessible within Docker
+await server.start(port, host);
+console.log(`OAuth 2 Mock Server listening on http://${host}:${port}`);
+console.log(`Issuer URL: ${server.issuer.url}`);
+console.log('---');
+console.log('Pre-defined users:');
+console.log(JSON.stringify(users, null, 2));
+console.log('---');
@@ -0,0 +1,48 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/oidc-setup",
+  timeout: 5000,
+  testDir: "./tests/playwright/oidc",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    storageState: "loginAuth.json",
+    actionTimeout: 5000,
+    //storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});
@@ -0,0 +1 @@
+demo-127.0.0.1:$apr1$j5FRA4Bc$RYdNFuM7YAAo9Qtie8w4b/
@@ -1,6 +1,6 @@
 server:
  port: 8080
-  baseURL:  "/"
+  baseURL:  "/subpath"
  logging:
    - levels: "info|error|debug"
  sources:
@@ -32,5 +32,5 @@ userDefaults:
  permissions:
    admin: false
    modify: true
-    share: false
+    share: true
    api: false
@@ -7,13 +7,25 @@ server {
    listen 80;
    server_name localhost 127.0.0.1;

-    location / {
+    location /subpath/public/ {
+        proxy_pass http://filebrowser:8080/subpath/public/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    } 
+
+    # requires basic auth demo-127.0.0.1:SecurePass123!
+    location /subpath {
+        auth_basic "Restricted Access";
+        auth_basic_user_file /etc/nginx/conf.d/.htpasswd;
        proxy_set_header X-Username $uuid;
        add_header X-Username $uuid;
-        proxy_pass http://filebrowser:8080;
+        proxy_pass http://filebrowser:8080/subpath;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
+
 }
@@ -10,9 +10,9 @@ import { defineConfig, devices } from "@playwright/test";
 * See https://playwright.dev/docs/test-configuration.
 */
 export default defineConfig({
-  //globalSetup: "./global-setup",
-  timeout: 3000,
-  testDir: "./tests-playwright/proxy",
+  globalSetup: "./tests/playwright/proxy-setup.ts",
+  timeout: 5000,
+  testDir: "./tests/playwright/proxy",
  /* Run tests in files in parallel */
  fullyParallel: false,
  /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -25,8 +25,8 @@ export default defineConfig({
  reporter: "line",
  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
  use: {
-    actionTimeout: 3000,
-    //storageState: "loginAuth.json",
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
    /* Base URL to use in actions like `await page.goto('/')`. */
    baseURL: "http://127.0.0.1",

@@ -0,0 +1,22 @@
+server:
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      name: "playwright + files"
+      config:
+        defaultEnabled: true
+    - path: "."
+      name: "docker"
+      config:
+        private: true
+        defaultEnabled: true
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/global-setup",
+  timeout: 10000,
+  testDir: "./tests/playwright/sharing",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1,
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1/",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});
@@ -0,0 +1,17 @@
+root = "."
+tmp_dir = "tmp"
+
+[build]
+  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/version.CommitSHA=testingCommit' -X 'github.com/gtsteffaniak/filebrowser/backend/version.Version=testing'\" ."
+  bin = "tmp/filebrowser"
+  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser -c test_config.yaml"
+  include_ext = ["go", "tpl", "tmpl", "html"]
+  exclude_dir = ["tmp", "vendor", "http/dist", "http/embed", "swagger/docs"]
+  log = "air.log"
+  delay = 1000 # ms
+
+[log]
+  time = true
+
+[misc]
+  clean_on_exit = true
@@ -0,0 +1,5 @@
+tmp/
+air.log
+filebrowser
+generated.yaml
+test_config.yaml
@@ -22,20 +22,22 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

-func FileInfoFaster(opts iteminfo.FileOptions) (iteminfo.ExtendedFileInfo, error) {
-	response := iteminfo.ExtendedFileInfo{}
+func FileInfoFaster(opts iteminfo.FileOptions) (*iteminfo.ExtendedFileInfo, error) {
+	response := &iteminfo.ExtendedFileInfo{}
 	index := indexing.GetIndex(opts.Source)
 	if index == nil {
 		return response, fmt.Errorf("could not get index: %v ", opts.Source)
 	}
+
 	realPath, isDir, err := index.GetRealPath(opts.Path)
 	if err != nil {
-		return response, err
+		return response, fmt.Errorf("could not get real path for requested path: %v", opts.Path)
 	}
 	opts.IsDir = isDir
 	var info *iteminfo.FileInfo
@@ -47,7 +49,7 @@ func FileInfoFaster(opts iteminfo.FileOptions) (iteminfo.ExtendedFileInfo, error
 			if err != nil {
 				return response, err
 			}
-		} else {
+		} else if err == errors.ErrNotIndexed {
 			return response, fmt.Errorf("could not refresh file info: %v", err)
 		}
 	} else {
@@ -56,33 +58,71 @@ func FileInfoFaster(opts iteminfo.FileOptions) (iteminfo.ExtendedFileInfo, error
 			return response, fmt.Errorf("could not get metadata for path: %v", opts.Path)
 		}
 	}
-	if opts.Content {
-		if info.Size < 20*1024*1024 { // 20 megabytes in bytes
-			content, err := getContent(realPath)
-			if err != nil {
-				logger.Debugf("could not get content for file: "+info.Path, info.Name, err)
-				return response, err
-			}
-			response.Content = content
-		} else {
-			logger.Debug("skipping large text file contents (20MB limit): "+info.Path, info.Name)
-		}
-	}
 	response.FileInfo = *info
 	response.RealPath = realPath
 	response.Source = opts.Source
+
+	if opts.Access != nil && !opts.Access.Permitted(index.Path, opts.Path, opts.Username) {
+		// check if any subpath is permitted
+		// keep track of permitted paths and only show them at the end
+		subFolders := info.Folders
+		subFiles := info.Files
+		response.Folders = make([]iteminfo.ItemInfo, 0)
+		response.Files = make([]iteminfo.ItemInfo, 0)
+		hasPermittedPaths := false
+		for _, subFolder := range subFolders {
+			indexPath := info.Path + subFolder.Name
+			if opts.Access.Permitted(index.Path, indexPath, opts.Username) {
+				hasPermittedPaths = true
+				response.Folders = append(response.Folders, subFolder)
+			}
+		}
+		for _, subFile := range subFiles {
+			indexPath := info.Path + subFile.Name
+			if opts.Access.Permitted(index.Path, indexPath, opts.Username) {
+				hasPermittedPaths = true
+				response.Files = append(response.Files, subFile)
+			}
+		}
+		if !hasPermittedPaths {
+			return response, errors.ErrPermissionDenied
+		}
+	}
+	if opts.Content {
+		processContent(response, index)
+	}
 	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
 		response.OnlyOfficeId = generateOfficeId(realPath)
 	}
-	if strings.HasPrefix(info.Type, "video") {
-		parentInfo, exists := index.GetReducedMetadata(filepath.Dir(info.Path), true)
-		if exists {
-			response.DetectSubtitles(parentInfo)
-		}
-	}
+
 	return response, nil
 }

+func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index) {
+	isVideo := strings.HasPrefix(info.Type, "video")
+	if isVideo {
+		parentInfo, exists := idx.GetReducedMetadata(filepath.Dir(info.Path), true)
+		if exists {
+			info.DetectSubtitles(parentInfo)
+			err := info.LoadSubtitleContent()
+			if err != nil {
+				logger.Debug("failed to load subtitle content: " + err.Error())
+			}
+		}
+		return
+	}
+	if info.Size < 20*1024*1024 { // 20 megabytes in bytes
+		content, err := getContent(info.RealPath)
+		if err != nil {
+			logger.Debugf("could not get content for file: "+info.RealPath, info.Name, err)
+			return
+		}
+		info.Content = content
+	} else {
+		logger.Debug("skipping large text file contents (20MB limit): "+info.Path, info.Name)
+	}
+}
+
 func generateOfficeId(realPath string) string {
 	key, ok := utils.OnlyOfficeCache.Get(realPath).(string)
 	if !ok {
@@ -156,28 +196,77 @@ func RefreshIndex(source string, path string, isDir bool) error {
 	return idx.RefreshFileInfo(iteminfo.FileOptions{Path: path, IsDir: isDir})
 }

-func MoveResource(sourceIndex, destIndex, realsrc, realdst string) error {
+// validateMoveDestination checks if a move/rename operation is valid
+// It prevents moving a directory into itself or its subdirectories
+func validateMoveDestination(src, dst string, isSrcDir bool) error {
+	// Clean and normalize paths
+	src = filepath.Clean(src)
+	dst = filepath.Clean(dst)
+
+	// If source is a directory, check if destination is within source
+	if isSrcDir {
+		// Get the parent directory of the destination
+		dstParent := filepath.Dir(dst)
+
+		// Check if destination parent is the source directory or a subdirectory of it
+		if strings.HasPrefix(dstParent+string(filepath.Separator), src+string(filepath.Separator)) || dstParent == src {
+			return fmt.Errorf("cannot move directory '%s' to a location within itself: '%s'", src, dst)
+		}
+	}
+
+	// Check if destination parent directory exists
+	dstParent := filepath.Dir(dst)
+	if dstParent != "." && dstParent != "/" {
+		if _, err := os.Stat(dstParent); os.IsNotExist(err) {
+			return fmt.Errorf("destination directory does not exist: '%s'", dstParent)
+		}
+	}
+
+	return nil
+}
+
+func MoveResource(isSrcDir, isDestDir bool, sourceIndex, destIndex, realsrc, realdst string, s *share.Storage) error {
+	// Validate the move operation before executing
+	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
+		return err
+	}
+
 	err := fileutils.MoveFile(realsrc, realdst)
 	if err != nil {
 		return err
 	}
-	err = RefreshIndex(sourceIndex, filepath.Dir(realsrc), true)
-	if err != nil {
-		return err
+	go RefreshIndex(sourceIndex, realsrc, isSrcDir) //nolint:errcheck
+	go RefreshIndex(destIndex, realdst, isDestDir)  //nolint:errcheck
+
+	// update shares
+	idx := indexing.GetIndex(sourceIndex)
+	if idx == nil {
+		return fmt.Errorf("could not get index: %v ", sourceIndex)
 	}
-	return RefreshIndex(destIndex, filepath.Dir(realdst), true)
+	idx2 := indexing.GetIndex(destIndex)
+	if idx2 == nil {
+		return fmt.Errorf("could not get index: %v ", destIndex)
+	}
+
+	// Use backend source paths to match how shares are stored
+	go s.UpdateShares(idx.Path, idx.MakeIndexPath(realsrc), idx2.Path, idx2.MakeIndexPath(realdst)) //nolint:errcheck
+	return nil
 }

-func CopyResource(sourceIndex, destIndex, realsrc, realdst string) error {
+func CopyResource(isSrcDir, isDestDir bool, sourceIndex, destIndex, realsrc, realdst string) error {
+	// Validate the copy operation before executing
+	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
+		return err
+	}
+
 	err := fileutils.CopyFile(realsrc, realdst)
 	if err != nil {
 		return err
 	}
-	err = RefreshIndex(sourceIndex, filepath.Dir(realsrc), true)
-	if err != nil {
-		return err
-	}
-	return RefreshIndex(destIndex, filepath.Dir(realdst), true)
+	go RefreshIndex(sourceIndex, realsrc, isSrcDir) //nolint:errcheck
+	go RefreshIndex(destIndex, realdst, isDestDir)  //nolint:errcheck
+	// update shares
+	return nil
 }

 func WriteDirectory(opts iteminfo.FileOptions) error {
@@ -187,7 +276,7 @@ func WriteDirectory(opts iteminfo.FileOptions) error {
 	}
 	realPath, _, _ := idx.GetRealPath(opts.Path)
 	// Ensure the parent directories exist
-	err := os.MkdirAll(realPath, 0775)
+	err := os.MkdirAll(realPath, fileutils.PermDir)
 	if err != nil {
 		return err
 	}
@@ -201,12 +290,12 @@ func WriteFile(opts iteminfo.FileOptions, in io.Reader) error {
 	}
 	dst, _, _ := idx.GetRealPath(opts.Path)
 	// Ensure the parent directories exist
-	err := os.MkdirAll(filepath.Dir(dst), 0775)
+	err := os.MkdirAll(filepath.Dir(dst), fileutils.PermDir)
 	if err != nil {
 		return err
 	}
 	// Open the file for writing (create if it doesn't exist, truncate if it does)
-	file, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0775)
+	file, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileutils.PermFile)
 	if err != nil {
 		return err
 	}
@@ -293,7 +382,6 @@ func getContent(realPath string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-
 	// Handle empty file (original logic - returns specific string)
 	if len(content) == 0 {
 		return "empty-file-x6OlSil", nil
@@ -10,6 +10,9 @@ import (
 	"github.com/gtsteffaniak/go-logger/logger"
 )

+const PermFile = 0644
+const PermDir = 0755
+
 // MoveFile moves a file from src to dst.
 // By default, the rename system call is used. If src and dst point to different volumes,
 // the file copy is used as a fallback.
@@ -63,13 +66,13 @@ func copySingleFile(source, dest string) error {
 	defer src.Close()

 	// Create the destination directory if needed.
-	err = os.MkdirAll(filepath.Dir(dest), 0775) //nolint:gomnd
+	err = os.MkdirAll(filepath.Dir(dest), PermDir)
 	if err != nil {
 		return err
 	}

 	// Create the destination file.
-	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0666) //nolint:gomnd
+	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, PermFile)
 	if err != nil {
 		return err
 	}
@@ -97,7 +100,7 @@ func copySingleFile(source, dest string) error {
 // copyDirectory handles copying directories recursively.
 func copyDirectory(source, dest string) error {
 	// Create the destination directory.
-	err := os.MkdirAll(dest, 0775) //nolint:gomnd
+	err := os.MkdirAll(dest, PermDir)
 	if err != nil {
 		return err
 	}
@@ -8,12 +8,12 @@ import (
 )

 var (
-	revokedApiKeyList map[string]bool
+	revokedApiKeyList map[string]struct{}
 	revokeMu          sync.Mutex
 )

 func init() {
-	revokedApiKeyList = make(map[string]bool)
+	revokedApiKeyList = make(map[string]struct{})
 }

 // Auther is the authentication interface.
@@ -32,5 +32,5 @@ func IsRevokedApiKey(key string) bool {
 func RevokeAPIKey(key string) {
 	revokeMu.Lock()
 	defer revokeMu.Unlock()
-	revokedApiKeyList[key] = true
+	revokedApiKeyList[key] = struct{}{}
 }
@@ -2,10 +2,13 @@ package auth

 import (
 	"encoding/base64"
+	"log"
+
+	"crypto/sha256"

 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
+	"golang.org/x/crypto/pbkdf2"
 )

 // StorageBackend is a storage backend for auth storage.
@@ -35,9 +38,19 @@ func NewStorage(back StorageBackend, userStore *users.Storage) (*Storage, error)
 	if err != nil {
 		return nil, err
 	}
-	encryptionKey, err = base64.StdEncoding.DecodeString(settings.Config.Auth.TotpSecret)
-	if err != nil {
-		logger.Warning("failed to decode TOTP secret, using default key. This is insecure and should be fixed.")
+	if settings.Config.Auth.TotpSecret != "" {
+		key, err := base64.StdEncoding.DecodeString(settings.Config.Auth.TotpSecret)
+		keyLen := len(key)
+
+		if err == nil && (keyLen == 16 || keyLen == 24 || keyLen == 25) {
+			// Use the user-provided key if it's valid
+			encryptionKey = key
+		} else {
+			// Otherwise, derive the key from the provided secret string
+			log.Println("[WARN] totpSecret is not a valid Base64 encoded key. Deriving a key from it. For better security, generate a secret with 'openssl rand -base64 32'.")
+			salt := []byte{0xda, 0x90, 0x45, 0xc3, 0x06, 0xb5, 0x99, 0x9f, 0xb6, 0xae, 0xfc, 0x14, 0xef, 0x27, 0x6e, 0x6a}
+			encryptionKey = pbkdf2.Key([]byte(settings.Config.Auth.TotpSecret), salt, 4096, 32, sha256.New)
+		}
 	}
 	return store, nil
 }
@@ -11,10 +11,10 @@ import (

 	"github.com/goccy/go-yaml"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -85,10 +85,7 @@ func runCLI() bool {
 			}
 			username := userInfo[0]
 			password := userInfo[1]
-			ok := getStore(dbConfig)
-			if !ok {
-				logger.Fatal("could not load db info")
-			}
+			_ = getStore(dbConfig) // ignore bool check
 			user, err := store.Users.Get(username)
 			if err != nil {
 				newUser := users.User{
@@ -113,7 +110,9 @@ func runCLI() bool {
 				} else {
 					logger.Infof("Creating non-admin user: %s\n", username)
 				}
-				err = storage.CreateUser(newUser, asAdmin)
+				newUser.Permissions = settings.Config.UserDefaults.Permissions
+				newUser.Permissions.Admin = asAdmin
+				err = storage.CreateUser(newUser)
 				if err != nil {
 					logger.Errorf("could not create user: %v", err)
 				}
@@ -259,7 +258,7 @@ func createConfig(configpath string) {
 		if err == nil {
 			var isDir bool
 			// Resolve symlinks and get the real path
-			realPath, isDir, _ = utils.ResolveSymlinks(absolutePath)
+			realPath, isDir, _ = iteminfo.ResolveSymlinks(absolutePath)
 			if realPath != "" && isDir {
 				break // Valid path found, exit loop
 			}
@@ -333,7 +332,7 @@ func createConfig(configpath string) {
 	}
 	// cleanup database if it exists
 	if _, err := os.Stat(config.Server.Database); err == nil {
-		response := askYesNoQuestion(reader, "Database specified already exists. Move databse file to backup to start fresh?", "no")
+		response := askYesNoQuestion(reader, "Database specified already exists. Move database file to backup to start fresh?", "no")
 		if !response {
 			return
 		}
@@ -14,6 +14,7 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
 	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
@@ -22,7 +23,7 @@ import (
 	"github.com/swaggo/swag"
 )

-var store *storage.Storage
+var store *bolt.BoltStore

 func getStore(configFile string) bool {
 	// Use the config file (global flag)
@@ -53,12 +54,14 @@ func StartFilebrowser() {
 	if !keepGoing {
 		return
 	}
-	info, _ := utils.CheckForUpdates()
-	if info.LatestVersion != "" {
-		logger.Infof("A new version is available: %s (current: %s)", info.LatestVersion, info.CurrentVersion)
-		logger.Infof("Release notes: %s", info.ReleaseNotes)
+	if !settings.Config.Server.DisableUpdateCheck {
+		info, _ := utils.CheckForUpdates()
+		if info.LatestVersion != "" {
+			logger.Infof("A new version is available: %s (current: %s)", info.LatestVersion, info.CurrentVersion)
+			logger.Infof("Release notes: %s", info.ReleaseNotes)
+		}
+		go utils.StartCheckForUpdates()
 	}
-	go utils.StartCheckForUpdates()

 	// Create context and channels for graceful shutdown
 	ctx, cancel := context.WithCancel(context.Background())
@@ -119,7 +122,7 @@ func StartFilebrowser() {
 	logger.Info("Shutdown complete.")
 }

-func rootCMD(ctx context.Context, store *storage.Storage, serverConfig *settings.Server, shutdownComplete chan struct{}) error {
+func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.Server, shutdownComplete chan struct{}) error {
 	if serverConfig.NumImageProcessors < 1 {
 		logger.Fatal("Image resize workers count could not be < 1")
 	}
@@ -21,10 +21,6 @@ func validateUserInfo() {
 	for _, user := range usersList {
 		changePass := false
 		updateUser := false
-		if user.Username == "publicUser" {
-			settings.ApplyUserDefaults(user)
-			updateUser = true
-		}
 		if updateUserScopes(user) {
 			updateUser = true
 		}
@@ -65,7 +61,7 @@ func validateUserInfo() {

 func updateUserScopes(user *users.User) bool {
 	newScopes := []users.SourceScope{}
-	seen := make(map[string]bool)
+	seen := make(map[string]struct{})

 	// Build map for existing scopes by Name
 	existing := make(map[string]users.SourceScope)
@@ -95,12 +91,12 @@ func updateUserScopes(user *users.User) bool {
 			Name:  realsource.Path,
 			Scope: existingScope.Scope,
 		})
-		seen[realsource.Path] = true
+		seen[realsource.Path] = struct{}{}
 	}

 	// Preserve user-defined scopes not matching current sources, append to end
 	for _, s := range user.Scopes {
-		if !seen[s.Name] {
+		if _, ok := seen[s.Name]; !ok {
 			newScopes = append(newScopes, s)
 		}
 	}
@@ -12,12 +12,12 @@ import (
 )

 type Auth struct {
-	TokenExpirationHours int          `json:"tokenExpirationHours"` // the number of hours until the token expires. Default is 2 hours.
+	TokenExpirationHours int          `json:"tokenExpirationHours"` // time in hours each web UI session token is valid for. Default is 2 hours.
 	Methods              LoginMethods `json:"methods"`
-	Key                  string       `json:"key"`           // the key used to sign the JWT tokens. If not set, a random key will be generated.
-	AdminUsername        string       `json:"adminUsername"` // the username of the admin user. If not set, the default is "admin".
-	AdminPassword        string       `json:"adminPassword"` // the password of the admin user. If not set, the default is "admin".
-	TotpSecret           string       `json:"totpSecret"`    // secret used to encrypt TOTP secrets
+	Key                  string       `json:"key"`           // secret: the key used to sign the JWT tokens. If not set, a random key will be generated.
+	AdminUsername        string       `json:"adminUsername"` // secret: the username of the admin user. If not set, the default is "admin".
+	AdminPassword        string       `json:"adminPassword"` // secret: the password of the admin user. If not set, the default is "admin".
+	TotpSecret           string       `json:"totpSecret"`    // secret: secret used to encrypt TOTP secrets
 	AuthMethods          []string     `json:"-"`
 }

@@ -52,8 +52,8 @@ type Recaptcha struct {
 // OpenID OAuth2.0
 type OidcConfig struct {
 	Enabled           bool                  `json:"enabled"`           // whether to enable OIDC authentication
-	ClientID          string                `json:"clientId"`          // client id of the OIDC application
-	ClientSecret      string                `json:"clientSecret"`      // client secret of the OIDC application
+	ClientID          string                `json:"clientId"`          // secret: client id of the OIDC application
+	ClientSecret      string                `json:"clientSecret"`      // secret: client secret of the OIDC application
 	IssuerUrl         string                `json:"issuerUrl"`         // authorization URL of the OIDC provider
 	Scopes            string                `json:"scopes"`            // scopes to request from the OIDC provider
 	UserIdentifier    string                `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username", can also be "email" or "username", or "phone"
@@ -82,7 +82,6 @@ func validateOidcAuth() error {
 	if !oidcCfg.Enabled {
 		return errors.New("OIDC is not enabled")
 	}
-
 	ctx := context.Background()

 	// If disableVerifyTLS is true, create a custom HTTP client
@@ -44,10 +44,13 @@ func Initialize(configFile string) {
 	setupAuth(false)
 	setupSources(false)
 	setupUrls()
-	setupFrontend()
+	setupFrontend(false)
 }

-func setupFrontend() {
+func setupFrontend(generate bool) {
+	if Config.Server.MinSearchLength == 0 {
+		Config.Server.MinSearchLength = 3
+	}
 	if !Config.Frontend.DisableDefaultLinks {
 		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
 			Text:  fmt.Sprintf("(%v)", version.Version),
@@ -56,9 +59,41 @@ func setupFrontend() {
 		})
 		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
 			Text: "Help",
-			Url:  "https://github.com/gtsteffaniak/filebrowser/wiki",
+			Url:  "help prompt",
 		})
 	}
+	if Config.Frontend.Description == "" {
+		Config.Frontend.Description = "FileBrowser Quantum is a file manager for the web which can be used to manage files on your server"
+	}
+	Config.Frontend.Styling.LightBackground = FallbackColor(Config.Frontend.Styling.LightBackground, "#f5f5f5")
+	Config.Frontend.Styling.DarkBackground = FallbackColor(Config.Frontend.Styling.DarkBackground, "#141D24")
+	Config.Frontend.Styling.CustomCSSRaw = readCustomCSS(Config.Frontend.Styling.CustomCSS)
+	Config.Frontend.Styling.CustomThemeOptions = map[string]CustomTheme{}
+	Config.Frontend.Styling.CustomThemes = map[string]CustomTheme{}
+	for name, theme := range Config.Frontend.Styling.CustomThemes {
+		addCustomTheme(name, theme.Description, theme.CSS)
+	}
+	noThemes := len(Config.Frontend.Styling.CustomThemes) == 0
+	if noThemes {
+		addCustomTheme("default", "The default theme", "")
+		// check if file exists
+		if _, err := os.Stat("reduce-rounded-corners.css"); err == nil {
+			addCustomTheme("alternative", "Reduce rounded corners", "reduce-rounded-corners.css")
+			if generate {
+				Config.Frontend.Styling.CustomThemes["alternative"] = CustomTheme{
+					Description: "Reduce rounded corners",
+					CSS:         "reduce-rounded-corners.css",
+				}
+			}
+		}
+	}
+	_, ok := Config.Frontend.Styling.CustomThemes["default"]
+	if !ok {
+		addCustomTheme("default", "The default theme", "")
+	}
+
+	// Load custom favicon if configured
+	loadCustomFavicon()
 }

 func getRealPath(path string) string {
@@ -78,6 +113,9 @@ func setupSources(generate bool) {
 		logger.Fatal("There are no `server.sources` configured. If you have `server.root` configured, please update the config and add at least one `server.sources` with a `path` configured.")
 	} else {
 		for k, source := range Config.Server.Sources {
+			if source.Config.Disabled {
+				continue
+			}
 			realPath := getRealPath(source.Path)
 			name := filepath.Base(realPath)
 			if name == "\\" {
@@ -139,8 +177,16 @@ func setupUrls() {
 	} else {
 		Config.Server.BaseURL = "/" + baseurl + "/"
 	}
-	Config.Server.InternalUrl = strings.Trim(Config.Server.InternalUrl, "/")
-	Config.Server.ExternalUrl = strings.Trim(Config.Server.ExternalUrl, "/")
+	if Config.Server.BaseURL != "/" {
+		if Config.Server.ExternalUrl != "" {
+			Config.Server.ExternalUrl = strings.TrimSuffix(Config.Server.ExternalUrl, "/") + "/"
+			Config.Server.ExternalUrl = strings.TrimSuffix(Config.Server.ExternalUrl, Config.Server.BaseURL)
+		}
+		if Config.Server.InternalUrl != "" {
+			Config.Server.InternalUrl = strings.TrimSuffix(Config.Server.InternalUrl, "/") + "/"
+			Config.Server.InternalUrl = strings.TrimSuffix(Config.Server.InternalUrl, Config.Server.BaseURL)
+		}
+	}
 	Config.Integrations.OnlyOffice.Url = strings.Trim(Config.Integrations.OnlyOffice.Url, "/")
 	Config.Integrations.OnlyOffice.InternalUrl = strings.Trim(Config.Integrations.OnlyOffice.InternalUrl, "/")
 }
@@ -188,8 +234,14 @@ func setupLogging() {
 		}
 	}
 	for _, logConfig := range Config.Server.Logging {
+		// Enable debug logging automatically in dev mode
+		levels := logConfig.Levels
+		if os.Getenv("FILEBROWSER_DEVMODE") == "true" {
+			levels = "info|warning|error|debug"
+		}
+
 		logConfig := logger.JsonConfig{
-			Levels:    logConfig.Levels,
+			Levels:    levels,
 			ApiLevels: logConfig.ApiLevels,
 			Output:    logConfig.Output,
 			Utc:       logConfig.Utc,
@@ -335,17 +387,17 @@ func setDefaults(generate bool) Settings {
 		Frontend: Frontend{
 			Name: "FileBrowser Quantum",
 		},
+
 		UserDefaults: UserDefaults{
-			DisableOnlyOfficeExt: ".txt .csv .html .pdf",
-			StickySidebar:        true,
-			LockPassword:         false,
-			ShowHidden:           false,
-			DarkMode:             true,
-			DisableSettings:      false,
-			ViewMode:             "normal",
-			Locale:               "en",
-			GallerySize:          3,
-			ThemeColor:           "var(--blue)",
+			StickySidebar:   true,
+			LockPassword:    false,
+			ShowHidden:      false,
+			DarkMode:        true,
+			DisableSettings: false,
+			ViewMode:        "normal",
+			Locale:          "en",
+			GallerySize:     3,
+			ThemeColor:      "var(--blue)",
 			Permissions: users.Permissions{
 				Modify: false,
 				Share:  false,
@@ -468,6 +520,54 @@ func GetSources(u *users.User) []string {
 	return sources
 }

+func loadCustomFavicon() {
+	// Check if a custom favicon path is configured
+	if Config.Frontend.Favicon == "" {
+		logger.Debug("No custom favicon configured, using default")
+		return
+	}
+
+	// Get absolute path for the favicon
+	faviconPath, err := filepath.Abs(Config.Frontend.Favicon)
+	if err != nil {
+		logger.Warningf("Could not resolve favicon path '%v': %v", Config.Frontend.Favicon, err)
+		Config.Frontend.Favicon = "" // Unset invalid path
+		return
+	}
+
+	// Check if the favicon file exists and get info
+	stat, err := os.Stat(faviconPath)
+	if err != nil {
+		logger.Warningf("Could not access custom favicon file '%v': %v", faviconPath, err)
+		Config.Frontend.Favicon = "" // Unset invalid path
+		return
+	}
+
+	// Check file size (limit to 1MB for security)
+	const maxFaviconSize = 1024 * 1024 // 1MB
+	if stat.Size() > maxFaviconSize {
+		logger.Warningf("Favicon file '%v' is too large (%d bytes), maximum allowed is %d bytes", faviconPath, stat.Size(), maxFaviconSize)
+		Config.Frontend.Favicon = "" // Unset invalid path
+		return
+	}
+
+	// Validate file format based on extension
+	ext := strings.ToLower(filepath.Ext(faviconPath))
+	switch ext {
+	case ".ico", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp":
+		// Valid favicon formats
+	default:
+		logger.Warningf("Unsupported favicon format '%v', supported formats: .ico, .png, .jpg, .gif, .svg, .webp", ext)
+		Config.Frontend.Favicon = "" // Unset invalid path
+		return
+	}
+
+	// Update to absolute path and mark as valid
+	Config.Frontend.Favicon = faviconPath
+
+	logger.Infof("Successfully validated custom favicon at '%v' (%d bytes, %s)", faviconPath, stat.Size(), ext)
+}
+
 func modifyExcludeInclude(config *Source) {
 	normalize := func(s []string, checkExists bool) {
 		for i, v := range s {
@@ -14,19 +14,44 @@ import (
 	"gopkg.in/yaml.v3"
 )

-// commentsMap[typeName][fieldName] = combined doc+inline comment text
-type commentsMap map[string]map[string]string
+// CommentsMap[typeName][fieldName] = combined doc+inline comment text
+type CommentsMap map[string]map[string]string

-// collectComments parses all Go source in the directory of srcPath and returns commentsMap.
-func collectComments(srcPath string) (commentsMap, error) {
+// SecretFieldsMap[typeName][fieldName] = true if field should be redacted
+type SecretFieldsMap map[string]map[string]bool
+
+// DeprecatedFieldsMap[typeName][fieldName] = true if field is deprecated
+type DeprecatedFieldsMap map[string]map[string]bool
+
+// getStringStyle determines whether a string should be quoted in YAML
+func getStringStyle(value string) yaml.Style {
+	// Always quote all strings for consistency
+	return yaml.DoubleQuotedStyle
+}
+
+// CollectComments parses all Go source in the directory of srcPath and returns CommentsMap.
+func CollectComments(srcPath string) (CommentsMap, error) {
+	comments, _, _, err := CollectCommentsAndSecrets(srcPath)
+	return comments, err
+}
+
+// CollectCommentsAndSecrets parses all Go source and returns comments, secrets, and deprecated field mappings
+func CollectCommentsAndSecrets(srcPath string) (CommentsMap, SecretFieldsMap, DeprecatedFieldsMap, error) {
 	// parse entire package so we capture comments on all types
-	dir := filepath.Dir(srcPath)
+	dir := srcPath
+	if filepath.IsAbs(srcPath) {
+		// If it's an absolute path to a file, get the directory
+		dir = filepath.Dir(srcPath)
+	}
+
 	fset := token.NewFileSet()
 	pkgs, err := parser.ParseDir(fset, dir, nil, parser.ParseComments)
 	if err != nil {
-		return nil, err
+		return nil, nil, nil, err
 	}
-	out := make(commentsMap)
+	comments := make(CommentsMap)
+	secrets := make(SecretFieldsMap)
+	deprecated := make(DeprecatedFieldsMap)
 	for _, pkg := range pkgs {
 		for _, file := range pkg.Files {
 			for _, decl := range file.Decls {
@@ -43,48 +68,81 @@ func collectComments(srcPath string) (commentsMap, error) {
 					if !ok {
 						continue
 					}
-					m := make(map[string]string)
-					out[ts.Name.Name] = m
+					typeName := ts.Name.Name
+					commentMap := make(map[string]string)
+					secretMap := make(map[string]bool)
+					deprecatedMap := make(map[string]bool)
+					comments[typeName] = commentMap
+					secrets[typeName] = secretMap
+					deprecated[typeName] = deprecatedMap
+
 					for _, field := range st.Fields.List {
 						if len(field.Names) == 0 {
 							continue
 						}
 						name := field.Names[0].Name
 						var parts []string
+						var fullComment string
+
 						if field.Doc != nil {
-							parts = append(parts, strings.TrimSpace(field.Doc.Text()))
+							docText := strings.TrimSpace(field.Doc.Text())
+							parts = append(parts, docText)
+							fullComment += docText + " "
 						}
 						if field.Comment != nil {
-							parts = append(parts, strings.TrimSpace(field.Comment.Text()))
+							commentText := strings.TrimSpace(field.Comment.Text())
+							parts = append(parts, commentText)
+							fullComment += commentText
 						}
+
 						if len(parts) > 0 {
-							m[name] = strings.Join(parts, " : ")
+							commentMap[name] = strings.Join(parts, " : ")
+						}
+
+						// Check if field should be treated as secret
+						if strings.Contains(strings.ToLower(fullComment), "secret:") {
+							secretMap[name] = true
+						}
+
+						// Check if field should be treated as deprecated
+						if strings.Contains(strings.ToLower(fullComment), "deprecated:") {
+							deprecatedMap[name] = true
 						}
 					}
 				}
 			}
 		}
 	}
-	return out, nil
+	return comments, secrets, deprecated, nil
 }

-// buildNode constructs a yaml.Node for any Go value, injecting comments on struct fields.
-func buildNode(v reflect.Value, comm commentsMap) (*yaml.Node, error) {
+// BuildNode constructs a yaml.Node for any Go value, injecting comments on struct fields.
+func BuildNode(v reflect.Value, comm CommentsMap) (*yaml.Node, error) {
+	return buildNodeWithDefaults(v, comm, reflect.Value{}, SecretFieldsMap{}, DeprecatedFieldsMap{})
+}
+
+// buildNodeWithDefaults constructs a yaml.Node for any Go value, skipping fields that match defaults, redacting secrets, and filtering deprecated fields
+func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.Value, secrets SecretFieldsMap, deprecated DeprecatedFieldsMap) (*yaml.Node, error) {
 	// Dereference pointers
 	if v.Kind() == reflect.Ptr {
 		if v.IsNil() {
 			return &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!null", Value: "null"}, nil
 		}
-		return buildNode(v.Elem(), comm)
+		var defaultsElem reflect.Value
+		if defaults.IsValid() && !defaults.IsNil() {
+			defaultsElem = defaults.Elem()
+		}
+		return buildNodeWithDefaults(v.Elem(), comm, defaultsElem, secrets, deprecated)
 	}

 	switch v.Kind() {
 	case reflect.String:
+		value := v.String()
 		return &yaml.Node{
 			Kind:  yaml.ScalarNode,
 			Tag:   "!!str",
-			Value: v.String(),
-			Style: yaml.DoubleQuotedStyle,
+			Value: value,
+			Style: getStringStyle(value),
 		}, nil
 	case reflect.Struct:
 		rt := v.Type()
@@ -104,6 +162,26 @@ func buildNode(v reflect.Value, comm commentsMap) (*yaml.Node, error) {
 				continue
 			}

+			// Skip deprecated fields if filtering is enabled
+			if len(deprecated) > 0 && deprecated[typeName][sf.Name] {
+				continue
+			}
+
+			currentField := v.Field(i)
+
+			// If we have defaults, compare and skip if values match
+			if defaults.IsValid() && i < defaults.NumField() {
+				defaultField := defaults.Field(i)
+				currentValue := currentField.Interface()
+				defaultValue := defaultField.Interface()
+
+				isEqual := reflect.DeepEqual(currentValue, defaultValue)
+
+				if isEqual {
+					continue // Skip this field as it matches the default
+				}
+			}
+
 			// determine key: yaml tag > json tag > field name
 			yamlTag := sf.Tag.Get("yaml")
 			jsonTag := sf.Tag.Get("json")
@@ -118,22 +196,43 @@ func buildNode(v reflect.Value, comm commentsMap) (*yaml.Node, error) {

 			keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: keyName}

-			// attach validate and comments inline
+			// attach validate and comments inline (only when comments are enabled)
 			var parts []string
 			if cm := comm[typeName][sf.Name]; cm != "" {
 				parts = append(parts, cm)
 			}
-			if vt := sf.Tag.Get("validate"); vt != "" {
-				parts = append(parts, fmt.Sprintf(" validate:%s", vt))
+			// Only add validation tags if comments map is not empty (meaning comments are enabled)
+			if len(comm) > 0 {
+				if vt := sf.Tag.Get("validate"); vt != "" {
+					parts = append(parts, fmt.Sprintf(" validate:%s", vt))
+				}
 			}

 			if len(parts) > 0 {
 				keyNode.LineComment = strings.Join(parts, " ")
 			}

-			valNode, err := buildNode(v.Field(i), comm)
-			if err != nil {
-				return nil, err
+			// Check if this field should be redacted as a secret
+			var valNode *yaml.Node
+			var err error
+			if secrets[typeName][sf.Name] {
+				valNode = &yaml.Node{
+					Kind:  yaml.ScalarNode,
+					Tag:   "!!str",
+					Value: "**hidden**",
+					Style: yaml.DoubleQuotedStyle, // Keep secrets quoted for clarity
+				}
+			} else {
+				// Pass through the corresponding default field for recursive comparison
+				var defaultField reflect.Value
+				if defaults.IsValid() && i < defaults.NumField() {
+					defaultField = defaults.Field(i)
+				}
+
+				valNode, err = buildNodeWithDefaults(currentField, comm, defaultField, secrets, deprecated)
+				if err != nil {
+					return nil, err
+				}
 			}
 			mapNode.Content = append(mapNode.Content, keyNode, valNode)
 		}
@@ -148,7 +247,11 @@ func buildNode(v reflect.Value, comm commentsMap) (*yaml.Node, error) {
 		// placeholder for empty slice of structs
 		if v.Len() == 0 && v.Type().Elem().Kind() == reflect.Struct {
 			zero := reflect.Zero(v.Type().Elem())
-			n, err := buildNode(zero, comm)
+			var defaultElem reflect.Value
+			if defaults.IsValid() && defaults.Len() > 0 {
+				defaultElem = defaults.Index(0)
+			}
+			n, err := buildNodeWithDefaults(zero, comm, defaultElem, secrets, deprecated)
 			if err != nil {
 				return nil, err
 			}
@@ -156,7 +259,11 @@ func buildNode(v reflect.Value, comm commentsMap) (*yaml.Node, error) {
 			return seq, nil
 		}
 		for i := 0; i < v.Len(); i++ {
-			n, err := buildNode(v.Index(i), comm)
+			var defaultElem reflect.Value
+			if defaults.IsValid() && i < defaults.Len() {
+				defaultElem = defaults.Index(i)
+			}
+			n, err := buildNodeWithDefaults(v.Index(i), comm, defaultElem, secrets, deprecated)
 			if err != nil {
 				return nil, err
 			}
@@ -164,6 +271,33 @@ func buildNode(v reflect.Value, comm commentsMap) (*yaml.Node, error) {
 		}
 		return seq, nil

+	case reflect.Map:
+		mapNode := &yaml.Node{Kind: yaml.MappingNode}
+
+		for _, key := range v.MapKeys() {
+			// Handle key
+			keyStr := fmt.Sprintf("%v", key.Interface())
+			keyNode := &yaml.Node{
+				Kind:  yaml.ScalarNode,
+				Value: keyStr,
+			}
+
+			// Handle value recursively
+			mapVal := v.MapIndex(key)
+			var defaultVal reflect.Value
+			if defaults.IsValid() {
+				defaultVal = defaults.MapIndex(key)
+			}
+
+			valNode, err := buildNodeWithDefaults(mapVal, comm, defaultVal, secrets, deprecated)
+			if err != nil {
+				return nil, err
+			}
+
+			mapNode.Content = append(mapNode.Content, keyNode, valNode)
+		}
+		return mapNode, nil
+
 	default:
 		n := &yaml.Node{}
 		if err := n.Encode(v.Interface()); err != nil {
@@ -185,22 +319,74 @@ func GenerateYaml() {
 	setupAuth(true)
 	setupSources(true)
 	setupUrls()
-	setupFrontend()
-	input := "common/settings/settings.go" // "path to Go source file or directory containing structs"
-	output := "generated.yaml"             // "output YAML file"
+	setupFrontend(true)
+	output := "generated.yaml" // "output YAML file"

-	comm, err := collectComments(input)
+	// Generate YAML with comments enabled, full config, and deprecated fields filtered
+	// Force the source path to be correct for static generation
+	yamlContent, err := GenerateConfigYamlWithSource(&Config, true, true, true, "common/settings")
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "error parsing comments: %v\n", err)
+		fmt.Fprintf(os.Stderr, "error generating YAML: %v\n", err)
 		os.Exit(1)
 	}

-	node, err := buildNode(reflect.ValueOf(Config), comm)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "error building YAML node: %v\n", err)
+	if err := os.WriteFile(output, []byte(yamlContent), 0644); err != nil {
+		fmt.Fprintf(os.Stderr, "error writing YAML: %v\n", err)
 		os.Exit(1)
 	}
+	fmt.Printf("Generated YAML with comments (deprecated fields filtered): %s\n", output)
+}

+// GenerateConfigYaml generates YAML from a given config with options for comments and filtering
+func GenerateConfigYaml(config *Settings, showComments bool, showFull bool, filterDeprecated bool) (string, error) {
+	// Try different source paths to handle both runtime and test scenarios
+	sourcePaths := []string{
+		"common/settings", // When running from backend directory
+		".",               // When running tests from settings directory
+		"../settings",     // Alternative test path
+	}
+
+	for _, sourcePath := range sourcePaths {
+		yamlOutput, err := GenerateConfigYamlWithSource(config, showComments, showFull, filterDeprecated, sourcePath)
+		if err == nil {
+			return yamlOutput, nil
+		}
+		// If it's not a file not found error, return immediately
+		if !strings.Contains(err.Error(), "no such file or directory") && !strings.Contains(err.Error(), "cannot find") {
+			return "", err
+		}
+	}
+
+	// If all paths failed, try with empty maps to at least generate basic YAML
+	return GenerateConfigYamlWithEmptyMaps(config, showFull)
+}
+
+// GenerateConfigYamlWithEmptyMaps generates YAML without comment parsing when source files are unavailable
+func GenerateConfigYamlWithEmptyMaps(config *Settings, showFull bool) (string, error) {
+	// Create empty maps
+	comm := make(CommentsMap)
+	secrets := make(SecretFieldsMap)
+	deprecated := make(DeprecatedFieldsMap)
+
+	var node *yaml.Node
+	var err error
+
+	if showFull {
+		// Show the full current config
+		node, err = buildNodeWithDefaults(reflect.ValueOf(config), comm, reflect.Value{}, secrets, deprecated)
+	} else {
+		// Show only non-default values by comparing with defaults during node building
+		defaultConfig := setDefaults(true)
+		defaultConfig.Server.Sources = []Source{{Path: "."}}
+
+		node, err = buildNodeWithDefaults(reflect.ValueOf(config), comm, reflect.ValueOf(&defaultConfig), secrets, deprecated)
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	// Convert to YAML
 	doc := &yaml.Node{Kind: yaml.DocumentNode}
 	doc.Content = []*yaml.Node{node}

@@ -208,17 +394,78 @@ func GenerateYaml() {
 	enc := yaml.NewEncoder(&rawBuf)
 	enc.SetIndent(2)
 	if err := enc.Encode(doc); err != nil {
-		fmt.Fprintf(os.Stderr, "error encoding YAML: %v\n", err)
-		os.Exit(1)
+		return "", err
 	}

-	aligned := alignComments(rawBuf.String())
+	return AlignComments(rawBuf.String()), nil
+}

-	if err := os.WriteFile(output, []byte(aligned), 0644); err != nil {
-		fmt.Fprintf(os.Stderr, "error writing YAML: %v\n", err)
-		os.Exit(1)
+// GenerateConfigYamlWithSource generates YAML from a given config with options for comments and filtering, using a custom source path
+func GenerateConfigYamlWithSource(config *Settings, showComments bool, showFull bool, filterDeprecated bool, sourcePath string) (string, error) {
+	var comm CommentsMap
+	var secrets SecretFieldsMap
+	var deprecated DeprecatedFieldsMap
+	var err error
+
+	if showComments {
+		// Collect comments, secrets, and deprecated fields from the settings source files
+		comm, secrets, deprecated, err = CollectCommentsAndSecrets(sourcePath)
+		if err != nil {
+			return "", err
+		}
+	} else {
+		// Still need to collect secrets and deprecated fields even if not showing comments
+		_, secrets, deprecated, err = CollectCommentsAndSecrets(sourcePath)
+		if err != nil {
+			return "", err
+		}
+		// Create empty comments map
+		comm = make(CommentsMap)
 	}
-	fmt.Printf("Generated YAML with comments: %s\n", output)
+
+	// If not filtering deprecated fields, clear the deprecated map
+	if !filterDeprecated {
+		deprecated = make(DeprecatedFieldsMap)
+	}
+
+	var node *yaml.Node
+
+	if showFull {
+		// Show the full current config
+		node, err = buildNodeWithDefaults(reflect.ValueOf(config), comm, reflect.Value{}, secrets, deprecated)
+	} else {
+		// Show only non-default values by comparing with defaults during node building
+		// Create a clean default config (no file loading, just pure defaults)
+		defaultConfig := setDefaults(true)
+		// Apply same setup as a fresh instance would have
+		defaultConfig.Server.Sources = []Source{{Path: "."}}
+
+		node, err = buildNodeWithDefaults(reflect.ValueOf(config), comm, reflect.ValueOf(&defaultConfig), secrets, deprecated)
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	// Create document
+	doc := &yaml.Node{Kind: yaml.DocumentNode}
+	doc.Content = []*yaml.Node{node}
+
+	// Encode to YAML
+	var rawBuf bytes.Buffer
+	enc := yaml.NewEncoder(&rawBuf)
+	enc.SetIndent(2)
+	if err := enc.Encode(doc); err != nil {
+		return "", err
+	}
+
+	// Apply comment alignment if comments are enabled
+	yamlOutput := rawBuf.String()
+	if showComments {
+		yamlOutput = AlignComments(yamlOutput)
+	}
+
+	return yamlOutput, nil
 }

 // formatLine applies padding to a single line so its comment starts at a target column.
@@ -226,31 +473,39 @@ func formatLine(line string) string {
 	const targetCol = 42
 	const defaultPadding = 1

-	idx := strings.Index(line, "#")
-	// If there's no comment, do nothing.
-	if idx == -1 {
-		return line
+	// Find the first # character that is NOT inside double or single quotes.
+	inSingle, inDouble := false, false
+	for i := 0; i < len(line); i++ {
+		c := line[i]
+		switch c {
+		case '\'':
+			if !inDouble {
+				inSingle = !inSingle
+			}
+		case '"':
+			if !inSingle {
+				inDouble = !inDouble
+			}
+		case '#':
+			if !inSingle && !inDouble {
+				// found a comment
+				contentPart := line[:i]
+				commentPart := line[i:]
+				trimmedContent := strings.TrimRight(contentPart, " ")
+				if len(trimmedContent) >= targetCol {
+					return trimmedContent + strings.Repeat(" ", defaultPadding) + commentPart
+				}
+				paddingNeeded := targetCol - len(trimmedContent)
+				return trimmedContent + strings.Repeat(" ", paddingNeeded) + commentPart
+			}
+		}
 	}
-
-	// Separate the content (before #) from the comment (from # onwards).
-	contentPart := line[:idx]
-	commentPart := line[idx:]
-
-	// The YAML encoder adds a space; trim it so we measure only the content length.
-	trimmedContent := strings.TrimRight(contentPart, " ")
-
-	// If the content already extends past our target column, just add a single space.
-	if len(trimmedContent) >= targetCol {
-		return trimmedContent + strings.Repeat(" ", defaultPadding) + commentPart
-	}
-
-	// Otherwise, calculate the needed padding to reach the target column and add it.
-	paddingNeeded := targetCol - len(trimmedContent)
-	return trimmedContent + strings.Repeat(" ", paddingNeeded) + commentPart
+	// No comment found
+	return line
 }

-// alignComments formats each line of the YAML string independently.
-func alignComments(input string) string {
+// AlignComments formats each line of the YAML string independently.
+func AlignComments(input string) string {
 	lines := strings.Split(input, "\n")
 	outputLines := make([]string, len(lines))

@@ -0,0 +1,230 @@
+package settings
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestGenerateConfigYaml_Basic(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Test using the actual source directory structure
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "es",          // Non-default value
+			DarkMode:                true,          // Default value
+			DisableOfficePreviewExt: ".docx .xlsx", // This field is deprecated
+		},
+		Auth: Auth{
+			Key:           "secret123",    // This is a secret field
+			AdminUsername: "testadmin",    // This is a secret field
+			AdminPassword: "testpassword", // This is a secret field
+		},
+	}
+
+	// Test different combinations
+	testCases := []struct {
+		name             string
+		showComments     bool
+		showFull         bool
+		filterDeprecated bool
+		expectSecrets    bool
+		expectDeprecated bool
+	}{
+		{
+			name:             "API_mode_all_fields",
+			showComments:     false,
+			showFull:         true,
+			filterDeprecated: false,
+			expectSecrets:    true, // Secrets should be hidden
+			expectDeprecated: true, // Deprecated should be shown
+		},
+		{
+			name:             "Static_config_filter_deprecated",
+			showComments:     true,
+			showFull:         true,
+			filterDeprecated: true,
+			expectSecrets:    true,  // Secrets should be hidden
+			expectDeprecated: false, // Deprecated should be filtered
+		},
+		{
+			name:             "Filtered_non_defaults",
+			showComments:     false,
+			showFull:         false,
+			filterDeprecated: false,
+			expectSecrets:    true,  // Secrets should be hidden
+			expectDeprecated: false, // Might not appear if matches default
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Use the current directory structure for real testing
+			yamlOutput, err := GenerateConfigYaml(config, tc.showComments, tc.showFull, tc.filterDeprecated)
+			if err != nil {
+				t.Fatalf("GenerateConfigYaml failed: %v", err)
+			}
+
+			// Basic validation - should produce some output
+			if len(yamlOutput) == 0 {
+				t.Fatal("Generated empty YAML")
+			}
+
+			// Test string quoting - string values should be quoted, numbers and booleans should not
+			lines := strings.Split(yamlOutput, "\n")
+			for _, line := range lines {
+				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+					// This is a key-value line, skip comment portion
+					parts := strings.SplitN(line, ":", 2)
+					if len(parts) == 2 {
+						value := strings.TrimSpace(parts[1])
+						// Remove comments
+						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+							value = strings.TrimSpace(value[:commentIdx])
+						}
+
+						// Skip empty values, arrays, and objects
+						if value == "" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
+							continue
+						}
+
+						// Check if it's a number (should NOT be quoted)
+						if reNumber.MatchString(value) {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's a boolean (should NOT be quoted)
+						if value == "true" || value == "false" {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Everything else should be a quoted string
+						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+							// Add debug info to see what's wrong
+							t.Logf("DEBUG: Checking value '%s' from line '%s'", value, strings.TrimSpace(line))
+							t.Errorf("String value should be quoted in line: %s (value: %s)", strings.TrimSpace(line), value)
+						}
+					}
+				}
+			}
+
+			// Test secret hiding
+			if tc.expectSecrets {
+				if !strings.Contains(yamlOutput, "**hidden**") {
+					t.Error("Expected secrets to be hidden with **hidden**")
+				}
+				if strings.Contains(yamlOutput, "secret123") || strings.Contains(yamlOutput, "testadmin") || strings.Contains(yamlOutput, "testpassword") {
+					t.Error("Secret values should not appear in output")
+				}
+			}
+
+			// Test deprecated field filtering
+			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
+			if tc.expectDeprecated && !hasDeprecated {
+				t.Error("Expected deprecated field to be present")
+			}
+			if !tc.expectDeprecated && hasDeprecated && tc.filterDeprecated {
+				t.Error("Expected deprecated field to be filtered out when filterDeprecated=true")
+			}
+
+			// Test comments
+			hasComments := strings.Contains(yamlOutput, "#")
+			if tc.showComments && !hasComments {
+				t.Error("Expected comments to be present when showComments=true")
+			}
+
+			t.Logf("Test case: %s\nGenerated YAML:\n%s\n", tc.name, yamlOutput)
+		})
+	}
+}
+
+func TestCollectCommentsAndSecrets_Basic(t *testing.T) {
+	// Test the comment and secret collection directly
+	comments, secrets, deprecated, err := CollectCommentsAndSecrets(".")
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Should find some secrets in the actual source files
+	foundSecrets := false
+	for typeName, typeSecrets := range secrets {
+		for fieldName := range typeSecrets {
+			t.Logf("Found secret: %s.%s", typeName, fieldName)
+			foundSecrets = true
+		}
+	}
+	if !foundSecrets {
+		t.Error("Expected to find some secret fields in the actual source code")
+	}
+
+	// Should find some deprecated fields
+	foundDeprecated := false
+	for typeName, typeDeprecated := range deprecated {
+		for fieldName := range typeDeprecated {
+			t.Logf("Found deprecated: %s.%s", typeName, fieldName)
+			foundDeprecated = true
+		}
+	}
+	if !foundDeprecated {
+		t.Error("Expected to find some deprecated fields in the actual source code")
+	}
+
+	t.Logf("Comments: %d types", len(comments))
+	t.Logf("Secrets: %d types", len(secrets))
+	t.Logf("Deprecated: %d types", len(deprecated))
+}
+
+func TestGenerateYaml_StaticGeneration(t *testing.T) {
+	// Test the static generation function that's used by FILEBROWSER_GENERATE_CONFIG=true
+
+	// Create a temporary config for testing
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "en",
+			DisableOfficePreviewExt: ".docx .xlsx", // This should be filtered out
+		},
+		Auth: Auth{
+			Key: "test-secret", // This should be redacted
+		},
+	}
+
+	// Test static generation with comments and deprecated filtering
+	yamlOutput, err := GenerateConfigYamlWithSource(config, true, true, true, ".")
+	if err != nil {
+		t.Fatalf("Static generation failed: %v", err)
+	}
+
+	// Verify comments are included
+	if !strings.Contains(yamlOutput, "#") {
+		t.Error("Static generation should include comments")
+	}
+
+	// Verify deprecated field is filtered out
+	if strings.Contains(yamlOutput, "disableOfficePreviewExt") {
+		t.Error("Static generation should filter out deprecated field disableOfficePreviewExt")
+	}
+
+	// Verify secrets are redacted
+	if !strings.Contains(yamlOutput, "**hidden**") {
+		t.Error("Static generation should redact secrets")
+	}
+	if strings.Contains(yamlOutput, "test-secret") {
+		t.Error("Static generation should not contain actual secret values")
+	}
+
+	// Verify it has proper structure
+	if !strings.Contains(yamlOutput, "userDefaults:") {
+		t.Error("Static generation should contain userDefaults section")
+	}
+	if !strings.Contains(yamlOutput, "auth:") {
+		t.Error("Static generation should contain auth section")
+	}
+
+	t.Logf("Static generation successful with comments and proper filtering")
+}
@@ -0,0 +1,470 @@
+package settings
+
+import (
+	"os"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// Test structs for comprehensive testing
+type TestConfig struct {
+	PublicField     string     `json:"publicField"`     // A regular public field
+	SecretField     string     `json:"secretField"`     // secret: this should be hidden
+	DeprecatedField string     `json:"deprecatedField"` // deprecated: this field is old
+	EmptyField      string     `json:"emptyField"`      // An empty string field
+	DefaultField    string     `json:"defaultField"`    // A field that matches default
+	NonDefaultField string     `json:"nonDefaultField"` // A field that differs from default
+	NestedStruct    TestNested `json:"nestedStruct"`
+}
+
+type TestNested struct {
+	NestedPublic     string `json:"nestedPublic"`     // A nested public field
+	NestedSecret     string `json:"nestedSecret"`     // secret: nested secret field
+	NestedDeprecated string `json:"nestedDeprecated"` // deprecated: nested deprecated field
+}
+
+// Helper to create test source files for comment parsing
+func createTestSourceFile(t *testing.T, content string) (string, func()) {
+	tmpFile, err := os.CreateTemp("", "test_*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := tmpFile.WriteString(content); err != nil {
+		t.Fatal(err)
+	}
+	tmpFile.Close()
+
+	cleanup := func() {
+		os.Remove(tmpFile.Name())
+	}
+
+	return tmpFile.Name(), cleanup
+}
+
+func TestGenerateConfigYaml_StringQuoting(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Create a simple test source file for this test
+	sourceContent := `package settings
+
+type Settings struct {
+	UserDefaults UserDefaults ` + "`json:\"userDefaults\"`" + `
+	Auth Auth ` + "`json:\"auth\"`" + `
+}
+
+type UserDefaults struct {
+	Locale string ` + "`json:\"locale\"`" + `
+}
+
+type Auth struct {
+	AdminUsername string ` + "`json:\"adminUsername\"`" + `
+}
+`
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]
+
+	// Create real Settings with string values to test quoting
+	settings := &Settings{
+		UserDefaults: UserDefaults{
+			Locale: "en-US",
+		},
+		Auth: Auth{
+			AdminUsername: "admin",
+		},
+	}
+
+	// Test with no filtering - should quote all strings
+	yamlOutput, err := GenerateConfigYamlWithSource(settings, false, true, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml failed: %v", err)
+	}
+
+	// All string values should be quoted
+	lines := strings.Split(yamlOutput, "\n")
+	for _, line := range lines {
+		if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+			// This is a key-value line
+			parts := strings.SplitN(line, ":", 2)
+			if len(parts) == 2 {
+				value := strings.TrimSpace(parts[1])
+
+				// Remove comments
+				if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+					value = strings.TrimSpace(value[:commentIdx])
+				}
+
+				// Skip empty values, arrays, objects, booleans
+				if value == "" || value == "false" || value == "true" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
+					continue
+				}
+
+				// Check if it's a number (should NOT be quoted)
+				if reNumber.MatchString(value) {
+					if strings.HasPrefix(value, "\"") {
+						t.Errorf("Numeric value should not be quoted: %s (value: '%s')", line, value)
+					}
+					continue
+				}
+
+				// Everything else should be a quoted string
+				if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+					t.Errorf("String value should be quoted: %s (value: '%s')", line, value)
+				}
+			}
+		}
+	}
+}
+
+func TestGenerateConfigYaml_SecretHiding(t *testing.T) {
+	// Create temporary source file with our test structs
+	sourceContent := `package settings
+
+type TestConfig struct {
+	PublicField string ` + "`json:\"publicField\"`" + ` // A regular public field
+	SecretField string ` + "`json:\"secretField\"`" + ` // secret: this should be hidden
+}
+
+type TestNested struct {
+	NestedPublic string ` + "`json:\"nestedPublic\"`" + ` // A nested public field
+	NestedSecret string ` + "`json:\"nestedSecret\"`" + ` // secret: nested secret field
+}
+`
+
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+
+	// Test secret detection
+	_, secrets, _, err := CollectCommentsAndSecrets(tmpFile)
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Verify secret fields are detected
+	if !secrets["TestConfig"]["SecretField"] {
+		t.Error("SecretField should be marked as secret")
+	}
+	if !secrets["TestNested"]["NestedSecret"] {
+		t.Error("NestedSecret should be marked as secret")
+	}
+	if secrets["TestConfig"]["PublicField"] {
+		t.Error("PublicField should not be marked as secret")
+	}
+
+	// Test that secrets are properly collected
+	if len(secrets["TestConfig"]) != 1 {
+		t.Errorf("Expected 1 secret field in TestConfig, got %d", len(secrets["TestConfig"]))
+	}
+}
+
+func TestGenerateConfigYaml_DeprecatedFiltering(t *testing.T) {
+	// Create temporary source file with deprecated fields
+	sourceContent := `package settings
+
+type TestConfig struct {
+	PublicField     string ` + "`json:\"publicField\"`" + ` // A regular public field
+	DeprecatedField string ` + "`json:\"deprecatedField\"`" + ` // deprecated: this field is old
+}
+`
+
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+
+	// Test deprecated detection
+	_, _, deprecated, err := CollectCommentsAndSecrets(tmpFile)
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Verify deprecated fields are detected
+	if !deprecated["TestConfig"]["DeprecatedField"] {
+		t.Error("DeprecatedField should be marked as deprecated")
+	}
+	if deprecated["TestConfig"]["PublicField"] {
+		t.Error("PublicField should not be marked as deprecated")
+	}
+}
+
+func TestGenerateConfigYaml_FullVsFiltered(t *testing.T) {
+	// Create minimal test source
+	sourceContent := `package settings
+
+type Settings struct {
+	UserDefaults UserDefaults ` + "`json:\"userDefaults\"`" + `
+}
+
+type UserDefaults struct {
+	DarkMode bool ` + "`json:\"darkMode\"`" + `
+	Locale string ` + "`json:\"locale\"`" + `
+}
+`
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]
+
+	// Create a config with both default and non-default values
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			DarkMode: true, // This matches default
+			Locale:   "es", // This differs from default ("en")
+		},
+	}
+
+	// Test full=true - should show all fields
+	fullYaml, err := GenerateConfigYamlWithSource(config, false, true, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with full=true failed: %v", err)
+	}
+
+	// Test full=false - should only show non-default fields
+	filteredYaml, err := GenerateConfigYamlWithSource(config, false, false, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with full=false failed: %v", err)
+	}
+
+	// Full output should be longer than filtered
+	if len(fullYaml) <= len(filteredYaml) {
+		t.Error("Full YAML should be longer than filtered YAML")
+	}
+
+	// Filtered output should contain the non-default field
+	if !strings.Contains(filteredYaml, "locale") {
+		t.Error("Filtered YAML should contain non-default locale field")
+	}
+
+	// Full output should contain default fields
+	if !strings.Contains(fullYaml, "darkMode") {
+		t.Error("Full YAML should contain darkMode field")
+	}
+}
+
+func TestGenerateConfigYaml_CommentsOnOff(t *testing.T) {
+	// Use the actual settings source directory since comments work there
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale: "en",
+		},
+	}
+
+	// Test with comments=true using the real source
+	withComments, err := GenerateConfigYaml(config, true, true, false)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with comments=true failed: %v", err)
+	}
+
+	// Test with comments=false using the real source
+	withoutComments, err := GenerateConfigYaml(config, false, true, false)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with comments=false failed: %v", err)
+	}
+
+	// Output with comments should be longer
+	if len(withComments) <= len(withoutComments) {
+		t.Errorf("YAML with comments (%d chars) should be longer than without comments (%d chars)", len(withComments), len(withoutComments))
+	}
+
+	// With comments should contain '#' characters
+	if !strings.Contains(withComments, "#") {
+		t.Error("YAML with comments should contain '#' characters")
+	}
+
+	// Without comments should not contain '#' characters
+	if strings.Contains(withoutComments, "#") {
+		t.Error("YAML without comments should not contain '#' characters")
+	}
+}
+
+func TestGenerateConfigYaml_IntegrationTest(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Comprehensive test with all features
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "es",          // Non-default
+			DarkMode:                true,          // Default
+			DisableOfficePreviewExt: ".docx .xlsx", // This is deprecated
+		},
+		Auth: Auth{
+			Key:           "secret123", // This is secret
+			AdminUsername: "admin",     // This is secret
+			AdminPassword: "password",  // This is secret
+		},
+	}
+
+	tests := []struct {
+		name             string
+		showComments     bool
+		showFull         bool
+		filterDeprecated bool
+		expectSecret     bool
+		expectDeprecated bool
+		expectFull       bool
+		expectComments   bool
+	}{
+		{
+			name:             "API mode: show all including deprecated",
+			showComments:     false,
+			showFull:         true,
+			filterDeprecated: false,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: true,  // deprecated should be shown
+			expectFull:       true,  // all fields shown
+			expectComments:   false, // no comments
+		},
+		{
+			name:             "Static config mode: filter deprecated",
+			showComments:     true,
+			showFull:         true,
+			filterDeprecated: true,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: false, // deprecated should be filtered
+			expectFull:       true,  // all non-deprecated fields shown
+			expectComments:   true,  // comments included
+		},
+		{
+			name:             "Filtered output: only changes",
+			showComments:     false,
+			showFull:         false,
+			filterDeprecated: false,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: false, // might not appear if matches default
+			expectFull:       false, // only non-default fields
+			expectComments:   false, // no comments
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			yamlOutput, err := GenerateConfigYaml(config, tt.showComments, tt.showFull, tt.filterDeprecated)
+			if err != nil {
+				t.Fatalf("GenerateConfigYaml failed: %v", err)
+			}
+
+			// Check secret hiding
+			if tt.expectSecret {
+				if !strings.Contains(yamlOutput, "**hidden**") {
+					t.Error("Expected secrets to be hidden with **hidden**")
+				}
+				if strings.Contains(yamlOutput, "secret123") {
+					t.Error("Secret values should not appear in output")
+				}
+			}
+
+			// Check deprecated field filtering
+			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
+			if tt.expectDeprecated && !hasDeprecated {
+				t.Error("Expected deprecated field to be present")
+			}
+			if !tt.expectDeprecated && hasDeprecated && tt.filterDeprecated {
+				t.Error("Expected deprecated field to be filtered out")
+			}
+
+			// Check comments
+			hasComments := strings.Contains(yamlOutput, "#")
+			if tt.expectComments && !hasComments {
+				t.Error("Expected comments to be present")
+			}
+			if !tt.expectComments && hasComments {
+				t.Error("Expected no comments")
+			}
+
+			// Check string quoting - all string values should be quoted
+			lines := strings.Split(yamlOutput, "\n")
+			for _, line := range lines {
+				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+					// This is a key-value line
+					parts := strings.SplitN(line, ":", 2)
+					if len(parts) == 2 {
+						value := strings.TrimSpace(parts[1])
+						// Skip comments and empty values
+						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+							// If comment starts at the beginning, there's no value, just a comment
+							if commentIdx == 0 {
+								continue
+							}
+							value = strings.TrimSpace(value[:commentIdx])
+						}
+						// Check if it's a number (should NOT be quoted)
+						if reNumber.MatchString(value) {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's a boolean (should NOT be quoted)
+						if value == "true" || value == "false" {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Skip arrays, objects, and empty values
+						if value == "" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") || strings.Contains(value, ":") {
+							continue
+						}
+
+						// Everything else should be a quoted string
+						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+							t.Errorf("String value should be quoted in line: %s (value: '%s')", line, value)
+						}
+					}
+				}
+			}
+
+			t.Logf("Generated YAML for %s:\n%s", tt.name, yamlOutput)
+		})
+	}
+}
+
+func TestGenerateConfigYaml_EdgeCases(t *testing.T) {
+	tests := []struct {
+		name   string
+		config *Settings
+		desc   string
+	}{
+		{
+			name:   "empty_config",
+			config: &Settings{},
+			desc:   "Empty config should generate valid YAML",
+		},
+		{
+			name: "only_defaults",
+			config: &Settings{
+				UserDefaults: UserDefaults{
+					DarkMode: true, // default value
+					Locale:   "en", // default value
+				},
+			},
+			desc: "Config with only default values",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test all combinations
+			for _, showComments := range []bool{false, true} {
+				for _, showFull := range []bool{false, true} {
+					for _, filterDeprecated := range []bool{false, true} {
+						yamlOutput, err := GenerateConfigYaml(tt.config, showComments, showFull, filterDeprecated)
+						if err != nil {
+							t.Fatalf("GenerateConfigYaml failed for %s (comments=%v, full=%v, filterDeprecated=%v): %v",
+								tt.desc, showComments, showFull, filterDeprecated, err)
+						}
+
+						// Basic validation - should produce valid YAML structure
+						if yamlOutput == "" {
+							t.Errorf("Generated empty YAML for %s", tt.desc)
+						}
+
+						// Should not contain obvious error messages (but allow "error" in log levels etc)
+						if strings.Contains(yamlOutput, "Error:") || strings.Contains(yamlOutput, "ERROR:") {
+							t.Errorf("YAML contains error for %s", tt.desc)
+						}
+					}
+				}
+			}
+		})
+	}
+}
@@ -49,7 +49,7 @@ func ApplyUserDefaults(u *users.User) {
 	u.Preview = Config.UserDefaults.Preview
 	u.ShowHidden = Config.UserDefaults.ShowHidden
 	u.DateFormat = Config.UserDefaults.DateFormat
-	u.DisableOnlyOfficeExt = Config.UserDefaults.DisableOnlyOfficeExt
+	u.DisableViewingExt = Config.UserDefaults.DisableViewingExt
 	u.ThemeColor = Config.UserDefaults.ThemeColor
 	u.GallerySize = Config.UserDefaults.GallerySize
 	u.QuickDownload = Config.UserDefaults.QuickDownload
@@ -21,6 +21,8 @@ type Settings struct {
 }

 type Server struct {
+	MinSearchLength              int         `json:"minSearchLength"`              // minimum length of search query to begin searching (default: 3)
+	DisableUpdateCheck           bool        `json:"disableUpdateCheck"`           // disables backend update check service
 	NumImageProcessors           int         `json:"numImageProcessors"`           // number of concurrent image processing jobs used to create previews, default is number of cpu cores available.
 	Socket                       string      `json:"socket"`                       // socket to listen on
 	TLSKey                       string      `json:"tlsKey"`                       // path to TLS key
@@ -34,8 +36,8 @@ type Server struct {
 	DebugMedia                   bool        `json:"debugMedia"` // output ffmpeg stdout for media integration -- careful can produces lots of output!
 	Database                     string      `json:"database"`   // path to the database file
 	Sources                      []Source    `json:"sources" validate:"required,dive"`
-	ExternalUrl                  string      `json:"externalUrl"`    // used by share links if set
-	InternalUrl                  string      `json:"internalUrl"`    // used by integrations if set, this is the url that an integration service will use to communicate with filebrowser
+	ExternalUrl                  string      `json:"externalUrl"`    // used by share links if set (eg. http://mydomain.com)
+	InternalUrl                  string      `json:"internalUrl"`    // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
 	CacheDir                     string      `json:"cacheDir"`       // path to the cache directory, used for thumbnails and other cached files
 	MaxArchiveSizeGB             int64       `json:"maxArchiveSize"` // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
 	// not exposed to config
@@ -52,9 +54,9 @@ type Integrations struct {
 // onlyoffice secret is stored in the local.json file
 // docker exec <containerID> /var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/local.json 'services.CoAuthoring.secret.session.string'
 type OnlyOffice struct {
-	Url         string `json:"url" validate:"required"` // The URL to the OnlyOffice Document Server, needs to be accessible to the user.
-	InternalUrl string `json:"internalUrl"`             // An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
-	Secret      string `json:"secret" validate:"required"`
+	Url         string `json:"url" validate:"required"`    // The URL to the OnlyOffice Document Server, needs to be accessible to the user.
+	InternalUrl string `json:"internalUrl"`                // An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
+	Secret      string `json:"secret" validate:"required"` // secret: authentication key for OnlyOffice integration
 }

 type Media struct {
@@ -73,19 +75,22 @@ type LogConfig struct {
 type Source struct {
 	Path   string       `json:"path" validate:"required"` // file system path. (Can be relative)
 	Name   string       `json:"name"`                     // display name
-	Config SourceConfig `json:"config"`
+	Config SourceConfig `json:"config,omitempty"`
 }

 type SourceConfig struct {
-	IndexingInterval uint32             `json:"indexingIntervalMinutes"` // optional manual overide interval in seconds to re-index the source
-	DisableIndexing  bool               `json:"disableIndexing"`         // disable the indexing of this source
-	MaxWatchers      int                `json:"maxWatchers"`             // number of concurrent watchers to use for this source, currently not supported
-	NeverWatchPaths  []string           `json:"neverWatchPaths"`         // paths that get initially once. Useful for folders that rarely change contents (without source path prefix)
-	Exclude          ExcludeIndexFilter `json:"exclude"`                 // exclude files and folders from indexing, if include is not set
-	Include          IncludeIndexFilter `json:"include"`                 // include files and folders from indexing, if exclude is not set
-	DefaultUserScope string             `json:"defaultUserScope"`        // default "/" should match folders under path
-	DefaultEnabled   bool               `json:"defaultEnabled"`          // should be added as a default source for new users?
-	CreateUserDir    bool               `json:"createUserDir"`           // create a user directory for each user
+	DenyByDefault    bool               `json:"denyByDefault,omitempty"`           // deny access unless an "allow" access rule was specifically created.
+	Private          bool               `json:"private"`                           // designate as source as private -- currently just means no sharing permitted.
+	Disabled         bool               `json:"disabled,omitempty"`                // disable the source, this is useful so you don't need to remove it from the config file
+	IndexingInterval uint32             `json:"indexingIntervalMinutes,omitempty"` // optional manual overide interval in minutes to re-index the source
+	DisableIndexing  bool               `json:"disableIndexing,omitempty"`         // disable the indexing of this source
+	MaxWatchers      int                `json:"maxWatchers"`                       // number of concurrent watchers to use for this source, currently not supported
+	NeverWatchPaths  []string           `json:"neverWatchPaths"`                   // paths that get initially once. Useful for folders that rarely change contents (without source path prefix)
+	Exclude          ExcludeIndexFilter `json:"exclude"`                           // exclude files and folders from indexing, if include is not set
+	Include          IncludeIndexFilter `json:"include"`                           // include files and folders from indexing, if exclude is not set
+	DefaultUserScope string             `json:"defaultUserScope"`                  // default "/" should match folders under path
+	DefaultEnabled   bool               `json:"defaultEnabled"`                    // should be added as a default source for new users?
+	CreateUserDir    bool               `json:"createUserDir"`                     // create a user directory for each user
 }

 type IncludeIndexFilter struct {
@@ -110,6 +115,25 @@ type Frontend struct {
 	DisableUsedPercentage bool           `json:"disableUsedPercentage"` // disable used percentage for the sources in the sidebar
 	ExternalLinks         []ExternalLink `json:"externalLinks"`
 	DisableNavButtons     bool           `json:"disableNavButtons"` // disable the nav buttons in the sidebar
+	Styling               StylingConfig  `json:"styling"`
+	Favicon               string         `json:"favicon"`     // path to a favicon to use for the frontend
+	Description           string         `json:"description"` // description that shows up in html head meta description
+}
+
+type StylingConfig struct {
+	CustomCSS       string                 `json:"customCSS"`       // if a valid path to a css file is provided, it will be applied for all users. (eg. "reduce-rounded-corners.css")
+	CustomCSSRaw    string                 `json:"-"`               // The css raw content to use for the custom css.
+	LightBackground string                 `json:"lightBackground"` // specify a valid CSS color property value to use as the background color in light mode
+	DarkBackground  string                 `json:"darkBackground"`  // Specify a valid CSS color property value to use as the background color in dark mode
+	CustomThemes    map[string]CustomTheme `json:"customThemes"`    // A list of custom css files that each user can select to override the default styling. if "default" is key name then it will be the default option.
+	// In-memory (not exposed to config)
+	CustomThemeOptions map[string]CustomTheme `json:"-"` // not exposed
+}
+
+type CustomTheme struct {
+	Description string `json:"description"`   // The description of the theme to display in the UI.
+	CSS         string `json:"css,omitempty"` // The css file path and filename to use for the theme.
+	CssRaw      string `json:"-"`             // The css raw content to use for the theme.
 }

 type ExternalLink struct {
@@ -135,8 +159,8 @@ type UserDefaults struct {
 	GallerySize                int                 `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
 	ThemeColor                 string              `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
 	QuickDownload              bool                `json:"quickDownload"`             // show icon to download in one click
-	DisableOnlyOfficeExt       string              `json:"disableOnlyOfficeExt"`      // comma separated list of file extensions to disable onlyoffice preview for
-	DisableOfficePreviewExt    string              `json:"disableOfficePreviewExt"`   // comma separated list of file extensions to disable office preview for
+	DisablePreviewExt          string              `json:"disablePreviewExt"`         // space separated list of file extensions to disable preview for
+	DisableViewingExt          string              `json:"disableViewingExt"`         // space separated list of file extensions to disable viewing for
 	LockPassword               bool                `json:"lockPassword"`              // disable the user from changing their password
 	DisableSettings            bool                `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
 	Preview                    users.Preview       `json:"preview"`
@@ -146,4 +170,9 @@ type UserDefaults struct {
 	DisableUpdateNotifications bool                `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
 	DeleteWithoutConfirming    bool                `json:"deleteWithoutConfirming"`    // delete files without confirmation
 	FileLoading                users.FileLoading   `json:"fileLoading"`                // upload and download settings
+	DisableOfficePreviewExt    string              `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
+	DisableOnlyOfficeExt       string              `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
+	CustomTheme                string              `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
+	ShowSelectMultiple         bool                `json:"showSelectMultiple"`         // show select multiple files on desktop
+	DebugOffice                bool                `json:"debugOffice"`                // debug onlyoffice editor
 }
@@ -0,0 +1,113 @@
+package settings
+
+import (
+	"os"
+	"regexp"
+	"strings"
+
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// Strict hex color regex: #RGB, #RGBA, #RRGGBB, #RRGGBBAA
+var hexColorRE = regexp.MustCompile(`^#([0-9a-fA-F]{3}|[0-9a-fA-F]{4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$`)
+
+// All valid CSS named colors (W3C spec, lower-case)
+var cssNamedColors = map[string]struct{}{
+	"aliceblue": {}, "antiquewhite": {}, "aqua": {}, "aquamarine": {}, "azure": {},
+	"beige": {}, "bisque": {}, "black": {}, "blanchedalmond": {}, "blue": {}, "blueviolet": {},
+	"brown": {}, "burlywood": {}, "cadetblue": {}, "chartreuse": {}, "chocolate": {},
+	"coral": {}, "cornflowerblue": {}, "cornsilk": {}, "crimson": {}, "cyan": {},
+	"darkblue": {}, "darkcyan": {}, "darkgoldenrod": {}, "darkgray": {}, "darkgreen": {},
+	"darkgrey": {}, "darkkhaki": {}, "darkmagenta": {}, "darkolivegreen": {}, "darkorange": {},
+	"darkorchid": {}, "darkred": {}, "darksalmon": {}, "darkseagreen": {}, "darkslateblue": {},
+	"darkslategray": {}, "darkslategrey": {}, "darkturquoise": {}, "darkviolet": {}, "deeppink": {},
+	"deepskyblue": {}, "dimgray": {}, "dimgrey": {}, "dodgerblue": {}, "firebrick": {},
+	"floralwhite": {}, "forestgreen": {}, "fuchsia": {}, "gainsboro": {}, "ghostwhite": {},
+	"gold": {}, "goldenrod": {}, "gray": {}, "green": {}, "greenyellow": {}, "grey": {},
+	"honeydew": {}, "hotpink": {}, "indianred": {}, "indigo": {}, "ivory": {},
+	"khaki": {}, "lavender": {}, "lavenderblush": {}, "lawngreen": {}, "lemonchiffon": {},
+	"lightblue": {}, "lightcoral": {}, "lightcyan": {}, "lightgoldenrodyellow": {}, "lightgray": {},
+	"lightgreen": {}, "lightgrey": {}, "lightpink": {}, "lightsalmon": {}, "lightseagreen": {},
+	"lightskyblue": {}, "lightslategray": {}, "lightslategrey": {}, "lightsteelblue": {}, "lightyellow": {},
+	"lime": {}, "limegreen": {}, "linen": {}, "magenta": {}, "maroon": {}, "mediumaquamarine": {},
+	"mediumblue": {}, "mediumorchid": {}, "mediumpurple": {}, "mediumseagreen": {}, "mediumslateblue": {},
+	"mediumspringgreen": {}, "mediumturquoise": {}, "mediumvioletred": {}, "midnightblue": {}, "mintcream": {},
+	"mistyrose": {}, "moccasin": {}, "navajowhite": {}, "navy": {}, "oldlace": {},
+	"olive": {}, "olivedrab": {}, "orange": {}, "orangered": {}, "orchid": {},
+	"palegoldenrod": {}, "palegreen": {}, "paleturquoise": {}, "palevioletred": {}, "papayawhip": {},
+	"peachpuff": {}, "peru": {}, "pink": {}, "plum": {}, "powderblue": {},
+	"purple": {}, "rebeccapurple": {}, "red": {}, "rosybrown": {}, "royalblue": {},
+	"saddlebrown": {}, "salmon": {}, "sandybrown": {}, "seagreen": {}, "seashell": {},
+	"sienna": {}, "silver": {}, "skyblue": {}, "slateblue": {}, "slategray": {},
+	"slategrey": {}, "snow": {}, "springgreen": {}, "steelblue": {}, "tan": {},
+	"teal": {}, "thistle": {}, "tomato": {}, "turquoise": {}, "violet": {},
+	"wheat": {}, "white": {}, "whitesmoke": {}, "yellow": {}, "yellowgreen": {},
+	// And the special values:
+	"transparent": {}, "currentcolor": {},
+}
+
+func FallbackColor(val, defaultColor string) string {
+	val = strings.TrimSpace(val)
+	if val == "" {
+		return defaultColor
+	}
+	if hexColorRE.MatchString(val) {
+		return val
+	}
+	lc := strings.ToLower(val)
+	// CSS color functions
+	if strings.HasPrefix(lc, "rgb(") || strings.HasPrefix(lc, "rgba(") ||
+		strings.HasPrefix(lc, "hsl(") || strings.HasPrefix(lc, "hsla(") {
+		return val
+	}
+	// CSS variable
+	if strings.HasPrefix(lc, "var(") {
+		return val
+	}
+	// Named colors and special values
+	if _, ok := cssNamedColors[lc]; ok {
+		return val
+	}
+	// Log a warning if the color is invalid
+	logger.Warningf("Invalid CSS color value provided: '%s'. Falling back to default: '%s'", val, defaultColor)
+	return defaultColor
+}
+
+func addCustomTheme(name, description, cssFilePath string) {
+	// Store only file path in config (for YAML export)
+	Config.Frontend.Styling.CustomThemes[name] = CustomTheme{
+		Description: description,
+		CSS:         cssFilePath, // Store file path, not content
+	}
+
+	// Load CSS content for runtime use (frontend consumption)
+	cssContent := ""
+	if cssFilePath != "" {
+		cssContent = readCustomCSS(cssFilePath)
+	}
+	Config.Frontend.Styling.CustomThemeOptions[name] = CustomTheme{
+		Description: description,
+		CSS:         cssFilePath,
+		CssRaw:      cssContent, // Store loaded content
+	}
+}
+
+func readCustomCSS(path string) string {
+	if path == "" {
+		return ""
+	}
+	content, err := os.ReadFile(path)
+	if err != nil {
+		// Only log if the file exists but cannot be read (e.g., permission error)
+		if !os.IsNotExist(err) {
+			logger.Warningf("Could not read custom CSS file %s: %v", path, err)
+			return ""
+		}
+	}
+	if len(content) > 128*1024 {
+		logger.Warningf("Custom CSS file %s is too large (%d bytes), ignoring", path, len(content))
+		return ""
+	}
+	logger.Infof("Loaded custom CSS from: %s (%d bytes)", path, len(content))
+	return string(content)
+}
@@ -12,4 +12,5 @@ var (
 	SearchResultsCache = cache.NewCache(15*time.Second, 1*time.Hour)
 	OnlyOfficeCache    = cache.NewCache(48*time.Hour, 1*time.Hour)
 	JwtCache           = cache.NewCache(1*time.Hour, 72*time.Hour)
+	MediaCache         = cache.NewCache(24 * time.Hour) // subtitles get cached for 24 hours
 )
@@ -6,14 +6,12 @@ import (
 	"encoding/hex"
 	"fmt"
 	math "math/rand"
-	"os"
 	"path/filepath"
 	"reflect"
 	"runtime"
 	"strings"
 	"time"

-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -117,30 +115,16 @@ func JoinPathAsUnix(parts ...string) string {
 	return joinedPath
 }

-// ResolveSymlinks resolves symlinks in the given path and returns
-// the final resolved path, whether it's a directory (considering bundle logic), and any error.
-func ResolveSymlinks(path string) (string, bool, error) {
-	for {
-		// Get the file info using os.Lstat to handle symlinks
-		info, err := os.Lstat(path)
-		if err != nil {
-			return path, false, fmt.Errorf("could not stat path: %s, %v", path, err)
-		}
-
-		// Check if the path is a symlink
-		if info.Mode()&os.ModeSymlink != 0 {
-			// Read the symlink target
-			target, err := os.Readlink(path)
-			if err != nil {
-				return path, false, fmt.Errorf("could not read symlink: %s, %v", path, err)
-			}
-
-			// Resolve the symlink's target relative to its directory
-			path = filepath.Join(filepath.Dir(path), target)
-		} else {
-			// Not a symlink, check with bundle-aware directory logic
-			isDir := iteminfo.IsDirectory(info)
-			return path, isDir, nil
-		}
+func NonNilSlice[T any](in []T) []T {
+	if in == nil {
+		return []T{}
 	}
+	return in
+}
+
+func Ternary[T any](cond bool, vtrue, vfalse T) T {
+	if cond {
+		return vtrue
+	}
+	return vfalse
 }
@@ -4,35 +4,8 @@ import (
 	"time"

 	"math/rand"
-
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )

-func CreateMockData(numDirs, numFilesPerDir int) iteminfo.FileInfo {
-	dir := iteminfo.FileInfo{}
-	dir.Path = "/here/is/your/mock/dir"
-	for i := 0; i < numDirs; i++ {
-		newFile := iteminfo.ItemInfo{
-			Name:    "file-" + GetRandomTerm() + GetRandomExtension(),
-			Size:    rand.Int63n(1000),                                          // Random size
-			ModTime: time.Now().Add(-time.Duration(rand.Intn(100)) * time.Hour), // Random mod time
-			Type:    "blob",
-		}
-		dir.Folders = append(dir.Folders, newFile)
-	}
-	// Simulating files and directories with FileInfo
-	for j := 0; j < numFilesPerDir; j++ {
-		newFile := iteminfo.ItemInfo{
-			Name:    "file-" + GetRandomTerm() + GetRandomExtension(),
-			Size:    rand.Int63n(1000),                                          // Random size
-			ModTime: time.Now().Add(-time.Duration(rand.Intn(100)) * time.Hour), // Random mod time
-			Type:    "blob",
-		}
-		dir.Files = append(dir.Files, newFile)
-	}
-	return dir
-}
-
 func GenerateRandomPath(levels int) string {
 	rand.New(rand.NewSource(time.Now().UnixNano()))
 	dirName := "srv"
@@ -0,0 +1,995 @@
+package access
+
+import (
+	"encoding/json"
+	"fmt"
+	"maps"
+	"slices"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/asdine/storm/v3"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-cache/cache"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+var accessCache = cache.NewCache(1 * time.Minute)
+
+const accessRulesBucket = "access_rules"
+const accessRulesKey = "rules"
+const accessChangedKey = "newRule:"
+
+type RuleMap map[string]*AccessRule
+type SourceRuleMap map[string]RuleMap
+
+type StringSet map[string]struct{}
+
+type dbStorage struct {
+	AllRules SourceRuleMap `json:"all_rules"`
+	Groups   GroupMap      `json:"groups"`
+}
+
+// RuleSet groups users and groups for allow/deny lists.
+type RuleSet struct {
+	Users  StringSet
+	Groups StringSet
+}
+
+// AccessRule defines allow/deny lists for a path.
+type AccessRule struct {
+	DenyAll bool `json:"denyAll,omitempty"`
+	Deny    RuleSet
+	Allow   RuleSet
+}
+
+type FrontendRuleSet struct {
+	Users  []string `json:"users"`
+	Groups []string `json:"groups"`
+}
+
+type FrontendAccessRule struct {
+	DenyAll           bool            `json:"denyAll,omitempty"`
+	Deny              FrontendRuleSet `json:"deny"`
+	Allow             FrontendRuleSet `json:"allow"`
+	SourceDenyDefault bool            `json:"sourceDenyDefault"`
+}
+
+// GroupMap maps group names to a set of usernames.
+type GroupMap map[string]StringSet
+
+// Storage manages access rules and group membership.
+type Storage struct {
+	mux      sync.RWMutex
+	AllRules SourceRuleMap  // AllRules[sourcePath][indexPath] - in-memory authoritative state
+	Groups   GroupMap       // key: group name, value: set of usernames - in-memory authoritative state
+	DB       *storm.DB      // Optional: DB for persistence
+	Users    *users.Storage // Reference to users storage
+}
+
+// SaveToDB persists all rules to the DB if DB is set.
+func (s *Storage) SaveToDB() error {
+	if s.DB == nil {
+		return nil
+	}
+	data, err := json.Marshal(&dbStorage{
+		AllRules: s.AllRules,
+		Groups:   s.Groups,
+	})
+	if err != nil {
+		return err
+	}
+	return s.DB.Set(accessRulesBucket, accessRulesKey, data)
+}
+
+// Flush persists the current in-memory state to the backing store.
+// Call during graceful shutdown to ensure DB matches memory.
+func (s *Storage) Flush() error {
+	return s.SaveToDB()
+}
+
+// LoadFromDB loads all rules from the DB if DB is set.
+func (s *Storage) LoadFromDB() error {
+	if s.DB == nil {
+		return nil
+	}
+	var data []byte
+	err := s.DB.Get(accessRulesBucket, accessRulesKey, &data)
+	if err != nil {
+		return err
+	}
+	var storage dbStorage
+	if err := json.Unmarshal(data, &storage); err != nil {
+		return err
+	}
+	s.mux.Lock()
+	s.AllRules = storage.AllRules
+	if s.AllRules == nil {
+		s.AllRules = make(SourceRuleMap)
+	}
+	s.Groups = storage.Groups
+	if s.Groups == nil {
+		s.Groups = make(GroupMap)
+	}
+	s.mux.Unlock()
+	return nil
+}
+
+// NewStorage creates a new Storage instance. Optionally pass a DB for persistence and users storage.
+// After creating Storage with a DB, call LoadFromDB() to load rules from the database on startup.
+// Example:
+//
+//	store := NewStorage(db, usersStore)
+//	err := store.LoadFromDB()
+//	if err != nil { /* handle error */ }
+func NewStorage(db *storm.DB, usersStore *users.Storage) *Storage {
+	var s = &Storage{
+		AllRules: make(SourceRuleMap),
+		Groups:   make(GroupMap),
+		DB:       db,
+		Users:    usersStore,
+	}
+	return s
+}
+
+// ClearCache clears the access cache (useful for testing)
+func ClearCache() {
+	// Recreate the cache to clear it
+	accessCache = cache.NewCache(1 * time.Minute)
+}
+
+// getOrCreateRuleNL ensures a rule exists for the given source and index path.
+// The caller must hold the lock.
+func (s *Storage) getOrCreateRuleNL(sourcePath, indexPath string) *AccessRule {
+	if _, ok := s.AllRules[sourcePath]; !ok {
+		s.AllRules[sourcePath] = make(RuleMap)
+	}
+	rule, ok := s.AllRules[sourcePath][indexPath]
+	if !ok {
+		rule = &AccessRule{
+			Deny:  RuleSet{Users: make(StringSet), Groups: make(StringSet)},
+			Allow: RuleSet{Users: make(StringSet), Groups: make(StringSet)},
+		}
+		s.AllRules[sourcePath][indexPath] = rule
+	}
+	logger.Debugf("Created rule for source: %s and index: %s", sourcePath, indexPath)
+	return rule
+}
+
+// DenyUser adds a user to the deny list for a given source and index path.
+func (s *Storage) DenyUser(sourcePath, indexPath, username string) error {
+	if s.Users != nil {
+		_, err := s.Users.Get(username)
+		if err != nil {
+			return fmt.Errorf("user '%s' does not exist: %w", username, err)
+		}
+	}
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
+	if _, ok := rule.Deny.Users[username]; ok {
+		return errors.ErrExist
+	}
+	rule.Deny.Users[username] = struct{}{}
+	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
+	return s.SaveToDB()
+}
+
+// AllowUser adds a user to the allow list for a given source and index path.
+func (s *Storage) AllowUser(sourcePath, indexPath, username string) error {
+	if s.Users != nil {
+		_, err := s.Users.Get(username)
+		if err != nil {
+			return fmt.Errorf("user '%s' does not exist: %w", username, err)
+		}
+	}
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
+	if _, ok := rule.Allow.Users[username]; ok {
+		return errors.ErrExist
+	}
+	rule.Allow.Users[username] = struct{}{}
+	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
+	return s.SaveToDB()
+}
+
+// DenyGroup adds a group to the deny list for a given source and index path.
+func (s *Storage) DenyGroup(sourcePath, indexPath, groupname string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	_, ok := s.Groups[groupname]
+	if !ok {
+		return fmt.Errorf("group '%s' does not exist", groupname)
+	}
+	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
+	if _, ok := rule.Deny.Groups[groupname]; ok {
+		return errors.ErrExist
+	}
+	rule.Deny.Groups[groupname] = struct{}{}
+	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
+	return s.SaveToDB()
+}
+
+// AllowGroup adds a group to the allow list for a given source and index path.
+func (s *Storage) AllowGroup(sourcePath, indexPath, groupname string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	_, ok := s.Groups[groupname]
+	if !ok {
+		return fmt.Errorf("group '%s' does not exist", groupname)
+	}
+	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
+	if _, ok := rule.Allow.Groups[groupname]; ok {
+		return errors.ErrExist
+	}
+	rule.Allow.Groups[groupname] = struct{}{}
+	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
+	return s.SaveToDB()
+}
+
+// DenyAll sets a rule to deny all access for a given source and index path.
+func (s *Storage) DenyAll(sourcePath, indexPath string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	rule := s.getOrCreateRuleNL(sourcePath, indexPath)
+	if rule.DenyAll {
+		return errors.ErrExist
+	}
+	rule.DenyAll = true
+	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, false)
+	return s.SaveToDB()
+}
+
+// Permitted checks if a username is permitted for a given sourcePath and indexPath, recursively checking parent directories.
+func (s *Storage) Permitted(sourcePath, indexPath, username string) bool {
+
+	// Get current version for the sourcePath
+	versionKey := "version:" + sourcePath
+	version := 0
+	if v, ok := accessCache.Get(versionKey).(int); ok {
+		version = v
+	}
+
+	// Check cache with versioned key
+	permKey := fmt.Sprintf("perm:%s:%d:%s:%s", sourcePath, version, indexPath, username)
+	if p, ok := accessCache.Get(permKey).(bool); ok {
+		return p
+	}
+
+	// Not in cache, compute, then cache it.
+	result := s.computePermitted(sourcePath, indexPath, username)
+	accessCache.Set(permKey, result)
+	return result
+}
+
+func (s *Storage) computePermitted(sourcePath, indexPath, username string) bool {
+	for {
+		permitted, found := s.permittedAtExactPath(sourcePath, indexPath, username)
+		if found {
+			return permitted
+		}
+		indexPath = utils.GetParentDirectoryPath(indexPath)
+		if indexPath == "" {
+			break
+		}
+	}
+
+	// No rules found anywhere in the path hierarchy
+	// Check if the source has DenyByDefault configured (acts like a root-level denyAll rule)
+	sourceInfo, ok := settings.Config.Server.SourceMap[sourcePath]
+	if !ok {
+		logger.Errorf("source %s not found in config during access check", sourcePath)
+		return false
+	}
+
+	if sourceInfo.Config.DenyByDefault {
+		return false
+	}
+
+	return true
+}
+
+// permittedAtExactPath checks if a rule exists at the given path and evaluates it if so.
+func (s *Storage) permittedAtExactPath(sourcePath, indexPath, username string) (bool, bool) {
+	s.mux.RLock()
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		s.mux.RUnlock()
+		return true, false
+	}
+	rule, ok := rulesBySource[indexPath]
+	s.mux.RUnlock()
+	if !ok {
+		return true, false
+	}
+	return s.permittedRule(rule, username, sourcePath), true
+}
+
+// permittedRule contains the old Permitted logic, but operates on a rule and username only.
+func (s *Storage) permittedRule(rule *AccessRule, username string, sourcePath string) bool {
+	// Check user deny first - this always takes precedence
+	if _, found := rule.Deny.Users[username]; found {
+		return false
+	}
+	// Check group deny
+	for group := range rule.Deny.Groups {
+		if s.isUserInGroup(username, group) {
+			return false
+		}
+	}
+
+	// Check allow rules - these can override DenyAll
+	hasUserAllow := len(rule.Allow.Users) > 0
+	hasGroupAllow := len(rule.Allow.Groups) > 0
+	if hasUserAllow || hasGroupAllow {
+		// If user is in any allow list, permit them (overrides DenyAll)
+		if hasUserAllow {
+			if _, found := rule.Allow.Users[username]; found {
+				return true
+			}
+		}
+		if hasGroupAllow {
+			for group := range rule.Allow.Groups {
+				if s.isUserInGroup(username, group) {
+					return true
+				}
+			}
+		}
+
+		// User is not in any allow list
+		// Check DenyByDefault to determine behavior
+		sourceInfo, ok := settings.Config.Server.SourceMap[sourcePath]
+		if ok && sourceInfo.Config.DenyByDefault {
+			// DenyByDefault=true: allow lists are exclusive, deny users not on the list
+			return false
+		} else {
+			// DenyByDefault=false: allow lists are additive, allow users not on the list
+			return true
+		}
+	}
+
+	// Check DenyAll - only applies if no allow rules exist
+	if rule.DenyAll {
+		return false
+	}
+
+	// No specific rules apply - check source DenyByDefault setting
+	sourceInfo, ok := settings.Config.Server.SourceMap[sourcePath]
+	if ok && sourceInfo.Config.DenyByDefault {
+		return false
+	}
+
+	return true
+}
+
+// isUserInGroup checks if a username is in a group.
+func (s *Storage) isUserInGroup(username, group string) bool {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	users, ok := s.Groups[group]
+	if !ok {
+		return false
+	}
+	_, found := users[username]
+	return found
+}
+
+// GetRule retrieves a rule for a sourcePath and indexPath.
+func (s *Storage) GetFrontendRules(sourcePath, indexPath string) (FrontendAccessRule, bool) {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
+	frontendRules := FrontendAccessRule{
+		SourceDenyDefault: sourceDenyDefault,
+		Deny: FrontendRuleSet{
+			Users:  make([]string, 0),
+			Groups: make([]string, 0),
+		},
+		Allow: FrontendRuleSet{
+			Users:  make([]string, 0),
+			Groups: make([]string, 0),
+		},
+	}
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return frontendRules, false
+	}
+	rule, ok := rulesBySource[indexPath]
+	if !ok || rule == nil {
+		return frontendRules, false
+	}
+	// Convert AccessRule to FrontendAccessRule
+	frontendRules.DenyAll = rule.DenyAll
+	frontendRules.Deny.Users = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users)))
+	frontendRules.Deny.Groups = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups)))
+	frontendRules.Allow.Users = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users)))
+	frontendRules.Allow.Groups = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups)))
+
+	logger.Debugf("Returning frontend rules for source: %s and index: %s", sourcePath, indexPath)
+	return frontendRules, ok
+}
+
+// GetAllRules returns all access rules as a map.
+func (s *Storage) GetAllRules(sourcePath string) (map[string]FrontendAccessRule, error) {
+	value, ok := accessCache.Get(accessChangedKey + sourcePath).(map[string]FrontendAccessRule)
+	if ok {
+		return value, nil
+	}
+
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
+	// Return a copy to avoid external mutation
+	frontendRules := make(map[string]FrontendAccessRule, len(s.AllRules))
+	rules, ok := s.AllRules[sourcePath]
+	if !ok {
+		return frontendRules, nil
+	}
+	for indexPath, rule := range rules {
+		// Convert AccessRule to FrontendAccessRule
+		frontendRules[indexPath] = FrontendAccessRule{
+			DenyAll:           rule.DenyAll,
+			SourceDenyDefault: sourceDenyDefault,
+			Deny: FrontendRuleSet{
+				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
+				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
+			},
+			Allow: FrontendRuleSet{
+				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
+				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
+			},
+		}
+	}
+	// cache responses
+	accessCache.Set(accessChangedKey+sourcePath, frontendRules)
+	return frontendRules, nil
+}
+
+// AddUserToGroup adds a username to a group.
+func (s *Storage) AddUserToGroup(group, username string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	if _, ok := s.Groups[group]; !ok {
+		s.Groups[group] = make(StringSet)
+	}
+	if _, ok := s.Groups[group][username]; ok {
+		return nil
+	}
+	s.Groups[group][username] = struct{}{}
+	return s.SaveToDB()
+}
+
+// GetAllGroups returns all group names.
+func (s *Storage) GetAllGroups() []string {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	groups := make([]string, 0, len(s.Groups))
+	for group := range s.Groups {
+		groups = append(groups, group)
+	}
+	sort.Strings(groups)
+	return groups
+}
+
+// GetUserGroups returns all groups for a specific user.
+func (s *Storage) GetUserGroups(username string) []string {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	var groups []string
+	for group, users := range s.Groups {
+		if _, ok := users[username]; ok {
+			groups = append(groups, group)
+		}
+	}
+	return utils.NonNilSlice(groups)
+}
+
+// SyncUserGroups updates a user's group memberships.
+// It removes the user from groups not in the new list and adds them to new ones.
+func (s *Storage) SyncUserGroups(username string, newGroups []string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	changed := false
+
+	// Create a set of new groups for efficient lookup
+	newGroupsSet := make(StringSet, len(newGroups))
+	for _, g := range newGroups {
+		newGroupsSet[g] = struct{}{}
+	}
+
+	// Iterate over all existing groups to find the user's current memberships
+	for group, users := range s.Groups {
+		_, userIsInGroup := users[username]
+		_, groupIsInNewSet := newGroupsSet[group]
+
+		// If user is in a group that is not in their new set of groups, remove them.
+		if userIsInGroup && !groupIsInNewSet {
+			delete(s.Groups[group], username)
+			changed = true
+		}
+	}
+
+	// Add user to new groups
+	for group := range newGroupsSet {
+		if _, ok := s.Groups[group]; !ok {
+			s.Groups[group] = make(StringSet)
+		}
+		if _, ok := s.Groups[group][username]; !ok {
+			s.Groups[group][username] = struct{}{}
+			changed = true
+		}
+	}
+	if changed {
+		return s.SaveToDB()
+	}
+	return nil
+}
+
+// RemoveUserFromGroup removes a username from a group.
+func (s *Storage) RemoveUserFromGroup(group, username string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	users, ok := s.Groups[group]
+	if !ok {
+		return nil
+	}
+	if _, ok := users[username]; !ok {
+		return nil
+	}
+	delete(users, username)
+	if len(s.Groups[group]) == 0 {
+		delete(s.Groups, group)
+	}
+	return s.SaveToDB()
+}
+
+// RemoveAllowUser removes a user from the allow list for a given source and index path.
+func (s *Storage) RemoveAllowUser(sourcePath, indexPath, username string) (bool, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	rule, ok := s.AllRules[sourcePath][indexPath]
+	if !ok {
+		return false, nil
+	}
+	_, exists := rule.Allow.Users[username]
+	if exists {
+		delete(rule.Allow.Users, username)
+	}
+	removed := false
+	if exists {
+		s.incrementSourceVersion(sourcePath)
+		removed = true
+	}
+	// If rule is now empty, remove it
+	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
+		delete(s.AllRules[sourcePath], indexPath)
+		if len(s.AllRules[sourcePath]) == 0 {
+			delete(s.AllRules, sourcePath)
+		}
+	}
+	if removed {
+		accessCache.Set(accessChangedKey+sourcePath, false)
+		return exists, s.SaveToDB()
+	}
+	return false, nil
+}
+
+// RemoveAllowGroup removes a group from the allow list for a given source and index path.
+func (s *Storage) RemoveAllowGroup(sourcePath, indexPath, groupname string) (bool, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	rule, ok := s.AllRules[sourcePath][indexPath]
+	if !ok {
+		return false, nil
+	}
+	_, exists := rule.Allow.Groups[groupname]
+	if exists {
+		delete(rule.Allow.Groups, groupname)
+	}
+	removed := false
+	if exists {
+		s.incrementSourceVersion(sourcePath)
+		removed = true
+	}
+	// If rule is now empty, remove it
+	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
+		delete(s.AllRules[sourcePath], indexPath)
+		if len(s.AllRules[sourcePath]) == 0 {
+			delete(s.AllRules, sourcePath)
+		}
+	}
+	if removed {
+		accessCache.Set(accessChangedKey+sourcePath, false)
+		return exists, s.SaveToDB()
+	}
+	return exists, nil
+}
+
+// RemoveDenyUser removes a user from the deny list for a given source and index path.
+func (s *Storage) RemoveDenyUser(sourcePath, indexPath, username string) (bool, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	rule, ok := s.AllRules[sourcePath][indexPath]
+	if !ok {
+		return false, nil
+	}
+	_, exists := rule.Deny.Users[username]
+	if exists {
+		delete(rule.Deny.Users, username)
+	}
+	removed := false
+	if exists {
+		s.incrementSourceVersion(sourcePath)
+		removed = true
+	}
+	// If rule is now empty, remove it
+	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
+		delete(s.AllRules[sourcePath], indexPath)
+		if len(s.AllRules[sourcePath]) == 0 {
+			delete(s.AllRules, sourcePath)
+		}
+	}
+	if removed {
+		accessCache.Set(accessChangedKey+sourcePath, false)
+		return exists, s.SaveToDB()
+	}
+	return false, nil
+}
+
+// RemoveDenyGroup removes a group from the deny list for a given source and index path.
+func (s *Storage) RemoveDenyGroup(sourcePath, indexPath, groupname string) (bool, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	rule, ok := s.AllRules[sourcePath][indexPath]
+	if !ok {
+		return false, nil
+	}
+	_, exists := rule.Deny.Groups[groupname]
+	if exists {
+		delete(rule.Deny.Groups, groupname)
+	}
+	removed := false
+	if exists {
+		s.incrementSourceVersion(sourcePath)
+		removed = true
+	}
+	// If rule is now empty, remove it
+	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
+		delete(s.AllRules[sourcePath], indexPath)
+		if len(s.AllRules[sourcePath]) == 0 {
+			delete(s.AllRules, sourcePath)
+		}
+	}
+	if removed {
+		accessCache.Set(accessChangedKey+sourcePath, false)
+		return exists, s.SaveToDB()
+	}
+	return exists, nil
+}
+
+// RemoveDenyAll removes the deny all rule for a given source and index path.
+func (s *Storage) RemoveDenyAll(sourcePath, indexPath string) (bool, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	rule, ok := s.AllRules[sourcePath][indexPath]
+	if !ok {
+		return false, nil
+	}
+	removed := false
+	if rule.DenyAll {
+		rule.DenyAll = false
+		s.incrementSourceVersion(sourcePath)
+		removed = true
+	}
+	// If rule is now empty, remove it
+	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
+		delete(s.AllRules[sourcePath], indexPath)
+		if len(s.AllRules[sourcePath]) == 0 {
+			delete(s.AllRules, sourcePath)
+		}
+	}
+	if removed {
+		accessCache.Set(accessChangedKey+sourcePath, false)
+		return true, s.SaveToDB()
+	}
+	return false, nil
+}
+
+// RemoveAllRulesForUser removes a user from all allow and deny lists.
+func (s *Storage) RemoveAllRulesForUser(username string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	changed := false
+	changedSourcePaths := make(map[string]struct{})
+	for sourcePath, rulesBySource := range s.AllRules {
+		for indexPath, rule := range rulesBySource {
+			if _, exists := rule.Allow.Users[username]; exists {
+				delete(rule.Allow.Users, username)
+				changedSourcePaths[sourcePath] = struct{}{}
+				changed = true
+			}
+			if _, exists := rule.Deny.Users[username]; exists {
+				delete(rule.Deny.Users, username)
+				changedSourcePaths[sourcePath] = struct{}{}
+				changed = true
+			}
+			if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
+				delete(s.AllRules[sourcePath], indexPath)
+				if len(s.AllRules[sourcePath]) == 0 {
+					delete(s.AllRules, sourcePath)
+				}
+			}
+		}
+	}
+	for sp := range changedSourcePaths {
+		s.incrementSourceVersion(sp)
+		accessCache.Set(accessChangedKey+sp, false)
+	}
+	if changed {
+		return s.SaveToDB()
+	}
+	return nil
+}
+
+// RemoveAllRulesForGroup removes a group from all allow and deny lists.
+func (s *Storage) RemoveAllRulesForGroup(groupname string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	changed := false
+	changedSourcePaths := make(map[string]struct{})
+	for sourcePath, rulesBySource := range s.AllRules {
+		for indexPath, rule := range rulesBySource {
+			if _, exists := rule.Allow.Groups[groupname]; exists {
+				delete(rule.Allow.Groups, groupname)
+				changedSourcePaths[sourcePath] = struct{}{}
+				changed = true
+			}
+			if _, exists := rule.Deny.Groups[groupname]; exists {
+				delete(rule.Deny.Groups, groupname)
+				changedSourcePaths[sourcePath] = struct{}{}
+				changed = true
+			}
+			if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
+				delete(s.AllRules[sourcePath], indexPath)
+				if len(s.AllRules[sourcePath]) == 0 {
+					delete(s.AllRules, sourcePath)
+				}
+			}
+		}
+	}
+	for sp := range changedSourcePaths {
+		s.incrementSourceVersion(sp)
+		accessCache.Set(accessChangedKey+sp, false)
+	}
+	if changed {
+		return s.SaveToDB()
+	}
+	return nil
+}
+
+// GetRulesForUser returns all rules for a specific user for a given sourcePath.
+func (s *Storage) GetRulesForUser(sourcePath, username string) map[string]FrontendAccessRule {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
+	userRules := make(map[string]FrontendAccessRule)
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return userRules
+	}
+	for indexPath, rule := range rulesBySource {
+		userHasRule := false
+		if _, ok := rule.Allow.Users[username]; ok {
+			userHasRule = true
+		}
+		if !userHasRule {
+			if _, ok := rule.Deny.Users[username]; ok {
+				userHasRule = true
+			}
+		}
+		if userHasRule {
+			userRules[indexPath] = FrontendAccessRule{
+				DenyAll:           rule.DenyAll,
+				SourceDenyDefault: sourceDenyDefault,
+				Deny: FrontendRuleSet{
+					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
+					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
+				},
+				Allow: FrontendRuleSet{
+					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
+					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
+				},
+			}
+		}
+	}
+	return userRules
+}
+
+// GetRulesForGroup returns all rules for a specific group for a given sourcePath.
+func (s *Storage) GetRulesForGroup(sourcePath, groupname string) map[string]FrontendAccessRule {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
+	groupRules := make(map[string]FrontendAccessRule)
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return groupRules
+	}
+	for indexPath, rule := range rulesBySource {
+		groupHasRule := false
+		if _, ok := rule.Allow.Groups[groupname]; ok {
+			groupHasRule = true
+		}
+		if !groupHasRule {
+			if _, ok := rule.Deny.Groups[groupname]; ok {
+				groupHasRule = true
+			}
+		}
+		if groupHasRule {
+			groupRules[indexPath] = FrontendAccessRule{
+				DenyAll:           rule.DenyAll,
+				SourceDenyDefault: sourceDenyDefault,
+				Deny: FrontendRuleSet{
+					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
+					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
+				},
+				Allow: FrontendRuleSet{
+					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
+					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
+				},
+			}
+		}
+	}
+	return groupRules
+}
+
+// GetAllRulesByUsers returns a map of usernames to their rules for a given sourcePath.
+func (s *Storage) GetAllRulesByUsers(sourcePath string) map[string]map[string]FrontendAccessRule {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
+	allUserRules := make(map[string]map[string]FrontendAccessRule)
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return allUserRules
+	}
+	for indexPath, rule := range rulesBySource {
+		hasAllowUsers := len(rule.Allow.Users) > 0
+		hasDenyUsers := len(rule.Deny.Users) > 0
+		if !hasAllowUsers && !hasDenyUsers {
+			continue
+		}
+		frontendRule := FrontendAccessRule{
+			DenyAll:           rule.DenyAll,
+			SourceDenyDefault: sourceDenyDefault,
+			Deny: FrontendRuleSet{
+				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
+				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
+			},
+			Allow: FrontendRuleSet{
+				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
+				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
+			},
+		}
+		for user := range rule.Allow.Users {
+			if _, ok := allUserRules[user]; !ok {
+				allUserRules[user] = make(map[string]FrontendAccessRule)
+			}
+			allUserRules[user][indexPath] = frontendRule
+		}
+		for user := range rule.Deny.Users {
+			if _, ok := allUserRules[user]; !ok {
+				allUserRules[user] = make(map[string]FrontendAccessRule)
+			}
+			allUserRules[user][indexPath] = frontendRule
+		}
+	}
+	return allUserRules
+}
+
+// GetAllRulesByGroups returns a map of groupnames to their rules for a given sourcePath.
+func (s *Storage) GetAllRulesByGroups(sourcePath string) map[string]map[string]FrontendAccessRule {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
+	allGroupRules := make(map[string]map[string]FrontendAccessRule)
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return allGroupRules
+	}
+	for indexPath, rule := range rulesBySource {
+		hasAllowGroups := len(rule.Allow.Groups) > 0
+		hasDenyGroups := len(rule.Deny.Groups) > 0
+		if !hasAllowGroups && !hasDenyGroups {
+			continue
+		}
+		frontendRule := FrontendAccessRule{
+			DenyAll:           rule.DenyAll,
+			SourceDenyDefault: sourceDenyDefault,
+			Deny: FrontendRuleSet{
+				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
+				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
+			},
+			Allow: FrontendRuleSet{
+				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users))),
+				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups))),
+			},
+		}
+		for group := range rule.Allow.Groups {
+			if _, ok := allGroupRules[group]; !ok {
+				allGroupRules[group] = make(map[string]FrontendAccessRule)
+			}
+			allGroupRules[group][indexPath] = frontendRule
+		}
+		for group := range rule.Deny.Groups {
+			if _, ok := allGroupRules[group]; !ok {
+				allGroupRules[group] = make(map[string]FrontendAccessRule)
+			}
+			allGroupRules[group][indexPath] = frontendRule
+		}
+	}
+	return allGroupRules
+}
+
+// incrementSourceVersion increments the version of a sourcePath to invalidate caches.
+// The caller MUST hold the mutex lock.
+func (s *Storage) incrementSourceVersion(sourcePath string) {
+	key := "version:" + sourcePath
+	version := 0
+	if v, ok := accessCache.Get(key).(int); ok {
+		version = v
+	}
+	accessCache.Set(key, version+1)
+}
@@ -0,0 +1,407 @@
+package access_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/asdine/storm/v3"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
+	boltusers "github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+func createTestStorage(t *testing.T) (*access.Storage, *users.Storage) {
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "test.db")
+	db, err := storm.Open(dbPath)
+	if err != nil {
+		t.Fatalf("failed to open storm db: %v", err)
+	}
+	userStore := users.NewStorage(boltusers.NewUsersBackend(db))
+	return access.NewStorage(db, userStore), userStore
+}
+
+func createTestUser(t *testing.T, userStore *users.Storage, username string) {
+	u := &users.User{NonAdminEditable: users.NonAdminEditable{Password: "test"}, Username: username}
+	err := userStore.Save(u, false, false)
+	if err != nil {
+		t.Fatalf("failed to create user %s: %v", username, err)
+	}
+}
+
+func setupTestSources() {
+	// Setup default test sources with allow-by-default behavior
+	settings.Config.Server.SourceMap = map[string]settings.Source{
+		"mnt/storage": {
+			Path: "mnt/storage",
+			Name: "storage",
+			Config: settings.SourceConfig{
+				DenyByDefault: false,
+			},
+		},
+		"mnt/open": {
+			Path: "mnt/open",
+			Name: "open",
+			Config: settings.SourceConfig{
+				DenyByDefault: false,
+			},
+		},
+	}
+}
+
+func TestPermitted_UserBlacklist(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	createTestUser(t, userStore, "bob")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+	if err := s.DenyUser("mnt/storage", "/secret", "alice"); err != nil {
+		t.Errorf("DenyUser failed: %v", err)
+	}
+	if s.Permitted("mnt/storage", "/secret", "alice") {
+		t.Error("alice should not be permitted (denied)")
+	}
+	if !s.Permitted("mnt/storage", "/secret", "bob") {
+		t.Error("bob should be permitted (not denied)")
+	}
+}
+
+func TestPermitted_UserWhitelist(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	createTestUser(t, userStore, "bob")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+	if err := s.AllowUser("mnt/storage", "/vip", "bob"); err != nil {
+		t.Errorf("AllowUser failed: %v", err)
+	}
+	if !s.Permitted("mnt/storage", "/vip", "bob") {
+		t.Error("bob should be permitted (allowed)")
+	}
+	if !s.Permitted("mnt/storage", "/vip", "alice") {
+		t.Error("alice should be permitted (default allow behavior when DenyByDefault=false)")
+	}
+}
+
+func TestPermitted_GroupBlacklist(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	createTestUser(t, userStore, "bob")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+	_ = s.AddUserToGroup("admins", "alice")
+	if err := s.DenyGroup("mnt/storage", "/admin", "admins"); err != nil {
+		t.Errorf("DenyGroup failed: %v", err)
+	}
+	if s.Permitted("mnt/storage", "/admin", "bob") == false {
+		t.Error("bob should be permitted (not in denied group)")
+	}
+	if s.Permitted("mnt/storage", "/admin", "alice") {
+		t.Error("alice should not be permitted (in denied group)")
+	}
+}
+
+func TestPermitted_GroupWhitelist(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	createTestUser(t, userStore, "bob")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+	_ = s.AddUserToGroup("vip", "bob")
+	if err := s.AllowGroup("mnt/storage", "/vip", "vip"); err != nil {
+		t.Errorf("AllowGroup failed: %v", err)
+	}
+	if !s.Permitted("mnt/storage", "/vip", "bob") {
+		t.Error("bob should be permitted (in allowed group)")
+	}
+	if !s.Permitted("mnt/storage", "/vip", "alice") {
+		t.Error("alice should be permitted (default allow behavior when DenyByDefault=false)")
+	}
+}
+
+func TestPermitted_NoRule(t *testing.T) {
+	setupTestSources()
+	s, _ := createTestStorage(t)
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+	if !s.Permitted("mnt/storage", "/public", "anyone") {
+		t.Error("anyone should be permitted if no rule exists")
+	}
+}
+
+func TestPermitted_CombinedRules(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	createTestUser(t, userStore, "bob")
+	createTestUser(t, userStore, "carol")
+	createTestUser(t, userStore, "eve")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+	err = s.AddUserToGroup("vip", "bob")
+	if err != nil {
+		t.Errorf("AddUserToGroup failed: %v", err)
+	}
+	err = s.AddUserToGroup("admins", "alice")
+	if err != nil {
+		t.Errorf("AddUserToGroup failed: %v", err)
+	}
+	if err := s.DenyUser("mnt/storage", "/combo", "eve"); err != nil {
+		t.Errorf("DenyUser failed: %v", err)
+	}
+	if err := s.AllowUser("mnt/storage", "/combo", "carol"); err != nil {
+		t.Errorf("AllowUser failed: %v", err)
+	}
+	if err := s.DenyGroup("mnt/storage", "/combo", "admins"); err != nil {
+		t.Errorf("DenyGroup failed: %v", err)
+	}
+	if err := s.AllowGroup("mnt/storage", "/combo", "vip"); err != nil {
+		t.Errorf("AllowGroup failed: %v", err)
+	}
+	if s.Permitted("mnt/storage", "/combo", "eve") {
+		t.Error("eve should not be permitted (user denied)")
+	}
+	if !s.Permitted("mnt/storage", "/combo", "carol") {
+		t.Error("carol should be permitted (user allowed)")
+	}
+	if s.Permitted("mnt/storage", "/combo", "alice") {
+		t.Error("alice should not be permitted (in group denied)")
+	}
+	if !s.Permitted("mnt/storage", "/combo", "bob") {
+		t.Error("bob should be permitted (in group allowed)")
+	}
+}
+
+func TestPermitted_DenyAll(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	createTestUser(t, userStore, "bob")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Test DenyAll
+	if err = s.DenyAll("mnt/storage", "/private"); err != nil {
+		t.Errorf("DenyAll failed: %v", err)
+	}
+	if s.Permitted("mnt/storage", "/private", "alice") {
+		t.Error("alice should not be permitted (deny all)")
+	}
+	if s.Permitted("mnt/storage", "/private", "bob") {
+		t.Error("bob should not be permitted (deny all)")
+	}
+
+	// Test that Allow rule overrides DenyAll
+	if err = s.AllowUser("mnt/storage", "/private", "alice"); err != nil {
+		t.Errorf("AllowUser failed: %v", err)
+	}
+	if !s.Permitted("mnt/storage", "/private", "alice") {
+		t.Error("alice should be permitted (allow overrides deny all)")
+	}
+
+	// Test removing DenyAll
+	removed, err := s.RemoveDenyAll("mnt/storage", "/private")
+	if err != nil {
+		t.Errorf("RemoveDenyAll failed: %v", err)
+	}
+	if !removed {
+		t.Error("RemoveDenyAll should have removed the rule")
+	}
+
+	// After removing DenyAll, alice should be permitted due to the Allow rule
+	if !s.Permitted("mnt/storage", "/private", "alice") {
+		t.Error("alice should be permitted after removing deny all")
+	}
+
+	// Bob should be permitted because DenyByDefault=false makes allow lists additive (not exclusive)
+	if !s.Permitted("mnt/storage", "/private", "bob") {
+		t.Error("bob should be permitted after removing deny all (DenyByDefault=false makes allow lists additive)")
+	}
+}
+
+func TestPermitted_DenyByDefault(t *testing.T) {
+	// Clear access cache to prevent test pollution
+	access.ClearCache()
+
+	// Create isolated storage for this test
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	createTestUser(t, userStore, "bob")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Setup test configuration with DenyByDefault enabled for one source
+	originalSourceMap := settings.Config.Server.SourceMap
+	defer func() {
+		settings.Config.Server.SourceMap = originalSourceMap
+		access.ClearCache()
+	}()
+
+	settings.Config.Server.SourceMap = map[string]settings.Source{
+		"mnt/storage": {
+			Path: "mnt/storage",
+			Name: "storage",
+			Config: settings.SourceConfig{
+				DenyByDefault: true,
+			},
+		},
+		"mnt/open": {
+			Path: "mnt/open",
+			Name: "open",
+			Config: settings.SourceConfig{
+				DenyByDefault: false,
+			},
+		},
+	}
+
+	// Test DenyByDefault: When no rules exist, users should be denied
+	if s.Permitted("mnt/storage", "/private", "alice") {
+		t.Error("alice should not be permitted (DenyByDefault is true and no rules exist)")
+	}
+	if s.Permitted("mnt/storage", "/private", "bob") {
+		t.Error("bob should not be permitted (DenyByDefault is true and no rules exist)")
+	}
+
+	// Test that explicit allow rules override DenyByDefault
+	if err := s.AllowUser("mnt/storage", "/allowed", "alice"); err != nil {
+		t.Errorf("AllowUser failed: %v", err)
+	}
+	if !s.Permitted("mnt/storage", "/allowed", "alice") {
+		t.Error("alice should be permitted (explicit allow rule overrides DenyByDefault)")
+	}
+	if s.Permitted("mnt/storage", "/allowed", "bob") {
+		t.Error("bob should not be permitted (not in allow list and DenyByDefault is true)")
+	}
+
+	// Test that explicit deny rules work with DenyByDefault
+	if err := s.DenyUser("mnt/storage", "/denied", "alice"); err != nil {
+		t.Errorf("DenyUser failed: %v", err)
+	}
+	if s.Permitted("mnt/storage", "/denied", "alice") {
+		t.Error("alice should not be permitted (explicit deny rule)")
+	}
+	if s.Permitted("mnt/storage", "/denied", "bob") {
+		t.Error("bob should not be permitted (DenyByDefault is true)")
+	}
+
+	// Test that DenyByDefault doesn't affect sources where it's disabled
+	if !s.Permitted("mnt/open", "/public", "alice") {
+		t.Error("alice should be permitted in open source (DenyByDefault is false)")
+	}
+	if !s.Permitted("mnt/open", "/public", "bob") {
+		t.Error("bob should be permitted in open source (DenyByDefault is false)")
+	}
+
+	// Test recursive path checking with DenyByDefault
+	// Allow alice at parent path, should work for child paths too
+	if err := s.AllowUser("mnt/storage", "/parent", "alice"); err != nil {
+		t.Errorf("AllowUser failed: %v", err)
+	}
+	if !s.Permitted("mnt/storage", "/parent/child", "alice") {
+		t.Error("alice should be permitted for child path (inherits from parent allow rule)")
+	}
+	if s.Permitted("mnt/storage", "/parent/child", "bob") {
+		t.Error("bob should not be permitted for child path (DenyByDefault and not in allow list)")
+	}
+
+	// Test that group rules work with DenyByDefault
+	_ = s.AddUserToGroup("vip", "alice")
+	if err := s.AllowGroup("mnt/storage", "/vip", "vip"); err != nil {
+		t.Errorf("AllowGroup failed: %v", err)
+	}
+	if !s.Permitted("mnt/storage", "/vip", "alice") {
+		t.Error("alice should be permitted (in allowed group)")
+	}
+	if s.Permitted("mnt/storage", "/vip", "bob") {
+		t.Error("bob should not be permitted (not in allowed group and DenyByDefault is true)")
+	}
+}
+
+func TestPermitted_DenyByDefaultWithDenyAll(t *testing.T) {
+	// Clear access cache to prevent test pollution
+	access.ClearCache()
+
+	// Create isolated storage for this test
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	createTestUser(t, userStore, "bob")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Setup test configuration with DenyByDefault enabled
+	originalSourceMap := settings.Config.Server.SourceMap
+	defer func() {
+		settings.Config.Server.SourceMap = originalSourceMap
+		access.ClearCache()
+	}()
+
+	settings.Config.Server.SourceMap = map[string]settings.Source{
+		"mnt/storage": {
+			Path: "mnt/storage",
+			Name: "storage",
+			Config: settings.SourceConfig{
+				DenyByDefault: true,
+			},
+		},
+	}
+
+	// Test that explicit DenyAll rule also works when DenyByDefault is enabled
+	if err = s.DenyAll("mnt/storage", "/restricted"); err != nil {
+		t.Errorf("DenyAll failed: %v", err)
+	}
+	if s.Permitted("mnt/storage", "/restricted", "alice") {
+		t.Error("alice should not be permitted (DenyAll rule)")
+	}
+	if s.Permitted("mnt/storage", "/restricted", "bob") {
+		t.Error("bob should not be permitted (DenyAll rule)")
+	}
+
+	// Test that Allow rule overrides DenyAll even with DenyByDefault
+	if err = s.AllowUser("mnt/storage", "/restricted", "alice"); err != nil {
+		t.Errorf("AllowUser failed: %v", err)
+	}
+	if !s.Permitted("mnt/storage", "/restricted", "alice") {
+		t.Error("alice should be permitted (allow overrides DenyAll)")
+	}
+
+	// Remove DenyAll and test that DenyByDefault takes effect
+	removed, err := s.RemoveDenyAll("mnt/storage", "/restricted")
+	if err != nil {
+		t.Errorf("RemoveDenyAll failed: %v", err)
+	}
+	if !removed {
+		t.Error("RemoveDenyAll should have removed the rule")
+	}
+
+	// After removing DenyAll, alice should be permitted due to Allow rule
+	if !s.Permitted("mnt/storage", "/restricted", "alice") {
+		t.Error("alice should be permitted after removing DenyAll (has allow rule)")
+	}
+	// Bob should not be permitted due to DenyByDefault
+	if s.Permitted("mnt/storage", "/restricted", "bob") {
+		t.Error("bob should not be permitted (DenyByDefault is true and no allow rule)")
+	}
+}
@@ -0,0 +1,34 @@
+package crud
+
+// CrudBackend defines the basic CRUD operations for a type T.
+type CrudBackend[T any] interface {
+	GetByID(id any) (*T, error)
+	GetAll() ([]*T, error)
+	Save(obj *T) error
+	DeleteByID(id any) error
+}
+
+// Storage provides generic CRUD operations for any type T.
+type Storage[T any] struct {
+	backend CrudBackend[T]
+}
+
+func NewStorage[T any](backend CrudBackend[T]) *Storage[T] {
+	return &Storage[T]{backend: backend}
+}
+
+func (s *Storage[T]) Get(id any) (*T, error) {
+	return s.backend.GetByID(id)
+}
+
+func (s *Storage[T]) GetAll() ([]*T, error) {
+	return s.backend.GetAll()
+}
+
+func (s *Storage[T]) Save(obj *T) error {
+	return s.backend.Save(obj)
+}
+
+func (s *Storage[T]) Delete(id any) error {
+	return s.backend.DeleteByID(id)
+}
@@ -1,6 +1,38 @@
 package share

+import "sync"
+
+type CommonShare struct {
+	//AllowEdit           bool   `json:"allowEdit,omitempty"`
+	AllowUpload             bool     `json:"allowUpload,omitempty"`
+	DisableFileViewer       bool     `json:"disableFileViewer,omitempty"`
+	DownloadsLimit          int      `json:"downloadsLimit,omitempty"`
+	ShareTheme              string   `json:"shareTheme,omitempty"`
+	DisableAnonymous        bool     `json:"disableAnonymous,omitempty"`
+	MaxBandwidth            int      `json:"maxBandwidth,omitempty"`
+	DisableThumbnails       bool     `json:"disableThumbnails,omitempty"`
+	KeepAfterExpiration     bool     `json:"keepAfterExpiration,omitempty"`
+	AllowedUsernames        []string `json:"allowedUsernames,omitempty"`
+	ThemeColor              string   `json:"themeColor,omitempty"`
+	Banner                  string   `json:"banner,omitempty"`
+	Title                   string   `json:"title,omitempty"`
+	Description             string   `json:"description,omitempty"`
+	Favicon                 string   `json:"favicon,omitempty"`
+	QuickDownload           bool     `json:"quickDownload,omitempty"`
+	HideNavButtons          bool     `json:"hideNavButtons,omitempty"`
+	DisableSidebar          bool     `json:"disableSidebar"`
+	ViewMode                string   `json:"viewMode,omitempty"`
+	Source                  string   `json:"source,omitempty"` // backend source is path to maintain between name changes
+	Path                    string   `json:"path,omitempty"`
+	DownloadURL             string   `json:"downloadURL,omitempty"`
+	DisableShareCard        bool     `json:"disableShareCard,omitempty"`
+	EnforceDarkLightMode    string   `json:"enforceDarkLightMode,omitempty"` // "dark" or "light"
+	EnableOnlyOffice        bool     `json:"enableOnlyOffice,omitempty"`
+	EnableOnlyOfficeEditing bool     `json:"enableOnlyOfficeEditing,omitempty"`
+}
 type CreateBody struct {
+	CommonShare
+	Hash     string `json:"hash,omitempty"`
 	Password string `json:"password"`
 	Expires  string `json:"expires"`
 	Unit     string `json:"unit"`
@@ -8,12 +40,13 @@ type CreateBody struct {

 // Link is the information needed to build a shareable link.
 type Link struct {
-	Hash         string `json:"hash" storm:"id,index"`
-	Path         string `json:"path" storm:"index"`
-	Source       string `json:"source" storm:"index"`
-	UserID       uint   `json:"userID"`
-	Expire       int64  `json:"expire"`
-	PasswordHash string `json:"password_hash,omitempty"`
+	CommonShare
+	Mu           sync.Mutex `json:"-"`
+	Downloads    int        `json:"downloads"`
+	Hash         string     `json:"hash" storm:"id,index"`
+	UserID       uint       `json:"userID"`
+	Expire       int64      `json:"expire"`
+	PasswordHash string     `json:"password_hash,omitempty"`
 	// Token is a random value that will only be set when PasswordHash is set. It is
 	// URL-Safe and is used to download links in password-protected shares via a
 	// query arg.
@@ -1,9 +1,14 @@
 package share

 import (
+	"strings"
+	"sync"
 	"time"

 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/database/crud"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
 )

 // StorageBackend is the interface to implement for a share storage.
@@ -12,109 +17,304 @@ type StorageBackend interface {
 	FindByUserID(id uint) ([]*Link, error)
 	GetByHash(hash string) (*Link, error)
 	GetPermanent(path, source string, id uint) (*Link, error)
+	GetBySourcePath(path, source string) ([]*Link, error)
 	Gets(path, source string, id uint) ([]*Link, error)
 	Save(s *Link) error
 	Delete(hash string) error
 }

-// Storage is a storage.
-type Storage struct {
+// crudBackend implements crud.CrudBackend[Link] for share storage.
+type crudBackend struct {
 	back StorageBackend
 }

-// NewStorage creates a share links storage from a backend.
-func NewStorage(back StorageBackend) *Storage {
-	return &Storage{back: back}
+func (c *crudBackend) GetByID(id any) (*Link, error) {
+	hash, ok := id.(string)
+	if !ok {
+		return nil, errors.ErrInvalidDataType
+	}
+	return c.back.GetByHash(hash)
 }

-// All wraps a StorageBackend.All.
+func (c *crudBackend) GetAll() ([]*Link, error) {
+	return c.back.All()
+}
+
+func (c *crudBackend) Save(obj *Link) error {
+	return c.back.Save(obj)
+}
+
+func (c *crudBackend) DeleteByID(id any) error {
+	hash, ok := id.(string)
+	if !ok {
+		return errors.ErrInvalidDataType
+	}
+	return c.back.Delete(hash)
+}
+
+// Storage is a share storage using generics.
+type Storage struct {
+	Generic    *crud.Storage[Link]
+	back       StorageBackend
+	shareCache map[string]*Link
+	mu         sync.RWMutex
+	users      *users.Storage
+}
+
+// NewStorage creates a share links storage from a backend.
+func NewStorage(back StorageBackend, usersStore *users.Storage) *Storage {
+	return &Storage{
+		Generic:    crud.NewStorage[Link](&crudBackend{back: back}),
+		back:       back,
+		shareCache: make(map[string]*Link),
+		users:      usersStore,
+	}
+}
+
+// All wraps StorageBackend.All and handles expiry.
 func (s *Storage) All() ([]*Link, error) {
 	links, err := s.back.All()
-
+	if err != nil {
+		return nil, err
+	}
+	filtered, err := s.filterExpired(links)
 	if err != nil {
 		return nil, err
 	}

-	for i, link := range links {
-		if link.Expire != 0 && link.Expire <= time.Now().Unix() {
-			if err := s.Delete(link.Hash); err != nil {
-				return nil, err
-			}
-			links = append(links[:i], links[i+1:]...)
+	s.mu.Lock()
+	for i, l := range filtered {
+		if l == nil {
+			continue
+		}
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			filtered[i] = existing
+		} else {
+			s.shareCache[l.Hash] = l
 		}
 	}
-
-	return links, nil
+	s.mu.Unlock()
+	return filtered, nil
 }

-// FindByUserID wraps a StorageBackend.FindByUserID.
+// FindByUserID wraps StorageBackend.FindByUserID and handles expiry.
 func (s *Storage) FindByUserID(id uint) ([]*Link, error) {
 	links, err := s.back.FindByUserID(id)
-
+	if err != nil {
+		return nil, err
+	}
+	filtered, err := s.filterExpired(links)
 	if err != nil {
 		return nil, err
 	}

-	for i, link := range links {
-		if link.Expire != 0 && link.Expire <= time.Now().Unix() {
-			if err := s.Delete(link.Hash); err != nil {
-				return nil, err
-			}
-			links = append(links[:i], links[i+1:]...)
+	s.mu.Lock()
+	for i, l := range filtered {
+		if l == nil {
+			continue
+		}
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			filtered[i] = existing
+		} else {
+			s.shareCache[l.Hash] = l
 		}
 	}
-
-	return links, nil
+	s.mu.Unlock()
+	return filtered, nil
 }

-// GetByHash wraps a StorageBackend.GetByHash.
+// GetByHash wraps StorageBackend.GetByHash and handles expiry.
 func (s *Storage) GetByHash(hash string) (*Link, error) {
+	// return stable in-memory pointer if available
+	s.mu.RLock()
+	if link, ok := s.shareCache[hash]; ok && link != nil {
+		s.mu.RUnlock()
+		if link.Expire != 0 && link.Expire <= time.Now().Unix() {
+			_ = s.back.Delete(hash)
+			s.mu.Lock()
+			delete(s.shareCache, hash)
+			s.mu.Unlock()
+			return nil, errors.ErrNotExist
+		}
+		return link, nil
+	}
+	s.mu.RUnlock()
+
 	link, err := s.back.GetByHash(hash)
 	if err != nil {
 		return nil, err
 	}
-
 	if link.Expire != 0 && link.Expire <= time.Now().Unix() {
-		if err := s.Delete(link.Hash); err != nil {
-			return nil, err
-		}
+		_ = s.back.Delete(hash)
 		return nil, errors.ErrNotExist
 	}
+	s.mu.Lock()

+	s.shareCache[hash] = link
+	s.mu.Unlock()
 	return link, nil
 }

-// GetPermanent wraps a StorageBackend.GetPermanent
+// GetPermanent wraps StorageBackend.GetPermanent
 func (s *Storage) GetPermanent(path, source string, id uint) (*Link, error) {
-	return s.back.GetPermanent(path, source, id)
+	l, err := s.back.GetPermanent(path, source, id)
+	if err == nil && l != nil {
+		s.mu.Lock()
+
+		s.shareCache[l.Hash] = l
+		s.mu.Unlock()
+	}
+	return l, err
 }

-// Gets wraps a StorageBackend.Gets
+// Gets wraps StorageBackend.Gets and handles expiry.
 func (s *Storage) Gets(sourcePath, source string, id uint) ([]*Link, error) {
 	links, err := s.back.Gets(sourcePath, source, id)
-
 	if err != nil {
 		return nil, err
 	}
-
-	for i, link := range links {
-		if link.Expire != 0 && link.Expire <= time.Now().Unix() {
-			if err := s.Delete(link.Hash); err != nil {
-				return nil, err
-			}
-			links = append(links[:i], links[i+1:]...)
+	filtered, err := s.filterExpired(links)
+	if err != nil {
+		return nil, err
+	}
+	s.mu.Lock()
+	for i, l := range filtered {
+		if l == nil {
+			continue
+		}
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			filtered[i] = existing
+		} else {
+			s.shareCache[l.Hash] = l
 		}
 	}
-
-	return links, nil
+	s.mu.Unlock()
+	return filtered, nil
 }

-// Save wraps a StorageBackend.Save
+// GetBySourcePath wraps StorageBackend.GetBySourcePath and handles expiry.
+func (s *Storage) GetBySourcePath(path, source string) ([]*Link, error) {
+	links, err := s.back.GetBySourcePath(path, source)
+	if err != nil {
+		return nil, err
+	}
+	filtered, err := s.filterExpired(links)
+	if err != nil {
+		return nil, err
+	}
+	s.mu.Lock()
+	for i, l := range filtered {
+		if l == nil {
+			continue
+		}
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			filtered[i] = existing
+		} else {
+			s.shareCache[l.Hash] = l
+		}
+	}
+	s.mu.Unlock()
+	return filtered, nil
+}
+
+// UpdateShares updates all shares that exactly match oldSource and oldPath
+// to point to newSource and newPath. Returns the number of updated shares.
+func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (int, error) {
+	links, err := s.back.All()
+	if err != nil && err != errors.ErrNotExist {
+		logger.Error("failed to list shares", "error", err)
+		return 0, err
+	}
+	updated := 0
+	for _, l := range links {
+		if l == nil {
+			continue
+		}
+		if l.Source != oldSource {
+			continue
+		}
+		pos := strings.Index(l.Path, oldPath)
+		if pos < 0 {
+			continue
+		}
+		oldFullPath := l.Path
+		l.Source = newSource
+		l.Path = oldFullPath[:pos] + newPath + oldFullPath[pos+len(oldPath):]
+		if err := s.back.Save(l); err != nil {
+			logger.Error("failed to save updated share", "hash", l.Hash, "error", err)
+			return updated, err
+		}
+		s.mu.Lock()
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			// update existing cached pointer fields
+			existing.Source = l.Source
+			existing.Path = l.Path
+		} else {
+			s.shareCache[l.Hash] = l
+		}
+		s.mu.Unlock()
+		logger.Info("share updated", "hash", l.Hash, "fromPath", oldFullPath, "toPath", l.Path)
+		updated++
+	}
+	if updated == 0 {
+		logger.Warning("no matching shares to update for provided source/path")
+	}
+	return updated, nil
+}
+
+// Save wraps StorageBackend.Save
 func (s *Storage) Save(l *Link) error {
-	return s.back.Save(l)
+	if err := s.back.Save(l); err != nil {
+		return err
+	}
+	s.mu.Lock()
+	s.shareCache[l.Hash] = l
+	s.mu.Unlock()
+	return nil
 }

-// Delete wraps a StorageBackend.Delete
+// Delete wraps StorageBackend.Delete
 func (s *Storage) Delete(hash string) error {
-	return s.back.Delete(hash)
+	if err := s.back.Delete(hash); err != nil {
+		return err
+	}
+	s.mu.Lock()
+	delete(s.shareCache, hash)
+	s.mu.Unlock()
+	return nil
+}
+
+// Flush persists the current in-memory state of all shares to the backing store.
+// Call during graceful shutdown to ensure DB matches memory.
+func (s *Storage) Flush() error {
+	s.mu.RLock()
+	links := make([]*Link, 0, len(s.shareCache))
+	for _, l := range s.shareCache {
+		if l != nil {
+			links = append(links, l)
+		}
+	}
+	s.mu.RUnlock()
+	for _, l := range links {
+		if err := s.back.Save(l); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// filterExpired removes expired links and deletes them from storage.
+func (s *Storage) filterExpired(links []*Link) ([]*Link, error) {
+	var filtered []*Link
+	for _, link := range links {
+		if link.Expire != 0 && link.Expire <= time.Now().Unix() && !link.KeepAfterExpiration {
+			_ = s.back.Delete(link.Hash)
+			s.mu.Lock()
+			delete(s.shareCache, link.Hash)
+			s.mu.Unlock()
+			continue
+		}
+		filtered = append(filtered, link)
+	}
+	return filtered, nil
 }
@@ -5,18 +5,33 @@ import (

 	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

+// Storage is a storage powered by a Backend which makes the necessary
+// verifications when fetching and saving data to ensure consistency.
+type BoltStore struct {
+	Users    *users.Storage
+	Share    *share.Storage
+	Auth     *auth.Storage
+	Settings *settings.Storage
+	Access   *access.Storage
+}
+
 // NewStorage creates a storage.Storage based on Bolt DB.
-func NewStorage(db *storm.DB) (*auth.Storage, *users.Storage, *share.Storage, *settings.Storage, error) {
+func NewStorage(db *storm.DB) (*BoltStore, error) {
 	userStore := users.NewStorage(usersBackend{db: db})
-	shareStore := share.NewStorage(shareBackend{db: db})
-	settingsStore := settings.NewStorage(settingsBackend{db: db})
 	authStore, err := auth.NewStorage(authBackend{db: db}, userStore)
 	if err != nil {
-		return nil, nil, nil, nil, err
+		return nil, err
 	}
-	return authStore, userStore, shareStore, settingsStore, nil
+	return &BoltStore{
+		Users:    userStore,
+		Share:    share.NewStorage(shareBackend{db: db}, userStore),
+		Auth:     authStore,
+		Settings: settings.NewStorage(settingsBackend{db: db}),
+		Access:   access.NewStorage(db, userStore),
+	}, nil
 }
@@ -52,6 +52,16 @@ func (s shareBackend) GetPermanent(path, source string, id uint) (*share.Link, e
 	return &v, nil
 }

+// GetBySourcePath returns all shares that exactly match Path and Source across users.
+func (s shareBackend) GetBySourcePath(path, source string) ([]*share.Link, error) {
+	var v []*share.Link
+	err := s.db.Select(q.Eq("Path", path), q.Eq("Source", source)).Find(&v)
+	if err == storm.ErrNotFound {
+		return nil, errors.ErrNotExist
+	}
+	return v, err
+}
+
 func (s shareBackend) Gets(path, sourcePath string, id uint) ([]*share.Link, error) {
 	var v []*share.Link
 	_ = s.db.Select(q.Eq("Path", path), q.Eq("Source", sourcePath), q.Eq("UserID", id)).Find(&v)
@@ -60,7 +70,7 @@ func (s shareBackend) Gets(path, sourcePath string, id uint) ([]*share.Link, err
 	// through and filter out expired share
 	for i := range v {
 		if v[i].Expire < time.Now().Unix() && v[i].Expire != 0 {
-			err = s.Delete(v[i].PasswordHash)
+			err = s.Delete(v[i].Hash)
 			if err != nil {
 				logger.Errorf("expired share could not be deleted: %v", err.Error())
 			}
@@ -21,6 +21,11 @@ type usersBackend struct {
 	db *storm.DB
 }

+// NewUsersBackend returns a users.StorageBackend backed by storm DB.
+func NewUsersBackend(db *storm.DB) users.StorageBackend {
+	return &usersBackend{db: db}
+}
+
 func (st usersBackend) GetBy(i interface{}) (user *users.User, err error) {
 	user = &users.User{}

@@ -153,6 +158,9 @@ func (st usersBackend) Save(user *users.User, changePass, disableScopeChange boo
 	if user.LoginMethod == "" {
 		user.LoginMethod = users.LoginMethodPassword
 	}
+	if user.Username == "anonymous" {
+		return fmt.Errorf("username cannot be 'anonymous'")
+	}
 	logger.Debugf("Saving user [%s] changepass: %v", user.Username, changePass)
 	if user.LoginMethod == users.LoginMethodPassword && changePass {
 		err := checkPassword(user.Password)
@@ -234,10 +242,11 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 			field := t.Field(i)
 			// which=all can't update password
 			switch strings.ToLower(field.Name) {
-			case "id", "username", "loginmethod", "password", "apikeys", "totpenabled", "totpsecret", "totpnonce":
+			case "id", "username", "password", "apikeys", "totpenabled", "totpsecret", "totpnonce":
 				// Skip these fields
 				continue
 			}
+
 			fields = append(fields, field.Name)
 		}
 	}
@@ -18,3 +18,16 @@ func get(db *storm.DB, name string, to interface{}) error {
 func Save(db *storm.DB, name string, from interface{}) error {
 	return db.Set("config", name, from)
 }
+
+func SaveAccessRules(db *storm.DB, name string, from interface{}) error {
+	return db.Set("access_rules", name, from)
+}
+
+func GetAccessRules(db *storm.DB, name string, to interface{}) error {
+	err := db.Get("access_rules", name, to)
+	if err == storm.ErrNotFound {
+		return errors.ErrNotExist
+	}
+
+	return err
+}
@@ -7,27 +7,16 @@ import (
 	"strings"

 	storm "github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/share"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

-// Storage is a storage powered by a Backend which makes the necessary
-// verifications when fetching and saving data to ensure consistency.
-type Storage struct {
-	Users    *users.Storage
-	Share    *share.Storage
-	Auth     *auth.Storage
-	Settings *settings.Storage
-}
+var userStore *users.Storage

-var store *Storage
-
-func InitializeDb(path string) (*Storage, bool, error) {
+func InitializeDb(path string) (*bolt.BoltStore, bool, error) {
 	exists, err := dbExists(path)
 	if err != nil {
 		panic(err)
@@ -39,20 +28,18 @@ func InitializeDb(path string) (*Storage, bool, error) {
 		}
 		logger.Fatalf("could not open database: %v", err)
 	}
-	authStore, userStore, shareStore, settingsStore, err := bolt.NewStorage(db)
+	store, err := bolt.NewStorage(db)
 	if err != nil {
 		return nil, exists, err
 	}
+	// Load access rules from DB on startup
+	// ignoring errors because
+	_ = store.Access.LoadFromDB()
+	userStore = store.Users
 	err = bolt.Save(db, "version", 2)
 	if err != nil {
 		return nil, exists, err
 	}
-	store = &Storage{
-		Auth:     authStore,
-		Users:    userStore,
-		Share:    shareStore,
-		Settings: settingsStore,
-	}
 	if !exists {
 		quickSetup(store)
 	}
@@ -80,7 +67,7 @@ func dbExists(path string) (bool, error) {
 	return false, err
 }

-func quickSetup(store *Storage) {
+func quickSetup(store *bolt.BoltStore) {
 	settings.Config.Auth.Key = utils.GenerateKey()
 	err := store.Settings.Save(&settings.Config)
 	utils.CheckErr("store.Settings.Save", err)
@@ -113,7 +100,7 @@ func quickSetup(store *Storage) {
 }

 // create new user
-func CreateUser(userInfo users.User, asAdmin bool) error {
+func CreateUser(userInfo users.User) error {
 	newUser := &userInfo
 	if userInfo.LoginMethod == "password" {
 		if userInfo.Password == "" {
@@ -126,18 +113,13 @@ func CreateUser(userInfo users.User, asAdmin bool) error {
 		}
 		userInfo.Password = hashpass
 	}
-	userInfo.Permissions = settings.Config.UserDefaults.Permissions
 	// must have username
 	if userInfo.Username == "" {
 		return fmt.Errorf("username is required to create a user")
 	}
 	logger.Debugf("Creating user: %v %v", userInfo.Username, userInfo.Scopes)
-	settings.ApplyUserDefaults(newUser)
-	if asAdmin {
-		userInfo.Permissions = settings.AdminPerms()
-	}
 	// create new home directories
-	err := store.Users.Save(newUser, true, false)
+	err := userStore.Save(newUser, true, false)
 	if err != nil {
 		return err
 	}
@@ -5,6 +5,7 @@ import (
 	"time"

 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/database/crud"
 )

 // StorageBackend is the interface to implement for a users storage.
@@ -29,8 +30,43 @@ type Store interface {
 	DeleteApiKey(username uint, name string) error
 }

-// Storage is a users storage.
+// crudBackend implements crud.CrudBackend[User] for users storage.
+type crudBackend struct {
+	back StorageBackend
+}
+
+func (c *crudBackend) GetByID(id any) (*User, error) {
+	switch v := id.(type) {
+	case string, uint:
+		return c.back.GetBy(v)
+	default:
+		return nil, errors.ErrInvalidDataType
+	}
+}
+
+func (c *crudBackend) GetAll() ([]*User, error) {
+	return c.back.Gets()
+}
+
+func (c *crudBackend) Save(obj *User) error {
+	// Use default values for changePass and disableScopeChange
+	return c.back.Save(obj, false, false)
+}
+
+func (c *crudBackend) DeleteByID(id any) error {
+	switch v := id.(type) {
+	case string:
+		return c.back.DeleteByUsername(v)
+	case uint:
+		return c.back.DeleteByID(v)
+	default:
+		return errors.ErrInvalidDataType
+	}
+}
+
+// Storage is a users storage using generics.
 type Storage struct {
+	Generic *crud.Storage[User]
 	back    StorageBackend
 	updated map[uint]int64
 	mux     sync.RWMutex
@@ -39,6 +75,7 @@ type Storage struct {
 // NewStorage creates a users storage from a backend.
 func NewStorage(back StorageBackend) *Storage {
 	return &Storage{
+		Generic: crud.NewStorage[User](&crudBackend{back: back}),
 		back:    back,
 		updated: map[uint]int64{},
 	}
@@ -49,6 +49,7 @@ type Preview struct {
 	Office             bool `json:"office"`             // show preview image for office files
 	PopUp              bool `json:"popup"`              // show larger popup preview when hovering
 	AutoplayMedia      bool `json:"autoplayMedia"`      // autoplay media files in preview
+	DefaultMediaPlayer bool `json:"defaultMediaPlayer"` // disable html5 media player and use the default media player
 }

 // User describes a user.
@@ -95,10 +96,15 @@ type NonAdminEditable struct {
 	GallerySize                int         `json:"gallerySize"`                // 0-9 - the size of the gallery thumbnails
 	ThemeColor                 string      `json:"themeColor"`                 // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
 	QuickDownload              bool        `json:"quickDownload"`              // show icon to download in one click
-	DisableOnlyOfficeExt       string      `json:"disableOnlyOfficeExt"`       // comma separated list of file extensions to disable onlyoffice preview for
-	DisableOfficePreviewExt    string      `json:"disableOfficePreviewExt"`    // comma separated list of file extensions to disable office preview for
 	DisableUpdateNotifications bool        `json:"disableUpdateNotifications"` // disable update notifications
 	FileLoading                FileLoading `json:"fileLoading"`                // upload and download settings
+	DisableOfficePreviewExt    string      `json:"disableOfficePreviewExt"`    // deprecated
+	DisableOnlyOfficeExt       string      `json:"disableOnlyOfficeExt"`       // deprecated
+	DisablePreviewExt          string      `json:"disablePreviewExt"`          // space separated list of file extensions to disable preview for
+	DisableViewingExt          string      `json:"disableViewingExt"`          // space separated list of file extensions to disable viewing for
+	CustomTheme                string      `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
+	ShowSelectMultiple         bool        `json:"showSelectMultiple"`         // show select multiple files on desktop
+	DebugOffice                bool        `json:"debugOffice"`                // debug onlyoffice editor
 }

 type FileLoading struct {
@@ -106,16 +112,6 @@ type FileLoading struct {
 	ChunkSize     int `json:"uploadChunkSizeMb"`
 }

-var PublicUser = User{
-	NonAdminEditable: NonAdminEditable{
-		Password: "publicUser", // temp user not registered
-		ViewMode: "normal",
-	},
-	Username:     "publicUser", // temp user not registered
-	LockPassword: true,
-	Permissions:  Permissions{},
-}
-
 func CleanUsername(s string) string {
 	// Remove any trailing space to avoid ending on -
 	s = strings.Trim(s, " ")
@@ -138,3 +138,14 @@ func handleSourceUpdates() {
 		}
 	}
 }
+
+func Shutdown() {
+	userClientsMu.Lock()
+	defer userClientsMu.Unlock()
+
+	for _, clientChannels := range userClients {
+		for _, ch := range clientChannels {
+			close(ch)
+		}
+	}
+}
@@ -0,0 +1,289 @@
+package ffmpeg
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// SubtitleTrack represents a subtitle track (embedded or external file)
+type SubtitleTrack struct {
+	Name     string `json:"name"`               // filename for external, or descriptive name for embedded
+	Language string `json:"language,omitempty"` // language code
+	Title    string `json:"title,omitempty"`    // title/description
+	Index    *int   `json:"index,omitempty"`    // stream index for embedded subtitles (nil for external)
+	Codec    string `json:"codec,omitempty"`    // codec name for embedded subtitles
+	Content  string `json:"content,omitempty"`  // subtitle content
+	IsFile   bool   `json:"isFile"`             // true for external files, false for embedded streams
+}
+
+// FFProbeOutput represents the JSON output from ffprobe
+type FFProbeOutput struct {
+	Streams []struct {
+		Index       int               `json:"index"`
+		CodecType   string            `json:"codec_type"`
+		CodecName   string            `json:"codec_name"`
+		Tags        map[string]string `json:"tags,omitempty"`
+		Disposition map[string]int    `json:"disposition,omitempty"`
+	} `json:"streams"`
+}
+
+// DetectAllSubtitles finds both embedded and external subtitle tracks
+func DetectAllSubtitles(videoPath string, parentDir string, modtime time.Time) []SubtitleTrack {
+	key := "all_subtitles:" + videoPath + ":" + modtime.Format(time.RFC3339)
+
+	// Check cache first
+	if cached, ok := utils.MediaCache.Get(key).([]SubtitleTrack); ok {
+		return cached
+	}
+
+	var allSubtitles []SubtitleTrack
+
+	// First, get embedded subtitles
+	embeddedSubs := detectEmbeddedSubtitles(videoPath)
+	allSubtitles = append(allSubtitles, embeddedSubs...)
+
+	// Then, get external subtitle files
+	externalSubs := detectExternalSubtitles(videoPath, parentDir)
+	allSubtitles = append(allSubtitles, externalSubs...)
+
+	// Cache the complete list
+	utils.MediaCache.Set(key, allSubtitles)
+
+	return allSubtitles
+}
+
+// detectEmbeddedSubtitles uses ffprobe to find embedded subtitle tracks
+func detectEmbeddedSubtitles(realPath string) []SubtitleTrack {
+	cmd := exec.Command("ffprobe",
+		"-v", "quiet",
+		"-print_format", "json",
+		"-show_streams",
+		"-select_streams", "s",
+		realPath)
+
+	output, err := cmd.Output()
+	if err != nil {
+		logger.Debug("ffprobe failed for file: " + realPath + ", error: " + err.Error())
+		return nil
+	}
+
+	var probeOutput FFProbeOutput
+	if err := json.Unmarshal(output, &probeOutput); err != nil {
+		logger.Debug("failed to parse ffprobe output for file: " + realPath)
+		return nil
+	}
+
+	var subtitles []SubtitleTrack
+	for _, stream := range probeOutput.Streams {
+		if stream.CodecType == "subtitle" {
+			track := SubtitleTrack{
+				Index:  &stream.Index,
+				Codec:  stream.CodecName,
+				IsFile: false, // This is an embedded subtitle
+			}
+
+			// Extract language and title from tags
+			if stream.Tags != nil {
+				if lang, ok := stream.Tags["language"]; ok {
+					track.Language = lang
+				}
+				if title, ok := stream.Tags["title"]; ok {
+					track.Title = title
+				}
+			}
+
+			// Generate a descriptive name
+			if track.Title != "" {
+				track.Name = track.Title
+			} else if track.Language != "" {
+				track.Name = "Embedded (" + track.Language + ")"
+			} else {
+				track.Name = "Embedded Subtitle " + strconv.Itoa(stream.Index)
+			}
+
+			subtitles = append(subtitles, track)
+		}
+	}
+	return subtitles
+}
+
+// detectExternalSubtitles finds external subtitle files in the same directory
+func detectExternalSubtitles(videoPath string, parentDir string) []SubtitleTrack {
+	var subtitles []SubtitleTrack
+
+	// Get the base name of the video (without extension)
+	videoBaseName := strings.TrimSuffix(filepath.Base(videoPath), filepath.Ext(videoPath))
+
+	// Common subtitle extensions
+	subtitleExts := []string{".srt", ".vtt", ".lrc", ".sbv", ".ass", ".ssa", ".sub", ".smi"}
+
+	// Look for subtitle files with matching base name
+	for _, ext := range subtitleExts {
+		subtitlePath := filepath.Join(parentDir, videoBaseName+ext)
+		if _, err := os.Stat(subtitlePath); err == nil {
+			// File exists
+			track := SubtitleTrack{
+				Name:   filepath.Base(subtitlePath),
+				IsFile: true, // This is an external file
+			}
+
+			// Try to infer language from filename patterns like "video.en.srt"
+			parts := strings.Split(videoBaseName, ".")
+			if len(parts) > 1 {
+				// Check if the last part before extension looks like a language code
+				lastPart := parts[len(parts)-1]
+				if len(lastPart) == 2 || len(lastPart) == 3 {
+					track.Language = lastPart
+				}
+			}
+
+			subtitles = append(subtitles, track)
+		}
+	}
+
+	return subtitles
+}
+
+// ExtractSubtitleContent extracts subtitle content without service management
+func ExtractSubtitleContent(videoPath string, streamIndex int) (string, error) {
+	cmd := exec.Command("ffmpeg",
+		"-i", videoPath,
+		"-map", fmt.Sprintf("0:%d", streamIndex),
+		"-c:s", "webvtt",
+		"-f", "webvtt",
+		"-") // output to stdout
+
+	output, err := cmd.Output()
+	if err != nil {
+		return "", fmt.Errorf("subtitle extraction failed: %v", err)
+	}
+
+	return string(output), nil
+}
+
+// LoadAndConvertSubtitleFile loads a subtitle file and converts it to WebVTT format
+func LoadAndConvertSubtitleFile(subtitlePath string) (string, error) {
+	ext := strings.ToLower(filepath.Ext(subtitlePath))
+
+	if ext == ".vtt" {
+		// Already WebVTT, just read it
+		content, err := os.ReadFile(subtitlePath)
+		if err != nil {
+			return "", err
+		}
+		return string(content), nil
+	}
+
+	if ext == ".srt" {
+		// Convert SRT to WebVTT using ffmpeg
+		cmd := exec.Command("ffmpeg",
+			"-i", subtitlePath,
+			"-c:s", "webvtt",
+			"-f", "webvtt",
+			"-") // output to stdout
+
+		output, err := cmd.Output()
+		if err != nil {
+			return "", fmt.Errorf("failed to convert SRT to WebVTT: %v", err)
+		}
+		return string(output), nil
+	}
+
+	// For other formats, try to read as plain text and hope for the best
+	// This is a fallback - ideally you'd want format-specific converters
+	content, err := os.ReadFile(subtitlePath)
+	if err != nil {
+		return "", err
+	}
+
+	// Basic conversion wrapper for non-VTT formats
+	vttHeader := "WEBVTT\n\n"
+	return vttHeader + string(content), nil
+}
+
+// ExtractSingleSubtitle extracts content for a specific subtitle track by array index
+func ExtractSingleSubtitle(videoPath string, parentDir string, trackIndex int, modtime time.Time) (SubtitleTrack, error) {
+	// Get all subtitle tracks
+	allTracks := DetectAllSubtitles(videoPath, parentDir, modtime)
+
+	if trackIndex >= len(allTracks) {
+		return SubtitleTrack{}, fmt.Errorf("subtitle track %d not found (only %d tracks available)", trackIndex, len(allTracks))
+	}
+
+	track := allTracks[trackIndex]
+
+	// Load content based on type
+	if track.IsFile {
+		// Load external subtitle file
+		subtitlePath := filepath.Join(parentDir, track.Name)
+		content, err := LoadAndConvertSubtitleFile(subtitlePath)
+		if err != nil {
+			return SubtitleTrack{}, fmt.Errorf("failed to load external subtitle: %v", err)
+		}
+		track.Content = content
+	} else {
+		// Extract embedded subtitle content
+		if track.Index == nil {
+			return SubtitleTrack{}, fmt.Errorf("embedded subtitle track has no stream index")
+		}
+		content, err := ExtractSubtitleContent(videoPath, *track.Index)
+		if err != nil {
+			return SubtitleTrack{}, fmt.Errorf("failed to extract embedded subtitle: %v", err)
+		}
+		track.Content = content
+	}
+
+	return track, nil
+}
+
+// LoadAllSubtitleContent loads the actual content for all detected subtitle tracks
+func LoadAllSubtitleContent(videoPath string, subtitles []SubtitleTrack, modtime time.Time) error {
+	for idx := range subtitles {
+		subtitle := &subtitles[idx]
+
+		// Check if content is already cached
+		contentKey := fmt.Sprintf("subtitle_content:%s:%d:%s", videoPath, idx, modtime.Format(time.RFC3339))
+		if cached, ok := utils.MediaCache.Get(contentKey).(string); ok {
+			subtitle.Content = cached
+			continue
+		}
+
+		var content string
+		var err error
+
+		if subtitle.IsFile {
+			// Load external subtitle file content and convert to WebVTT
+			subtitlePath := filepath.Join(filepath.Dir(videoPath), subtitle.Name)
+			content, err = LoadAndConvertSubtitleFile(subtitlePath)
+			if err != nil {
+				logger.Debug("failed to read/convert subtitle file " + subtitlePath + ": " + err.Error())
+				continue
+			}
+		} else {
+			// Load embedded subtitle content
+			if subtitle.Index == nil {
+				logger.Debug("embedded subtitle has no stream index")
+				continue
+			}
+			content, err = ExtractSubtitleContent(videoPath, *subtitle.Index)
+			if err != nil {
+				logger.Debug("failed to extract embedded subtitle: " + err.Error())
+				continue
+			}
+		}
+
+		subtitle.Content = content
+		// Cache the content for future requests
+		utils.MediaCache.Set(contentKey, content)
+	}
+	return nil
+}
@@ -0,0 +1,147 @@
+package ffmpeg
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// VideoService handles video preview operations with ffmpeg
+type VideoService struct {
+	ffmpegPath  string
+	ffprobePath string
+	debug       bool
+	semaphore   chan struct{}
+}
+
+// NewVideoService creates a new video service instance
+func NewVideoService(ffmpegPath, ffprobePath string, maxConcurrent int, debug bool) *VideoService {
+	return &VideoService{
+		ffmpegPath:  ffmpegPath,
+		ffprobePath: ffprobePath,
+		debug:       debug,
+		semaphore:   make(chan struct{}, maxConcurrent),
+	}
+}
+
+func (s *VideoService) acquire(ctx context.Context) error {
+	select {
+	case s.semaphore <- struct{}{}:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func (s *VideoService) release() {
+	<-s.semaphore
+}
+
+// GenerateVideoPreview generates a single preview image from a video using ffmpeg.
+// videoPath: path to the input video file.
+// outputPath: path where the generated preview image will be saved (e.g., "/tmp/preview.jpg").
+// seekTime: how many seconds into the video to seek before capturing the frame.
+func (s *VideoService) GenerateVideoPreview(videoPath, outputPath string, percentageSeek int) ([]byte, error) {
+	if err := s.acquire(context.Background()); err != nil {
+		return nil, err
+	}
+	defer s.release()
+
+	// Step 1: Get video duration from the container format
+	probeCmd := exec.Command(
+		s.ffprobePath,
+		"-v", "error",
+		// Use format=duration for better compatibility
+		"-show_entries", "format=duration",
+		"-of", "default=noprint_wrappers=1:nokey=1",
+		videoPath,
+	)
+
+	var probeOut bytes.Buffer
+	probeCmd.Stdout = &probeOut
+	if s.debug {
+		probeCmd.Stderr = os.Stderr
+	}
+	if err := probeCmd.Run(); err != nil {
+		logger.Errorf("ffprobe command failed on file '%v' : %v", videoPath, err)
+		return nil, fmt.Errorf("ffprobe failed: %w", err)
+	}
+
+	durationStr := strings.TrimSpace(probeOut.String())
+	if durationStr == "" || durationStr == "N/A" {
+		logger.Errorf("could not determine video duration for file '%v' using duration info '%v'", videoPath, durationStr)
+		return nil, fmt.Errorf("could not determine video duration")
+	}
+
+	durationFloat, err := strconv.ParseFloat(durationStr, 64)
+	if err != nil {
+		// The original error you saw would be caught here if "N/A" was still the output
+		return nil, fmt.Errorf("invalid duration: %v", err)
+	}
+
+	if durationFloat <= 0 {
+		return nil, fmt.Errorf("video duration must be positive")
+	}
+
+	// Step 2: Get the duration of the video in whole seconds
+	duration := int(durationFloat)
+
+	// Step 3: Calculate seek time based on percentageSeek (percentage value)
+	seekSeconds := duration * percentageSeek / 100
+
+	// Step 4: Convert seekSeconds to string for ffmpeg command
+	seekTime := strconv.Itoa(seekSeconds)
+
+	// Step 5: Extract frame at seek time
+	cmd := exec.Command(
+		s.ffmpegPath,
+		"-ss", seekTime,
+		"-i", videoPath,
+		"-frames:v", "1",
+		"-q:v", "10",
+		"-y", // overwrite output
+		outputPath,
+	)
+
+	if s.debug {
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+	}
+	err = cmd.Run()
+	if err != nil {
+		return nil, fmt.Errorf("ffmpeg command failed on file '%v' : %w", videoPath, err)
+	}
+	return os.ReadFile(outputPath)
+}
+
+// GetVideoDuration extracts the duration of a video file using ffprobe
+func GetVideoDuration(ffprobePath string, videoPath string) (float64, error) {
+	cmd := exec.Command(ffprobePath,
+		"-v", "error",
+		"-show_entries", "format=duration",
+		"-of", "default=noprint_wrappers=1:nokey=1",
+		videoPath)
+
+	output, err := cmd.Output()
+	if err != nil {
+		return 0, fmt.Errorf("ffprobe failed: %w", err)
+	}
+
+	durationStr := strings.TrimSpace(string(output))
+	if durationStr == "" || durationStr == "N/A" {
+		return 0, fmt.Errorf("could not determine video duration")
+	}
+
+	duration, err := strconv.ParseFloat(durationStr, 64)
+	if err != nil {
+		return 0, fmt.Errorf("invalid duration: %v", err)
+	}
+
+	return duration, nil
+}
@@ -1,10 +1,10 @@
 module github.com/gtsteffaniak/filebrowser/backend

-go 1.24.2
+go 1.25.0

 require (
 	github.com/asdine/storm/v3 v3.2.1
-	github.com/coreos/go-oidc/v3 v3.14.1
+	github.com/coreos/go-oidc/v3 v3.15.0
 	github.com/dsoprea/go-exif/v3 v3.0.1
 	github.com/gen2brain/go-fitz v1.24.15
 	github.com/go-playground/validator/v10 v10.27.0
@@ -18,49 +18,59 @@ require (
 	github.com/spf13/afero v1.14.0
 	github.com/stretchr/testify v1.10.0
 	github.com/swaggo/http-swagger v1.3.4
-	github.com/swaggo/swag v1.16.4
-	golang.org/x/crypto v0.40.0
-	golang.org/x/image v0.29.0
-	golang.org/x/mod v0.26.0
+	github.com/swaggo/swag v1.16.6
+	golang.org/x/crypto v0.41.0
+	golang.org/x/image v0.30.0
+	golang.org/x/mod v0.27.0
 	golang.org/x/oauth2 v0.30.0
-	golang.org/x/sys v0.34.0
+	golang.org/x/sys v0.35.0
+	golang.org/x/time v0.12.0
 	gopkg.in/yaml.v3 v3.0.1
 )

 require (
 	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
 	4d63.com/gochecknoglobals v0.2.2 // indirect
-	github.com/4meepo/tagalign v1.4.2 // indirect
-	github.com/Abirdcfly/dupword v0.1.3 // indirect
+	codeberg.org/chavacava/garif v0.2.0 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect
+	dev.gaijin.team/go/golib v0.6.0 // indirect
+	github.com/4meepo/tagalign v1.4.3 // indirect
+	github.com/Abirdcfly/dupword v0.1.6 // indirect
+	github.com/AlwxSin/noinlineerr v1.0.5 // indirect
 	github.com/Antonboom/errname v1.1.0 // indirect
 	github.com/Antonboom/nilnil v1.1.0 // indirect
 	github.com/Antonboom/testifylint v1.6.1 // indirect
 	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
-	github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 // indirect
 	github.com/KyleBanks/depth v1.2.1 // indirect
 	github.com/Masterminds/semver/v3 v3.3.1 // indirect
 	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
-	github.com/alecthomas/chroma/v2 v2.17.2 // indirect
+	github.com/air-verse/air v1.62.0 // indirect
+	github.com/alecthomas/chroma/v2 v2.20.0 // indirect
 	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
 	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
 	github.com/alexkohler/prealloc v1.0.0 // indirect
+	github.com/alfatraining/structtag v1.0.0 // indirect
 	github.com/alingse/asasalint v0.0.11 // indirect
 	github.com/alingse/nilnesserr v0.2.0 // indirect
-	github.com/ashanbrown/forbidigo v1.6.0 // indirect
-	github.com/ashanbrown/makezero v1.2.0 // indirect
+	github.com/ashanbrown/forbidigo/v2 v2.1.0 // indirect
+	github.com/ashanbrown/makezero/v2 v2.0.1 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bep/godartsass/v2 v2.5.0 // indirect
+	github.com/bep/golibsass v1.2.0 // indirect
 	github.com/bkielbasa/cyclop v1.2.3 // indirect
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
 	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
-	github.com/boombuler/barcode v1.0.2 // indirect
+	github.com/bombsimon/wsl/v5 v5.1.1 // indirect
+	github.com/boombuler/barcode v1.1.0 // indirect
 	github.com/breml/bidichk v0.3.3 // indirect
 	github.com/breml/errchkjson v0.4.1 // indirect
 	github.com/butuzov/ireturn v0.4.0 // indirect
 	github.com/butuzov/mirror v1.3.0 // indirect
 	github.com/catenacyber/perfsprint v0.9.1 // indirect
-	github.com/ccojocar/zxcvbn-go v1.0.2 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charithe/durationcheck v0.0.10 // indirect
 	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
@@ -68,11 +78,11 @@ require (
 	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/chavacava/garif v0.1.0 // indirect
 	github.com/ckaznocha/intrange v0.3.1 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/creack/pty v1.1.24 // indirect
 	github.com/curioswitch/go-reassign v0.3.0 // indirect
-	github.com/daixiang0/gci v0.13.6 // indirect
+	github.com/daixiang0/gci v0.13.7 // indirect
 	github.com/dave/dst v0.27.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
@@ -84,14 +94,14 @@ require (
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fatih/structtag v1.2.0 // indirect
 	github.com/firefart/nonamedreturns v1.0.6 // indirect
-	github.com/fsnotify/fsnotify v1.5.4 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.10 // indirect
 	github.com/ghostiam/protogetter v0.3.15 // indirect
 	github.com/go-critic/go-critic v0.13.0 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
-	github.com/go-openapi/jsonpointer v0.21.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.2 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/spec v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
@@ -104,20 +114,22 @@ require (
 	github.com/go-toolsmith/astp v1.1.0 // indirect
 	github.com/go-toolsmith/strparse v1.1.0 // indirect
 	github.com/go-toolsmith/typep v1.1.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect
-	github.com/golang/geo v0.0.0-20250707181242-c5087ca84cf4 // indirect
+	github.com/gohugoio/hugo v0.147.6 // indirect
+	github.com/golang/geo v0.0.0-20250825151631-54d70cc7cb31 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
 	github.com/golangci/go-printf-func-name v0.1.0 // indirect
 	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
-	github.com/golangci/golangci-lint/v2 v2.1.6 // indirect
+	github.com/golangci/golangci-lint/v2 v2.4.0 // indirect
 	github.com/golangci/golines v0.0.0-20250217134842-442fd0091d95 // indirect
-	github.com/golangci/misspell v0.6.0 // indirect
-	github.com/golangci/plugin-module-register v0.1.1 // indirect
+	github.com/golangci/misspell v0.7.0 // indirect
+	github.com/golangci/plugin-module-register v0.1.2 // indirect
 	github.com/golangci/revgrep v0.8.0 // indirect
+	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
 	github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
 	github.com/gordonklaus/ineffassign v0.1.0 // indirect
 	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
@@ -130,30 +142,31 @@ require (
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jgautheron/goconst v1.8.1 // indirect
+	github.com/jgautheron/goconst v1.8.2 // indirect
 	github.com/jingyugao/rowserrcheck v1.1.1 // indirect
-	github.com/jjti/go-spancheck v0.6.4 // indirect
+	github.com/jjti/go-spancheck v0.6.5 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/julz/importas v0.2.0 // indirect
-	github.com/jupiterrider/ffi v0.5.0 // indirect
+	github.com/jupiterrider/ffi v0.5.1 // indirect
 	github.com/karamaru-alpha/copyloopvar v1.2.1 // indirect
 	github.com/kisielk/errcheck v1.9.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
 	github.com/kulti/thelper v0.6.3 // indirect
 	github.com/kunwardeep/paralleltest v1.0.14 // indirect
 	github.com/lasiar/canonicalheader v1.1.2 // indirect
-	github.com/ldez/exptostd v0.4.3 // indirect
-	github.com/ldez/gomoddirectives v0.6.1 // indirect
-	github.com/ldez/grignotin v0.9.0 // indirect
+	github.com/ldez/exptostd v0.4.4 // indirect
+	github.com/ldez/gomoddirectives v0.7.0 // indirect
+	github.com/ldez/grignotin v0.10.0 // indirect
 	github.com/ldez/tagliatelle v0.7.1 // indirect
-	github.com/ldez/usetesting v0.4.3 // indirect
+	github.com/ldez/usetesting v0.5.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/leonklingele/grouper v1.1.2 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/macabu/inamedparam v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
-	github.com/manuelarte/funcorder v0.2.1 // indirect
+	github.com/manuelarte/embeddedstructfieldcheck v0.3.0 // indirect
+	github.com/manuelarte/funcorder v0.5.0 // indirect
 	github.com/maratori/testableexamples v1.0.0 // indirect
 	github.com/maratori/testpackage v1.1.1 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
@@ -161,16 +174,15 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/mgechev/revive v1.9.0 // indirect
+	github.com/mgechev/revive v1.11.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
-	github.com/nunnatsa/ginkgolinter v0.19.1 // indirect
-	github.com/olekukonko/tablewriter v0.0.5 // indirect
+	github.com/nunnatsa/ginkgolinter v0.20.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -191,18 +203,18 @@ require (
 	github.com/ryancurrah/gomodguard v1.4.1 // indirect
 	github.com/ryanrolds/sqlclosecheck v0.5.1 // indirect
 	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
-	github.com/sashamelentyev/usestdlibvars v1.28.0 // indirect
-	github.com/securego/gosec/v2 v2.22.3 // indirect
+	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
+	github.com/securego/gosec/v2 v2.22.7 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
-	github.com/sonatard/noctx v0.1.0 // indirect
+	github.com/sonatard/noctx v0.4.0 // indirect
 	github.com/sourcegraph/go-diff v0.7.0 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/spf13/cast v1.8.0 // indirect
 	github.com/spf13/cobra v1.9.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/spf13/viper v1.12.0 // indirect
 	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
 	github.com/stbenjam/no-sprintf-host-port v0.2.0 // indirect
@@ -210,6 +222,7 @@ require (
 	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/swaggo/files v1.0.1 // indirect
 	github.com/tdakkota/asciicheck v0.4.1 // indirect
+	github.com/tdewolff/parse/v2 v2.8.1 // indirect
 	github.com/tetafro/godot v1.5.1 // indirect
 	github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 // indirect
 	github.com/timonwong/loggercheck v0.11.0 // indirect
@@ -219,7 +232,7 @@ require (
 	github.com/ultraware/whitespace v0.2.0 // indirect
 	github.com/urfave/cli/v2 v2.3.0 // indirect
 	github.com/uudashr/gocognit v1.2.0 // indirect
-	github.com/uudashr/iface v1.3.1 // indirect
+	github.com/uudashr/iface v1.4.1 // indirect
 	github.com/xen0n/gosmopolitan v1.3.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yagipy/maintidx v1.0.0 // indirect
@@ -227,18 +240,18 @@ require (
 	github.com/ykadowak/zerologlint v0.1.5 // indirect
 	gitlab.com/bosi/decorder v0.4.2 // indirect
 	go-simpler.org/musttag v0.13.1 // indirect
-	go-simpler.org/sloglint v0.11.0 // indirect
+	go-simpler.org/sloglint v0.11.1 // indirect
+	go.augendre.info/arangolint v0.2.0 // indirect
 	go.augendre.info/fatcontext v0.8.0 // indirect
-	go.etcd.io/bbolt v1.4.2 // indirect
-	go.uber.org/atomic v1.7.0 // indirect
+	go.etcd.io/bbolt v1.4.3 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
-	go.uber.org/multierr v1.6.0 // indirect
-	go.uber.org/zap v1.24.0 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
-	golang.org/x/net v0.42.0 // indirect
+	go.uber.org/multierr v1.10.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20250620022241-b7579e27df2b // indirect
+	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
-	golang.org/x/tools v0.34.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -249,6 +262,7 @@ require (
 )

 tool (
+	github.com/air-verse/air
 	github.com/golangci/golangci-lint/v2/cmd/golangci-lint
 	github.com/swaggo/swag/cmd/swag
 )
@@ -34,17 +34,29 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+codeberg.org/chavacava/garif v0.2.0 h1:F0tVjhYbuOCnvNcU3YSpO6b3Waw6Bimy4K0mM8y6MfY=
+codeberg.org/chavacava/garif v0.2.0/go.mod h1:P2BPbVbT4QcvLZrORc2T29szK3xEOlnl0GiPTJmEqBQ=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+dev.gaijin.team/go/exhaustruct/v4 v4.0.0 h1:873r7aNneqoBB3IaFIzhvt2RFYTuHgmMjoKfwODoI1Y=
+dev.gaijin.team/go/exhaustruct/v4 v4.0.0/go.mod h1:aZ/k2o4Y05aMJtiux15x8iXaumE88YdiB0Ai4fXOzPI=
+dev.gaijin.team/go/golib v0.6.0 h1:v6nnznFTs4bppib/NyU1PQxobwDHwCXXl15P7DV5Zgo=
+dev.gaijin.team/go/golib v0.6.0/go.mod h1:uY1mShx8Z/aNHWDyAkZTkX+uCi5PdX7KsG1eDQa2AVE=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/4meepo/tagalign v1.4.2 h1:0hcLHPGMjDyM1gHG58cS73aQF8J4TdVR96TZViorO9E=
-github.com/4meepo/tagalign v1.4.2/go.mod h1:+p4aMyFM+ra7nb41CnFG6aSDXqRxU/w1VQqScKqDARI=
-github.com/Abirdcfly/dupword v0.1.3 h1:9Pa1NuAsZvpFPi9Pqkd93I7LIYRURj+A//dFd5tgBeE=
-github.com/Abirdcfly/dupword v0.1.3/go.mod h1:8VbB2t7e10KRNdwTVoxdBaxla6avbhGzb8sCTygUMhw=
+github.com/4meepo/tagalign v1.4.3 h1:Bnu7jGWwbfpAie2vyl63Zup5KuRv21olsPIha53BJr8=
+github.com/4meepo/tagalign v1.4.3/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
+github.com/Abirdcfly/dupword v0.1.6 h1:qeL6u0442RPRe3mcaLcbaCi2/Y/hOcdtw6DE9odjz9c=
+github.com/Abirdcfly/dupword v0.1.6/go.mod h1:s+BFMuL/I4YSiFv29snqyjwzDp4b65W2Kvy+PKzZ6cw=
+github.com/AlwxSin/noinlineerr v1.0.5 h1:RUjt63wk1AYWTXtVXbSqemlbVTb23JOSRiNsshj7TbY=
+github.com/AlwxSin/noinlineerr v1.0.5/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc=
 github.com/Antonboom/errname v1.1.0 h1:A+ucvdpMwlo/myWrkHEUEBWc/xuXdud23S8tmTb/oAE=
 github.com/Antonboom/errname v1.1.0/go.mod h1:O1NMrzgUcVBGIfi3xlVuvX8Q/VP/73sseCaAppfjqZw=
 github.com/Antonboom/nilnil v1.1.0 h1:jGxJxjgYS3VUUtOTNk8Z1icwT5ESpLH/426fjmQG+ng=
 github.com/Antonboom/nilnil v1.1.0/go.mod h1:b7sAlogQjFa1wV8jUW3o4PMzDVFLbTux+xnQdvzdcIE=
 github.com/Antonboom/testifylint v1.6.1 h1:6ZSytkFWatT8mwZlmRCHkWz1gPi+q6UBSbieji2Gj/o=
 github.com/Antonboom/testifylint v1.6.1/go.mod h1:k+nEkathI2NFjKO6HvwmSrbzUcQ6FAnbZV+ZRrnXPLI=
+github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69 h1:+tu3HOoMXB7RXEINRVIpxJCT+KdYiI7LAEAUrOw3dIU=
+github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69/go.mod h1:L1AbZdiDllfyYH5l5OkAaZtk7VkWe89bPJFmnDBNHxg=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
@@ -53,8 +65,6 @@ github.com/DataDog/zstd v1.4.1 h1:3oxKN3wbHibqx897utPC2LTQU4J+IHWWJO+glkAkpFM=
 github.com/DataDog/zstd v1.4.1/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
 github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 h1:sHglBQTwgx+rWPdisA5ynNEsoARbiCBOyGcJM4/OzsM=
 github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
-github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 h1:Sz1JIXEcSfhz7fUi7xHnhpIE0thVASYjvosApmHuD2k=
-github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1/go.mod h1:n/LSCXNuIYqVfBlVXyHfMQkZDdp1/mmxfSjADd3z1Zg=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
 github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
@@ -63,14 +73,16 @@ github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsu
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgzrVxUYBlgKNGquUo=
 github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863 h1:BRrxwOZBolJN4gIwvZMJY1tzqBvQgpaZiQRuIDD40jM=
 github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863/go.mod h1:D0JMgToj/WdxCgd30Kc1UcA9E+WdZoJqeVOuYW7iTBM=
+github.com/air-verse/air v1.62.0 h1:6CoXL4MAX9dc4xAzLfjMcDfbBoGmW5VjuuTV/1+bI+M=
+github.com/air-verse/air v1.62.0/go.mod h1:EO+jWuetL10tS9raffwg8WEV0t0KUeucRRaf9ii86dA=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.17.2 h1:Rm81SCZ2mPoH+Q8ZCc/9YvzPUN/E7HgPiPJD8SLV6GI=
-github.com/alecthomas/chroma/v2 v2.17.2/go.mod h1:RVX6AvYm4VfYe/zsk7mjHueLDZor3aWCNE14TFlepBk=
+github.com/alecthomas/chroma/v2 v2.20.0 h1:sfIHpxPyR07/Oylvmcai3X/exDlE8+FA820NTz+9sGw=
+github.com/alecthomas/chroma/v2 v2.20.0/go.mod h1:e7tViK0xh/Nf4BYHl00ycY6rV7b8iXBksI9E359yNmA=
 github.com/alecthomas/go-check-sumtype v0.3.1 h1:u9aUvbGINJxLVXiFvHUlPEaD7VDULsrxJb4Aq31NLkU=
 github.com/alecthomas/go-check-sumtype v0.3.1/go.mod h1:A8TSiN3UPRw3laIgWEUOHHLPa6/r9MtoigdlP5h3K/E=
-github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
-github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alecthomas/repr v0.5.1 h1:E3G4t2QbHTSNpPKBgMTln5KLkZHLOcU7r37J4pXBuIg=
+github.com/alecthomas/repr v0.5.1/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -80,33 +92,63 @@ github.com/alexkohler/nakedret/v2 v2.0.6 h1:ME3Qef1/KIKr3kWX3nti3hhgNxw6aqN5pZmQ
 github.com/alexkohler/nakedret/v2 v2.0.6/go.mod h1:l3RKju/IzOMQHmsEvXwkqMDzHHvurNQfAgE1eVmT40Q=
 github.com/alexkohler/prealloc v1.0.0 h1:Hbq0/3fJPQhNkN0dR95AVrr6R7tou91y0uHG5pOcUuw=
 github.com/alexkohler/prealloc v1.0.0/go.mod h1:VetnK3dIgFBBKmg0YnD9F9x6Icjd+9cvfHR56wJVlKE=
+github.com/alfatraining/structtag v1.0.0 h1:2qmcUqNcCoyVJ0up879K614L9PazjBSFruTB0GOFjCc=
+github.com/alfatraining/structtag v1.0.0/go.mod h1:p3Xi5SwzTi+Ryj64DqjLWz7XurHxbGsq6y3ubePJPus=
 github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQRnw=
 github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I=
 github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEWd/w=
 github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
+github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c h1:651/eoCRnQ7YtSjAnSzRucrJz+3iGEFt+ysraELS81M=
+github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asdine/storm/v3 v3.2.1 h1:I5AqhkPK6nBZ/qJXySdI7ot5BlXSZ7qvDY1zAn5ZJac=
 github.com/asdine/storm/v3 v3.2.1/go.mod h1:LEpXwGt4pIqrE/XcTvCnZHT5MgZCV6Ub9q7yQzOFWr0=
-github.com/ashanbrown/forbidigo v1.6.0 h1:D3aewfM37Yb3pxHujIPSpTf6oQk9sc9WZi8gerOIVIY=
-github.com/ashanbrown/forbidigo v1.6.0/go.mod h1:Y8j9jy9ZYAEHXdu723cUlraTqbzjKF1MUyfOKL+AjcU=
-github.com/ashanbrown/makezero v1.2.0 h1:/2Lp1bypdmK9wDIq7uWBlDF1iMUpIIS4A+pF6C9IEUU=
-github.com/ashanbrown/makezero v1.2.0/go.mod h1:dxlPhHbDMC6N6xICzFBSK+4njQDdK8euNO0qjQMtGY4=
+github.com/ashanbrown/forbidigo/v2 v2.1.0 h1:NAxZrWqNUQiDz19FKScQ/xvwzmij6BiOw3S0+QUQ+Hs=
+github.com/ashanbrown/forbidigo/v2 v2.1.0/go.mod h1:0zZfdNAuZIL7rSComLGthgc/9/n2FqspBOH90xlCHdA=
+github.com/ashanbrown/makezero/v2 v2.0.1 h1:r8GtKetWOgoJ4sLyUx97UTwyt2dO7WkGFHizn/Lo8TY=
+github.com/ashanbrown/makezero/v2 v2.0.1/go.mod h1:kKU4IMxmYW1M4fiEHMb2vc5SFoPzXvgbMR9gIp5pjSw=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
-github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
-github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bep/clocks v0.5.0 h1:hhvKVGLPQWRVsBP/UB7ErrHYIO42gINVbvqxvYTPVps=
+github.com/bep/clocks v0.5.0/go.mod h1:SUq3q+OOq41y2lRQqH5fsOoxN8GbxSiT6jvoVVLCVhU=
+github.com/bep/debounce v1.2.1 h1:v67fRdBA9UQu2NhLFXrSg0Brw7CexQekrBwDMM8bzeY=
+github.com/bep/debounce v1.2.1/go.mod h1:H8yggRPQKLUhUoqrJC1bO2xNya7vanpDl7xR3ISbCJ0=
+github.com/bep/gitmap v1.6.0 h1:sDuQMm9HoTL0LtlrfxjbjgAg2wHQd4nkMup2FInYzhA=
+github.com/bep/gitmap v1.6.0/go.mod h1:n+3W1f/rot2hynsqEGxGMErPRgT41n9CkGuzPvz9cIw=
+github.com/bep/goat v0.5.0 h1:S8jLXHCVy/EHIoCY+btKkmcxcXFd34a0Q63/0D4TKeA=
+github.com/bep/goat v0.5.0/go.mod h1:Md9x7gRxiWKs85yHlVTvHQw9rg86Bm+Y4SuYE8CTH7c=
+github.com/bep/godartsass/v2 v2.5.0 h1:tKRvwVdyjCIr48qgtLa4gHEdtRkPF8H1OeEhJAEv7xg=
+github.com/bep/godartsass/v2 v2.5.0/go.mod h1:rjsi1YSXAl/UbsGL85RLDEjRKdIKUlMQHr6ChUNYOFU=
+github.com/bep/golibsass v1.2.0 h1:nyZUkKP/0psr8nT6GR2cnmt99xS93Ji82ZD9AgOK6VI=
+github.com/bep/golibsass v1.2.0/go.mod h1:DL87K8Un/+pWUS75ggYv41bliGiolxzDKWJAq3eJ1MA=
+github.com/bep/goportabletext v0.1.0 h1:8dqym2So1cEqVZiBa4ZnMM1R9l/DnC1h4ONg4J5kujw=
+github.com/bep/goportabletext v0.1.0/go.mod h1:6lzSTsSue75bbcyvVc0zqd1CdApuT+xkZQ6Re5DzZFg=
+github.com/bep/gowebp v0.4.0 h1:QihuVnvIKbRoeBNQkN0JPMM8ClLmD6V2jMftTFwSK3Q=
+github.com/bep/gowebp v0.4.0/go.mod h1:95gtYkAA8iIn1t3HkAPurRCVGV/6NhgaHJ1urz0iIwc=
+github.com/bep/imagemeta v0.12.0 h1:ARf+igs5B7pf079LrqRnwzQ/wEB8Q9v4NSDRZO1/F5k=
+github.com/bep/imagemeta v0.12.0/go.mod h1:23AF6O+4fUi9avjiydpKLStUNtJr5hJB4rarG18JpN8=
+github.com/bep/lazycache v0.8.0 h1:lE5frnRjxaOFbkPZ1YL6nijzOPPz6zeXasJq8WpG4L8=
+github.com/bep/lazycache v0.8.0/go.mod h1:BQ5WZepss7Ko91CGdWz8GQZi/fFnCcyWupv8gyTeKwk=
+github.com/bep/logg v0.4.0 h1:luAo5mO4ZkhA5M1iDVDqDqnBBnlHjmtZF6VAyTp+nCQ=
+github.com/bep/logg v0.4.0/go.mod h1:Ccp9yP3wbR1mm++Kpxet91hAZBEQgmWgFgnXX3GkIV0=
+github.com/bep/overlayfs v0.10.0 h1:wS3eQ6bRsLX+4AAmwGjvoFSAQoeheamxofFiJ2SthSE=
+github.com/bep/overlayfs v0.10.0/go.mod h1:ouu4nu6fFJaL0sPzNICzxYsBeWwrjiTdFZdK4lI3tro=
+github.com/bep/tmc v0.5.1 h1:CsQnSC6MsomH64gw0cT5f+EwQDcvZz4AazKunFwTpuI=
+github.com/bep/tmc v0.5.1/go.mod h1:tGYHN8fS85aJPhDLgXETVKp+PR382OvFi2+q2GkGsq0=
 github.com/bkielbasa/cyclop v1.2.3 h1:faIVMIGDIANuGPWH031CZJTi2ymOQBULs9H21HSMa5w=
 github.com/bkielbasa/cyclop v1.2.3/go.mod h1:kHTwA9Q0uZqOADdupvcFJQtp/ksSnytRMe8ztxG8Fuo=
 github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ089M=
 github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
 github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
 github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
+github.com/bombsimon/wsl/v5 v5.1.1 h1:cQg5KJf9FlctAH4cpL9vLKnziYknoCMCdqXl0wjl72Q=
+github.com/bombsimon/wsl/v5 v5.1.1/go.mod h1:Gp8lD04z27wm3FANIUPZycXp+8huVsn0oxc+n4qfV9I=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/boombuler/barcode v1.0.2 h1:79yrbttoZrLGkL/oOI8hBrUKucwOL0oOjUgEguGMcJ4=
-github.com/boombuler/barcode v1.0.2/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
+github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
 github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE=
 github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg=
@@ -117,8 +159,8 @@ github.com/butuzov/mirror v1.3.0 h1:HdWCXzmwlQHdVhwvsfBb2Au0r3HyINry3bDWLYXiKoc=
 github.com/butuzov/mirror v1.3.0/go.mod h1:AEij0Z8YMALaq4yQj9CPPVYOyJQyiexpQEQgihajRfI=
 github.com/catenacyber/perfsprint v0.9.1 h1:5LlTp4RwTooQjJCvGEFV6XksZvWE7wCOUvjD2z0vls0=
 github.com/catenacyber/perfsprint v0.9.1/go.mod h1:q//VWC2fWbcdSLEY1R3l8n0zQCDPdE4IjZwyY1HMunM=
-github.com/ccojocar/zxcvbn-go v1.0.2 h1:na/czXU8RrhXO4EZme6eQJLR4PzcGsahsBOAwU6I3Vg=
-github.com/ccojocar/zxcvbn-go v1.0.2/go.mod h1:g1qkXtUSvHP8lhHp5GrSmTz6uWALGRMQdw6Qnz/hi60=
+github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc=
+github.com/ccojocar/zxcvbn-go v1.0.4/go.mod h1:3GxGX+rHmueTUMvm5ium7irpyjmm7ikxYFOSJB21Das=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -136,24 +178,26 @@ github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0G
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
 github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
-github.com/chavacava/garif v0.1.0 h1:2JHa3hbYf5D9dsgseMKAmc/MZ109otzgNFk5s87H9Pc=
-github.com/chavacava/garif v0.1.0/go.mod h1:XMyYCkEL58DF0oyW4qDjjnPWONs2HBqYKI+UIPD+Gww=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/ckaznocha/intrange v0.3.1 h1:j1onQyXvHUsPWujDH6WIjhyH26gkRt/txNlV7LspvJs=
 github.com/ckaznocha/intrange v0.3.1/go.mod h1:QVepyz1AkUoFQkpEqksSYpNpUo3c5W7nWh/s6SHIJJk=
+github.com/clbanning/mxj/v2 v2.7.0 h1:WA/La7UGCanFe5NpHF0Q3DNtnCsVoxbPKuyBNHWRyME=
+github.com/clbanning/mxj/v2 v2.7.0/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
-github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/coreos/go-oidc/v3 v3.15.0 h1:R6Oz8Z4bqWR7VFQ+sPSvZPQv4x8M+sJkDO5ojgwlyAg=
+github.com/coreos/go-oidc/v3 v3.15.0/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/curioswitch/go-reassign v0.3.0 h1:dh3kpQHuADL3cobV/sSGETA8DOv457dwl+fbBAhrQPs=
 github.com/curioswitch/go-reassign v0.3.0/go.mod h1:nApPCCTtqLJN/s8HfItCcKV0jIPwluBOvZP+dsJGA88=
-github.com/daixiang0/gci v0.13.6 h1:RKuEOSkGpSadkGbvZ6hJ4ddItT3cVZ9Vn9Rybk6xjl8=
-github.com/daixiang0/gci v0.13.6/go.mod h1:12etP2OniiIdP4q+kjUGrC/rUagga7ODbqsom5Eo5Yk=
+github.com/daixiang0/gci v0.13.7 h1:+0bG5eK9vlI08J+J/NWGbWPTNiXPG4WhNLJOkSxWITQ=
+github.com/daixiang0/gci v0.13.7/go.mod h1:812WVN6JLFY9S6Tv76twqmNqevN0pa3SX3nih0brVzQ=
 github.com/dave/dst v0.27.3 h1:P1HPoMza3cMEquVf9kKy8yXsFirry4zEnWOdYPOoIzY=
 github.com/dave/dst v0.27.3/go.mod h1:jHh6EOibnHgcUW3WjKHisiooEkYwqpHLBSX1iOBhEyc=
 github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo=
@@ -163,6 +207,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42t4429eC9k8=
 github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY=
+github.com/disintegration/gift v1.2.1 h1:Y005a1X4Z7Uc+0gLpSAsKhWi4qLtsdEcMIbbdvdZ6pc=
+github.com/disintegration/gift v1.2.1/go.mod h1:Jh2i7f7Q2BM7Ezno3PhfezbR1xpUg9dUg3/RlKGr4HI=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dsoprea/go-exif/v2 v2.0.0-20200321225314-640175a69fe4/go.mod h1:Lm2lMM2zx8p4a34ZemkaUV95AnMl4ZvLbCUbwOvLC2E=
@@ -190,22 +236,29 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/ettle/strcase v0.2.0 h1:fGNiVF21fHXpX1niBgk0aROov1LagYsOwV/xqKDKR/Q=
 github.com/ettle/strcase v0.2.0/go.mod h1:DajmHElDSaX76ITe3/VHVyMin4LWSJN5Z909Wp+ED1A=
+github.com/evanw/esbuild v0.25.3 h1:4JKyUsm/nHDhpxis4IyWXAi8GiyTwG1WdEp6OhGVE8U=
+github.com/evanw/esbuild v0.25.3/go.mod h1:D2vIQZqV/vIf/VRHtViaUtViZmG7o+kKmlBfVQuRi48=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
 github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
 github.com/firefart/nonamedreturns v1.0.6 h1:vmiBcKV/3EqKY3ZiPxCINmpS431OcE1S47AQUwhrg8E=
 github.com/firefart/nonamedreturns v1.0.6/go.mod h1:R8NisJnSIpvPWheCq0mNRXJok6D8h7fagJTF8EMEwCo=
-github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
-github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
-github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
-github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
+github.com/frankban/quicktest v1.7.2/go.mod h1:jaStnuzAqU1AJdCO0l53JDCJrVDKcS03DbaAcR7Ks/o=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
-github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
-github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
+github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIpU+bX4+ZK0=
+github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/gen2brain/go-fitz v1.24.15 h1:sJNB1MOWkqnzzENPHggFpgxTwW0+S5WF/rM5wUBpJWo=
 github.com/gen2brain/go-fitz v1.24.15/go.mod h1:SftkiVbTHqF141DuiLwBBM65zP7ig6AVDQpf2WlHamo=
+github.com/getkin/kin-openapi v0.132.0 h1:3ISeLMsQzcb5v26yeJrBcdTCEQTag36ZjaGk7MIRUwk=
+github.com/getkin/kin-openapi v0.132.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/go-critic/go-critic v0.13.0 h1:kJzM7wzltQasSUXtYyTl6UaPVySO6GkaR1thFnJ6afY=
@@ -219,18 +272,18 @@ github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3Bop
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
-github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
+github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
-github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v0.21.2 h1:AqQaNADVwq/VnkCmQg6ogE+M3FOsKTytwges0JdwVuA=
+github.com/go-openapi/jsonpointer v0.21.2/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
 github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
@@ -269,10 +322,12 @@ github.com/go-toolsmith/strparse v1.1.0 h1:GAioeZUK9TGxnLS+qfdqNbA4z0SSm5zVNtCQi
 github.com/go-toolsmith/strparse v1.1.0/go.mod h1:7ksGy58fsaQkGQlY8WVoBFNyEPMGuJin1rfoPS4lBSQ=
 github.com/go-toolsmith/typep v1.1.0 h1:fIRYDyF+JywLfqzyhdiHzRop/GQDxxNhLGQ6gFUNHus=
 github.com/go-toolsmith/typep v1.1.0/go.mod h1:fVIw+7zjdsMxDA3ITWnH1yOiw1rnTQKCsF/sk2H/qig=
-github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
-github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY=
 github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
+github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
+github.com/gobuffalo/flect v1.0.3/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
@@ -280,13 +335,29 @@ github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7Lk
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gohugoio/go-i18n/v2 v2.1.3-0.20230805085216-e63c13218d0e h1:QArsSubW7eDh8APMXkByjQWvuljwPGAGQpJEFn0F0wY=
+github.com/gohugoio/go-i18n/v2 v2.1.3-0.20230805085216-e63c13218d0e/go.mod h1:3Ltoo9Banwq0gOtcOwxuHG6omk+AwsQPADyw2vQYOJQ=
+github.com/gohugoio/hashstructure v0.5.0 h1:G2fjSBU36RdwEJBWJ+919ERvOVqAg9tfcYp47K9swqg=
+github.com/gohugoio/hashstructure v0.5.0/go.mod h1:Ser0TniXuu/eauYmrwM4o64EBvySxNzITEOLlm4igec=
+github.com/gohugoio/httpcache v0.7.0 h1:ukPnn04Rgvx48JIinZvZetBfHaWE7I01JR2Q2RrQ3Vs=
+github.com/gohugoio/httpcache v0.7.0/go.mod h1:fMlPrdY/vVJhAriLZnrF5QpN3BNAcoBClgAyQd+lGFI=
+github.com/gohugoio/hugo v0.147.6 h1:rL4rnus/5qzj4+FoA+JMzsVvFJ2YZdVIH6pbuCB2P84=
+github.com/gohugoio/hugo v0.147.6/go.mod h1:Sb2COQPDPYG+tRSpePtzKytiuVDqkBivEhgIew1QbNo=
+github.com/gohugoio/hugo-goldmark-extensions/extras v0.3.0 h1:gj49kTR5Z4Hnm0ZaQrgPVazL3DUkppw+x6XhHCmh+Wk=
+github.com/gohugoio/hugo-goldmark-extensions/extras v0.3.0/go.mod h1:IMMj7xiUbLt1YNJ6m7AM4cnsX4cFnnfkleO/lBHGzUg=
+github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.3.1 h1:nUzXfRTszLliZuN0JTKeunXTRaiFX6ksaWP0puLLYAY=
+github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.3.1/go.mod h1:Wy8ThAA8p2/w1DY05vEzq6EIeI2mzDjvHsu7ULBVwog=
+github.com/gohugoio/locales v0.14.0 h1:Q0gpsZwfv7ATHMbcTNepFd59H7GoykzWJIxi113XGDc=
+github.com/gohugoio/locales v0.14.0/go.mod h1:ip8cCAv/cnmVLzzXtiTpPwgJ4xhKZranqNqtoIu0b/4=
+github.com/gohugoio/localescompressed v1.0.1 h1:KTYMi8fCWYLswFyJAeOtuk/EkXR/KPTHHNN9OS+RTxo=
+github.com/gohugoio/localescompressed v1.0.1/go.mod h1:jBF6q8D7a0vaEmcWPNcAjUZLJaIVNiwvM3WlmTvooB0=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/geo v0.0.0-20190916061304-5b978397cfec/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/geo v0.0.0-20200319012246-673a6f80352d/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/geo v0.0.0-20210211234256-740aa86cb551/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
-github.com/golang/geo v0.0.0-20250707181242-c5087ca84cf4 h1:vCeHcs8N7MOccOOsOVIy1xcYu+kBkA4J5urTgigww7c=
-github.com/golang/geo v0.0.0-20250707181242-c5087ca84cf4/go.mod h1:AN0OjM34c3PbjAsX+QNma1nYtJtRxl+s9MZNV7S+efw=
+github.com/golang/geo v0.0.0-20250825151631-54d70cc7cb31 h1:226lwSa0uZO7sd7QU88n43nDIqGoc+bOh0vSO3Q/byU=
+github.com/golang/geo v0.0.0-20250825151631-54d70cc7cb31/go.mod h1:AN0OjM34c3PbjAsX+QNma1nYtJtRxl+s9MZNV7S+efw=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -324,16 +395,19 @@ github.com/golangci/go-printf-func-name v0.1.0 h1:dVokQP+NMTO7jwO4bwsRwLWeudOVUP
 github.com/golangci/go-printf-func-name v0.1.0/go.mod h1:wqhWFH5mUdJQhweRnldEywnR5021wTdZSNgwYceV14s=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d h1:viFft9sS/dxoYY0aiOTsLKO2aZQAPT4nlQCsimGcSGE=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d/go.mod h1:ivJ9QDg0XucIkmwhzCDsqcnxxlDStoTl89jDMIoNxKY=
-github.com/golangci/golangci-lint/v2 v2.1.6 h1:LXqShFfAGM5BDzEOWD2SL1IzJAgUOqES/HRBsfKjI+w=
-github.com/golangci/golangci-lint/v2 v2.1.6/go.mod h1:EPj+fgv4TeeBq3TcqaKZb3vkiV5dP4hHHKhXhEhzci8=
+github.com/golangci/golangci-lint v1.64.8 h1:y5TdeVidMtBGG32zgSC7ZXTFNHrsJkDnpO4ItB3Am+I=
+github.com/golangci/golangci-lint/v2 v2.4.0 h1:qz6O6vr7kVzXJqyvHjHSz5fA3D+PM8v96QU5gxZCNWM=
+github.com/golangci/golangci-lint/v2 v2.4.0/go.mod h1:Oq7vuAf6L1iNL34uHDcsIF6Mnc0amOPdsT3/GlpHD+I=
 github.com/golangci/golines v0.0.0-20250217134842-442fd0091d95 h1:AkK+w9FZBXlU/xUmBtSJN1+tAI4FIvy5WtnUnY8e4p8=
 github.com/golangci/golines v0.0.0-20250217134842-442fd0091d95/go.mod h1:k9mmcyWKSTMcPPvQUCfRWWQ9VHJ1U9Dc0R7kaXAgtnQ=
-github.com/golangci/misspell v0.6.0 h1:JCle2HUTNWirNlDIAUO44hUsKhOFqGPoC4LZxlaSXDs=
-github.com/golangci/misspell v0.6.0/go.mod h1:keMNyY6R9isGaSAu+4Q8NMBwMPkh15Gtc8UCVoDtAWo=
-github.com/golangci/plugin-module-register v0.1.1 h1:TCmesur25LnyJkpsVrupv1Cdzo+2f7zX0H6Jkw1Ol6c=
-github.com/golangci/plugin-module-register v0.1.1/go.mod h1:TTpqoB6KkwOJMV8u7+NyXMrkwwESJLOkfl9TxR1DGFc=
+github.com/golangci/misspell v0.7.0 h1:4GOHr/T1lTW0hhR4tgaaV1WS/lJ+ncvYCoFKmqJsj0c=
+github.com/golangci/misspell v0.7.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg=
+github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3HIYbzSuP53UAYgOpg=
+github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
 github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
 github.com/golangci/revgrep v0.8.0/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k=
+github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e h1:ai0EfmVYE2bRA5htgAG9r7s3tHsfjIhN98WshBTJ9jM=
+github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e/go.mod h1:Vrn4B5oR9qRwM+f54koyeH3yzphlecwERs0el27Fr/s=
 github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqtt0ssnqSJNNndxe69DOQ24A5h7+i3KpM=
 github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e/go.mod h1:h+wZwLjUTJnm/P2rwlbJdRPZXOzaT36/FwnPnY2inzc=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -348,7 +422,6 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -362,8 +435,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
-github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20250607225305-033d6d78b36a h1://KbezygeMJZCSHH+HgUZiTeSoiuFspbMg1ge+eFj18=
+github.com/google/pprof v0.0.0-20250607225305-033d6d78b36a/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
@@ -386,6 +459,8 @@ github.com/gtsteffaniak/go-cache v0.0.0-20250521142451-edc77dfcb063 h1:CoLbeqTmM
 github.com/gtsteffaniak/go-cache v0.0.0-20250521142451-edc77dfcb063/go.mod h1:rHUZvf4huhMX/bnNK4/oQ3sNAE2fYC2jFpAWZiBPWac=
 github.com/gtsteffaniak/go-logger v0.1.2 h1:0g6UxxNwU+Q+7IVRw+Yn7AuYsIK0ukiTgbzjTLm+Uy4=
 github.com/gtsteffaniak/go-logger v0.1.2/go.mod h1:U3ZkdAclcxXNMvoQLq+zDkqcTmdqhX3hTf+6AuTo6v0=
+github.com/hairyhenderson/go-codeowners v0.7.0 h1:s0W4wF8bdsBEjTWzwzSlsatSthWtTAF2xLgo4a4RwAo=
+github.com/hairyhenderson/go-codeowners v0.7.0/go.mod h1:wUlNgQ3QjqC4z8DnM5nnCYVq/icpqXJyJOukKx5U8/Q=
 github.com/hashicorp/go-immutable-radix/v2 v2.1.0 h1:CUW5RYIcysz+D3B+l1mDeXrQ7fUvGGCwJfdASSzbrfo=
 github.com/hashicorp/go-immutable-radix/v2 v2.1.0/go.mod h1:hgdqLXA4f6NIjRVisM1TJ9aOJVNRqKZj+xDGF6m7PBw=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
@@ -404,14 +479,16 @@ github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSo
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jdkato/prose v1.2.1 h1:Fp3UnJmLVISmlc57BgKUzdjr0lOtjqTZicL3PaYy6cU=
+github.com/jdkato/prose v1.2.1/go.mod h1:AiRHgVagnEx2JbQRQowVBKjG0bcs/vtkGCH1dYAL1rA=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/jgautheron/goconst v1.8.1 h1:PPqCYp3K/xlOj5JmIe6O1Mj6r1DbkdbLtR3AJuZo414=
-github.com/jgautheron/goconst v1.8.1/go.mod h1:A0oxgBCHy55NQn6sYpO7UdnA9p+h7cPtoOZUmvNIako=
+github.com/jgautheron/goconst v1.8.2 h1:y0XF7X8CikZ93fSNT6WBTb/NElBu9IjaY7CCYQrCMX4=
+github.com/jgautheron/goconst v1.8.2/go.mod h1:A0oxgBCHy55NQn6sYpO7UdnA9p+h7cPtoOZUmvNIako=
 github.com/jingyugao/rowserrcheck v1.1.1 h1:zibz55j/MJtLsjP1OF4bSdgXxwL1b+Vn7Tjzq7gFzUs=
 github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
-github.com/jjti/go-spancheck v0.6.4 h1:Tl7gQpYf4/TMU7AT84MN83/6PutY21Nb9fuQjFTpRRc=
-github.com/jjti/go-spancheck v0.6.4/go.mod h1:yAEYdKJ2lRkDA8g7X+oKUHXOWVAXSBJRv04OhF+QUjk=
+github.com/jjti/go-spancheck v0.6.5 h1:lmi7pKxa37oKYIMScialXUK6hP3iY5F1gu+mLBPgYB8=
+github.com/jjti/go-spancheck v0.6.5/go.mod h1:aEogkeatBrbYsyW6y5TgDfihCulDYciL1B7rG2vSsrU=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
@@ -425,8 +502,8 @@ github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7V
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
 github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
-github.com/jupiterrider/ffi v0.5.0 h1:j2nSgpabbV1JOwgP4Kn449sJUHq3cVLAZVBoOYn44V8=
-github.com/jupiterrider/ffi v0.5.0/go.mod h1:x7xdNKo8h0AmLuXfswDUBxUsd2OqUP4ekC8sCnsmbvo=
+github.com/jupiterrider/ffi v0.5.1 h1:l7ANXU+Ex33LilVa283HNaf/sTzCrrht7D05k6T6nlc=
+github.com/jupiterrider/ffi v0.5.1/go.mod h1:x7xdNKo8h0AmLuXfswDUBxUsd2OqUP4ekC8sCnsmbvo=
 github.com/karamaru-alpha/copyloopvar v1.2.1 h1:wmZaZYIjnJ0b5UoKDjUHrikcV0zuPyyxI4SVplLd2CI=
 github.com/karamaru-alpha/copyloopvar v1.2.1/go.mod h1:nFmMlFNlClC2BPvNaHMdkirmTJxVCY0lhxBtlfOypMM=
 github.com/kisielk/errcheck v1.9.0 h1:9xt1zI9EBfcYBvdU1nVrzMzzUPUtPKs9bVSIM3TAb3M=
@@ -450,18 +527,20 @@ github.com/kulti/thelper v0.6.3 h1:ElhKf+AlItIu+xGnI990no4cE2+XaSu1ULymV2Yulxs=
 github.com/kulti/thelper v0.6.3/go.mod h1:DsqKShOvP40epevkFrvIwkCMNYxMeTNjdWL4dqWHZ6I=
 github.com/kunwardeep/paralleltest v1.0.14 h1:wAkMoMeGX/kGfhQBPODT/BL8XhK23ol/nuQ3SwFaUw8=
 github.com/kunwardeep/paralleltest v1.0.14/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
+github.com/kyokomi/emoji/v2 v2.2.13 h1:GhTfQa67venUUvmleTNFnb+bi7S3aocF7ZCXU9fSO7U=
+github.com/kyokomi/emoji/v2 v2.2.13/go.mod h1:JUcn42DTdsXJo1SWanHh4HKDEyPaR5CqkmoirZZP9qE=
 github.com/lasiar/canonicalheader v1.1.2 h1:vZ5uqwvDbyJCnMhmFYimgMZnJMjwljN5VGY0VKbMXb4=
 github.com/lasiar/canonicalheader v1.1.2/go.mod h1:qJCeLFS0G/QlLQ506T+Fk/fWMa2VmBUiEI2cuMK4djI=
-github.com/ldez/exptostd v0.4.3 h1:Ag1aGiq2epGePuRJhez2mzOpZ8sI9Gimcb4Sb3+pk9Y=
-github.com/ldez/exptostd v0.4.3/go.mod h1:iZBRYaUmcW5jwCR3KROEZ1KivQQp6PHXbDPk9hqJKCQ=
-github.com/ldez/gomoddirectives v0.6.1 h1:Z+PxGAY+217f/bSGjNZr/b2KTXcyYLgiWI6geMBN2Qc=
-github.com/ldez/gomoddirectives v0.6.1/go.mod h1:cVBiu3AHR9V31em9u2kwfMKD43ayN5/XDgr+cdaFaKs=
-github.com/ldez/grignotin v0.9.0 h1:MgOEmjZIVNn6p5wPaGp/0OKWyvq42KnzAt/DAb8O4Ow=
-github.com/ldez/grignotin v0.9.0/go.mod h1:uaVTr0SoZ1KBii33c47O1M8Jp3OP3YDwhZCmzT9GHEk=
+github.com/ldez/exptostd v0.4.4 h1:58AtQjnLcT/tI5W/1KU7xE/O7zW9RAWB6c/ScQAnfus=
+github.com/ldez/exptostd v0.4.4/go.mod h1:QfdzPw6oHjFVdNV7ILoPu5sw3OZ3OG1JS0I5JN3J4Js=
+github.com/ldez/gomoddirectives v0.7.0 h1:EOx8Dd56BZYSez11LVgdj025lKwlP0/E5OLSl9HDwsY=
+github.com/ldez/gomoddirectives v0.7.0/go.mod h1:wR4v8MN9J8kcwvrkzrx6sC9xe9Cp68gWYCsda5xvyGc=
+github.com/ldez/grignotin v0.10.0 h1:NQPeh1E/Eza4F0exCeC1WkpnLvgUcQDT8MQ1vOLML0E=
+github.com/ldez/grignotin v0.10.0/go.mod h1:oR4iCKUP9fwoeO6vCQeD7M5SMxCT6xdVas4vg0h1LaI=
 github.com/ldez/tagliatelle v0.7.1 h1:bTgKjjc2sQcsgPiT902+aadvMjCeMHrY7ly2XKFORIk=
 github.com/ldez/tagliatelle v0.7.1/go.mod h1:3zjxUpsNB2aEZScWiZTHrAXOl1x25t3cRmzfK1mlo2I=
-github.com/ldez/usetesting v0.4.3 h1:pJpN0x3fMupdTf/IapYjnkhiY1nSTN+pox1/GyBRw3k=
-github.com/ldez/usetesting v0.4.3/go.mod h1:eEs46T3PpQ+9RgN9VjpY6qWdiw2/QmfiDeWmdZdrjIQ=
+github.com/ldez/usetesting v0.5.0 h1:3/QtzZObBKLy1F4F8jLuKJiKBjjVFi1IavpoWbmqLwc=
+github.com/ldez/usetesting v0.5.0/go.mod h1:Spnb4Qppf8JTuRgblLrEWb7IE6rDmUpGvxY3iRrzvDQ=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
@@ -474,12 +553,18 @@ github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamh
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
-github.com/manuelarte/funcorder v0.2.1 h1:7QJsw3qhljoZ5rH0xapIvjw31EcQeFbF31/7kQ/xS34=
-github.com/manuelarte/funcorder v0.2.1/go.mod h1:BQQ0yW57+PF9ZpjpeJDKOffEsQbxDFKW8F8zSMe/Zd0=
+github.com/makeworld-the-better-one/dither/v2 v2.4.0 h1:Az/dYXiTcwcRSe59Hzw4RI1rSnAZns+1msaCXetrMFE=
+github.com/makeworld-the-better-one/dither/v2 v2.4.0/go.mod h1:VBtN8DXO7SNtyGmLiGA7IsFeKrBkQPze1/iAeM95arc=
+github.com/manuelarte/embeddedstructfieldcheck v0.3.0 h1:VhGqK8gANDvFYDxQkjPbv7/gDJtsGU9k6qj/hC2hgso=
+github.com/manuelarte/embeddedstructfieldcheck v0.3.0/go.mod h1:LSo/IQpPfx1dXMcX4ibZCYA7Yy6ayZHIaOGM70+1Wy8=
+github.com/manuelarte/funcorder v0.5.0 h1:llMuHXXbg7tD0i/LNw8vGnkDTHFpTnWqKPI85Rknc+8=
+github.com/manuelarte/funcorder v0.5.0/go.mod h1:Yt3CiUQthSBMBxjShjdXMexmzpP8YGvGLjrxJNkO2hA=
 github.com/maratori/testableexamples v1.0.0 h1:dU5alXRrD8WKSjOUnmJZuzdxWOEQ57+7s93SLMxb2vI=
 github.com/maratori/testableexamples v1.0.0/go.mod h1:4rhjL1n20TUTT4vdh3RDqSizKLyXp7K2u6HgraZCGzE=
 github.com/maratori/testpackage v1.1.1 h1:S58XVV5AD7HADMmD0fNnziNHqKvSdDuEKdPD1rNTU04=
 github.com/maratori/testpackage v1.1.1/go.mod h1:s4gRK/ym6AMrqpOa/kEbQTV4Q4jb7WeLZzVhVVVOQMc=
+github.com/marekm4/color-extractor v1.2.1 h1:3Zb2tQsn6bITZ8MBVhc33Qn1k5/SEuZ18mrXGUqIwn0=
+github.com/marekm4/color-extractor v1.2.1/go.mod h1:90VjmiHI6M8ez9eYUaXLdcKnS+BAOp7w+NpwBdkJmpA=
 github.com/matoous/godox v1.1.0 h1:W5mqwbyWrwZv6OQ5Z1a/DHGMOvXYCBP3+Ht7KMoJhq4=
 github.com/matoous/godox v1.1.0/go.mod h1:jgE/3fUXiTurkdHOLT5WEkThTSuE7yxHv5iWPa80afs=
 github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
@@ -488,42 +573,51 @@ github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHP
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mgechev/revive v1.9.0 h1:8LaA62XIKrb8lM6VsBSQ92slt/o92z5+hTw3CmrvSrM=
-github.com/mgechev/revive v1.9.0/go.mod h1:LAPq3+MgOf7GcL5PlWIkHb0PT7XH4NuC2LdWymhb9Mo=
+github.com/mgechev/revive v1.11.0 h1:b/gLLpBE427o+Xmd8G58gSA+KtBwxWinH/A565Awh0w=
+github.com/mgechev/revive v1.11.0/go.mod h1:tI0oLF/2uj+InHCBLrrqfTKfjtFTBCFFfG05auyzgdw=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
-github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374mizHuIWj+OSJCajGr/phAmuMug9qIX3l9CflE=
+github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/moricho/tparallel v0.3.2 h1:odr8aZVFA3NZrNybggMkYO3rgPRcqjeQUlBBFVxKHTI=
 github.com/moricho/tparallel v0.3.2/go.mod h1:OQ+K3b4Ln3l2TZveGCywybl68glfLEwFGqvnjok8b+U=
+github.com/muesli/smartcrop v0.3.0 h1:JTlSkmxWg/oQ1TcLDoypuirdE8Y/jzNirQeLkxpA6Oc=
+github.com/muesli/smartcrop v0.3.0/go.mod h1:i2fCI/UorTfgEpPPLWiFBv4pye+YAG78RwcQLUkocpI=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U=
 github.com/nakabonne/nestif v0.3.1/go.mod h1:9EtoZochLn5iUprVDmDjqGKPofoUEBL8U4Ngq6aY7OE=
+github.com/niklasfasching/go-org v1.7.0 h1:vyMdcMWWTe/XmANk19F4k8XGBYg0GQ/gJGMimOjGMek=
+github.com/niklasfasching/go-org v1.7.0/go.mod h1:WuVm4d45oePiE0eX25GqTDQIt/qPW1T9DGkRscqLW5o=
 github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhKRf3Swg=
 github.com/nishanths/exhaustive v0.12.0/go.mod h1:mEZ95wPIZW+x8kC4TgC+9YCUgiST7ecevsVDTgc2obs=
 github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
 github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
-github.com/nunnatsa/ginkgolinter v0.19.1 h1:mjwbOlDQxZi9Cal+KfbEJTCz327OLNfwNvoZ70NJ+c4=
-github.com/nunnatsa/ginkgolinter v0.19.1/go.mod h1:jkQ3naZDmxaZMXPWaS9rblH+i+GWXQCaS/JFIWcOH2s=
+github.com/nunnatsa/ginkgolinter v0.20.0 h1:OmWLkAFO2HUTYcU6mprnKud1Ey5pVdiVNYGO5HVicx8=
+github.com/nunnatsa/ginkgolinter v0.20.0/go.mod h1:dCIuFlTPfQerXgGUju3VygfAFPdC5aE1mdacCDKDJcQ=
+github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
+github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
+github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
+github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/ginkgo/v2 v2.23.3 h1:edHxnszytJ4lD9D5Jjc4tiDkPBZ3siDeJJkUZJJVkp0=
-github.com/onsi/ginkgo/v2 v2.23.3/go.mod h1:zXTP6xIp3U8aVuXN8ENK9IXRaTjFnpVB9mGmaSRvxnM=
-github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
-github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
+github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
+github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
+github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
 github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
 github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
@@ -531,10 +625,14 @@ github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJ
 github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
 github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
 github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
+github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 h1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=
+github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58/go.mod h1:DXv8WO4yhMYhSNPKjeNKa5WY9YCIEBRbNzFFPJbWO6Y=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
+github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -596,14 +694,14 @@ github.com/ryanrolds/sqlclosecheck v0.5.1 h1:dibWW826u0P8jNLsLN+En7+RqWWTYrjCB9f
 github.com/ryanrolds/sqlclosecheck v0.5.1/go.mod h1:2g3dUjoS6AL4huFdv6wn55WpLIDjY7ZgUR4J8HOO/XQ=
 github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0=
 github.com/sanposhiho/wastedassign/v2 v2.1.0/go.mod h1:+oSmSC+9bQ+VUAxA66nBb0Z7N8CK7mscKTDYC6aIek4=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 h1:PKK9DyHxif4LZo+uQSgXNqs0jj5+xZwwfKHgph2lxBw=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.1/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tMEOsumirXcOJqAw=
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
-github.com/sashamelentyev/usestdlibvars v1.28.0 h1:jZnudE2zKCtYlGzLVreNp5pmCdOxXUzwsMDBkR21cyQ=
-github.com/sashamelentyev/usestdlibvars v1.28.0/go.mod h1:9nl0jgOfHKWNFS43Ojw0i7aRoS4j6EBye3YBhmAIRF8=
-github.com/securego/gosec/v2 v2.22.3 h1:mRrCNmRF2NgZp4RJ8oJ6yPJ7G4x6OCiAXHd8x4trLRc=
-github.com/securego/gosec/v2 v2.22.3/go.mod h1:42M9Xs0v1WseinaB/BmNGO8AVqG8vRfhC2686ACY48k=
+github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
+github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
+github.com/securego/gosec/v2 v2.22.7 h1:8/9P+oTYI4yIpAzccQKVsg1/90Po+JzGtAhqoHImDeM=
+github.com/securego/gosec/v2 v2.22.7/go.mod h1:510TFNDMrIPytokyHQAVLvPeDr41Yihn2ak8P+XQfNE=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
@@ -616,21 +714,22 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
 github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
-github.com/sonatard/noctx v0.1.0 h1:JjqOc2WN16ISWAjAk8M5ej0RfExEXtkEyExl2hLW+OM=
-github.com/sonatard/noctx v0.1.0/go.mod h1:0RvBxqY8D4j9cTTTWE8ylt2vqj2EPI8fHmrxHdsaZ2c=
+github.com/sonatard/noctx v0.4.0 h1:7MC/5Gg4SQ4lhLYR6mvOP6mQVSxCrdyiExo7atBs27o=
+github.com/sonatard/noctx v0.4.0/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
 github.com/sourcegraph/go-diff v0.7.0 h1:9uLlrd5T46OXs5qpp8L/MTltk0zikUGi0sNNyCpA8G0=
 github.com/sourcegraph/go-diff v0.7.0/go.mod h1:iBszgVvyxdc8SFZ7gm69go2KDdt3ag071iBaWPF6cjs=
 github.com/spf13/afero v1.14.0 h1:9tH6MapGnn/j0eb0yIXiLjERO8RB6xIVZRDCX7PtqWA=
 github.com/spf13/afero v1.14.0/go.mod h1:acJQ8t0ohCGuMN3O+Pv0V0hgMxNYDlvdk+VTfyZmbYo=
-github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
-github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
+github.com/spf13/cast v1.8.0 h1:gEN9K4b8Xws4EX0+a0reLmhq8moKn7ntRlQYgjPeCDk=
+github.com/spf13/cast v1.8.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.12.0 h1:CZ7eSOd3kZoaYDLbXnmzgQI5RlciuXBMA+18HwHRfZQ=
 github.com/spf13/viper v1.12.0/go.mod h1:b6COn30jlNxbm/V2IqWiNWkJ+vZNiMNksliPCiuKtSI=
 github.com/ssgreg/nlreturn/v2 v2.2.1 h1:X4XDI7jstt3ySqGU86YGAURbxw3oTDPK9sPEi6YEwQ0=
@@ -639,18 +738,12 @@ github.com/stbenjam/no-sprintf-host-port v0.2.0 h1:i8pxvGrt1+4G0czLr/WnmyH7zbZ8B
 github.com/stbenjam/no-sprintf-host-port v0.2.0/go.mod h1:eL0bQ9PasS0hsyTyfTjjG+E80QIyPnBVQbYZyv20Jfk=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
@@ -659,16 +752,24 @@ github.com/swaggo/files v1.0.1 h1:J1bVJ4XHZNq0I46UU90611i9/YzdrF7x92oX1ig5IdE=
 github.com/swaggo/files v1.0.1/go.mod h1:0qXmMNH6sXNf+73t65aKeB+ApmgxdnkQzVTAj2uaMUg=
 github.com/swaggo/http-swagger v1.3.4 h1:q7t/XLx0n15H1Q9/tk3Y9L4n210XzJF5WtnDX64a5ww=
 github.com/swaggo/http-swagger v1.3.4/go.mod h1:9dAh0unqMBAlbp1uE2Uc2mQTxNMU/ha4UbucIg1MFkQ=
-github.com/swaggo/swag v1.16.4 h1:clWJtd9LStiG3VeijiCfOVODP6VpHtKdQy9ELFG3s1A=
-github.com/swaggo/swag v1.16.4/go.mod h1:VBsHJRsDvfYvqoiMKnsdwhNV9LEMHgEDZcyVYX0sxPg=
+github.com/swaggo/swag v1.16.6 h1:qBNcx53ZaX+M5dxVyTrgQ0PJ/ACK+NzhwcbieTt+9yI=
+github.com/swaggo/swag v1.16.6/go.mod h1:ngP2etMK5a0P3QBizic5MEwpRmluJZPHjXcMoj4Xesg=
 github.com/tdakkota/asciicheck v0.4.1 h1:bm0tbcmi0jezRA2b5kg4ozmMuGAFotKI3RZfrhfovg8=
 github.com/tdakkota/asciicheck v0.4.1/go.mod h1:0k7M3rCfRXb0Z6bwgvkEIMleKH3kXNz9UqJ9Xuqopr8=
+github.com/tdewolff/minify/v2 v2.23.5 h1:/P548KcpTkIOUvNg22zN83/GiaYSOIrbqtoue4I7kYM=
+github.com/tdewolff/minify/v2 v2.23.5/go.mod h1:2RI9tiIrzJU1Z5EasXEPaI1MqobRyxKHOOgrRkq5oEw=
+github.com/tdewolff/parse/v2 v2.8.1 h1:J5GSHru6o3jF1uLlEKVXkDxxcVx6yzOlIVIotK4w2po=
+github.com/tdewolff/parse/v2 v2.8.1/go.mod h1:Hwlni2tiVNKyzR1o6nUs4FOF07URA+JLBLd6dlIXYqo=
+github.com/tdewolff/test v1.0.11 h1:FdLbwQVHxqG16SlkGveC0JVyrJN62COWTRyUFzfbtBE=
+github.com/tdewolff/test v1.0.11/go.mod h1:XPuWBzvdUzhCuxWO1ojpXsyzsA5bFoS3tO/Q3kFuTG8=
 github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA=
 github.com/tenntenn/modver v1.0.1/go.mod h1:bePIyQPb7UeioSRkw3Q0XeMhYZSMx9B8ePqg6SAMGH0=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpRQGxTSkNYKJ51yaw6ChIqO+Je8UqsTKN/cDag=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
 github.com/tetafro/godot v1.5.1 h1:PZnjCol4+FqaEzvZg5+O8IY2P3hfY9JzRBNPv1pEDS4=
 github.com/tetafro/godot v1.5.1/go.mod h1:cCdPtEndkmqqrhiCfkmxDodMQJ/f3L1BCNskCUZdTwk=
+github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
+github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
 github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 h1:9LPGD+jzxMlnk5r6+hJnar67cgpDIz/iyD+rfl5r2Vk=
 github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67/go.mod h1:mkjARE7Yr8qU23YcGMSALbIxTQ9r9QBVahQOBRfU460=
 github.com/timonwong/loggercheck v0.11.0 h1:jdaMpYBl+Uq9mWPXv1r8jc5fC3gyXx4/WGwTnnNKn4M=
@@ -685,8 +786,8 @@ github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
 github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
 github.com/uudashr/gocognit v1.2.0 h1:3BU9aMr1xbhPlvJLSydKwdLN3tEUUrzPSSM8S4hDYRA=
 github.com/uudashr/gocognit v1.2.0/go.mod h1:k/DdKPI6XBZO1q7HgoV2juESI2/Ofj9AcHPZhBBdrTU=
-github.com/uudashr/iface v1.3.1 h1:bA51vmVx1UIhiIsQFSNq6GZ6VPTk3WNMZgRiCe9R29U=
-github.com/uudashr/iface v1.3.1/go.mod h1:4QvspiRd3JLPAEXBQ9AiZpLbJlrWWgRChOKDJEuQTdg=
+github.com/uudashr/iface v1.4.1 h1:J16Xl1wyNX9ofhpHmQ9h9gk5rnv2A6lX/2+APLTo0zU=
+github.com/uudashr/iface v1.4.1/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM=
@@ -706,34 +807,38 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.7.11 h1:ZCxLyDMtz0nT2HFfsYG8WZ47Trip2+JyLysKcMYE5bo=
+github.com/yuin/goldmark v1.7.11/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs=
+github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA=
 gitlab.com/bosi/decorder v0.4.2 h1:qbQaV3zgwnBZ4zPMhGLW4KZe7A7NwxEhJx39R3shffo=
 gitlab.com/bosi/decorder v0.4.2/go.mod h1:muuhHoaJkA9QLcYHq4Mj8FJUwDZ+EirSHRiaTcTf6T8=
 go-simpler.org/assert v0.9.0 h1:PfpmcSvL7yAnWyChSjOz6Sp6m9j5lyK8Ok9pEL31YkQ=
 go-simpler.org/assert v0.9.0/go.mod h1:74Eqh5eI6vCK6Y5l3PI8ZYFXG4Sa+tkr70OIPJAUr28=
 go-simpler.org/musttag v0.13.1 h1:lw2sJyu7S1X8lc8zWUAdH42y+afdcCnHhWpnkWvd6vU=
 go-simpler.org/musttag v0.13.1/go.mod h1:8r450ehpMLQgvpb6sg+hV5Ur47eH6olp/3yEanfG97k=
-go-simpler.org/sloglint v0.11.0 h1:JlR1X4jkbeaffiyjLtymeqmGDKBDO1ikC6rjiuFAOco=
-go-simpler.org/sloglint v0.11.0/go.mod h1:CFDO8R1i77dlciGfPEPvYke2ZMx4eyGiEIWkyeW2Pvw=
+go-simpler.org/sloglint v0.11.1 h1:xRbPepLT/MHPTCA6TS/wNfZrDzkGvCCqUv4Bdwc3H7s=
+go-simpler.org/sloglint v0.11.1/go.mod h1:2PowwiCOK8mjiF+0KGifVOT8ZsCNiFzvfyJeJOIt8MQ=
+go.augendre.info/arangolint v0.2.0 h1:2NP/XudpPmfBhQKX4rMk+zDYIj//qbt4hfZmSSTcpj8=
+go.augendre.info/arangolint v0.2.0/go.mod h1:Vx4KSJwu48tkE+8uxuf0cbBnAPgnt8O1KWiT7bljq7w=
 go.augendre.info/fatcontext v0.8.0 h1:2dfk6CQbDGeu1YocF59Za5Pia7ULeAM6friJ3LP7lmk=
 go.augendre.info/fatcontext v0.8.0/go.mod h1:oVJfMgwngMsHO+KB2MdgzcO+RvtNdiCEOlWvSFtax/s=
 go.etcd.io/bbolt v1.3.4/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
-go.etcd.io/bbolt v1.4.2 h1:IrUHp260R8c+zYx/Tm8QZr04CX+qWS5PGfPdevhdm1I=
-go.etcd.io/bbolt v1.4.2/go.mod h1:Is8rSHO/b4f3XigBC0lL0+4FwAQv3HXEEIgFMuKHceM=
+go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
+go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
-go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI=
-go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
-go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
+go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -743,8 +848,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -755,16 +860,16 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 h1:e66Fs6Z+fZTbFBAxKfP3PALWBtpfqks2bwGcexMxgtk=
-golang.org/x/exp v0.0.0-20240909161429-701f63a606c0/go.mod h1:2TbTHSBQa924w8M6Xs1QcRcFwyucIwBGpK1p2f1YFFY=
+golang.org/x/exp v0.0.0-20250531010427-b6e5de432a8b h1:QoALfVG9rhQ/M7vYDScfPdWjGL9dlsVVM5VGh7aKoAA=
+golang.org/x/exp v0.0.0-20250531010427-b6e5de432a8b/go.mod h1:U6Lno4MTRCDY+Ba7aCcauB9T60gsv5s4ralQzP72ZoQ=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac h1:TSSpLIG4v+p0rPv1pNOQtl1I8knsO4S9trOxNMOLVP4=
-golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
+golang.org/x/exp/typeparams v0.0.0-20250620022241-b7579e27df2b h1:KdrhdYPDUvJTvrDK9gdjfFd6JTk8vA1WJoldYSi0kHo=
+golang.org/x/exp/typeparams v0.0.0-20250620022241-b7579e27df2b/go.mod h1:LKZHyeOpPuZcMgxeHjJp4p5yvxrCX1xDvH10zYHhjjQ=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.29.0 h1:HcdsyR4Gsuys/Axh0rDEmlBmB68rW1U9BUdB3UVHsas=
-golang.org/x/image v0.29.0/go.mod h1:RVJROnf3SLK8d26OW91j4FrIHGbsJ8QnbEocVTOWQDA=
+golang.org/x/image v0.30.0 h1:jD5RhkmVAnjqaCUXfbGBrn3lpxbknfN9w2UhHHU+5B4=
+golang.org/x/image v0.30.0/go.mod h1:SAEUTxCCMWSrJcCy/4HwavEsfZZJlYxeHLc6tTiAe/c=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -787,13 +892,11 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -831,15 +934,13 @@ golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20221002022538-bcab6841153b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -908,25 +1009,21 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
@@ -937,16 +1034,16 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -998,13 +1095,15 @@ golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
-golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
-golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1123,6 +1222,8 @@ mvdan.cc/gofumpt v0.8.0/go.mod h1:vEYnSzyGPmjvFkqJWtXkh79UwPWP9/HMxQdGEXZHjpg=
 mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4 h1:WjUu4yQoT5BHT1w8Zu56SP8367OuBV5jvo+4Ulppyf8=
 mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4/go.mod h1:rthT7OuvRbaGcd5ginj6dA2oLE7YNlta9qhBNNdCaLE=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
+rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY=
+rsc.io/qr v0.2.0/go.mod h1:IF+uZjkb9fqyeF/4tlBoynqmQxUoPfWEKh921coOuXs=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
@@ -0,0 +1,267 @@
+package http
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+type GroupListResponse struct {
+	Groups []string `json:"groups"`
+}
+
+// accessGetHandler lists all access rules or retrieves a specific rule.
+// @Summary List access rules
+// @Description Lists access rules. Can be filtered by source, path, user, or group. Can also be grouped by user or group.
+// @Tags Access
+// @Accept json
+// @Produce json
+// @Param source query string false "Source name (e.g. 'default')"
+// @Param path query string false "Index path (e.g. /secret)"
+// @Param user query string false "Username to filter rules for"
+// @Param group query string false "Group name to filter rules for"
+// @Success 200 {object} object "Varies based on query. Can be access.FrontendAccessRule (when source and path specified), []access.PrincipalRule, map[string][]access.PrincipalRule, or map[string]access.FrontendAccessRule"
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/access [get]
+func accessGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	sourceName := r.URL.Query().Get("source")
+	indexPath := r.URL.Query().Get("path")
+	user := r.URL.Query().Get("user")
+	group := r.URL.Query().Get("group")
+
+	var sourcePath string
+	if sourceName != "" {
+		index := indexing.GetIndex(sourceName)
+		if index == nil {
+			return http.StatusBadRequest, fmt.Errorf("source not found: %s", sourceName)
+		}
+		sourcePath = index.Path
+	}
+
+	// Return rules based on input parameters
+	if user != "" {
+		rules := store.Access.GetRulesForUser(sourcePath, user)
+		return renderJSON(w, r, rules)
+	}
+	if group != "" {
+		rules := store.Access.GetRulesForGroup(sourcePath, group)
+		return renderJSON(w, r, rules)
+	}
+
+	if sourceName == "" {
+		return http.StatusBadRequest, fmt.Errorf("source parameter is required for this query")
+	}
+
+	if indexPath != "" {
+		rule, _ := store.Access.GetFrontendRules(sourcePath, indexPath)
+		return renderJSON(w, r, rule)
+	}
+
+	// List all rules for the source by default
+	all, err := store.Access.GetAllRules(sourcePath)
+	if err != nil {
+		logger.Errorf("failed to retrieve access rules: %v", err)
+		return http.StatusInternalServerError, fmt.Errorf("failed to retrieve access rules: %w", err)
+	}
+	return renderJSON(w, r, all)
+}
+
+// accessPostHandler adds or updates an access rule.
+// @Summary Add or update access rule
+// @Description Add or update an access rule for a sourcePath and indexPath.
+// @Tags Access
+// @Accept json
+// @Produce json
+// @Param source query string true "Source path prefix (e.g. mnt/storage)"
+// @Param path query string true "Index path (e.g. /secret)"
+// @Param body body object{allow=bool,ruleCategory=string,value=string} true "Rule details: allow (true/false), ruleCategory (user/group), value (username or groupname)"
+// @Success 200 {object} map[string]string "Rule added or updated"
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/access [post]
+func accessPostHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	sourceName := r.URL.Query().Get("source")
+	indexPath := r.URL.Query().Get("path")
+	index := indexing.GetIndex(sourceName)
+	if index == nil {
+		return http.StatusBadRequest, fmt.Errorf("source not found: %s", sourceName)
+	}
+	var body struct {
+		Allow        bool   `json:"allow"`
+		RuleCategory string `json:"ruleCategory"`
+		Value        string `json:"value"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		return http.StatusBadRequest, fmt.Errorf("invalid request body: %w", err)
+	}
+
+	if indexPath == "" || body.RuleCategory == "" || (body.RuleCategory != "all" && body.Value == "") {
+		return http.StatusBadRequest, fmt.Errorf("path, ruleCategory, and value are required, unless ruleCategory is 'all'")
+	}
+	var err error
+	if body.Allow {
+		switch body.RuleCategory {
+		case "user":
+			err = store.Access.AllowUser(index.Path, indexPath, body.Value)
+		case "group":
+			err = store.Access.AllowGroup(index.Path, indexPath, body.Value)
+		default:
+			return http.StatusBadRequest, fmt.Errorf("invalid ruleCategory: must be 'user' or 'group'")
+		}
+	} else {
+		switch body.RuleCategory {
+		case "user":
+			err = store.Access.DenyUser(index.Path, indexPath, body.Value)
+		case "group":
+			err = store.Access.DenyGroup(index.Path, indexPath, body.Value)
+		case "all":
+			err = store.Access.DenyAll(index.Path, indexPath)
+		default:
+			return http.StatusBadRequest, fmt.Errorf("invalid ruleCategory: must be 'user', 'group', or 'all'")
+		}
+	}
+	if err != nil {
+		logger.Errorf("failed to add or update rule: %v", err)
+		return http.StatusInternalServerError, fmt.Errorf("failed to add or update rule: %w", err)
+	}
+	return renderJSON(w, r, map[string]string{"message": "rule added or updated"})
+}
+
+// accessDeleteHandler deletes a single user or group from a rule.
+// @Summary Delete access rule entry
+// @Description Delete a user or group from an allow or deny list for a sourcePath and indexPath.
+// @Tags Access
+// @Accept json
+// @Produce json
+// @Param source query string true "Source path prefix (e.g. mnt/storage)"
+// @Param path query string true "Index path (e.g. /secret)"
+// @Param ruleType query string true "Rule type (allow or deny)"
+// @Param ruleCategory query string true "Rule category (user or group)"
+// @Param value query string true "Username or groupname to remove"
+// @Success 200 {object} map[string]string "Rule entry deleted"
+// @Failure 404 {object} map[string]string "Not found"
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/access [delete]
+func accessDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	sourceName := r.URL.Query().Get("source")
+	indexPath := r.URL.Query().Get("path")
+	index := indexing.GetIndex(sourceName)
+	if index == nil {
+		return 500, fmt.Errorf("source not found: %s", sourceName)
+	}
+
+	ruleType := r.URL.Query().Get("ruleType")
+	ruleCategory := r.URL.Query().Get("ruleCategory")
+	value := r.URL.Query().Get("value")
+	allow := ruleType == "allow"
+
+	if indexPath == "" || ruleCategory == "" || (ruleCategory != "all" && value == "") {
+		return http.StatusBadRequest, fmt.Errorf("path, ruleCategory, and value are required, unless ruleCategory is 'all'")
+	}
+
+	var found bool
+	var err error
+	if allow {
+		switch ruleCategory {
+		case "user":
+			found, err = store.Access.RemoveAllowUser(index.Path, indexPath, value)
+		case "group":
+			found, err = store.Access.RemoveAllowGroup(index.Path, indexPath, value)
+		}
+	} else {
+		switch ruleCategory {
+		case "user":
+			found, err = store.Access.RemoveDenyUser(index.Path, indexPath, value)
+		case "group":
+			found, err = store.Access.RemoveDenyGroup(index.Path, indexPath, value)
+		case "all":
+			found, err = store.Access.RemoveDenyAll(index.Path, indexPath)
+		}
+	}
+	if !found {
+		if err != nil {
+			logger.Errorf("failed to remove rule entry: %v", err)
+		}
+		return http.StatusNotFound, fmt.Errorf("entry not found in rule")
+	}
+
+	return renderJSON(w, r, map[string]string{"message": "rule entry deleted"})
+}
+
+// groupGetHandler retrieves all groups or groups for a specific user.
+// @Summary Get all groups or groups for a user
+// @Description Returns a list of all groups or the groups for a specific user.
+// @Tags Access
+// @Accept json
+// @Produce json
+// @Param user query string false "User name"
+// @Success 200 {object} GroupListResponse "Object containing a list of groups"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /api/access/groups [get]
+func groupGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !d.user.Permissions.Admin {
+		return http.StatusForbidden, nil
+	}
+	user := r.URL.Query().Get("user")
+	if user != "" {
+		groups := store.Access.GetUserGroups(user)
+		return renderJSON(w, r, &GroupListResponse{Groups: groups})
+	}
+	groups := store.Access.GetAllGroups()
+	return renderJSON(w, r, &GroupListResponse{Groups: groups})
+}
+
+// groupPostHandler adds a user to a group.
+// @Summary Add a user to a group
+// @Description Adds a user to a group.
+// @Tags Access
+// @Accept json
+// @Produce json
+// @Param group query string true "Group name"
+// @Param user query string true "User name"
+// @Success 200 "User added to group successfully"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Failure 500 {object} map[string]string "Internal Server Error"
+// @Router /api/access/group [post]
+func groupPostHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !d.user.Permissions.Admin {
+		return http.StatusForbidden, nil
+	}
+	group := r.URL.Query().Get("group")
+	user := r.URL.Query().Get("user")
+	err := store.Access.AddUserToGroup(group, user)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	return http.StatusOK, nil
+}
+
+// groupDeleteHandler removes a user from a group.
+// @Summary Remove a user from a group
+// @Description Removes a user from a group.
+// @Tags Access
+// @Accept json
+// @Produce json
+// @Param group query string true "Group name"
+// @Param user query string true "User name"
+// @Success 200 "User removed from group successfully"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Failure 500 {object} map[string]string "Internal Server Error"
+// @Router /api/access/group [delete]
+func groupDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !d.user.Permissions.Admin {
+		return http.StatusForbidden, nil
+	}
+	group := r.URL.Query().Get("group")
+	user := r.URL.Query().Get("user")
+	err := store.Access.RemoveUserFromGroup(group, user)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	return http.StatusOK, nil
+}
@@ -76,10 +76,12 @@ func setupProxyUser(r *http.Request, data *requestContext, proxyUser string) (*u
 			return nil, err
 		}
 		if config.Auth.Methods.ProxyAuth.CreateUser {
-			err = storage.CreateUser(users.User{
+			user := users.User{
 				LoginMethod: users.LoginMethodProxy,
 				Username:    proxyUser,
-			}, false)
+			}
+			settings.ApplyUserDefaults(&user)
+			err = storage.CreateUser(user)
 			if err != nil {
 				return nil, err
 			}
@@ -194,7 +196,8 @@ func signupHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 		},
 		LoginMethod: users.LoginMethodPassword,
 	}
-	err = storage.CreateUser(user, false)
+	user.Permissions = settings.Config.UserDefaults.Permissions
+	err = storage.CreateUser(user)
 	if err != nil {
 		logger.Debug(err.Error())
 		w.WriteHeader(http.StatusConflict)
@@ -71,7 +71,11 @@ func sseHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int,
 				return http.StatusInternalServerError, fmt.Errorf("error sending broadcast: %v, user: %s", err, username)
 			}

-		case msg := <-sendChan:
+		case msg, ok := <-sendChan:
+			if !ok {
+				logger.Debugf("SSE channel closed for user: %s, SessionId: %s", username, sessionId)
+				return http.StatusOK, nil
+			}
 			if err := msgr.sendEvent(msg.EventType, msg.Message); err != nil {
 				return http.StatusInternalServerError, fmt.Errorf("error sending targeted message: %v, user: %s", err, username)
 			}
@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/tls"
 	"embed"
+	"encoding/json"
 	"fmt"
 	"io/fs"
 	"net/http"
@@ -13,7 +14,8 @@ import (

 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
+	"github.com/gtsteffaniak/filebrowser/backend/events"
 	"github.com/gtsteffaniak/go-logger/logger"
 	// http-swagger middleware
 )
@@ -23,9 +25,6 @@ import (
 //go:embed embed/*
 var assets embed.FS

-// Boolean flag to determine whether to use the embedded FS or not
-var embeddedFS = os.Getenv("FILEBROWSER_NO_EMBEDED") != "true"
-
 // Custom dirFS to handle both embedded and non-embedded file systems
 type dirFS struct {
 	http.Dir
@@ -37,16 +36,26 @@ func (d dirFS) Open(name string) (fs.File, error) {
 }

 var (
-	store  *storage.Storage
-	config *settings.Settings
-	//fileCache diskcache.Interface
+	store   *bolt.BoltStore
+	config  *settings.Settings
 	assetFs fs.FS
 )

-func StartHttp(ctx context.Context, storage *storage.Storage, shutdownComplete chan struct{}) {
+func StartHttp(ctx context.Context, storage *bolt.BoltStore, shutdownComplete chan struct{}) {
 	store = storage
 	config = &settings.Config
-	var err error
+
+	// Dev mode enables development features like template hot-reloading
+	devMode := os.Getenv("FILEBROWSER_DEVMODE") == "true"
+	_, err := os.Stat("http/dist")
+	// In dev mode, always use filesystem assets. Otherwise, check if http/dist exists
+	var embeddedFS bool
+	if devMode {
+		embeddedFS = false
+	} else {
+		embeddedFS = os.IsNotExist(err)
+	}
+
 	// --- START: ADD THIS DECRYPTION LOGIC ---
 	if embeddedFS {
 		// Embedded mode: Serve files from the embedded assets
@@ -58,13 +67,27 @@ func StartHttp(ctx context.Context, storage *storage.Storage, shutdownComplete c
 		assetFs = dirFS{Dir: http.Dir("http/dist")}
 	}

+	// In development mode, we want to reload the templates on each request.
+	// In production (embedded), we parse them once.
+	templates := template.New("").Funcs(template.FuncMap{
+		"marshal": func(v interface{}) (string, error) {
+			a, err := json.Marshal(v)
+			return string(a), err
+		},
+	})
+	if !devMode {
+		templates = template.Must(templates.ParseFS(assetFs, "public/index.html"))
+	}
 	templateRenderer = &TemplateRenderer{
-		templates: template.Must(template.ParseFS(assetFs, "public/index.html")),
+		templates: templates,
+		devMode:   devMode,
 	}

 	router := http.NewServeMux()
 	// API group routing
 	api := http.NewServeMux()
+	// Public group routing (new structure)
+	publicRoutes := http.NewServeMux()

 	// User routes
 	api.HandleFunc("GET /users", withUser(userGetHandler))
@@ -94,53 +117,84 @@ func StartHttp(ctx context.Context, storage *storage.Storage, shutdownComplete c
 	api.HandleFunc("PATCH /resources", withUser(resourcePatchHandler))
 	api.HandleFunc("GET /raw", withUser(rawHandler))
 	api.HandleFunc("GET /preview", withUser(previewHandler))
+	api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))
 	if version.Version == "testing" || version.Version == "untracked" {
 		api.HandleFunc("GET /inspectIndex", inspectIndex)
 		api.HandleFunc("GET /mockData", mockData)
 	}
+	// Access routes
+	api.HandleFunc("GET /access", withAdmin(accessGetHandler))
+	api.HandleFunc("POST /access", withAdmin(accessPostHandler))
+	api.HandleFunc("DELETE /access", withAdmin(accessDeleteHandler))
+	api.HandleFunc("GET /access/groups", withAdmin(groupGetHandler))
+	api.HandleFunc("POST /access/group", withAdmin(groupPostHandler))
+	api.HandleFunc("DELETE /access/group", withAdmin(groupDeleteHandler))

-	// Share routes
+	// Share management routes (require permission)
 	api.HandleFunc("GET /shares", withPermShare(shareListHandler))
+	api.HandleFunc("GET /share/direct", withPermShare(shareDirectDownloadHandler))
 	api.HandleFunc("GET /share", withPermShare(shareGetHandler))
 	api.HandleFunc("POST /share", withPermShare(sharePostHandler))
 	api.HandleFunc("DELETE /share", withPermShare(shareDeleteHandler))

-	// Public routes
-	api.HandleFunc("GET /public/publicUser", withoutUser(publicUserGetHandler))
-	api.HandleFunc("GET /public/dl", withHashFile(publicRawHandler))
-	api.HandleFunc("GET /public/share", withHashFile(publicShareHandler))
-	api.HandleFunc("GET /public/preview", withHashFile(publicPreviewHandler))
+	// Create API sub-router for public API endpoints
+	publicAPI := http.NewServeMux()
+	// NEW PUBLIC ROUTES - All publicly accessible endpoints
+	// Public API routes (hash-based authentication)
+	publicAPI.HandleFunc("GET /raw", withHashFile(publicRawHandler))
+	publicAPI.HandleFunc("GET /preview", withHashFile(publicPreviewHandler))
+	publicAPI.HandleFunc("GET /resources", withHashFile(publicShareHandler))
+	publicAPI.HandleFunc("GET /users", withUser(userGetHandler))
+	publicAPI.HandleFunc("POST /onlyoffice/callback", withHashFile(onlyofficeCallbackHandler))
+	publicAPI.HandleFunc("GET /onlyoffice/config", withHashFile(onlyofficeClientConfigGetHandler))

 	// Settings routes
 	api.HandleFunc("GET /settings", withAdmin(settingsGetHandler))
+	api.HandleFunc("GET /settings/config", withAdmin(settingsConfigHandler))

 	// Events routes
 	api.HandleFunc("GET /events", withUser(func(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 		d.ctx = ctx // Pass the parent context to ensure proper shutdown
 		return sseHandler(w, r, d)
 	}))
-
 	// Job routes
 	api.HandleFunc("GET /jobs/{action}/{target}", withUser(getJobsHandler))

 	api.HandleFunc("GET /onlyoffice/config", withUser(onlyofficeClientConfigGetHandler))
 	api.HandleFunc("POST /onlyoffice/callback", withUser(onlyofficeCallbackHandler))
-	api.HandleFunc("GET /onlyoffice/getToken", withUser(onlyofficeGetTokenHandler))

 	api.HandleFunc("GET /search", withUser(searchHandler))
+	// Mount the public API sub-router
+	publicRoutes.Handle("/api/", http.StripPrefix("/api", publicAPI))
+
+	// Mount the route groups
 	apiPath := config.Server.BaseURL + "api"
+	publicPath := config.Server.BaseURL + "public"
 	router.Handle(apiPath+"/", http.StripPrefix(apiPath, api))
+	router.Handle(publicPath+"/", http.StripPrefix(publicPath, publicRoutes))
+
+	// Frontend share route redirect (DEPRECATED - maintain for backwards compatibility)
+	router.HandleFunc(fmt.Sprintf("GET %vshare/", config.Server.BaseURL), withOrWithoutUser(redirectToShare))
+
+	// New frontend share route handler - handle share page and any subpaths
+	publicRoutes.HandleFunc("GET /share/", withOrWithoutUser(indexHandler))

 	// Static and index file handlers
-	router.HandleFunc(fmt.Sprintf("GET %vstatic/", config.Server.BaseURL), staticFilesHandler)
-	router.HandleFunc(config.Server.BaseURL, indexHandler)
+	staticPrefix := config.Server.BaseURL + "static/"
+	router.Handle(staticPrefix, http.StripPrefix(staticPrefix, http.HandlerFunc(staticFilesHandler)))
+	publicRoutes.Handle("GET /static/", http.StripPrefix("/static/", http.HandlerFunc(staticFilesHandler)))

-	// health
+	router.HandleFunc(config.Server.BaseURL, withOrWithoutUser(indexHandler))
 	router.HandleFunc(fmt.Sprintf("GET %vhealth", config.Server.BaseURL), healthHandler)
-
-	// Swagger
 	router.Handle(fmt.Sprintf("%vswagger/", config.Server.BaseURL), withUser(swaggerHandler))

+	// redirect to baseUrl if not root
+	if config.Server.BaseURL != "/" {
+		router.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+			http.Redirect(w, r, config.Server.BaseURL, http.StatusMovedPermanently)
+		})
+	}
+
 	var scheme string
 	port := ""
 	srv := &http.Server{
@@ -202,6 +256,23 @@ func StartHttp(ctx context.Context, storage *storage.Storage, shutdownComplete c
 	<-ctx.Done()
 	logger.Info("Shutting down HTTP server...")

+	// Close all SSE sessions
+	events.Shutdown()
+
+	// Persist in-memory state before shutting down the HTTP server
+	if store != nil {
+		if store.Share != nil {
+			if err := store.Share.Flush(); err != nil {
+				logger.Errorf("Failed to flush share storage: %v", err)
+			}
+		}
+		if store.Access != nil {
+			if err := store.Access.Flush(); err != nil {
+				logger.Errorf("Failed to flush access storage: %v", err)
+			}
+		}
+	}
+
 	// Graceful shutdown with a timeout - 30 seconds, in case downloads are happening
 	shutdownCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
@@ -0,0 +1,83 @@
+package http
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"strconv"
+	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+)
+
+// subtitlesHandler handles subtitle extraction requests
+// @Summary Extract embedded subtitles
+// @Description Extracts embedded subtitle content from video files by stream index and returns raw WebVTT content
+// @Tags Subtitles
+// @Accept json
+// @Produce text/vtt
+// @Param path query string true "Index path to the video file"
+// @Param source query string true "Source name for the desired source"
+// @Param index query int false "Stream index for embedded subtitle extraction, defaults to 0"
+// @Success 200 {string} string "Raw WebVTT subtitle content"
+// @Failure 400 {object} map[string]string "Bad request"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Failure 404 {object} map[string]string "Resource not found"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/media/subtitles [get]
+func subtitlesHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	encodedPath := r.URL.Query().Get("path")
+	source := r.URL.Query().Get("source")
+	indexParam := r.URL.Query().Get("index")
+
+	if indexParam == "" {
+		indexParam = "0" // default to first subtitle stream
+	}
+
+	path, err := url.QueryUnescape(encodedPath)
+	if err != nil {
+		return http.StatusBadRequest, fmt.Errorf("invalid path encoding: %v", err)
+	}
+	source, err = url.QueryUnescape(source)
+	if err != nil {
+		return http.StatusBadRequest, fmt.Errorf("invalid source encoding: %v", err)
+	}
+
+	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, source)
+	if err != nil {
+		return http.StatusForbidden, err
+	}
+
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		return http.StatusNotFound, fmt.Errorf("source %s not found", source)
+	}
+	realPath, _, err := idx.GetRealPath(userscope, path)
+	if err != nil {
+		return http.StatusNotFound, fmt.Errorf("file not found: %v", err)
+	}
+	metadata, exists := idx.GetMetadataInfo(userscope, true)
+	if !exists {
+		return http.StatusNotFound, fmt.Errorf("file not found: %v", err)
+	}
+
+	index, err := strconv.Atoi(indexParam)
+	if err != nil {
+		return http.StatusBadRequest, fmt.Errorf("invalid index parameter: %v", err)
+	}
+	parentDir := filepath.Dir(realPath)
+	subtitle, err := ffmpeg.ExtractSingleSubtitle(realPath, parentDir, index, metadata.ModTime)
+	if err != nil {
+		return http.StatusInternalServerError, fmt.Errorf("failed to extract subtitle: %v", err)
+	}
+	w.Header().Set("Content-Type", "text/vtt; charset=utf-8")
+	w.Header().Set("Content-Disposition", "inline")
+	w.Header().Set("Cache-Control", "private")
+	http.ServeContent(w, r, fmt.Sprintf("%s-%d.vtt", subtitle.Name, index),
+		time.Now(), bytes.NewReader([]byte(subtitle.Content)))
+	return http.StatusOK, nil
+}
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"runtime"
+	"slices"
 	"strings"
 	"time"

@@ -14,6 +15,8 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
@@ -21,12 +24,13 @@ import (
 )

 type requestContext struct {
-	user     *users.User
-	fileInfo iteminfo.ExtendedFileInfo
-	path     string
-	token    string
-	share    *share.Link
-	ctx      context.Context
+	user         *users.User
+	fileInfo     iteminfo.ExtendedFileInfo
+	token        string
+	share        *share.Link
+	shareValid   bool
+	ctx          context.Context
+	MaxBandwidth int
 }

 type HttpResponse struct {
@@ -42,15 +46,22 @@ type handleFunc func(w http.ResponseWriter, r *http.Request, data *requestContex

 // Middleware to handle file requests by hash and pass it to the handler
 func withHashFileHelper(fn handleFunc) handleFunc {
-	return func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
-		path := r.URL.Query().Get("path")
+	return withOrWithoutUserHelper(func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
 		hash := r.URL.Query().Get("hash")
-		// Retrieve the user (using the public user by default)
-		data.user = &users.PublicUser
+		path := r.URL.Query().Get("path")
 		// Get the file link by hash
 		link, err := store.Share.GetByHash(hash)
 		if err != nil {
-			return http.StatusNotFound, fmt.Errorf("share not found")
+			data.share = &share.Link{}
+			return http.StatusNotFound, fmt.Errorf("share hash not found")
+		}
+		if link.DisableAnonymous && data.user.Username == "anonymous" {
+			return http.StatusForbidden, fmt.Errorf("share is not available to anonymous users")
+		}
+		if len(link.AllowedUsernames) > 0 {
+			if !slices.Contains(link.AllowedUsernames, data.user.Username) {
+				return http.StatusForbidden, fmt.Errorf("share is not available to this user")
+			}
 		}
 		data.share = link
 		// Authenticate the share request if needed
@@ -61,32 +72,46 @@ func withHashFileHelper(fn handleFunc) handleFunc {
 				return status, fmt.Errorf("could not authenticate share request")
 			}
 		}
-		data.path = strings.TrimSuffix(link.Path, "/") + "/" + strings.TrimPrefix(path, "/")
-		if path == "" || path == "/" {
-			data.path = link.Path
-		}
-
 		source, ok := config.Server.SourceMap[link.Source]
 		if !ok {
 			return http.StatusNotFound, fmt.Errorf("source not found")
 		}
+		if source.Config.Private {
+			return http.StatusForbidden, fmt.Errorf("the target source is private")
+		}
 		// Get file information with options
+		getContent := r.URL.Query().Get("content") == "true"
+		if link.DisableFileViewer || link.Downloads >= link.DownloadsLimit {
+			getContent = false
+		}
 		file, err := FileInfoFasterFunc(iteminfo.FileOptions{
-			Path:   data.path,
-			Source: source.Name,
-			Modify: false,
-			Expand: true,
+			Path:    utils.JoinPathAsUnix(link.Path, path),
+			Source:  link.Source,
+			Modify:  false,
+			Expand:  true,
+			Content: getContent,
 		})
-		file.Token = link.Token
 		if err != nil {
-			logger.Errorf("error fetching file info for share. hash=%v path=%v error=%v", hash, data.path, err)
+			logger.Errorf("error fetching file info for share. hash=%v path=%v error=%v", hash, path, err)
 			return errToStatus(err), fmt.Errorf("error fetching share from server")
 		}
+		file.Token = link.Token
+		file.Source = ""
+		file.Hash = link.Hash
+		if !link.EnableOnlyOffice || !link.DisableFileViewer {
+			file.OnlyOfficeId = ""
+		}
+		if getContent && file.Content != "" {
+			link.Mu.Lock()
+			link.Downloads++
+			link.Mu.Unlock()
+		}
+		file.Path = "/" + strings.TrimPrefix(strings.TrimPrefix(file.Path, link.Path), "/")
 		// Set the file info in the `data` object
-		data.fileInfo = file
+		data.fileInfo = *file
 		// Call the next handler with the data
 		return fn(w, r, data)
-	}
+	})
 }

 // Middleware to ensure the user is an admin
@@ -100,6 +125,82 @@ func withAdminHelper(fn handleFunc) handleFunc {
 	})
 }

+// withOrWithoutUserHelper is a middleware that tries to authenticate a user.
+// If authentication is successful, the user is added to the request context.
+// If authentication fails, the request continues without a user.
+func withOrWithoutUserHelper(fn handleFunc) handleFunc {
+	return func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
+		var link *share.Link
+		var isShareRequest bool
+		var shareHash string
+
+		hash := r.URL.Query().Get("hash")
+		if hash != "" {
+			// Get the file link by hash
+			isShareRequest = true
+			shareHash = hash
+			link, _ = store.Share.GetByHash(hash)
+		} else {
+			prefix := config.Server.BaseURL + "public/share/"
+			reconstructed := config.Server.BaseURL + "public" + r.URL.Path
+			if strings.HasPrefix(reconstructed, prefix) {
+				remaining := strings.TrimPrefix(reconstructed, prefix)
+				if remaining != "" {
+					if idx := strings.IndexByte(remaining, '/'); idx >= 0 {
+						remaining = remaining[:idx]
+					}
+					if remaining != "" {
+						isShareRequest = true
+						shareHash = remaining
+						var err error
+						link, err = store.Share.GetByHash(remaining)
+						if err != nil {
+							logger.Debugf("error getting share by hash: %v", err)
+						}
+					}
+				}
+			}
+		}
+
+		// If this is a share request, always create a share context (even if invalid)
+		if isShareRequest {
+			if link != nil {
+				data.share = link
+				data.shareValid = true
+			} else {
+				// Create an empty share with just the hash for invalid shares
+				data.share = &share.Link{Hash: shareHash}
+				data.shareValid = false
+			}
+		}
+
+		// Try to authenticate user first
+		status, err := withUserHelper(nil)(w, r, data)
+		if err == nil && status < 400 {
+			if data.share != nil && data.shareValid {
+				if data.user != nil {
+					data.user.CustomTheme = data.share.ShareTheme
+				}
+			}
+			return fn(w, r, data)
+		}
+		// Only fall back to anonymous if authentication actually failed
+		if status == http.StatusUnauthorized || status == http.StatusForbidden {
+			data.user = &users.User{Username: "anonymous"}
+			settings.ApplyUserDefaults(data.user)
+			// If user authentication failed, call the handler without user context
+			// Clear any user data that might have been partially set
+			data.token = ""
+			if data.share != nil && data.shareValid {
+				data.user.CustomTheme = data.share.ShareTheme
+			}
+			// Call the handler function without user context
+			return fn(w, r, data)
+		}
+		return status, fmt.Errorf("could not authenticate request")
+	}
+}
+
 func withoutUserHelper(fn handleFunc) handleFunc {
 	return func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
 		// This middleware is used when no user authentication is required
@@ -158,6 +259,9 @@ func withUserHelper(fn handleFunc) handleFunc {
 				logger.Errorf("no auth: %v", err)
 				return http.StatusInternalServerError, err
 			}
+			if fn == nil {
+				return http.StatusOK, nil
+			}
 			return fn(w, r, data)
 		}
 		proxyUser := r.Header.Get(config.Auth.Methods.ProxyAuth.Header)
@@ -168,6 +272,9 @@ func withUserHelper(fn handleFunc) handleFunc {
 			}
 			data.user = user
 			setUserInResponseWriter(w, data.user)
+			if fn == nil {
+				return http.StatusOK, nil
+			}
 			return fn(w, r, data)
 		}
 		keyFunc := func(token *jwt.Token) (interface{}, error) {
@@ -192,17 +299,20 @@ func withUserHelper(fn handleFunc) handleFunc {
 		// Check if the token is about to expire and send a header to renew it
 		if tk.Expires < time.Now().Add(time.Hour).Unix() {
 			w.Header().Add("X-Renew-Token", "true")
-		}
-
-		// Retrieve the user from the store and store it in the context
+		} // Retrieve the user from the store and store it in the context
 		data.user, err = store.Users.Get(tk.BelongsTo)
 		if err != nil {
+			logger.Errorf("Failed to get user with ID %v: %v", tk.BelongsTo, err)
 			return http.StatusInternalServerError, err
 		}
-
 		setUserInResponseWriter(w, data.user)
-
-		// Call the handler function, passing in the context
+		if data.user.Username == "" {
+			return http.StatusForbidden, errors.ErrUnauthorized
+		}
+		// Call the handler function, passing in the context (or return OK if no handler)
+		if fn == nil {
+			return http.StatusOK, nil
+		}
 		return fn(w, r, data)
 	}
 }
@@ -285,6 +395,10 @@ func withUser(fn handleFunc) http.HandlerFunc {
 	return wrapHandler(withUserHelper(fn))
 }

+func withOrWithoutUser(fn handleFunc) http.HandlerFunc {
+	return wrapHandler(withOrWithoutUserHelper(fn))
+}
+
 func withoutUser(fn handleFunc) http.HandlerFunc {
 	return wrapHandler(withoutUserHelper(fn))
 }
@@ -11,7 +11,6 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
@@ -23,16 +22,10 @@ func setupTestEnv(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	authStore, userStore, shareStore, settingsStore, err := bolt.NewStorage(db)
+	store, err = bolt.NewStorage(db)
 	if err != nil {
 		t.Fatal(err)
 	}
-	store = &storage.Storage{
-		Auth:     authStore,
-		Users:    userStore,
-		Share:    shareStore,
-		Settings: settingsStore,
-	}
 	config = &settings.Config // mocked
 	config.Server.SourceMap = map[string]settings.Source{
 		"/srv": settings.Source{
@@ -50,8 +43,8 @@ func mockFileInfoFaster(t *testing.T) {
 	t.Cleanup(func() { FileInfoFasterFunc = originalFileInfoFaster })

 	// Mock the function to skip execution
-	FileInfoFasterFunc = func(opts iteminfo.FileOptions) (iteminfo.ExtendedFileInfo, error) {
-		return iteminfo.ExtendedFileInfo{
+	FileInfoFasterFunc = func(opts iteminfo.FileOptions) (*iteminfo.ExtendedFileInfo, error) {
+		return &iteminfo.ExtendedFileInfo{
 			FileInfo: iteminfo.FileInfo{
 				Path: opts.Path,
 				ItemInfo: iteminfo.ItemInfo{
@@ -157,8 +150,26 @@ func TestPublicShareHandlerAuthentication(t *testing.T) {
 		{
 			name: "Public share, no auth required",
 			share: &share.Link{
-				Hash:   "public_hash",
-				Source: "/srv",
+				Hash: "public_hash",
+				CommonShare: share.CommonShare{
+					Source: "/srv",
+				},
+			},
+			expectedStatusCode: 0, // zero means 200 on helpers
+		},
+		{
+			name: "Private share, valid password when token exists",
+			share: &share.Link{
+				Hash:         "pw_and_token_hash",
+				UserID:       1,
+				PasswordHash: passwordBcrypt,
+				Token:        "some_random_token",
+				CommonShare: share.CommonShare{
+					Source: "/srv",
+				},
+			},
+			extraHeaders: map[string]string{
+				"X-SHARE-PASSWORD": "password",
 			},
 			expectedStatusCode: 0, // zero means 200 on helpers
 		},
@@ -179,7 +190,9 @@ func TestPublicShareHandlerAuthentication(t *testing.T) {
 				UserID:       1,
 				PasswordHash: passwordBcrypt,
 				Token:        "123",
-				Source:       "/srv",
+				CommonShare: share.CommonShare{
+					Source: "/srv",
+				},
 			},
 			token:              "123",
 			expectedStatusCode: 0, // zero means 200 on helpers
@@ -264,22 +264,23 @@ func oidcCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		logger.Errorf("No valid username found for identifier '%v' in ID token or UserInfo response.", oidcCfg.UserIdentifier)
 		return http.StatusInternalServerError, fmt.Errorf("no valid username found in ID token or UserInfo response from claims")
 	}
-	isAdmin := false // Default to non-admin user
-	if config.Auth.Methods.OidcAuth.AdminGroup != "" {
-		if slices.Contains(userdata.Groups, config.Auth.Methods.OidcAuth.AdminGroup) {
-			isAdmin = true // User is in the admin group, grant admin privileges
-			logger.Debugf("User %s is in admin group %s, granting admin privileges.", loginUsername, config.Auth.Methods.OidcAuth.AdminGroup)
-		}
-	}
+
 	// Proceed to log the user in with the OIDC data
 	// userdata struct now contains info from either verified ID token or UserInfo endpoint
-	return loginWithOidcUser(w, r, loginUsername, isAdmin)
+	return loginWithOidcUser(w, r, loginUsername, userdata.Groups)
 }

 // loginWithOidcUser extracts the username from the user claims (userInfo)
 // based on the configured UserIdentifier and logs the user into the application.
 // It creates a new user if one doesn't exist.
-func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string, isAdmin bool) (int, error) {
+func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string, groups []string) (int, error) {
+	isAdmin := false // Default to non-admin user
+	if config.Auth.Methods.OidcAuth.AdminGroup != "" {
+		if slices.Contains(groups, config.Auth.Methods.OidcAuth.AdminGroup) {
+			isAdmin = true // User is in the admin group, grant admin privileges
+			logger.Debugf("User %s is in admin group %s, granting admin privileges.", username, config.Auth.Methods.OidcAuth.AdminGroup)
+		}
+	}
 	logger.Debugf("Successfully authenticated OIDC username: %s isAdmin: %v", username, isAdmin)
 	// Retrieve the user from the store and store it in the context
 	user, err := store.Users.Get(username)
@@ -291,10 +292,15 @@ func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string,
 			if config.Auth.Methods.OidcAuth.AdminGroup == "" {
 				isAdmin = config.UserDefaults.Permissions.Admin
 			}
-			err = storage.CreateUser(users.User{
-				LoginMethod: users.LoginMethodOidc,
+			user = &users.User{
 				Username:    username,
-			}, isAdmin)
+				LoginMethod: users.LoginMethodOidc,
+			}
+			settings.ApplyUserDefaults(user)
+			if isAdmin {
+				user.Permissions.Admin = true
+			}
+			err = storage.CreateUser(*user)
 			if err != nil {
 				return http.StatusInternalServerError, err
 			}
@@ -307,7 +313,7 @@ func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string,
 		}
 	} else {
 		// update user admin perms
-		if isAdmin != user.Permissions.Admin {
+		if isAdmin != user.Permissions.Admin && config.Auth.Methods.OidcAuth.AdminGroup != "" {
 			user.Permissions.Admin = isAdmin
 			err = store.Users.Update(user, true, "Permissions")
 			if err != nil {
@@ -318,11 +324,17 @@ func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string,
 	if user.LoginMethod != users.LoginMethodOidc {
 		return http.StatusForbidden, errors.ErrWrongLoginMethod
 	}
-	signed, err := makeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), time.Hour*time.Duration(config.Auth.TokenExpirationHours), user.Permissions)
-	if err != nil {
+
+	// Sync OIDC groups with access control system
+	if err = store.Access.SyncUserGroups(username, groups); err != nil {
+		logger.Warningf("failed to sync oidc user %s groups: %v", username, err)
+	}
+	// Generate a signed token for the user
+	signed, err2 := makeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), time.Hour*time.Duration(config.Auth.TokenExpirationHours), user.Permissions)
+	if err2 != nil {
 		// Handle potential errors during token generation
-		if strings.Contains(err.Error(), "key already exists with same name") {
-			return http.StatusConflict, fmt.Errorf("token name conflict: %v", err)
+		if strings.Contains(err2.Error(), "key already exists with same name") {
+			return http.StatusConflict, fmt.Errorf("token name conflict: %v", err2)
 		}
 		return http.StatusInternalServerError, fmt.Errorf("failed to generate authentication token for user %s: %v", username, err)
 	}
@@ -38,61 +38,100 @@ func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d
 	if settings.Config.Integrations.OnlyOffice.Url == "" {
 		return http.StatusInternalServerError, errors.New("only-office integration must be configured in settings")
 	}
-	encodedUrl := r.URL.Query().Get("url")
-	// Decode the URL-encoded path
-	url, err := url.QueryUnescape(encodedUrl)
+
+	// Extract clean parameters from request
+	source := r.URL.Query().Get("source")
+	path := r.URL.Query().Get("path")
+
+	// Validate required parameters
+	if (path == "" || source == "") && d.fileInfo.Hash == "" {
+		logger.Errorf("OnlyOffice callback missing required parameters: source=%s, path=%s", source, path)
+		return http.StatusBadRequest, errors.New("missing required parameters: path + source/hash are required")
+	}
+	themeMode := utils.Ternary(d.user.DarkMode, "dark", "light")
+
+	if d.fileInfo.Hash == "" {
+		// Build file info based on whether this is a share or regular request
+		// Regular user request - need to resolve scope
+		userScope, scopeErr := settings.GetScopeFromSourceName(d.user.Scopes, source)
+		if scopeErr != nil {
+			logger.Errorf("OnlyOffice: source %s not available for user %s: %v", source, d.user.Username, scopeErr)
+			return http.StatusForbidden, fmt.Errorf("source %s is not available", source)
+		}
+		resolvedPath := utils.JoinPathAsUnix(userScope, path)
+		logger.Debugf("OnlyOffice user request: resolved path=%s", resolvedPath)
+
+		fileInfo, err := files.FileInfoFaster(iteminfo.FileOptions{
+			Path:   resolvedPath,
+			Modify: d.user.Permissions.Modify,
+			Source: source,
+			Expand: false,
+		})
+		if err != nil {
+			logger.Errorf("OnlyOffice: failed to get file info for source=%s, path=%s: %v", source, resolvedPath, err)
+			return errToStatus(err), err
+		}
+		d.fileInfo = *fileInfo
+	} else {
+		// is a share, use the file info from the share middleware
+		sourceInfo, ok := settings.Config.Server.SourceMap[d.share.Source]
+		if !ok {
+			logger.Error("OnlyOffice: source from share not found")
+			return http.StatusInternalServerError, fmt.Errorf("source not found for share")
+		}
+		source = sourceInfo.Name
+		// path is index path, so we build from share path
+		path = utils.JoinPathAsUnix(d.share.Path, path)
+		if d.share.EnforceDarkLightMode == "dark" {
+			themeMode = "dark"
+		}
+		if d.share.EnforceDarkLightMode == "light" {
+			themeMode = "light"
+		}
+
+	}
+
+	// Determine file type and editing permissions
+	fileType := getFileExtension(d.fileInfo.Name)
+	canEdit := iteminfo.CanEditOnlyOffice(d.user.Permissions.Modify, fileType)
+	canEditMode := utils.Ternary(canEdit, "edit", "view")
+	if d.fileInfo.Hash != "" {
+		if d.share.EnableOnlyOfficeEditing {
+			canEditMode = "edit"
+		}
+	}
+	// For shares, we need to keep track of the original relative path for the callback URL
+	var callbackPath string
+	if d.fileInfo.Hash != "" {
+		// For shares, use the original path parameter (relative to share)
+		callbackPath = r.URL.Query().Get("path")
+	} else {
+		// For regular requests, use the processed path
+		callbackPath = path
+	}
+
+	// Generate document ID for OnlyOffice
+	documentId, err := getOnlyOfficeId(source, path)
 	if err != nil {
-		return http.StatusBadRequest, fmt.Errorf("invalid path encoding: %v", err)
+		logger.Errorf("OnlyOffice: failed to generate document ID for source=%s, path=%s: %v", source, path, err)
+		return http.StatusNotFound, fmt.Errorf("failed to generate document ID: %v", err)
 	}
-	// get path from url
-	pathParts := strings.Split(url, "/api/raw?files=")
-	origPathParts := strings.Split(encodedUrl, "/api/raw?files=")
-	encodedPath := origPathParts[len(origPathParts)-1]
-	sourceFile := pathParts[len(pathParts)-1]
-	sourceSplit := strings.Split(sourceFile, "::")
-	if len(sourceSplit) != 2 {
-		return http.StatusBadRequest, fmt.Errorf("invalid url path %v", url)
-	}
-	source := sourceSplit[0]
-	path := sourceSplit[1]
-	urlFirst := pathParts[0]
-	if settings.Config.Server.InternalUrl != "" {
-		urlFirst = settings.Config.Server.InternalUrl
-		replacement := strings.Split(url, "/api/raw")[0]
-		url = strings.Replace(url, replacement, settings.Config.Server.InternalUrl, 1)
-	}
-	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, source)
-	if err != nil {
-		return http.StatusForbidden, err
-	}
-	fileInfo, err := files.FileInfoFaster(iteminfo.FileOptions{
-		Path:   utils.JoinPathAsUnix(userscope, path),
-		Modify: d.user.Permissions.Modify,
-		Source: source,
-		Expand: false,
-	})
-	if err != nil {
-		return errToStatus(err), err
-	}
-	id, err := getOnlyOfficeId(source, fileInfo.Path)
-	if err != nil {
-		return http.StatusNotFound, err
-	}
-	split := strings.Split(fileInfo.Name, ".")
-	fileType := split[len(split)-1]
-	theme := "light"
-	if d.user.DarkMode {
-		theme = "dark"
-	}
-	callbackURL := fmt.Sprintf("%v/api/onlyoffice/callback?path=%v&auth=%v", urlFirst, encodedPath, d.token)
+
+	// Build download URL that OnlyOffice server will use
+	downloadURL := buildOnlyOfficeDownloadURL(source, callbackPath, d.fileInfo.Hash, d.token)
+
+	// Build callback URL for OnlyOffice to notify us of changes
+	callbackURL := buildOnlyOfficeCallbackURL(source, callbackPath, d.fileInfo.Hash, d.token)
+
+	// Build OnlyOffice client configuration
 	clientConfig := map[string]interface{}{
 		"document": map[string]interface{}{
 			"fileType": fileType,
-			"key":      id,
-			"title":    fileInfo.Name,
-			"url":      url + "&auth=" + d.token,
+			"key":      documentId,
+			"title":    d.fileInfo.Name,
+			"url":      downloadURL,
 			"permissions": map[string]interface{}{
-				"edit":     d.user.Permissions.Modify,
+				"edit":     canEditMode,
 				"download": true,
 				"print":    true,
 			},
@@ -106,78 +145,194 @@ func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d
 			"customization": map[string]interface{}{
 				"autosave":  true,
 				"forcesave": true,
-				"uiTheme":   theme,
+				"uiTheme":   themeMode,
 			},
 			"lang": d.user.Locale,
-			"mode": "edit",
+			"mode": canEditMode,
 		},
 	}
+
+	// Sign configuration with JWT if secret is configured
 	if settings.Config.Integrations.OnlyOffice.Secret != "" {
 		token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(clientConfig))
 		signature, err := token.SignedString([]byte(settings.Config.Integrations.OnlyOffice.Secret))
 		if err != nil {
-			return http.StatusInternalServerError, fmt.Errorf("failed to sign JWT")
+			logger.Errorf("OnlyOffice: failed to sign JWT: %v", err)
+			return http.StatusInternalServerError, fmt.Errorf("failed to sign configuration")
 		}
 		clientConfig["token"] = signature
 	}
+
 	return renderJSON(w, r, clientConfig)
 }

+// getFileExtension extracts file extension from filename
+func getFileExtension(filename string) string {
+	parts := strings.Split(filename, ".")
+	if len(parts) < 2 {
+		return ""
+	}
+	return parts[len(parts)-1]
+}
+
+// buildOnlyOfficeDownloadURL constructs the download URL that OnlyOffice server will use to fetch the file
+func buildOnlyOfficeDownloadURL(source, path, hash, token string) string {
+	// Determine base URL (internal URL takes priority for OnlyOffice server communication)
+	baseURL := settings.Config.Server.BaseURL
+	if settings.Config.Server.InternalUrl != "" {
+		baseURL = settings.Config.Server.InternalUrl + settings.Config.Server.BaseURL
+	}
+
+	var downloadURL string
+	if hash != "" {
+		// Share download URL - don't expose source name, just use the path relative to share
+		filesParam := url.QueryEscape(path)
+		downloadURL = fmt.Sprintf("%s/public/api/raw?files=%s&hash=%s&token=%s&auth=%s",
+			strings.TrimSuffix(baseURL, "/"), filesParam, hash, token, token)
+	} else {
+		// Regular download URL - include source for non-share requests
+		filesParam := url.QueryEscape(source + "::" + path)
+		downloadURL = fmt.Sprintf("%s/api/raw?files=%s&auth=%s",
+			strings.TrimSuffix(baseURL, "/"), filesParam, token)
+	}
+
+	return downloadURL
+}
+
+// buildOnlyOfficeCallbackURL constructs the callback URL that OnlyOffice server will use to notify us of changes
+func buildOnlyOfficeCallbackURL(source, path, hash, token string) string {
+	baseURL := settings.Config.Server.BaseURL
+	if settings.Config.Server.InternalUrl != "" {
+		baseURL = settings.Config.Server.InternalUrl + settings.Config.Server.BaseURL
+	}
+
+	var callbackURL string
+	if hash != "" {
+		// Share callback URL - use public API and don't expose source, use path relative to share
+		params := url.Values{}
+		params.Set("hash", hash)
+		params.Set("path", path) // This should be the path relative to the share, not the full filesystem path
+		params.Set("auth", token)
+
+		callbackURL = fmt.Sprintf("%s/public/api/onlyoffice/callback?%s",
+			strings.TrimSuffix(baseURL, "/"), params.Encode())
+	} else {
+		// Regular callback URL - include source for non-share requests
+		params := url.Values{}
+		params.Set("source", source)
+		params.Set("path", path)
+		params.Set("auth", token)
+
+		callbackURL = fmt.Sprintf("%s/api/onlyoffice/callback?%s",
+			strings.TrimSuffix(baseURL, "/"), params.Encode())
+	}
+
+	return callbackURL
+}
+
 func onlyofficeCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	// Parse OnlyOffice callback data
 	body, err := io.ReadAll(r.Body)
 	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-	var data OnlyOfficeCallback
-	err = json.Unmarshal(body, &data)
-	if err != nil {
+		logger.Errorf("OnlyOffice callback: failed to read request body: %v", err)
 		return http.StatusInternalServerError, err
 	}

-	encodedPath := r.URL.Query().Get("path")
-	pathParts := strings.Split(encodedPath, "::")
-	if len(pathParts) < 2 {
-		return http.StatusBadRequest, fmt.Errorf("invalid path encoding: %v", err)
-	}
-	source := pathParts[0]
-	// Decode the URL-encoded path
-	path, err := url.QueryUnescape(pathParts[1])
+	var data OnlyOfficeCallback
+	err = json.Unmarshal(body, &data)
 	if err != nil {
-		return http.StatusBadRequest, fmt.Errorf("invalid path encoding: %v", err)
+		logger.Errorf("OnlyOffice callback: failed to parse JSON: %v", err)
+		return http.StatusInternalServerError, err
 	}
+
+	// Extract clean parameters from query string
+	source := r.URL.Query().Get("source")
+	path := r.URL.Query().Get("path")
+
+	// Validate required parameters
+	if (path == "" || source == "") && d.fileInfo.Hash == "" {
+		logger.Errorf("OnlyOffice callback missing required parameters: source=%s, path=%s", source, path)
+		return http.StatusBadRequest, errors.New("missing required parameters: path + source/hash are required")
+	}
+
+	if d.fileInfo.Hash == "" {
+		// Regular user request - need to resolve scope
+		userScope, scopeErr := settings.GetScopeFromSourceName(d.user.Scopes, source)
+		if scopeErr != nil {
+			logger.Errorf("OnlyOffice callback: source %s not available for user %s: %v", source, d.user.Username, scopeErr)
+			return http.StatusForbidden, fmt.Errorf("source %s is not available", source)
+		}
+		path = utils.JoinPathAsUnix(userScope, path)
+	} else {
+		// is a share, use the file info from the share middleware
+		sourceInfo, ok := settings.Config.Server.SourceMap[d.share.Source]
+		if !ok {
+			logger.Error("OnlyOffice: source from share not found")
+			return http.StatusInternalServerError, fmt.Errorf("source not found for share")
+		}
+		source = sourceInfo.Name
+		// path is index path, so we build from share path
+		path = utils.JoinPathAsUnix(d.share.Path, path)
+	}
+	// Handle document closure - clean up document key cache
 	if data.Status == onlyOfficeStatusDocumentClosedWithChanges ||
 		data.Status == onlyOfficeStatusDocumentClosedWithNoChanges {
-		// Refer to only-office documentation
+		// Refer to OnlyOffice documentation:
 		// - https://api.onlyoffice.com/editors/coedit
 		// - https://api.onlyoffice.com/editors/callback
 		//
 		// When the document is fully closed by all editors,
-		// then the document key should no longer be re-used.
+		// the document key should no longer be re-used.
+		logger.Debugf("OnlyOffice: document closed, cleaning up document ID for source=%s, path=%s", source, path)
 		deleteOfficeId(source, path)
 	}

+	// Handle document save operations
 	if data.Status == onlyOfficeStatusDocumentClosedWithChanges ||
 		data.Status == onlyOfficeStatusForceSaveWhileDocumentStillOpen {
+
+		// Verify user has modify permissions
 		if !d.user.Permissions.Modify {
+			logger.Warningf("OnlyOffice callback: user %s lacks modify permissions for source=%s, path=%s",
+				d.user.Username, source, path)
 			return http.StatusForbidden, nil
 		}

+		// Download the updated document from OnlyOffice server
 		doc, err := http.Get(data.URL)
 		if err != nil {
+			logger.Errorf("OnlyOffice callback: failed to download updated document: %v", err)
 			return http.StatusInternalServerError, err
 		}
 		defer doc.Body.Close()

+		// Resolve file path for writing (same logic as in config handler)
+		var resolvedPath string
+		if d.fileInfo.Hash == "" {
+			// Regular user request - need to resolve scope
+			userScope, scopeErr := settings.GetScopeFromSourceName(d.user.Scopes, source)
+			if scopeErr != nil {
+				logger.Errorf("OnlyOffice callback: source %s not available for user %s: %v",
+					source, d.user.Username, scopeErr)
+				return http.StatusForbidden, fmt.Errorf("source %s is not available", source)
+			}
+			resolvedPath = utils.JoinPathAsUnix(userScope, path)
+		}
+
+		// Write the updated document
 		fileOpts := iteminfo.FileOptions{
-			Path:   path,
+			Path:   resolvedPath,
 			Source: source,
 		}
 		writeErr := files.WriteFile(fileOpts, doc.Body)
 		if writeErr != nil {
+			logger.Errorf("OnlyOffice callback: failed to write updated document: %v", writeErr)
 			return http.StatusInternalServerError, writeErr
 		}
+
 	}

+	// Return success response to OnlyOffice server
 	resp := map[string]int{
 		"error": 0,
 	}
@@ -208,29 +363,3 @@ func deleteOfficeId(source, path string) {
 	realpath, _, _ := idx.GetRealPath(path)
 	utils.OnlyOfficeCache.Delete(realpath)
 }
-
-func onlyofficeGetTokenHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	// get config from body
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-	defer r.Body.Close()
-
-	var payload map[string]interface{}
-	// marshall to struct
-	err = json.Unmarshal(body, &payload)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	if settings.Config.Integrations.OnlyOffice.Secret != "" {
-		token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(payload))
-		ss, err := token.SignedString([]byte(settings.Config.Integrations.OnlyOffice.Secret))
-		if err != nil {
-			return 500, errors.New("could not generate a new jwt")
-		}
-		return renderJSON(w, r, map[string]string{"token": ss})
-	}
-	return 400, fmt.Errorf("bad request")
-}
@@ -60,15 +60,17 @@ func previewHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (
 		return http.StatusForbidden, err
 	}
 	fileInfo, err := files.FileInfoFaster(iteminfo.FileOptions{
-		Path:   utils.JoinPathAsUnix(userscope, path),
-		Modify: d.user.Permissions.Modify,
-		Source: source,
-		Expand: true,
+		Access:   store.Access,
+		Username: d.user.Username,
+		Path:     utils.JoinPathAsUnix(userscope, path),
+		Modify:   d.user.Permissions.Modify,
+		Source:   source,
+		Expand:   true,
 	})
 	if err != nil {
 		return errToStatus(err), err
 	}
-	d.fileInfo = fileInfo
+	d.fileInfo = *fileInfo
 	return previewHelperFunc(w, r, d)
 }

@@ -7,10 +7,8 @@ import (
 	"net/url"
 	"strings"

-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"

 	_ "github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
@@ -22,7 +20,7 @@ import (
 // @Tags Resources
 // @Accept json
 // @Produce json
-// @Param files query string true "a list of files in the following format 'filename' and separated by '||' with additional items in the list. (required)"
+// @Param files query string false "if specified, only the files in the list will be downloaded. eg. files=/file1||/folder/file2"
 // @Param inline query bool false "If true, sets 'Content-Disposition' to 'inline'. Otherwise, defaults to 'attachment'."
 // @Param algo query string false "Compression algorithm for archiving multiple files or directories. Options: 'zip' and 'tar.gz'. Default is 'zip'."
 // @Success 200 {file} file "Raw file or directory content, or archive for multiple files"
@@ -32,35 +30,63 @@ import (
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Router /public/dl [get]
 func publicRawHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if d.share.DownloadsLimit > 0 && d.share.Downloads >= d.share.DownloadsLimit {
+		return http.StatusForbidden, fmt.Errorf("share downloads limit reached")
+	}
+	d.share.Mu.Lock()
+	d.share.Downloads++
+	d.share.Mu.Unlock()
 	encodedFiles := r.URL.Query().Get("files")
-	// Decode the URL-encoded path
-	f, err := url.QueryUnescape(encodedFiles)
+
+	// Decode the URL-encoded path - use PathUnescape to preserve + as literal character
+	f, err := url.PathUnescape(encodedFiles)
 	if err != nil {
 		return http.StatusBadRequest, fmt.Errorf("invalid path encoding: %v", err)
 	}

+	// Get the actual source name from the share's source mapping
+	sourceInfo, ok := settings.Config.Server.SourceMap[d.share.Source]
+	if !ok {
+		return http.StatusInternalServerError, fmt.Errorf("source not found for share")
+	}
+	actualSourceName := sourceInfo.Name
+
 	fileList := []string{}
 	for _, file := range strings.Split(f, "||") {
-		fileList = append(fileList, d.fileInfo.Source+"::"+d.fileInfo.Path+file)
+		// Check if file already contains source prefix (source::path format)
+		if strings.Contains(file, "::") {
+			splitFile := strings.SplitN(file, "::", 2)
+			if len(splitFile) == 2 {
+				source := splitFile[0]
+				path := splitFile[1]
+				// Join the share path with the requested path
+				filePath := utils.JoinPathAsUnix(d.share.Path, path)
+				fileList = append(fileList, source+"::"+filePath)
+			} else {
+				// Fallback: treat as plain path
+				filePath := utils.JoinPathAsUnix(d.share.Path, file)
+				fileList = append(fileList, actualSourceName+"::"+filePath)
+			}
+		} else {
+			// Plain path without source prefix - use the actual source name from share
+			filePath := utils.JoinPathAsUnix(d.share.Path, file)
+			fileList = append(fileList, actualSourceName+"::"+filePath)
+		}
 	}
+
 	var status int
 	status, err = rawFilesHandler(w, r, d, fileList)
 	if err != nil {
-		logger.Errorf("public share handler: error processing filelist: %v", err)
+		logger.Errorf("public share handler: error processing filelist: '%v' with error %v", f, err)
 		return status, fmt.Errorf("error processing filelist: %v", f)
 	}
 	return status, nil
 }

 func publicShareHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	d.fileInfo.Path = strings.TrimPrefix(d.fileInfo.Path, d.share.Path)
 	return renderJSON(w, r, d.fileInfo)
 }

-func publicUserGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	return renderJSON(w, r, users.PublicUser)
-}
-
 // health godoc
 // @Summary Health Check
 // @Schemes
@@ -96,27 +122,8 @@ func healthHandler(w http.ResponseWriter, r *http.Request) {
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Router /api/public/preview [get]
 func publicPreviewHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	if config.Server.DisablePreviews {
+	if config.Server.DisablePreviews || d.share.DisableThumbnails {
 		return http.StatusNotImplemented, fmt.Errorf("preview is disabled")
 	}
-	path := r.URL.Query().Get("path")
-	var err error
-	if path == "" {
-		return http.StatusBadRequest, fmt.Errorf("invalid request path")
-	}
-	fileInfo, err := files.FileInfoFaster(iteminfo.FileOptions{
-		Path:   utils.JoinPathAsUnix(d.share.Path, path),
-		Modify: d.user.Permissions.Modify,
-		Source: d.fileInfo.Source,
-		Expand: true,
-	})
-	if err != nil {
-		logger.Debugf("public preview handler: error getting file info: %v", err)
-		return 400, fmt.Errorf("file not found")
-	}
-	if fileInfo.Type == "directory" {
-		return http.StatusBadRequest, fmt.Errorf("can't create preview for directory")
-	}
-	d.fileInfo = fileInfo
 	return previewHelperFunc(w, r, d)
 }
@@ -4,6 +4,7 @@ import (
 	"archive/tar"
 	"archive/zip"
 	"compress/gzip"
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -13,12 +14,49 @@ import (
 	"path/filepath"
 	"strings"

+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
+	"golang.org/x/time/rate"
 )

+// throttledReadSeeker is a wrapper around an io.ReadSeeker that throttles the reading speed.
+type throttledReadSeeker struct {
+	rs      io.ReadSeeker
+	limiter *rate.Limiter
+	ctx     context.Context
+}
+
+// newThrottledReadSeeker creates a new throttledReadSeeker.
+func newThrottledReadSeeker(rs io.ReadSeeker, limit rate.Limit, burst int, ctx context.Context) *throttledReadSeeker {
+	return &throttledReadSeeker{
+		rs:      rs,
+		limiter: rate.NewLimiter(limit, burst),
+		ctx:     ctx,
+	}
+}
+
+func (r *throttledReadSeeker) Read(p []byte) (n int, err error) {
+	n, err = r.rs.Read(p)
+	if n > 0 {
+		if waitErr := r.limiter.WaitN(r.ctx, n); waitErr != nil {
+			// The original error (like io.EOF) is potentially more important
+			// than the context error.
+			if err == nil {
+				err = waitErr
+			}
+		}
+	}
+	return
+}
+
+func (r *throttledReadSeeker) Seek(offset int64, whence int) (int64, error) {
+	return r.rs.Seek(offset, whence)
+}
+
 func setContentDisposition(w http.ResponseWriter, r *http.Request, fileName string) {
 	if r.URL.Query().Get("inline") == "true" {
 		w.Header().Set("Content-Disposition", "inline; filename*=utf-8''"+url.PathEscape(fileName))
@@ -56,24 +94,33 @@ func addFile(path string, d *requestContext, tarWriter *tar.Writer, zipWriter *z
 	}
 	source := splitFile[0]
 	path = splitFile[1]
+
 	var err error
-	userScope := "/"
-	if d.user.Username != "publicUser" {
+	if d.share == nil {
+		var userScope string
 		userScope, err = settings.GetScopeFromSourceName(d.user.Scopes, source)
-		if d.share == nil && err != nil {
+		if err != nil {
 			return fmt.Errorf("source %s is not available for user %s", source, d.user.Username)
 		}
+		path = utils.JoinPathAsUnix(userScope, path)
 	}
+	// For shares, the path is already correctly resolved by publicRawHandler

 	idx := indexing.GetIndex(source)
 	if idx == nil {
 		return fmt.Errorf("source %s is not available", source)
 	}
-
-	realPath, _, err := idx.GetRealPath(userScope, path)
+	_, err = files.FileInfoFaster(iteminfo.FileOptions{
+		Access:   store.Access,
+		Username: d.user.Username,
+		Path:     path,
+		Source:   source,
+		Expand:   false,
+	})
 	if err != nil {
-		return fmt.Errorf("failed to get real path for %s: %v", path, err)
+		return err
 	}
+	realPath, _, _ := idx.GetRealPath(path)
 	info, err := os.Stat(realPath)
 	if err != nil {
 		return err
@@ -127,15 +174,20 @@ func addFile(path string, d *requestContext, tarWriter *tar.Writer, zipWriter *z
 			}
 			return addSingleFile(filePath, relPath, zipWriter, tarWriter)
 		})
+	} else {
+		// For a single file, use the base name as the archive path
+		return addSingleFile(realPath, baseName, zipWriter, tarWriter)
 	}
-
-	// For a single file, use the base name as the archive path
-	return addSingleFile(realPath, baseName, zipWriter, tarWriter)
 }

 func addSingleFile(realPath, archivePath string, zipWriter *zip.Writer, tarWriter *tar.Writer) error {
 	file, err := os.Open(realPath)
 	if err != nil {
+		// If we get "is a directory" error, this is likely a symlink to a directory
+		// that wasn't properly detected. Skip it gracefully.
+		if strings.Contains(err.Error(), "is a directory") {
+			return nil
+		}
 		return err
 	}
 	defer file.Close()
@@ -145,6 +197,11 @@ func addSingleFile(realPath, archivePath string, zipWriter *zip.Writer, tarWrite
 		return err
 	}

+	// Double-check if this is actually a directory (in case of symlinks)
+	if info.IsDir() {
+		return nil
+	}
+
 	if tarWriter != nil {
 		header, err := tar.FileInfoHeader(info, "")
 		if err != nil {
@@ -185,19 +242,21 @@ func rawFilesHandler(w http.ResponseWriter, r *http.Request, d *requestContext,
 	firstFilePath := splitFile[1]
 	// decode url encoded source name
 	var err error
+	var userscope string
 	fileName := filepath.Base(firstFilePath)
-	userscope := "/"
-	if d.user.Username != "publicUser" {
+	if d.share == nil {
 		userscope, err = settings.GetScopeFromSourceName(d.user.Scopes, firstFileSource)
 		if err != nil {
 			return http.StatusForbidden, err
 		}
+		firstFilePath = utils.JoinPathAsUnix(userscope, firstFilePath)
 	}
+	// For shares, the path is already correctly resolved by publicRawHandler
 	idx := indexing.GetIndex(firstFileSource)
 	if idx == nil {
 		return http.StatusInternalServerError, fmt.Errorf("source %s is not available", firstFileSource)
 	}
-	realPath, isDir, err := idx.GetRealPath(userscope, firstFilePath)
+	realPath, isDir, err := idx.GetRealPath(firstFilePath)
 	if err != nil {
 		return http.StatusInternalServerError, err
 	}
@@ -232,7 +291,15 @@ func rawFilesHandler(w http.ResponseWriter, r *http.Request, d *requestContext,
 		}
 		// serve content allows for range requests.
 		// video scrubbing, etc.
-		http.ServeContent(w, r, fileName, fileInfo.ModTime(), fd)
+		var reader io.ReadSeeker = fd
+		if d.share != nil && d.share.MaxBandwidth > 0 {
+			// convert KB/s to B/s
+			limit := rate.Limit(d.share.MaxBandwidth * 1024)
+			// burst size can be the same as limit
+			burst := d.share.MaxBandwidth * 1024
+			reader = newThrottledReadSeeker(fd, limit, burst, r.Context())
+		}
+		http.ServeContent(w, r, fileName, fileInfo.ModTime(), reader)
 		return 200, nil
 	}

@@ -300,7 +367,15 @@ func rawFilesHandler(w http.ResponseWriter, r *http.Request, d *requestContext,
 	w.Header().Set("Content-Type", "application/octet-stream")

 	// Stream the file
-	_, err = io.Copy(w, fd)
+	var reader io.Reader = fd
+	if d.share != nil && d.share.MaxBandwidth > 0 {
+		// convert KB/s to B/s
+		limit := rate.Limit(d.share.MaxBandwidth * 1024)
+		// burst size can be the same as limit
+		burst := d.share.MaxBandwidth * 1024
+		reader = newThrottledReadSeeker(fd, limit, burst, r.Context())
+	}
+	_, err = io.Copy(w, reader)
 	os.Remove(archiveData) // Remove the file after streaming
 	if err != nil {
 		logger.Errorf("Failed to copy archive data to response: %v", err)
@@ -324,14 +399,16 @@ func computeArchiveSize(fileList []string, d *requestContext) (int64, error) {
 		if idx == nil {
 			return 0, fmt.Errorf("source %s is not available", source)
 		}
-		userScope := "/"
-		if d.user.Username != "publicUser" {
+		var userScope string
+		if d.share == nil {
 			userScope, err = settings.GetScopeFromSourceName(d.user.Scopes, source)
-			if d.share == nil && err != nil {
+			if err != nil {
 				return 0, fmt.Errorf("source %s is not available for user %s", source, d.user.Username)
 			}
+			path = utils.JoinPathAsUnix(userScope, path)
 		}
-		realPath, isDir, err := idx.GetRealPath(userScope, path)
+		// For shares, the path is already correctly resolved by publicRawHandler
+		realPath, isDir, err := idx.GetRealPath(path)
 		if err != nil {
 			return http.StatusInternalServerError, err
 		}
@@ -15,6 +15,7 @@ import (
 	"strings"

 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
@@ -24,6 +25,35 @@ import (
 	"github.com/gtsteffaniak/go-logger/logger"
 )

+// validateMoveOperation checks if a move/rename operation is valid at the HTTP level
+// It prevents moving a directory into itself or its subdirectories
+func validateMoveOperation(src, dst string, isSrcDir bool) error {
+	// Clean and normalize paths
+	src = filepath.Clean(src)
+	dst = filepath.Clean(dst)
+
+	// If source is a directory, check if destination is within source
+	if isSrcDir {
+		// Get the parent directory of the destination
+		dstParent := filepath.Dir(dst)
+
+		// Check if destination parent is the source directory or a subdirectory of it
+		if strings.HasPrefix(dstParent+string(filepath.Separator), src+string(filepath.Separator)) || dstParent == src {
+			return fmt.Errorf("cannot move directory '%s' to a location within itself: '%s'", src, dst)
+		}
+	}
+
+	// Check if destination parent directory exists
+	dstParent := filepath.Dir(dst)
+	if dstParent != "." && dstParent != "/" {
+		if _, err := os.Stat(dstParent); os.IsNotExist(err) {
+			return fmt.Errorf("destination directory does not exist: '%s'", dstParent)
+		}
+	}
+
+	return nil
+}
+
 // resourceGetHandler retrieves information about a resource.
 // @Summary Get resource information
 // @Description Returns metadata and optionally file contents for a specified resource path.
@@ -55,12 +85,18 @@ func resourceGetHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 		return http.StatusForbidden, err
 	}
 	scopePath := utils.JoinPathAsUnix(userscope, path)
+	getContent := r.URL.Query().Get("content") == "true"
+	if d.share != nil && d.share.DisableFileViewer {
+		getContent = false
+	}
 	fileInfo, err := files.FileInfoFaster(iteminfo.FileOptions{
-		Path:    scopePath,
-		Modify:  d.user.Permissions.Modify,
-		Source:  source,
-		Expand:  true,
-		Content: r.URL.Query().Get("content") == "true",
+		Access:   store.Access,
+		Username: d.user.Username,
+		Path:     scopePath,
+		Modify:   d.user.Permissions.Modify,
+		Source:   source,
+		Expand:   true,
+		Content:  getContent,
 	})
 	if err != nil {
 		return errToStatus(err), err
@@ -128,17 +164,19 @@ func resourceDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestCon
 		return http.StatusForbidden, err
 	}
 	fileInfo, err := files.FileInfoFaster(iteminfo.FileOptions{
-		Path:   utils.JoinPathAsUnix(userscope, path),
-		Source: source,
-		Modify: d.user.Permissions.Modify,
-		Expand: false,
+		Access:   store.Access,
+		Username: d.user.Username,
+		Path:     utils.JoinPathAsUnix(userscope, path),
+		Source:   source,
+		Modify:   d.user.Permissions.Modify,
+		Expand:   false,
 	})
 	if err != nil {
 		return errToStatus(err), err
 	}

 	// delete thumbnails
-	preview.DelThumbs(r.Context(), fileInfo)
+	preview.DelThumbs(r.Context(), *fileInfo)

 	err = files.DeleteFiles(source, fileInfo.RealPath, filepath.Dir(fileInfo.RealPath))
 	if err != nil {
@@ -188,18 +226,22 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		return http.StatusForbidden, err
 	}
 	fileOpts := iteminfo.FileOptions{
-		Path:   utils.JoinPathAsUnix(userscope, path),
-		Source: source,
-		Modify: d.user.Permissions.Modify,
-		Expand: false,
+		Access:   store.Access,
+		Username: d.user.Username,
+		Path:     utils.JoinPathAsUnix(userscope, path),
+		Source:   source,
+		Modify:   d.user.Permissions.Modify,
+		Expand:   false,
 	}
 	idx := indexing.GetIndex(source)
 	if idx == nil {
+		logger.Debugf("source %s not found", source)
 		return http.StatusNotFound, fmt.Errorf("source %s not found", source)
 	}
 	realPath, _, _ := idx.GetRealPath(userscope, path)
+	isDir := strings.HasSuffix(path, "/")
 	// Directories creation on POST.
-	if strings.HasSuffix(path, "/") {
+	if isDir {
 		err = files.WriteDirectory(fileOpts)
 		if err != nil {
 			logger.Debugf("error writing directory: %v", err)
@@ -214,6 +256,7 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		var offset int64
 		offset, err = strconv.ParseInt(chunkOffsetStr, 10, 64)
 		if err != nil {
+			logger.Debugf("invalid chunk offset: %v", err)
 			return http.StatusBadRequest, fmt.Errorf("invalid chunk offset: %v", err)
 		}

@@ -221,19 +264,21 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		totalSizeStr := r.Header.Get("X-File-Total-Size")
 		totalSize, err = strconv.ParseInt(totalSizeStr, 10, 64)
 		if err != nil {
+			logger.Debugf("invalid total size: %v", err)
 			return http.StatusBadRequest, fmt.Errorf("invalid total size: %v", err)
 		}
 		// On the first chunk, check for conflicts or handle override
 		if offset == 0 {
-			var fileInfo iteminfo.ExtendedFileInfo
+			var fileInfo *iteminfo.ExtendedFileInfo
 			fileInfo, err = files.FileInfoFaster(fileOpts)
 			if err == nil { // File exists
 				if r.URL.Query().Get("override") != "true" {
+					logger.Debugf("resource already exists: %v", fileInfo.RealPath)
 					logger.Debugf("Resource already exists: %v", fileInfo.RealPath)
 					return http.StatusConflict, nil
 				}
 				// If overriding, delete existing thumbnails
-				preview.DelThumbs(r.Context(), fileInfo)
+				preview.DelThumbs(r.Context(), *fileInfo)
 			}
 		}

@@ -245,12 +290,14 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		tempFilePath := filepath.Join(settings.Config.Server.CacheDir, "uploads", uploadID)

 		if err = os.MkdirAll(filepath.Dir(tempFilePath), 0755); err != nil {
+			logger.Debugf("could not create temp dir: %v", err)
 			return http.StatusInternalServerError, fmt.Errorf("could not create temp dir: %v", err)
 		}
 		// Create or open the temporary file
 		var outFile *os.File
 		outFile, err = os.OpenFile(tempFilePath, os.O_CREATE|os.O_WRONLY, 0644)
 		if err != nil {
+			logger.Debugf("could not open temp file: %v", err)
 			return http.StatusInternalServerError, fmt.Errorf("could not open temp file: %v", err)
 		}
 		defer outFile.Close()
@@ -258,6 +305,7 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		// Seek to the correct offset to write the chunk
 		_, err = outFile.Seek(offset, 0)
 		if err != nil {
+			logger.Debugf("could not seek in temp file: %v", err)
 			return http.StatusInternalServerError, fmt.Errorf("could not seek in temp file: %v", err)
 		}

@@ -265,47 +313,26 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		var chunkSize int64
 		chunkSize, err = io.Copy(outFile, r.Body)
 		if err != nil {
+			logger.Debugf("could not write chunk to temp file: %v", err)
 			return http.StatusInternalServerError, fmt.Errorf("could not write chunk to temp file: %v", err)
 		}
 		// check if the file is complete
 		if (offset + chunkSize) >= totalSize {
-			// close file before renaming
+			// close file before moving
 			outFile.Close()
-
 			// Move the completed file from the temp location to the final destination
-			err = os.Rename(tempFilePath, fileOpts.Path)
+			err = fileutils.MoveFile(tempFilePath, realPath)
 			if err != nil {
-				// If rename fails (e.g., cross-device link), fall back to copy and delete.
-				var in *os.File
-				in, err = os.Open(tempFilePath)
-				if err != nil {
-					return http.StatusInternalServerError, fmt.Errorf("could not open temp file for copying: %v", err)
-				}
-				defer in.Close()
-				var out *os.File
-				out, err = os.Create(realPath)
-				if err != nil {
-					return http.StatusInternalServerError, fmt.Errorf("could not create destination file for copying: %v", err)
-				}
-				defer out.Close()
-
-				if _, err = io.Copy(out, in); err != nil {
-					return http.StatusInternalServerError, fmt.Errorf("could not copy temp file to destination: %v", err)
-				}
-
-				// Manually close files before removing source
-				in.Close()
-				out.Close()
-
-				if err = os.Remove(tempFilePath); err != nil {
-					logger.Errorf("failed to remove temporary upload file: %s", tempFilePath)
-				}
+				logger.Debugf("could not move temp file to destination: %v", err)
+				return http.StatusInternalServerError, fmt.Errorf("could not move temp file to destination: %v", err)
 			}
+			go files.RefreshIndex(source, realPath, false) //nolint:errcheck
 		}

 		return http.StatusOK, nil
 	}

+	logger.Debugf("non-chunked upload logic for %s", realPath)
 	// Non-chunked upload logic (original code)
 	fileInfo, err := files.FileInfoFaster(fileOpts)
 	if err == nil {
@@ -314,7 +341,7 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 			return http.StatusConflict, nil
 		}

-		preview.DelThumbs(r.Context(), fileInfo)
+		preview.DelThumbs(r.Context(), *fileInfo)
 	}
 	err = files.WriteFile(fileOpts, r.Body)
 	if err != nil {
@@ -366,10 +393,12 @@ func resourcePutHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 		return http.StatusForbidden, err
 	}
 	fileOpts := iteminfo.FileOptions{
-		Path:   utils.JoinPathAsUnix(userscope, path),
-		Source: source,
-		Modify: d.user.Permissions.Modify,
-		Expand: false,
+		Access:   store.Access,
+		Username: d.user.Username,
+		Path:     utils.JoinPathAsUnix(userscope, path),
+		Source:   source,
+		Modify:   d.user.Permissions.Modify,
+		Expand:   false,
 	}
 	err = files.WriteFile(fileOpts, r.Body)
 	return errToStatus(err), err
@@ -442,7 +471,7 @@ func resourcePatchHandler(w http.ResponseWriter, r *http.Request, d *requestCont
 		return http.StatusNotFound, fmt.Errorf("source %s not found", dstIndex)
 	}
 	// check target dir exists
-	parentDir, _, err := idx.GetRealPath(userscopeDst, filepath.Dir(dst))
+	parentDir, isDstDir, err := idx.GetRealPath(userscopeDst, filepath.Dir(dst))
 	if err != nil {
 		logger.Debugf("Could not get real path for parent dir: %v %v %v", userscopeDst, filepath.Dir(dst), err)
 		return http.StatusNotFound, err
@@ -467,7 +496,24 @@ func resourcePatchHandler(w http.ResponseWriter, r *http.Request, d *requestCont
 	if overwrite && !d.user.Permissions.Modify {
 		return http.StatusForbidden, fmt.Errorf("forbidden: user does not have permission to overwrite file")
 	}
-	err = patchAction(r.Context(), action, realSrc, realDest, d, isSrcDir, srcIndex, dstIndex)
+
+	// Validate move/rename operation to prevent circular references
+	if action == "rename" || action == "move" {
+		if err = validateMoveOperation(realSrc, realDest, isSrcDir); err != nil {
+			return http.StatusBadRequest, err
+		}
+	}
+
+	err = patchAction(r.Context(), patchActionParams{
+		action:   action,
+		srcIndex: srcIndex,
+		dstIndex: dstIndex,
+		src:      realSrc,
+		dst:      realDest,
+		d:        d,
+		isSrcDir: isSrcDir,
+		isDstDir: isDstDir,
+	})
 	if err != nil {
 		logger.Debugf("Could not run patch action. src=%v dst=%v err=%v", realSrc, realDest, err)
 	}
@@ -490,19 +536,32 @@ func addVersionSuffix(source string) string {
 	return source
 }

-func patchAction(ctx context.Context, action, src, dst string, d *requestContext, isSrcDir bool, srcIndex, destIndex string) error {
-	switch action {
+type patchActionParams struct {
+	action   string
+	srcIndex string
+	dstIndex string
+	src      string
+	dst      string
+	d        *requestContext
+	isSrcDir bool
+	isDstDir bool
+}
+
+func patchAction(ctx context.Context, params patchActionParams) error {
+	switch params.action {
 	case "copy":
-		err := files.CopyResource(srcIndex, destIndex, src, dst)
+		err := files.CopyResource(params.isSrcDir, params.isDstDir, params.srcIndex, params.dstIndex, params.src, params.dst)
 		return err
 	case "rename", "move":
-		idx := indexing.GetIndex(srcIndex)
-		srcPath := idx.MakeIndexPath(src)
+		idx := indexing.GetIndex(params.srcIndex)
+		srcPath := idx.MakeIndexPath(params.src)
 		fileInfo, err := files.FileInfoFaster(iteminfo.FileOptions{
+			Access:     store.Access,
+			Username:   params.d.user.Username,
 			Path:       srcPath,
-			Source:     srcIndex,
-			IsDir:      isSrcDir,
-			Modify:     d.user.Permissions.Modify,
+			Source:     params.srcIndex,
+			IsDir:      params.isSrcDir,
+			Modify:     params.d.user.Permissions.Modify,
 			Expand:     false,
 			ReadHeader: false,
 		})
@@ -512,10 +571,10 @@ func patchAction(ctx context.Context, action, src, dst string, d *requestContext
 		}

 		// delete thumbnails
-		preview.DelThumbs(ctx, fileInfo)
-		return files.MoveResource(srcIndex, destIndex, src, dst)
+		preview.DelThumbs(ctx, *fileInfo)
+		return files.MoveResource(params.isSrcDir, params.isDstDir, params.srcIndex, params.dstIndex, params.src, params.dst, store.Share)
 	default:
-		return fmt.Errorf("unsupported action %s: %w", action, errors.ErrInvalidRequestParams)
+		return fmt.Errorf("unsupported action %s: %w", params.action, errors.ErrInvalidRequestParams)
 	}
 }

@@ -542,6 +601,6 @@ func mockData(w http.ResponseWriter, r *http.Request) {
 	if err != nil || err2 != nil {
 		return
 	}
-	mockDir := utils.CreateMockData(NumDirs, numFiles)
+	mockDir := indexing.CreateMockData(NumDirs, numFiles)
 	renderJSON(w, r, mockDir) // nolint:errcheck
 }
@@ -64,6 +64,9 @@ func searchHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 	if err != nil {
 		return http.StatusBadRequest, fmt.Errorf("invalid path encoding: %v", err)
 	}
+	if len(query) < settings.Config.Server.MinSearchLength {
+		return http.StatusBadRequest, fmt.Errorf("query is too short, minimum length is %d", settings.Config.Server.MinSearchLength)
+	}
 	searchScope := strings.TrimPrefix(unencodedScope, ".")
 	// Retrieve the User-Agent and X-Auth headers from the request
 	sessionId := r.Header.Get("SessionId")
@@ -2,6 +2,8 @@ package http

 import (
 	"net/http"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 )

 // settingsGetHandler retrieves the current system settings.
@@ -34,3 +36,36 @@ func settingsGetHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 	}
 	return renderJSON(w, r, config)
 }
+
+// settingsConfigHandler returns the current system settings as YAML.
+// @Summary Get system settings as YAML
+// @Description Returns the current running configuration settings as YAML format with optional comments and filtering.
+// @Tags Settings
+// @Accept json
+// @Produce text/plain
+// @Param full query boolean false "Show all values (true) or only non-default values (false, default)"
+// @Param comments query boolean false "Include comments in YAML (true) or plain YAML (false, default)"
+// @Success 200 {string} string "System settings in YAML format"
+// @Router /api/settings/config [get]
+func settingsConfigHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	// Parse query parameters
+	fullParam := r.URL.Query().Get("full")
+	commentsParam := r.URL.Query().Get("comments")
+
+	showFull := fullParam == "true"
+	showComments := commentsParam == "true"
+
+	// Generate YAML using the existing generator function (don't filter deprecated fields in API)
+	yamlOutput, err := settings.GenerateConfigYaml(config, showComments, showFull, false)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	// Set content type and write response
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	if _, err := w.Write([]byte(yamlOutput)); err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return http.StatusOK, nil
+}
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"sort"
 	"strconv"
+	"strings"
 	"time"

 	"golang.org/x/crypto/bcrypt"
@@ -17,8 +17,35 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 )

+// ShareResponse represents a share with computed username field and download URL
+type ShareResponse struct {
+	*share.Link
+	Username    string `json:"username,omitempty"`
+	DownloadURL string `json:"downloadURL,omitempty"`
+}
+
+// convertToShareResponse converts shares to response format with usernames
+func convertToShareResponse(r *http.Request, shares []*share.Link) ([]*ShareResponse, error) {
+	responses := make([]*ShareResponse, len(shares))
+	for i, s := range shares {
+		user, err := store.Users.Get(s.UserID)
+		username := ""
+		if err == nil {
+			username = user.Username
+		}
+		responses[i] = &ShareResponse{
+			Link:        s,
+			Username:    username,
+			DownloadURL: getDownloadURL(r, s.Hash),
+		}
+	}
+	return responses, nil
+}
+
 // shareListHandler returns a list of all share links.
 // @Summary List share links
 // @Description Returns a list of share links for the current user, or all links if the user is an admin.
@@ -29,29 +56,22 @@ import (
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Router /api/shares [get]
 func shareListHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	var (
-		s   []*share.Link
-		err error
-	)
+	var err error
+	var shares []*share.Link
 	if d.user.Permissions.Admin {
-		s, err = store.Share.All()
+		shares, err = store.Share.All()
 	} else {
-		s, err = store.Share.FindByUserID(d.user.ID)
+		shares, err = store.Share.FindByUserID(d.user.ID)
 	}
-	if err == errors.ErrNotExist {
-		return renderJSON(w, r, []*share.Link{})
+	if err != nil && err != errors.ErrNotExist {
+		return http.StatusInternalServerError, err
 	}
+	shares = utils.NonNilSlice(shares)
+	sharesWithUsernames, err := convertToShareResponse(r, shares)
 	if err != nil {
 		return http.StatusInternalServerError, err
 	}
-
-	sort.Slice(s, func(i, j int) bool {
-		if s[i].UserID != s[j].UserID {
-			return s[i].UserID < s[j].UserID
-		}
-		return s[i].Expire < s[j].Expire
-	})
-	return renderJSON(w, r, s)
+	return renderJSON(w, r, sharesWithUsernames)
 }

 // shareGetsHandler retrieves share links for a specific resource path.
@@ -67,30 +87,34 @@ func shareListHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 // @Router /api/share [get]
 func shareGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	encodedPath := r.URL.Query().Get("path")
-	source := r.URL.Query().Get("source")
+	sourceName := r.URL.Query().Get("source")
 	// Decode the URL-encoded path
 	path, err := url.QueryUnescape(encodedPath)
 	if err != nil {
 		return http.StatusBadRequest, fmt.Errorf("invalid path encoding: %v", err)
 	}
-	sourcePath, ok := config.Server.NameToSource[source]
+	sourceInfo, ok := config.Server.NameToSource[sourceName] // backend source is path
 	if !ok {
-		return http.StatusBadRequest, fmt.Errorf("invalid source name: %s", source)
+		return http.StatusBadRequest, fmt.Errorf("invalid source name: %s", sourceName)
 	}
-	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, source)
+	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, sourceName)
 	if err != nil {
 		return http.StatusForbidden, err
 	}
 	scopePath := utils.JoinPathAsUnix(userscope, path)
-	s, err := store.Share.Gets(scopePath, sourcePath.Path, d.user.ID)
-	if err == errors.ErrNotExist {
-		return renderJSON(w, r, []*share.Link{})
+	s, err := store.Share.Gets(scopePath, sourceInfo.Path, d.user.ID)
+	if err == errors.ErrNotExist || len(s) == 0 {
+		return renderJSON(w, r, []*ShareResponse{})
 	}
-
+	// DownloadURL will be set in convertToShareResponse
 	if err != nil {
 		return http.StatusInternalServerError, fmt.Errorf("error getting share info from server")
 	}
-	return renderJSON(w, r, s)
+	sharesWithUsernames, err := convertToShareResponse(r, s)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	return renderJSON(w, r, sharesWithUsernames)
 }

 // shareDeleteHandler deletes a specific share link by its hash.
@@ -125,25 +149,28 @@ func shareDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 // @Tags Shares
 // @Accept json
 // @Produce json
-// @Param path query string true "Source Path of the files to share"
-// @Param source query string true "Source name of the files to share"
+// @Param body body share.CreateBody true "Share creation parameters"
 // @Success 200 {object} share.Link "Created share link"
 // @Failure 400 {object} map[string]string "Bad request - failed to decode body"
 // @Failure 500 {object} map[string]string "Internal server error"
-// @Router /api/shares [post]
+// @Router /api/share [post]
 func sharePostHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	var s *share.Link
+	var err error
 	var body share.CreateBody
 	if r.Body != nil {
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		if err = json.NewDecoder(r.Body).Decode(&body); err != nil {
 			return http.StatusBadRequest, fmt.Errorf("failed to decode body: %w", err)
 		}
 		defer r.Body.Close()
 	}

-	secure_hash, err := generateShortUUID()
-	if err != nil {
-		return http.StatusInternalServerError, err
+	// check if body.Hash is a valid hash
+	if body.Hash != "" {
+		s, err = store.Share.GetByHash(body.Hash)
+		if err != nil {
+			return http.StatusBadRequest, fmt.Errorf("invalid hash provided")
+		}
 	}

 	var expire int64 = 0
@@ -184,34 +211,279 @@ func sharePostHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 		token = base64.URLEncoding.EncodeToString(tokenBuffer)
 		stringHash = string(hash)
 	}
+	if s != nil {
+		s.Expire = expire
+		s.PasswordHash = stringHash
+		s.Token = token
+		// Preserve immutable fields for updates. Path and Source should not change on edits.
+		// If the request attempts to provide empty values (or any values) for these,
+		// keep the existing ones from the stored share.
+		body.Path = s.Path
+		body.Source = s.Source
+		s.CommonShare = body.CommonShare
+		if err = store.Share.Save(s); err != nil {
+			return http.StatusInternalServerError, err
+		}
+		// Convert to ShareResponse format with username
+		var user *users.User
+		user, err = store.Users.Get(s.UserID)
+		username := ""
+		if err == nil {
+			username = user.Username
+		}
+		response := &ShareResponse{
+			Link:     s,
+			Username: username,
+		}
+		return renderJSON(w, r, response)
+	}
+
+	source, ok := config.Server.NameToSource[body.Source]
+	if !ok {
+		return http.StatusForbidden, fmt.Errorf("source with name not found: %s", body.Source)
+	}
+
+	if source.Config.Private {
+		return http.StatusForbidden, fmt.Errorf("the target source is private, sharing is not permitted")
+	}
+
+	// create a new share link
+	secure_hash, err := generateShortUUID()
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	// validate source path exists
+	idx := indexing.GetIndex(source.Name)
+	if idx == nil {
+		return http.StatusForbidden, fmt.Errorf("source with name not found: %s", body.Source)
+	}
+
+	// validate path exists as file or folder
+	_, exists := idx.GetReducedMetadata(body.Path, true) // true to check if it exists
+	if !exists {
+		// could be a file instead
+		_, exists := idx.GetReducedMetadata(utils.GetParentDirectoryPath(body.Path), true)
+		if !exists {
+			return http.StatusForbidden, fmt.Errorf("path not found: %s", body.Path)
+		}
+	}
+
+	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, source.Name)
+	if err != nil {
+		return http.StatusForbidden, err
+	}
+	scopePath := utils.JoinPathAsUnix(userscope, body.Path)
+	body.Path = scopePath
+	body.Source = source.Path // backend source is path
+	s = &share.Link{
+		Expire:       expire,
+		UserID:       d.user.ID,
+		Hash:         secure_hash,
+		PasswordHash: stringHash,
+		Token:        token,
+		CommonShare:  body.CommonShare,
+	}
+
+	if err = store.Share.Save(s); err != nil {
+		return http.StatusInternalServerError, err
+	}
+	// Convert to ShareResponse format with username
+	var user *users.User
+	user, err = store.Users.Get(s.UserID)
+	username := ""
+	if err == nil {
+		username = user.Username
+	}
+	response := &ShareResponse{
+		Link:     s,
+		Username: username,
+	}
+	return renderJSON(w, r, response)
+}
+
+// DirectDownloadResponse represents the response for direct download endpoint
+type DirectDownloadResponse struct {
+	Status      string `json:"status"`
+	Hash        string `json:"hash"`
+	DownloadURL string `json:"url"`
+}
+
+// shareDirectDownloadHandler creates a direct download link for files only.
+// @Summary Create direct download link
+// @Description Creates a direct download link for a specific file with configurable duration, download count, and speed limits. If a share already exists with matching parameters, the existing share will be reused.
+// @Tags Shares
+// @Accept json
+// @Produce json
+// @Param path query string true "File path to create download link for"
+// @Param source query string true "Source name for the file"
+// @Param duration query string false "Duration in minutes for link validity (default: 60)"
+// @Param count query string false "Maximum number of downloads allowed (default: unlimited)"
+// @Param speed query string false "Download speed limit in kbps (default: unlimited)"
+// @Success 201 {object} DirectDownloadResponse "Direct download link created"
+// @Failure 400 {object} map[string]string "Bad request - invalid parameters or path is not a file"
+// @Failure 403 {object} map[string]string "Forbidden - access denied"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /public/share/direct [get]
+func shareDirectDownloadHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	// Extract query parameters
 	encodedPath := r.URL.Query().Get("path")
+	source := r.URL.Query().Get("source")
+	duration := r.URL.Query().Get("duration")
+	downloadCountStr := r.URL.Query().Get("count")
+	downloadSpeedStr := r.URL.Query().Get("speed")
+
+	// Validate required parameters
+	if encodedPath == "" || source == "" {
+		return http.StatusBadRequest, fmt.Errorf("path and source are required")
+	}
+
 	// Decode the URL-encoded path
 	path, err := url.QueryUnescape(encodedPath)
 	if err != nil {
 		return http.StatusBadRequest, fmt.Errorf("invalid path encoding: %v", err)
 	}
-	sourceName := r.URL.Query().Get("source")
-	source := config.Server.NameToSource[sourceName]
-	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, source.Name)
+
+	// Validate source exists
+	sourceInfo, ok := config.Server.NameToSource[source]
+	if !ok {
+		return http.StatusBadRequest, fmt.Errorf("invalid source name: %s", source)
+	}
+
+	// Get user scope for this source
+	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, source)
 	if err != nil {
 		return http.StatusForbidden, err
 	}
-	scopePath := utils.JoinPathAsUnix(userscope, path)
-	s = &share.Link{
-		Path:         scopePath,
-		Hash:         secure_hash,
-		Source:       source.Path, // path instead to persist accoss name change
-		Expire:       expire,
-		UserID:       d.user.ID,
-		PasswordHash: stringHash,
-		Token:        token,
+
+	// Validate the path exists and is a file (not a folder)
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		return http.StatusForbidden, fmt.Errorf("source with name not found: %s", source)
 	}

-	if err := store.Share.Save(s); err != nil {
+	metadata, exists := idx.GetReducedMetadata(path, false)
+	if !exists {
+		return http.StatusBadRequest, fmt.Errorf("path is either not a file or not found: %s", path)
+	}
+
+	// Check if it's a file (not a directory)
+	if metadata.Type == "directory" {
+		return http.StatusBadRequest, fmt.Errorf("path must be a file, not a directory: %s", path)
+	}
+
+	// Set default duration to 60 minutes if not provided
+	if duration == "" {
+		duration = "60"
+	}
+
+	// Parse download count
+	var downloadCount int
+	if downloadCountStr != "" {
+		downloadCount, err = strconv.Atoi(downloadCountStr)
+		if err != nil {
+			return http.StatusBadRequest, fmt.Errorf("invalid downloadCount: %v", err)
+		}
+	}
+
+	// Parse download speed (in bytes per second)
+	var downloadSpeed int
+	if downloadSpeedStr != "" {
+		downloadSpeed, err = strconv.Atoi(downloadSpeedStr)
+		if err != nil {
+			return http.StatusBadRequest, fmt.Errorf("invalid downloadSpeed: %v", err)
+		}
+	}
+
+	// Calculate expiration time
+	durationNum, err := strconv.Atoi(duration)
+	if err != nil {
+		return http.StatusBadRequest, fmt.Errorf("invalid duration: %v", err)
+	}
+	expire := time.Now().Add(time.Minute * time.Duration(durationNum)).Unix()
+
+	// Generate secure hash for the share
+	secureHash, err := generateShortUUID()
+	if err != nil {
 		return http.StatusInternalServerError, err
 	}

-	return renderJSON(w, r, s)
+	// Create the scope path
+	scopePath := utils.JoinPathAsUnix(userscope, path)
+
+	// Check if an existing share already matches these parameters
+	existingShares, err := store.Share.Gets(scopePath, sourceInfo.Path, d.user.ID)
+	if err == nil && len(existingShares) > 0 {
+		// Look for a share that matches our parameters
+		for _, existing := range existingShares {
+			if existing.DownloadsLimit == downloadCount &&
+				existing.MaxBandwidth == downloadSpeed &&
+				existing.QuickDownload &&
+				(existing.Expire == 0 || existing.Expire >= expire) { // Existing expires later or never
+
+				response := DirectDownloadResponse{
+					Status:      "201",
+					Hash:        existing.Hash,
+					DownloadURL: getDownloadURL(r, existing.Hash),
+				}
+				return renderJSON(w, r, response)
+			}
+		}
+	}
+
+	// No matching existing share found, create a new one
+	shareLink := &share.Link{
+		Expire: expire,
+		UserID: d.user.ID,
+		Hash:   secureHash,
+		CommonShare: share.CommonShare{
+			Path:           scopePath,
+			Source:         idx.Path,
+			DownloadsLimit: downloadCount,
+			MaxBandwidth:   downloadSpeed,
+			QuickDownload:  true, // Enable quick download for direct downloads
+		},
+	}
+
+	// Save the share
+	if err := store.Share.Save(shareLink); err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	// Return response
+	response := DirectDownloadResponse{
+		Status:      "200",
+		Hash:        secureHash,
+		DownloadURL: getDownloadURL(r, secureHash),
+	}
+
+	return renderJSON(w, r, response)
+}
+
+func getDownloadURL(r *http.Request, hash string) string {
+	var downloadURL string
+	if config.Server.ExternalUrl != "" {
+		downloadURL = fmt.Sprintf("%s%spublic/api/raw?hash=%s", config.Server.ExternalUrl, config.Server.BaseURL, hash)
+	} else {
+		// Prefer X-Forwarded-Host for proxy support
+		var host string
+		var scheme string
+
+		if forwardedHost := r.Header.Get("X-Forwarded-Host"); forwardedHost != "" {
+			host = forwardedHost
+			// Use X-Forwarded-Proto if available, otherwise default to https for proxied requests
+			if forwardedProto := r.Header.Get("X-Forwarded-Proto"); forwardedProto != "" {
+				scheme = forwardedProto
+			} else {
+				scheme = "https"
+			}
+		} else {
+			// Fallback to simple approach
+			host = r.Host
+			scheme = getScheme(r)
+		}
+		downloadURL = fmt.Sprintf("%s://%s%spublic/api/raw?hash=%s", scheme, host, config.Server.BaseURL, hash)
+	}
+	return downloadURL
 }

 func getSharePasswordHash(body share.CreateBody) (data []byte, statuscode int, err error) {
@@ -241,3 +513,14 @@ func generateShortUUID() (string, error) {
 	// Trim the length to 22 characters for a shorter ID
 	return uuid[:22], nil
 }
+
+func redirectToShare(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	// Remove the base URL and "/share/" prefix to get the full path after share
+	sharePath := strings.TrimPrefix(r.URL.Path, config.Server.BaseURL+"share/")
+	newURL := config.Server.BaseURL + "public/share/" + sharePath
+	if r.URL.RawQuery != "" {
+		newURL += "?" + r.URL.RawQuery
+	}
+	http.Redirect(w, r, newURL, http.StatusMovedPermanently)
+	return http.StatusMovedPermanently, nil
+}
@@ -17,10 +17,19 @@ var templateRenderer *TemplateRenderer

 type TemplateRenderer struct {
 	templates *template.Template
+	devMode   bool
 }

 // Render renders a template document with headers and data
 func (t *TemplateRenderer) Render(w http.ResponseWriter, name string, data interface{}) error {
+	// If in dev mode, reload templates on every render.
+	if t.devMode {
+		var err error
+		t.templates, err = t.templates.ParseFS(assetFs, "public/index.html")
+		if err != nil {
+			return fmt.Errorf("error reloading template: %w", err)
+		}
+	}
 	// Set headers
 	w.Header().Set("Cache-Control", "no-cache, private, max-age=0")
 	w.Header().Set("Pragma", "no-cache")
@@ -30,62 +39,164 @@ func (t *TemplateRenderer) Render(w http.ResponseWriter, name string, data inter
 	return t.templates.ExecuteTemplate(w, name, data)
 }

-func handleWithStaticData(w http.ResponseWriter, r *http.Request, file, contentType string) {
+func handleWithStaticData(w http.ResponseWriter, r *http.Request, d *requestContext, file, contentType string) (int, error) {
 	w.Header().Set("Content-Type", contentType)

 	auther, err := store.Auth.Get("password")
 	if err != nil {
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
+		return http.StatusInternalServerError, err
+	}
+	userSelectedTheme := ""
+	if d.user != nil {
+		theme, ok := config.Frontend.Styling.CustomThemeOptions[d.user.CustomTheme]
+		if ok {
+			userSelectedTheme = theme.CssRaw
+		}
 	}

+	defaultThemeColor := "#455a64"
+	staticURL := config.Server.BaseURL + "static"
+	publicStaticURL := config.Server.BaseURL + "public/static"
+
+	// Use custom favicon if configured and validated, otherwise fall back to default
+	var favicon string
+	if config.Frontend.Favicon != "" {
+		favicon = staticURL + "/favicon"
+	} else {
+		// Default favicon
+		favicon = staticURL + "/img/icons/favicon-256x256.png"
+	}
 	data := map[string]interface{}{
-		"Name":              config.Frontend.Name,
-		"DisableExternal":   config.Frontend.DisableDefaultLinks,
-		"darkMode":          settings.Config.UserDefaults.DarkMode,
-		"BaseURL":           config.Server.BaseURL,
-		"Version":           version.Version,
-		"CommitSHA":         version.CommitSHA,
-		"StaticURL":         config.Server.BaseURL + "static",
-		"Signup":            settings.Config.Auth.Methods.PasswordAuth.Signup,
-		"NoAuth":            config.Auth.Methods.NoAuth,
-		"LoginPage":         auther.LoginPage(),
-		"CSS":               false,
-		"EnableThumbs":      !config.Server.DisablePreviews,
-		"ExternalLinks":     config.Frontend.ExternalLinks,
-		"ExternalUrl":       strings.TrimSuffix(config.Server.ExternalUrl, "/"),
-		"OnlyOfficeUrl":     settings.Config.Integrations.OnlyOffice.Url,
-		"SourceCount":       len(config.Server.SourceMap),
-		"OidcAvailable":     config.Auth.Methods.OidcAuth.Enabled,
-		"PasswordAvailable": config.Auth.Methods.PasswordAuth.Enabled,
-		"MediaAvailable":    config.Integrations.Media.FfmpegPath != "",
-		"MuPdfAvailable":    config.Server.MuPdfAvailable,
-		"UpdateAvailable":   utils.GetUpdateAvailableUrl(),
-		"DisableNavButtons": settings.Config.Frontend.DisableNavButtons,
+		"title":             config.Frontend.Name,
+		"customCSS":         config.Frontend.Styling.CustomCSSRaw,
+		"userSelectedTheme": userSelectedTheme,
+		"lightBackground":   config.Frontend.Styling.LightBackground,
+		"darkBackground":    config.Frontend.Styling.DarkBackground,
+		"staticURL":         staticURL,
+		"baseURL":           config.Server.BaseURL,
+		"favicon":           favicon,
+		"color":             defaultThemeColor,
+		"winIcon":           staticURL + "/img/icons/mstile-144x144.png",
+		"appIcon":           staticURL + "/img/icons/android-chrome-256x256.png",
+		"description":       config.Frontend.Description,
 	}
+	shareProps := map[string]interface{}{
+		"isShare":             false,
+		"isValid":             false,
+		"banner":              "",
+		"title":               "",
+		"quickDownload":       false,
+		"description":         "",
+		"themeColor":          "",
+		"disableThumbnails":   false,
+		"viewMode":            "list",
+		"disableFileViewer":   false,
+		"disableShareCard":    false,
+		"disableSidebar":      false,
+		"isPasswordProtected": false,
+		"hash":                "",
+	}
+	disableNavButtons := settings.Config.Frontend.DisableNavButtons
+	if d.share != nil {
+		shareProps["isShare"] = true
+		shareProps["isValid"] = d.shareValid
+		shareProps["hash"] = d.share.Hash

-	b, err := json.Marshal(data)
+		if d.shareValid {
+			disableNavButtons = disableNavButtons || d.share.HideNavButtons
+			shareProps["viewMode"] = d.share.ViewMode
+			shareProps["banner"] = d.share.Banner
+			shareProps["title"] = d.share.Title
+			shareProps["description"] = d.share.Description
+			shareProps["themeColor"] = d.share.ThemeColor
+			shareProps["quickDownload"] = d.share.QuickDownload
+			shareProps["disableThumbnails"] = d.share.DisableThumbnails
+			shareProps["disableFileViewer"] = d.share.DisableFileViewer
+			shareProps["disableShareCard"] = d.share.DisableShareCard
+			shareProps["disableSidebar"] = d.share.DisableSidebar
+			shareProps["isPasswordProtected"] = d.share.PasswordHash != ""
+			shareProps["downloadURL"] = getDownloadURL(r, d.share.Hash)
+			shareProps["enforceDarkLightMode"] = d.share.EnforceDarkLightMode
+			shareProps["enableOnlyOffice"] = d.share.EnableOnlyOffice
+			shareProps["enableOnlyOfficeEditing"] = d.share.EnableOnlyOfficeEditing
+			if d.share.Favicon != "" {
+				if strings.HasPrefix(d.share.Favicon, "http") {
+					data["favicon"] = d.share.Favicon
+				} else {
+					data["favicon"] = publicStaticURL + "/" + d.share.Favicon
+				}
+			}
+			if d.share.Description != "" {
+				data["description"] = d.share.Description
+			}
+			if d.share.Title != "" {
+				data["title"] = d.share.Title
+			}
+		}
+
+		// base url could be different for routes behind proxy
+		data["staticURL"] = publicStaticURL
+		// Use custom favicon for shares too if configured
+		if config.Frontend.Favicon != "" {
+			data["favicon"] = publicStaticURL + "/favicon"
+		} else {
+			data["favicon"] = publicStaticURL + "/img/icons/favicon-256x256.png"
+		}
+		data["winIcon"] = publicStaticURL + "/img/icons/mstile-144x144.png"
+		data["appIcon"] = publicStaticURL + "/img/icons/android-chrome-256x256.png"
+	}
+	// variables consumed by frontend as json
+	data["globalVars"] = map[string]interface{}{
+		"name":                 config.Frontend.Name,
+		"minSearchLength":      config.Server.MinSearchLength,
+		"disableExternal":      config.Frontend.DisableDefaultLinks,
+		"darkMode":             settings.Config.UserDefaults.DarkMode,
+		"baseURL":              config.Server.BaseURL,
+		"version":              version.Version,
+		"commitSHA":            version.CommitSHA,
+		"signup":               settings.Config.Auth.Methods.PasswordAuth.Signup,
+		"noAuth":               config.Auth.Methods.NoAuth,
+		"loginPage":            auther.LoginPage(),
+		"enableThumbs":         !config.Server.DisablePreviews,
+		"externalLinks":        config.Frontend.ExternalLinks,
+		"externalUrl":          strings.TrimSuffix(config.Server.ExternalUrl, "/"),
+		"onlyOfficeUrl":        settings.Config.Integrations.OnlyOffice.Url,
+		"sourceCount":          len(config.Server.SourceMap),
+		"oidcAvailable":        config.Auth.Methods.OidcAuth.Enabled,
+		"passwordAvailable":    config.Auth.Methods.PasswordAuth.Enabled,
+		"mediaAvailable":       config.Integrations.Media.FfmpegPath != "",
+		"muPdfAvailable":       config.Server.MuPdfAvailable,
+		"updateAvailable":      utils.GetUpdateAvailableUrl(),
+		"disableNavButtons":    disableNavButtons,
+		"userSelectableThemes": config.Frontend.Styling.CustomThemeOptions,
+		"share":                shareProps,
+	}
+	jsonVars, err := json.Marshal(data["globalVars"])
 	if err != nil {
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-		return
+		return http.StatusInternalServerError, err
 	}
-
-	data["globalVars"] = strings.ReplaceAll(string(b), `'`, `\'`)
+	data["globalVars"] = strings.ReplaceAll(string(jsonVars), `'`, `\'`)

 	// Render the template with global variables
 	if err := templateRenderer.Render(w, file, data); err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return http.StatusInternalServerError, err
 	}
+	return http.StatusOK, nil
 }

 func staticFilesHandler(w http.ResponseWriter, r *http.Request) {
 	const maxAge = 86400 // 1 day
 	w.Header().Set("Cache-Control", fmt.Sprintf("public, max-age=%v", maxAge))
 	w.Header().Set("Content-Security-Policy", `default-src 'self'; style-src 'unsafe-inline';`)
-	// Remove "/static/" from the request path
-	adjustedPath := strings.TrimPrefix(r.URL.Path, fmt.Sprintf("%vstatic/", config.Server.BaseURL))
-	adjustedCompressed := adjustedPath + ".gz"
-	if strings.HasSuffix(adjustedPath, ".js") {
+
+	// Handle custom favicon if configured and requested
+	if r.URL.Path == "favicon" && config.Frontend.Favicon != "" {
+		http.ServeFile(w, r, config.Frontend.Favicon)
+		return
+	}
+
+	adjustedCompressed := r.URL.Path + ".gz"
+	if strings.HasSuffix(r.URL.Path, ".js") {
 		w.Header().Set("Content-Type", "application/javascript; charset=utf-8") // Set the correct MIME type for JavaScript files
 	}
 	// Check if the gzipped version of the file exists
@@ -98,15 +209,13 @@ func staticFilesHandler(w http.ResponseWriter, r *http.Request) {
 		}
 	} else {
 		// Otherwise, serve the regular file
-		http.StripPrefix(fmt.Sprintf("%vstatic/", config.Server.BaseURL), http.FileServer(http.FS(assetFs))).ServeHTTP(w, r)
+		http.FileServer(http.FS(assetFs)).ServeHTTP(w, r)
 	}
 }

-func indexHandler(w http.ResponseWriter, r *http.Request) {
+func indexHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	if r.Method != http.MethodGet {
-		http.Error(w, http.StatusText(http.StatusNotFound), http.StatusNotFound)
-		return
+		return http.StatusNotFound, nil
 	}
-	handleWithStaticData(w, r, "index.html", "text/html")
-
+	return handleWithStaticData(w, r, d, "index.html", "text/html")
 }
@@ -164,7 +164,7 @@ func usersPostHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 		return http.StatusBadRequest, errors.ErrEmptyPassword
 	}

-	err = storage.CreateUser(req.User, req.User.Permissions.Admin)
+	err = storage.CreateUser(req.User)
 	if err != nil {
 		return http.StatusInternalServerError, err
 	}
@@ -3,13 +3,16 @@

 package indexing

-import "syscall"
+import (
+	"syscall"
+)

 func CheckWindowsHidden(realpath string) bool {
 	// Non-Windows platforms don't support hidden attributes in the same way
 	return false
 }

+// getFilesystemSize returns the filesystem size (fallback method)
 func getPartitionSize(path string) (uint64, error) {
 	var stat syscall.Statfs_t
 	err := syscall.Statfs(path, &stat)
@@ -40,16 +40,16 @@ type Index struct {
 	CurrentSchedule            int `json:"-"`
 	settings.Source            `json:"-"`
 	Directories                map[string]*iteminfo.FileInfo `json:"-"`
-	DirectoriesLedger          map[string]bool               `json:"-"`
+	DirectoriesLedger          map[string]struct{}           `json:"-"`
 	runningScannerCount        int                           `json:"-"`
 	SmartModifier              time.Duration                 `json:"-"`
 	FilesChangedDuringIndexing bool                          `json:"-"`
 	mock                       bool
 	mu                         sync.RWMutex
 	hasIndex                   bool
-	FoundHardLinks             map[string]uint64 `json:"-"` // hardlink path -> size
-	processedInodes            map[uint64]bool   `json:"-"`
-	totalSize                  uint64            `json:"-"`
+	FoundHardLinks             map[string]uint64   `json:"-"` // hardlink path -> size
+	processedInodes            map[uint64]struct{} `json:"-"`
+	totalSize                  uint64              `json:"-"`
 }

 var (
@@ -75,8 +75,8 @@ func Initialize(source settings.Source, mock bool) {
 		mock:              mock,
 		Source:            source,
 		Directories:       make(map[string]*iteminfo.FileInfo),
-		DirectoriesLedger: make(map[string]bool),
-		processedInodes:   make(map[uint64]bool),
+		DirectoriesLedger: make(map[string]struct{}),
+		processedInodes:   make(map[uint64]struct{}),
 		FoundHardLinks:    make(map[string]uint64),
 	}
 	newIndex.ReducedIndex = ReducedIndex{
@@ -123,7 +123,7 @@ func (idx *Index) indexDirectory(adjustedPath string, quick, recursive bool) err
 	if recursive {
 		// Prevent race conditions if scanning becomes concurrent in the future.
 		idx.mu.Lock()
-		idx.DirectoriesLedger[adjustedPath] = true
+		idx.DirectoriesLedger[adjustedPath] = struct{}{}
 		idx.mu.Unlock()
 	}
 	combinedPath := adjustedPath + "/"
@@ -292,7 +292,9 @@ func (idx *Index) GetDirInfo(dirInfo *os.File, stat os.FileInfo, realPath, adjus
 			totalSize += itemInfo.Size
 			itemInfo.Type = "directory"
 			dirInfos = append(dirInfos, *itemInfo)
-			idx.NumDirs++
+			if recursive {
+				idx.NumDirs++
+			}
 		} else {
 			size, shouldCountSize := idx.handleFile(file, fullCombined)
 			itemInfo.DetectType(fullCombined, false)
@@ -301,7 +303,9 @@ func (idx *Index) GetDirInfo(dirInfo *os.File, stat os.FileInfo, realPath, adjus
 			if shouldCountSize {
 				totalSize += itemInfo.Size
 			}
-			idx.NumFiles++
+			if recursive {
+				idx.NumFiles++
+			}
 		}
 	}

@@ -378,7 +382,7 @@ func (idx *Index) GetRealPath(relativePath ...string) (string, bool, error) {
 		return absolutePath, false, fmt.Errorf("could not get real path: %v, %s", joinedPath, err)
 	}
 	// Resolve symlinks and get the real path
-	realPath, isDir, err := utils.ResolveSymlinks(absolutePath)
+	realPath, isDir, err := iteminfo.ResolveSymlinks(absolutePath)
 	if err == nil {
 		RealPathCache.Set(joinedPath, realPath)
 		RealPathCache.Set(joinedPath+":isdir", isDir)
@@ -570,7 +574,7 @@ func (idx *Index) handleFile(file os.FileInfo, fullCombined string) (size uint64
 			return realSize, false
 		}
 		// First time seeing this inode.
-		idx.processedInodes[ino] = true
+		idx.processedInodes[ino] = struct{}{}
 		idx.FoundHardLinks[fullCombined] = realSize
 		idx.totalSize += realSize
 		return realSize, true // Count size for directory total.
@@ -74,7 +74,7 @@ func (idx *Index) garbageCollection() {
 		}
 	}
 	// Reset the ledger for the next scan.
-	idx.DirectoriesLedger = make(map[string]bool)
+	idx.DirectoriesLedger = make(map[string]struct{})
 }

 func (idx *Index) UpdateSchedule() {
@@ -140,7 +140,7 @@ func (idx *Index) RunIndexing(origin string, quick bool) {
 		idx.mu.Lock()
 		idx.NumDirs = 0
 		idx.NumFiles = 0
-		idx.processedInodes = make(map[uint64]bool)
+		idx.processedInodes = make(map[uint64]struct{})
 		idx.FoundHardLinks = make(map[string]uint64)
 		idx.mu.Unlock()
 	}
@@ -160,9 +160,6 @@ func (idx *Index) RunIndexing(origin string, quick bool) {
 		logger.Debugf("Time spent indexing [%v]: %v seconds", idx.Name, idx.QuickScanTime)
 	} else {
 		idx.FullScanTime = int(time.Since(startTime).Seconds())
-		idx.mu.Lock()
-		idx.DiskUsed = idx.totalSize
-		idx.mu.Unlock()
 		// update smart indexing
 		if idx.FullScanTime < 3 || idx.NumDirs < 10000 {
 			idx.Assessment = "simple"
@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"

@@ -412,3 +413,12 @@ func HasDocConvertableExtension(name, mimetype string) bool {
 	}
 	return false
 }
+
+var ONLYOFFICE_READONLY_FILE_EXTENSIONS = []string{"pages", "numbers", "key"}
+
+func CanEditOnlyOffice(modify bool, extention string) bool {
+	if !modify {
+		return false
+	}
+	return !slices.Contains(ONLYOFFICE_READONLY_FILE_EXTENSIONS, strings.ToLower(extention))
+}
@@ -3,6 +3,9 @@ package iteminfo
 import (
 	"path/filepath"
 	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 )

 type ItemInfo struct {
@@ -26,17 +29,20 @@ type FileInfo struct {
 // extra calculated fields can be added here
 type ExtendedFileInfo struct {
 	FileInfo
-	Content      string            `json:"content,omitempty"`      // text content of a file, if requested
-	Subtitles    []string          `json:"subtitles,omitempty"`    // subtitles for video files
-	Checksums    map[string]string `json:"checksums,omitempty"`    // checksums for the file
-	Token        string            `json:"token,omitempty"`        // token for the file -- used for sharing
-	OnlyOfficeId string            `json:"onlyOfficeId,omitempty"` // id for onlyoffice files
-	Source       string            `json:"source"`                 // associated index source for the file
-	RealPath     string            `json:"-"`
+	Content      string                 `json:"content,omitempty"`      // text content of a file, if requested
+	Subtitles    []ffmpeg.SubtitleTrack `json:"subtitles,omitempty"`    // subtitles for video files
+	Checksums    map[string]string      `json:"checksums,omitempty"`    // checksums for the file
+	Token        string                 `json:"token,omitempty"`        // token for the file -- used for sharing
+	OnlyOfficeId string                 `json:"onlyOfficeId,omitempty"` // id for onlyoffice files
+	Source       string                 `json:"source,omitempty"`       // associated index source for the file
+	Hash         string                 `json:"hash,omitempty"`         // hash for the file -- used for sharing
+	RealPath     string                 `json:"-"`
 }

 // FileOptions are the options when getting a file info.
 type FileOptions struct {
+	Access     *access.Storage
+	Username   string // username for access control
 	Path       string // realpath
 	Source     string
 	IsDir      bool
@@ -1,34 +1,50 @@
 package iteminfo

 import (
+	"fmt"
+	"os"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"

+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

+type SubtitleTrack struct {
+	Name     string `json:"name"`               // filename for external, or descriptive name for embedded
+	Language string `json:"language,omitempty"` // language code
+	Title    string `json:"title,omitempty"`    // title/description
+	Index    *int   `json:"index,omitempty"`    // stream index for embedded subtitles (nil for external)
+	Codec    string `json:"codec,omitempty"`    // codec name for embedded subtitles
+	IsFile   bool   `json:"isFile"`             // true for external files, false for embedded
+}
+
+type FFProbeOutput struct {
+	Streams []struct {
+		Index       int               `json:"index"`
+		CodecType   string            `json:"codec_type"`
+		CodecName   string            `json:"codec_name"`
+		Tags        map[string]string `json:"tags,omitempty"`
+		Disposition map[string]int    `json:"disposition,omitempty"`
+	} `json:"streams"`
+}
+
 // detects subtitles for video files.
 func (i *ExtendedFileInfo) DetectSubtitles(parentInfo *FileInfo) {
 	if !strings.HasPrefix(i.Type, "video") {
 		logger.Debug("subtitles are not supported for this file : " + i.Name)
 		return
 	}
-	ext := filepath.Ext(i.Name)
-	baseWithoutExt := strings.TrimSuffix(i.Name, ext)
-	for _, f := range parentInfo.Files {
-		baseName := strings.TrimSuffix(i.Name, ext)
-		if baseName != baseWithoutExt {
-			continue
-		}
+	// Use unified subtitle detection that finds both embedded and external
+	parentDir := filepath.Dir(i.RealPath)
+	i.Subtitles = ffmpeg.DetectAllSubtitles(i.RealPath, parentDir, i.ModTime)
+}

-		for _, subtitleExt := range SubtitleExts {
-			if strings.HasSuffix(f.Name, subtitleExt) {
-				i.Subtitles = append(i.Subtitles, f.Name)
-			}
-		}
-	}
+// LoadSubtitleContent loads the actual content for all detected subtitle tracks
+func (i *ExtendedFileInfo) LoadSubtitleContent() error {
+	return ffmpeg.LoadAllSubtitleContent(i.RealPath, i.Subtitles, i.ModTime)
 }

 func (info *FileInfo) SortItems() {
@@ -57,3 +73,31 @@ func (info *FileInfo) SortItems() {
 		return strings.ToLower(info.Files[i].Name) < strings.ToLower(info.Files[j].Name)
 	})
 }
+
+// ResolveSymlinks resolves symlinks in the given path and returns
+// the final resolved path, whether it's a directory (considering bundle logic), and any error.
+func ResolveSymlinks(path string) (string, bool, error) {
+	for {
+		// Get the file info using os.Lstat to handle symlinks
+		info, err := os.Lstat(path)
+		if err != nil {
+			return path, false, fmt.Errorf("could not stat path: %s, %v", path, err)
+		}
+
+		// Check if the path is a symlink
+		if info.Mode()&os.ModeSymlink != 0 {
+			// Read the symlink target
+			target, err := os.Readlink(path)
+			if err != nil {
+				return path, false, fmt.Errorf("could not read symlink: %s, %v", path, err)
+			}
+
+			// Resolve the symlink's target relative to its directory
+			path = filepath.Join(filepath.Dir(path), target)
+		} else {
+			// Not a symlink, check with bundle-aware directory logic
+			isDir := IsDirectory(info)
+			return path, isDir, nil
+		}
+	}
+}
@@ -31,3 +31,28 @@ func (idx *Index) CreateMockData(numDirs, numFilesPerDir int) {
 		idx.UpdateMetadata(dirInfo)
 	}
 }
+
+func CreateMockData(numDirs, numFilesPerDir int) iteminfo.FileInfo {
+	dir := iteminfo.FileInfo{}
+	dir.Path = "/here/is/your/mock/dir"
+	for i := 0; i < numDirs; i++ {
+		newFile := iteminfo.ItemInfo{
+			Name:    "file-" + utils.GetRandomTerm() + utils.GetRandomExtension(),
+			Size:    rand.Int63n(1000),                                          // Random size
+			ModTime: time.Now().Add(-time.Duration(rand.Intn(100)) * time.Hour), // Random mod time
+			Type:    "blob",
+		}
+		dir.Folders = append(dir.Folders, newFile)
+	}
+	// Simulating files and directories with FileInfo
+	for j := 0; j < numFilesPerDir; j++ {
+		newFile := iteminfo.ItemInfo{
+			Name:    "file-" + utils.GetRandomTerm() + utils.GetRandomExtension(),
+			Size:    rand.Int63n(1000),                                          // Random size
+			ModTime: time.Now().Add(-time.Duration(rand.Intn(100)) * time.Hour), // Random mod time
+			Type:    "blob",
+		}
+		dir.Files = append(dir.Files, newFile)
+	}
+	return dir
+}
@@ -1,15 +1,9 @@
 package preview

 import (
-	"bytes"
 	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"strconv"
-	"strings"

-	"github.com/gtsteffaniak/go-logger/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 )

 // GenerateVideoPreview generates a single preview image from a video using ffmpeg.
@@ -21,69 +15,8 @@ func (s *Service) GenerateVideoPreview(videoPath, outputPath string, percentageS
 		return nil, err
 	}
 	defer s.release()
-	// Step 1: Get video duration from the container format
-	probeCmd := exec.Command(
-		s.ffprobePath,
-		"-v", "error",
-		// Use format=duration for better compatibility
-		"-show_entries", "format=duration",
-		"-of", "default=noprint_wrappers=1:nokey=1",
-		videoPath,
-	)

-	var probeOut bytes.Buffer
-	probeCmd.Stdout = &probeOut
-	if s.debug {
-		probeCmd.Stderr = os.Stderr
-	}
-	if err := probeCmd.Run(); err != nil {
-		logger.Errorf("ffprobe command failed on file '%v' : %v", videoPath, err)
-		return nil, fmt.Errorf("ffprobe failed: %w", err)
-	}
-
-	durationStr := strings.TrimSpace(probeOut.String())
-	if durationStr == "" || durationStr == "N/A" {
-		logger.Errorf("could not determine video duration for file '%v' using duration info '%v'", videoPath, durationStr)
-		return nil, fmt.Errorf("could not determine video duration")
-	}
-
-	durationFloat, err := strconv.ParseFloat(durationStr, 64)
-	if err != nil {
-		// The original error you saw would be caught here if "N/A" was still the output
-		return nil, fmt.Errorf("invalid duration: %v", err)
-	}
-
-	if durationFloat <= 0 {
-		return nil, fmt.Errorf("video duration must be positive")
-	}
-
-	// The rest of your function remains the same...
-	// Step 2: Get the duration of the video in whole seconds
-	duration := int(durationFloat)
-
-	// Step 3: Calculate seek time based on percentageSeek (percentage value)
-	seekSeconds := duration * percentageSeek / 100
-
-	// Step 4: Convert seekSeconds to string for ffmpeg command
-	seekTime := strconv.Itoa(seekSeconds)
-	// Step 5: Extract frame at seek time
-	cmd := exec.Command(
-		s.ffmpegPath,
-		"-ss", seekTime,
-		"-i", videoPath,
-		"-frames:v", "1",
-		"-q:v", "10",
-		"-y", // overwrite output
-		outputPath,
-	)
-
-	if s.debug {
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-	}
-	err = cmd.Run()
-	if err != nil {
-		return nil, fmt.Errorf("ffmpeg command failed on file '%v' : %w", videoPath, err)
-	}
-	return os.ReadFile(outputPath)
+	// Create a temporary video service for this operation
+	videoSvc := ffmpeg.NewVideoService(s.ffmpegPath, s.ffprobePath, 1, s.debug)
+	return videoSvc.GenerateVideoPreview(videoPath, outputPath, percentageSeek)
 }
@@ -0,0 +1,51 @@
+.card,
+#listingView.gallery .item,
+#listingView.normal .item,
+.button,
+button,
+.button-action,
+.input,
+input,
+#listingView.gallery .item img,
+#listingView .item img,
+.sizeInputWrapper,
+.sizeInput,
+#search-input,
+.floating-tooltip,
+.settings-items>.item,
+.button-group {
+    border-radius: 0.25em !important;
+}
+
+#listingView.compact .header {
+    border-bottom-left-radius: 0 !important;
+    border-bottom-right-radius: 0 !important;
+}
+
+#listingView.list .item:last-child,
+#results {
+    border-bottom-left-radius: 0.25em !important;
+    border-bottom-right-radius: 0.25em !important;
+}
+
+#listingView.list .item:first-child {
+    border-top-left-radius: 0.25em !important;
+    border-top-right-radius: 0.25em !important;
+}
+
+#breadcrumbs ul li:last-child a {
+    border-top-right-radius: 0.25em !important;
+    border-bottom-right-radius: 0.25em !important;
+}
+#breadcrumbs ul li:first-child a {
+    border-top-left-radius: 0.25em !important;
+    border-bottom-left-radius: 0.25em !important;
+}
+
+.button-group button {
+    border-radius: 0 !important;
+}
+
+.icon {
+    border-radius: 0.1em !important;
+}
@@ -12,6 +12,22 @@ definitions:
      name:
        type: string
    type: object
+  http.DirectDownloadResponse:
+    properties:
+      hash:
+        type: string
+      status:
+        type: string
+      url:
+        type: string
+    type: object
+  http.GroupListResponse:
+    properties:
+      groups:
+        items:
+          type: string
+        type: array
+    type: object
  http.HttpResponse:
    properties:
      message:
@@ -124,22 +140,34 @@ definitions:
  settings.Auth:
    properties:
      adminPassword:
-        description: the password of the admin user. If not set, the default is "admin".
+        description: 'secret: the password of the admin user. If not set, the default
+          is "admin".'
        type: string
      adminUsername:
-        description: the username of the admin user. If not set, the default is "admin".
+        description: 'secret: the username of the admin user. If not set, the default
+          is "admin".'
        type: string
      key:
-        description: the key used to sign the JWT tokens. If not set, a random key
-          will be generated.
+        description: 'secret: the key used to sign the JWT tokens. If not set, a random
+          key will be generated.'
        type: string
      methods:
        $ref: '#/definitions/settings.LoginMethods'
      tokenExpirationHours:
-        description: the number of hours until the token expires. Default is 2 hours.
+        description: time in hours each web UI session token is valid for. Default
+          is 2 hours.
        type: integer
      totpSecret:
-        description: secret used to encrypt TOTP secrets
+        description: 'secret: secret used to encrypt TOTP secrets'
+        type: string
+    type: object
+  settings.CustomTheme:
+    properties:
+      css:
+        description: The css file path and filename to use for the theme.
+        type: string
+      description:
+        description: The description of the theme to display in the UI.
        type: string
    type: object
  settings.ExcludeIndexFilter:
@@ -204,6 +232,9 @@ definitions:
    type: object
  settings.Frontend:
    properties:
+      description:
+        description: description that shows up in html head meta description
+        type: string
      disableDefaultLinks:
        description: disable default links in the sidebar
        type: boolean
@@ -217,9 +248,14 @@ definitions:
        items:
          $ref: '#/definitions/settings.ExternalLink'
        type: array
+      favicon:
+        description: path to a favicon to use for the frontend
+        type: string
      name:
        description: display name
        type: string
+      styling:
+        $ref: '#/definitions/settings.StylingConfig'
    type: object
  settings.IncludeIndexFilter:
    properties:
@@ -289,10 +325,10 @@ definitions:
        description: if set, users in this group will be granted admin privileges.
        type: string
      clientId:
-        description: client id of the OIDC application
+        description: 'secret: client id of the OIDC application'
        type: string
      clientSecret:
-        description: client secret of the OIDC application
+        description: 'secret: client secret of the OIDC application'
        type: string
      createUser:
        description: create user if not exists
@@ -330,6 +366,7 @@ definitions:
          to bypass proxy.
        type: string
      secret:
+        description: 'secret: authentication key for OnlyOffice integration'
        type: string
      url:
        description: The URL to the OnlyOffice Document Server, needs to be accessible
@@ -413,12 +450,15 @@ definitions:
      disableTypeDetectionByHeader:
        description: disable type detection by header, useful if filesystem is slow.
        type: boolean
+      disableUpdateCheck:
+        description: disables backend update check service
+        type: boolean
      externalUrl:
-        description: used by share links if set
+        description: used by share links if set (eg. http://mydomain.com)
        type: string
      internalUrl:
-        description: used by integrations if set, this is the url that an integration
-          service will use to communicate with filebrowser
+        description: used by integrations if set, this is the base domain that an
+          integration service will use to communicate with filebrowser (eg. http://localhost:8080)
        type: string
      logging:
        items:
@@ -428,6 +468,10 @@ definitions:
        description: max pre-archive combined size of files/folder that are allowed
          to be archived (in GB)
        type: integer
+      minSearchLength:
+        description: 'minimum length of search query to begin searching (default:
+          3)'
+        type: integer
      numImageProcessors:
        description: number of concurrent image processing jobs used to create previews,
          default is number of cpu cores available.
@@ -488,9 +532,16 @@ definitions:
      defaultUserScope:
        description: default "/" should match folders under path
        type: string
+      denyByDefault:
+        description: deny access unless an "allow" access rule was specifically created.
+        type: boolean
      disableIndexing:
        description: disable the indexing of this source
        type: boolean
+      disabled:
+        description: disable the source, this is useful so you don't need to remove
+          it from the config file
+        type: boolean
      exclude:
        allOf:
        - $ref: '#/definitions/settings.ExcludeIndexFilter'
@@ -500,7 +551,7 @@ definitions:
        - $ref: '#/definitions/settings.IncludeIndexFilter'
        description: include files and folders from indexing, if exclude is not set
      indexingIntervalMinutes:
-        description: optional manual overide interval in seconds to re-index the source
+        description: optional manual overide interval in minutes to re-index the source
        type: integer
      maxWatchers:
        description: number of concurrent watchers to use for this source, currently
@@ -512,9 +563,38 @@ definitions:
        items:
          type: string
        type: array
+      private:
+        description: designate as source as private -- currently just means no sharing
+          permitted.
+        type: boolean
+    type: object
+  settings.StylingConfig:
+    properties:
+      customCSS:
+        description: if a valid path to a css file is provided, it will be applied
+          for all users. (eg. "reduce-rounded-corners.css")
+        type: string
+      customThemes:
+        additionalProperties:
+          $ref: '#/definitions/settings.CustomTheme'
+        description: A list of custom css files that each user can select to override
+          the default styling. if "default" is key name then it will be the default
+          option.
+        type: object
+      darkBackground:
+        description: Specify a valid CSS color property value to use as the background
+          color in dark mode
+        type: string
+      lightBackground:
+        description: specify a valid CSS color property value to use as the background
+          color in light mode
+        type: string
    type: object
  settings.UserDefaults:
    properties:
+      customTheme:
+        description: Name of theme to use chosen from custom themes config.
+        type: string
      darkMode:
        description: should dark mode be enabled
        type: boolean
@@ -522,16 +602,20 @@ definitions:
        description: when false, the date is relative, when true, the date is an exact
          timestamp
        type: boolean
+      debugOffice:
+        description: debug onlyoffice editor
+        type: boolean
      deleteWithoutConfirming:
        description: delete files without confirmation
        type: boolean
      disableOfficePreviewExt:
-        description: comma separated list of file extensions to disable office preview
-          for
+        description: 'deprecated: use disablePreviewExt instead'
        type: string
      disableOnlyOfficeExt:
-        description: comma separated list of file extensions to disable onlyoffice
-          preview for
+        description: list of file extensions to disable onlyoffice editor for
+        type: string
+      disablePreviewExt:
+        description: space separated list of file extensions to disable preview for
        type: string
      disableQuickToggles:
        description: disable the quick toggles in the sidebar
@@ -545,6 +629,9 @@ definitions:
      disableUpdateNotifications:
        description: disable update notifications banner for admin users
        type: boolean
+      disableViewingExt:
+        description: space separated list of file extensions to disable viewing for
+        type: string
      editorQuickSave:
        description: show quick save button in editor
        type: boolean
@@ -578,6 +665,9 @@ definitions:
        description: show hidden files in the UI. On windows this includes files starting
          with a dot and windows hidden files
        type: boolean
+      showSelectMultiple:
+        description: show select multiple files on desktop
+        type: boolean
      singleClick:
        description: open directory on single click, also enables middle click to
          open in new tab
@@ -593,17 +683,134 @@ definitions:
        description: 'view mode to use: eg. normal, list, grid, or compact'
        type: string
    type: object
-  share.Link:
+  share.CreateBody:
    properties:
-      expire:
+      allowUpload:
+        description: AllowEdit           bool   `json:"allowEdit,omitempty"`
+        type: boolean
+      allowedUsernames:
+        items:
+          type: string
+        type: array
+      banner:
+        type: string
+      description:
+        type: string
+      disableAnonymous:
+        type: boolean
+      disableFileViewer:
+        type: boolean
+      disableShareCard:
+        type: boolean
+      disableSidebar:
+        type: boolean
+      disableThumbnails:
+        type: boolean
+      downloadURL:
+        type: string
+      downloadsLimit:
        type: integer
+      enableOnlyOffice:
+        type: boolean
+      enableOnlyOfficeEditing:
+        type: boolean
+      enforceDarkLightMode:
+        description: '"dark" or "light"'
+        type: string
+      expires:
+        type: string
+      favicon:
+        type: string
      hash:
        type: string
+      hideNavButtons:
+        type: boolean
+      keepAfterExpiration:
+        type: boolean
+      maxBandwidth:
+        type: integer
+      password:
+        type: string
+      path:
+        type: string
+      quickDownload:
+        type: boolean
+      shareTheme:
+        type: string
+      source:
+        description: backend source is path to maintain between name changes
+        type: string
+      themeColor:
+        type: string
+      title:
+        type: string
+      unit:
+        type: string
+      viewMode:
+        type: string
+    type: object
+  share.Link:
+    properties:
+      allowUpload:
+        description: AllowEdit           bool   `json:"allowEdit,omitempty"`
+        type: boolean
+      allowedUsernames:
+        items:
+          type: string
+        type: array
+      banner:
+        type: string
+      description:
+        type: string
+      disableAnonymous:
+        type: boolean
+      disableFileViewer:
+        type: boolean
+      disableShareCard:
+        type: boolean
+      disableSidebar:
+        type: boolean
+      disableThumbnails:
+        type: boolean
+      downloadURL:
+        type: string
+      downloads:
+        type: integer
+      downloadsLimit:
+        type: integer
+      enableOnlyOffice:
+        type: boolean
+      enableOnlyOfficeEditing:
+        type: boolean
+      enforceDarkLightMode:
+        description: '"dark" or "light"'
+        type: string
+      expire:
+        type: integer
+      favicon:
+        type: string
+      hash:
+        type: string
+      hideNavButtons:
+        type: boolean
+      keepAfterExpiration:
+        type: boolean
+      maxBandwidth:
+        type: integer
      password_hash:
        type: string
      path:
        type: string
+      quickDownload:
+        type: boolean
+      shareTheme:
+        type: string
      source:
+        description: backend source is path to maintain between name changes
+        type: string
+      themeColor:
+        type: string
+      title:
        type: string
      token:
        description: |-
@@ -613,6 +820,8 @@ definitions:
        type: string
      userID:
        type: integer
+      viewMode:
+        type: string
    type: object
  users.AuthToken:
    properties:
@@ -664,6 +873,9 @@ definitions:
      autoplayMedia:
        description: autoplay media files in preview
        type: boolean
+      defaultMediaPlayer:
+        description: disable html5 media player and use the default media player
+        type: boolean
      disableHideSidebar:
        description: disable the hide sidebar preview for previews and editors
        type: boolean
@@ -706,6 +918,9 @@ definitions:
        additionalProperties:
          $ref: '#/definitions/users.AuthToken'
        type: object
+      customTheme:
+        description: Name of theme to use chosen from custom themes config.
+        type: string
      darkMode:
        description: should dark mode be enabled
        type: boolean
@@ -713,16 +928,20 @@ definitions:
        description: when false, the date is relative, when true, the date is an exact
          timestamp
        type: boolean
+      debugOffice:
+        description: debug onlyoffice editor
+        type: boolean
      deleteWithoutConfirming:
        description: delete files without confirmation
        type: boolean
      disableOfficePreviewExt:
-        description: comma separated list of file extensions to disable office preview
-          for
+        description: deprecated
        type: string
      disableOnlyOfficeExt:
-        description: comma separated list of file extensions to disable onlyoffice
-          preview for
+        description: deprecated
+        type: string
+      disablePreviewExt:
+        description: space separated list of file extensions to disable preview for
        type: string
      disableQuickToggles:
        description: disable the quick toggles in the sidebar
@@ -735,6 +954,9 @@ definitions:
      disableUpdateNotifications:
        description: disable update notifications
        type: boolean
+      disableViewingExt:
+        description: space separated list of file extensions to disable viewing for
+        type: string
      editorQuickSave:
        description: show quick save button in editor
        type: boolean
@@ -783,6 +1005,9 @@ definitions:
        description: show hidden files in the UI. On windows this includes files starting
          with a dot and windows hidden files
        type: boolean
+      showSelectMultiple:
+        description: show select multiple files on desktop
+        type: boolean
      singleClick:
        description: open directory on single click, also enables middle click to
          open in new tab
@@ -809,6 +1034,264 @@ definitions:
 info:
  contact: {}
 paths:
+  /api/access:
+    delete:
+      consumes:
+      - application/json
+      description: Delete a user or group from an allow or deny list for a sourcePath
+        and indexPath.
+      parameters:
+      - description: Source path prefix (e.g. mnt/storage)
+        in: query
+        name: source
+        required: true
+        type: string
+      - description: Index path (e.g. /secret)
+        in: query
+        name: path
+        required: true
+        type: string
+      - description: Rule type (allow or deny)
+        in: query
+        name: ruleType
+        required: true
+        type: string
+      - description: Rule category (user or group)
+        in: query
+        name: ruleCategory
+        required: true
+        type: string
+      - description: Username or groupname to remove
+        in: query
+        name: value
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Rule entry deleted
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "400":
+          description: Bad request
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "404":
+          description: Not found
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "500":
+          description: Internal server error
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Delete access rule entry
+      tags:
+      - Access
+    get:
+      consumes:
+      - application/json
+      description: Lists access rules. Can be filtered by source, path, user, or group.
+        Can also be grouped by user or group.
+      parameters:
+      - description: Source name (e.g. 'default')
+        in: query
+        name: source
+        type: string
+      - description: Index path (e.g. /secret)
+        in: query
+        name: path
+        type: string
+      - description: Username to filter rules for
+        in: query
+        name: user
+        type: string
+      - description: Group name to filter rules for
+        in: query
+        name: group
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Varies based on query. Can be access.FrontendAccessRule (when
+            source and path specified), []access.PrincipalRule, map[string][]access.PrincipalRule,
+            or map[string]access.FrontendAccessRule
+          schema:
+            type: object
+        "400":
+          description: Bad request
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "500":
+          description: Internal server error
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: List access rules
+      tags:
+      - Access
+    post:
+      consumes:
+      - application/json
+      description: Add or update an access rule for a sourcePath and indexPath.
+      parameters:
+      - description: Source path prefix (e.g. mnt/storage)
+        in: query
+        name: source
+        required: true
+        type: string
+      - description: Index path (e.g. /secret)
+        in: query
+        name: path
+        required: true
+        type: string
+      - description: 'Rule details: allow (true/false), ruleCategory (user/group),
+          value (username or groupname)'
+        in: body
+        name: body
+        required: true
+        schema:
+          properties:
+            allow:
+              type: boolean
+            ruleCategory:
+              type: string
+            value:
+              type: string
+          type: object
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Rule added or updated
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "400":
+          description: Bad request
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "500":
+          description: Internal server error
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Add or update access rule
+      tags:
+      - Access
+  /api/access/group:
+    delete:
+      consumes:
+      - application/json
+      description: Removes a user from a group.
+      parameters:
+      - description: Group name
+        in: query
+        name: group
+        required: true
+        type: string
+      - description: User name
+        in: query
+        name: user
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: User removed from group successfully
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Remove a user from a group
+      tags:
+      - Access
+    post:
+      consumes:
+      - application/json
+      description: Adds a user to a group.
+      parameters:
+      - description: Group name
+        in: query
+        name: group
+        required: true
+        type: string
+      - description: User name
+        in: query
+        name: user
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: User added to group successfully
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Add a user to a group
+      tags:
+      - Access
+  /api/access/groups:
+    get:
+      consumes:
+      - application/json
+      description: Returns a list of all groups or the groups for a specific user.
+      parameters:
+      - description: User name
+        in: query
+        name: user
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Object containing a list of groups
+          schema:
+            $ref: '#/definitions/http.GroupListResponse'
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Get all groups or groups for a user
+      tags:
+      - Access
  /api/auth/logout:
    post:
      description: Returns a logout URL for the frontend to redirect to.
@@ -1111,6 +1594,61 @@ paths:
      summary: User login
      tags:
      - Auth
+  /api/media/subtitles:
+    get:
+      consumes:
+      - application/json
+      description: Extracts embedded subtitle content from video files by stream index
+        and returns raw WebVTT content
+      parameters:
+      - description: Index path to the video file
+        in: query
+        name: path
+        required: true
+        type: string
+      - description: Source name for the desired source
+        in: query
+        name: source
+        required: true
+        type: string
+      - description: Stream index for embedded subtitle extraction, defaults to 0
+        in: query
+        name: index
+        type: integer
+      produces:
+      - text/vtt
+      responses:
+        "200":
+          description: Raw WebVTT subtitle content
+          schema:
+            type: string
+        "400":
+          description: Bad request
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "404":
+          description: Resource not found
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "500":
+          description: Internal server error
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Extract embedded subtitles
+      tags:
+      - Subtitles
  /api/preview:
    get:
      consumes:
@@ -1634,6 +2172,31 @@ paths:
      summary: Get system settings
      tags:
      - Settings
+  /api/settings/config:
+    get:
+      consumes:
+      - application/json
+      description: Returns the current running configuration settings as YAML format
+        with optional comments and filtering.
+      parameters:
+      - description: Show all values (true) or only non-default values (false, default)
+        in: query
+        name: full
+        type: boolean
+      - description: Include comments in YAML (true) or plain YAML (false, default)
+        in: query
+        name: comments
+        type: boolean
+      produces:
+      - text/plain
+      responses:
+        "200":
+          description: System settings in YAML format
+          schema:
+            type: string
+      summary: Get system settings as YAML
+      tags:
+      - Settings
  /api/share:
    get:
      consumes:
@@ -1669,6 +2232,40 @@ paths:
      summary: Get share links by path
      tags:
      - Shares
+    post:
+      consumes:
+      - application/json
+      description: Creates a new share link with an optional expiration time and password
+        protection.
+      parameters:
+      - description: Share creation parameters
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/share.CreateBody'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Created share link
+          schema:
+            $ref: '#/definitions/share.Link'
+        "400":
+          description: Bad request - failed to decode body
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "500":
+          description: Internal server error
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Create a share link
+      tags:
+      - Shares
  /api/shares:
    delete:
      consumes:
@@ -1723,44 +2320,6 @@ paths:
      summary: List share links
      tags:
      - Shares
-    post:
-      consumes:
-      - application/json
-      description: Creates a new share link with an optional expiration time and password
-        protection.
-      parameters:
-      - description: Source Path of the files to share
-        in: query
-        name: path
-        required: true
-        type: string
-      - description: Source name of the files to share
-        in: query
-        name: source
-        required: true
-        type: string
-      produces:
-      - application/json
-      responses:
-        "200":
-          description: Created share link
-          schema:
-            $ref: '#/definitions/share.Link'
-        "400":
-          description: Bad request - failed to decode body
-          schema:
-            additionalProperties:
-              type: string
-            type: object
-        "500":
-          description: Internal server error
-          schema:
-            additionalProperties:
-              type: string
-            type: object
-      summary: Create a share link
-      tags:
-      - Shares
  /api/signup:
    post:
      consumes:
@@ -1978,11 +2537,10 @@ paths:
      description: Returns the raw content of a file, multiple files, or a directory.
        Supports downloading files as archives in various formats.
      parameters:
-      - description: a list of files in the following format 'filename' and separated
-          by '||' with additional items in the list. (required)
+      - description: if specified, only the files in the list will be downloaded.
+          eg. files=/file1||/folder/file2
        in: query
        name: files
-        required: true
        type: string
      - description: If true, sets 'Content-Disposition' to 'inline'. Otherwise, defaults
          to 'attachment'.
@@ -2028,4 +2586,62 @@ paths:
      summary: Get raw content of a file, multiple files, or directory
      tags:
      - Resources
+  /public/share/direct:
+    get:
+      consumes:
+      - application/json
+      description: Creates a direct download link for a specific file with configurable
+        duration, download count, and speed limits. If a share already exists with
+        matching parameters, the existing share will be reused.
+      parameters:
+      - description: File path to create download link for
+        in: query
+        name: path
+        required: true
+        type: string
+      - description: Source name for the file
+        in: query
+        name: source
+        required: true
+        type: string
+      - description: 'Duration in minutes for link validity (default: 60)'
+        in: query
+        name: duration
+        type: string
+      - description: 'Maximum number of downloads allowed (default: unlimited)'
+        in: query
+        name: count
+        type: string
+      - description: 'Download speed limit in kbps (default: unlimited)'
+        in: query
+        name: speed
+        type: string
+      produces:
+      - application/json
+      responses:
+        "201":
+          description: Direct download link created
+          schema:
+            $ref: '#/definitions/http.DirectDownloadResponse'
+        "400":
+          description: Bad request - invalid parameters or path is not a file
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "403":
+          description: Forbidden - access denied
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "500":
+          description: Internal server error
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Create direct download link
+      tags:
+      - Shares
 swagger: "2.0"
@@ -1 +0,0 @@
-frontend
@@ -8,11 +8,10 @@
    "node": ">=18.0.0"
  },
  "scripts": {
-    "dev": "vite dev",
-    "build": "vite build && cp -r dist/* ../backend/http/embed",
-    "build-windows": "vite build && robocopy dist ../backend/http/embed /e",
+    "build": "vite build --outDir ../backend/http/dist && cp -r ../backend/http/dist/* ../backend/http/embed",
+    "build-windows": "vite build --outDir ../backend/http/dist && robocopy ../backend/http/dist ../backend/http/embed /e",
    "build-docker": "vite build",
-    "watch": "vite build --watch",
+    "watch": "vite build --watch --outDir ../backend/http/dist",
    "typecheck": "vue-tsc -p ./tsconfig.json --noEmit",
    "lint": "eslint --ext .js,.vue,ts src",
    "lint:fix": "eslint --fix src/",
@@ -22,6 +21,7 @@
  },
  "dependencies": {
    "@onlyoffice/document-editor-vue": "^1.4.0",
+    "@skjnldsv/vue-plyr": "^7.5.0",
    "ace-builds": "^1.24.2",
    "axios": "^1.7.9",
    "clipboard": "^2.0.4",
@@ -31,6 +31,7 @@
    "file-loader": "^6.2.0",
    "glob": "^9.3.5",
    "highlight.js": "^11.11.1",
+    "jsmediatags": "github:Kurami32/jsmediatags",
    "mammoth": "^1.9.1",
    "marked": "^15.0.6",
    "normalize.css": "^8.0.1",
@@ -44,7 +45,8 @@
  "devDependencies": {
    "@intlify/eslint-plugin-vue-i18n": "^3.2.0",
    "@intlify/unplugin-vue-i18n": "^4.0.0",
-    "@playwright/test": "^1.49.1",
+    "@playwright/test": "^1.54.1",
+    "@types/node": "^24.1.0",
    "@vitejs/plugin-vue": "^5.0.4",
    "@vue/eslint-config-typescript": "^13.0.0",
    "deepl-node": "^1.18.0",
@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/local-setup",
+  timeout: 5000,
+  testDir: "./tests/playwright/copy",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1,
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://localhost:8080",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});
@@ -1,4 +1,6 @@
 server:
+  minSearchLength: 3                      # minimum length of search query to begin searching (default: 3)
+  disableUpdateCheck: false               # disables backend update check service
  numImageProcessors: 4                   # number of concurrent image processing jobs used to create previews, default is number of cpu cores available.
  socket: ""                              # socket to listen on
  tlsKey: ""                              # path to TLS key
@@ -21,7 +23,10 @@ server:
    - path: "/relative/or/absolute/path"  # file system path. (Can be relative)  validate:required
      name: "backend"                     # display name
      config:
-        indexingIntervalMinutes: 0        # optional manual overide interval in seconds to re-index the source
+        denyByDefault: false              # deny access unless an "allow" access rule was specifically created.
+        private: false                    # designate as source as private -- currently just means no sharing permitted.
+        disabled: false                   # disable the source, this is useful so you don't need to remove it from the config file
+        indexingIntervalMinutes: 0        # optional manual overide interval in minutes to re-index the source
        disableIndexing: false            # disable the indexing of this source
        maxWatchers: 0                    # number of concurrent watchers to use for this source, currently not supported
        neverWatchPaths: []
@@ -40,12 +45,12 @@ server:
        defaultUserScope: "/"             # default "/" should match folders under path
        defaultEnabled: false             # should be added as a default source for new users?
        createUserDir: false              # create a user directory for each user
-  externalUrl: ""                         # used by share links if set
-  internalUrl: ""                         # used by integrations if set, this is the url that an integration service will use to communicate with filebrowser
+  externalUrl: ""                         # used by share links if set (eg. http://mydomain.com)
+  internalUrl: ""                         # used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
  cacheDir: "tmp"                         # path to the cache directory, used for thumbnails and other cached files
  maxArchiveSize: 50                      # max pre-archive combined size of files/folder that are allowed to be archived (in GB)
 auth:
-  tokenExpirationHours: 2                 # the number of hours until the token expires. Default is 2 hours.
+  tokenExpirationHours: 2                 # time in hours each web UI session token is valid for. Default is 2 hours.
  methods:
    proxy:                                #  validate:omitempty
      enabled: false
@@ -64,8 +69,8 @@ auth:
      enforcedOtp: false                  # if set to true, TOTP is enforced for all password users users. Otherwise, users can choose to enable TOTP.
    oidc:                                 #  validate:omitempty
      enabled: false                      # whether to enable OIDC authentication
-      clientId: ""                        # client id of the OIDC application
-      clientSecret: ""                    # client secret of the OIDC application
+      clientId: "**hidden**"              # secret: client id of the OIDC application
+      clientSecret: "**hidden**"          # secret: client secret of the OIDC application
      issuerUrl: ""                       # authorization URL of the OIDC provider
      scopes: "openid email profile"      # scopes to request from the OIDC provider
      userIdentifier: "preferred_username" # the field value to use as the username. Default is "preferred_username", can also be "email" or "username", or "phone"
@@ -74,10 +79,10 @@ auth:
      createUser: false                   # create user if not exists
      adminGroup: ""                      # if set, users in this group will be granted admin privileges.
      groupsClaim: "groups"               # the JSON field name to read groups from. Default is "groups"
-  key: ""                                 # the key used to sign the JWT tokens. If not set, a random key will be generated.
-  adminUsername: "admin"                  # the username of the admin user. If not set, the default is "admin".
-  adminPassword: "admin"                  # the password of the admin user. If not set, the default is "admin".
-  totpSecret: ""                          # secret used to encrypt TOTP secrets
+  key: "**hidden**"                       # secret: the key used to sign the JWT tokens. If not set, a random key will be generated.
+  adminUsername: "**hidden**"             # secret: the username of the admin user. If not set, the default is "admin".
+  adminPassword: "**hidden**"             # secret: the password of the admin user. If not set, the default is "admin".
+  totpSecret: "**hidden**"                # secret: secret used to encrypt TOTP secrets
 frontend:
  name: "FileBrowser Quantum"             # display name
  disableDefaultLinks: false              # disable default links in the sidebar
@@ -88,8 +93,21 @@ frontend:
      url: "https://github.com/gtsteffaniak/filebrowser/releases/" # the url to link to  validate:required
    - text: "Help"                        # the text to display on the link  validate:required
      title: ""                           # the title to display on hover
-      url: "https://github.com/gtsteffaniak/filebrowser/wiki" # the url to link to  validate:required
+      url: "help prompt"                  # the url to link to  validate:required
  disableNavButtons: false                # disable the nav buttons in the sidebar
+  styling:
+    customCSS: ""                         # if a valid path to a css file is provided, it will be applied for all users. (eg. "reduce-rounded-corners.css")
+    lightBackground: "#f5f5f5"            # specify a valid CSS color property value to use as the background color in light mode
+    darkBackground: "#141D24"             # Specify a valid CSS color property value to use as the background color in dark mode
+    customThemes:                         # A list of custom css files that each user can select to override the default styling. if "default" is key name then it will be the default option.
+      default:
+        description: "The default theme"  # The description of the theme to display in the UI.
+        css: ""                           # The css file path and filename to use for the theme.
+      alternative:
+        description: "Reduce rounded corners" # The description of the theme to display in the UI.
+        css: "reduce-rounded-corners.css" # The css file path and filename to use for the theme.
+  favicon: ""                             # path to a favicon to use for the frontend
+  description: "FileBrowser Quantum is a file manager for the web which can be used to manage files on your server" # description that shows up in html head meta description
 userDefaults:
  editorQuickSave: false                  # show quick save button in editor
  hideSidebarFileActions: false           # hide the file actions in the sidebar
@@ -105,8 +123,8 @@ userDefaults:
  gallerySize: 3                          # 0-9 - the size of the gallery thumbnails
  themeColor: "var(--blue)"               # theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
  quickDownload: false                    # show icon to download in one click
-  disableOnlyOfficeExt: ".txt .csv .html .pdf" # comma separated list of file extensions to disable onlyoffice preview for
-  disableOfficePreviewExt: ""             # comma separated list of file extensions to disable office preview for
+  disablePreviewExt: ""                   # space separated list of file extensions to disable preview for
+  disableViewingExt: ""                   # space separated list of file extensions to disable viewing for
  lockPassword: false                     # disable the user from changing their password
  disableSettings: false                  # disable the user from viewing the settings page
  preview:
@@ -118,6 +136,7 @@ userDefaults:
    office: false
    popup: false
    autoplayMedia: false
+    defaultMediaPlayer: false
  permissions:
    api: false
    admin: false
@@ -130,10 +149,14 @@ userDefaults:
  fileLoading:                            # upload and download settings
    maxConcurrentUpload: 10
    uploadChunkSizeMb: 10
+  disableOnlyOfficeExt: ""                # list of file extensions to disable onlyoffice editor for
+  customTheme: ""                         # Name of theme to use chosen from custom themes config.
+  showSelectMultiple: false               # show select multiple files on desktop
+  debugOffice: false                      # debug onlyoffice editor
 integrations:
  office:                                 #  validate:omitempty
    url: ""                               # The URL to the OnlyOffice Document Server, needs to be accessible to the user.  validate:required
    internalUrl: ""                       # An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
-    secret: ""                            #  validate:required
+    secret: "**hidden**"                  # secret: authentication key for OnlyOffice integration  validate:required
  media:                                  #  validate:omitempty
    ffmpegPath: ""                        # path to ffmpeg directory with ffmpeg and ffprobe (eg. /usr/local/bin)
@@ -5,51 +5,51 @@
  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
-  <title>{{ if .Name }}{{ .Name }}{{ else }}FileBrowser Quantum{{ end }}</title>
+  <title>{{ .title }}</title>

-  <link rel="icon" type="image/png" sizes="256x256" href="{{ .StaticURL }}/img/icons/favicon-256x256.png">
+  <link rel="icon" type="image/png" sizes="256x256" href="{{ .favicon }}">

  <!--<link href="https://fonts.googleapis.com/css?family=Material+Icons|Material+Symbols+Outlined" rel="stylesheet">-->

  <!-- Add to home screen for Android and modern mobile browsers -->
  <link rel="manifest" id="manifestPlaceholder" crossorigin="use-credentials">
-  <meta name="theme-color" content="{{ if .Color }}{{ .Color }}{{ else }}#2979ff{{ end }}">
+  <meta name="theme-color" content="{{ .color }}">

  <!-- Add to home screen for Safari on iOS/iPadOS -->
  <meta name="apple-mobile-web-app-status-bar-style" content="black">
  <meta name="apple-mobile-web-app-title" content="assets">
-  <link rel="apple-touch-icon" sizes="180x180" href="{{ .StaticURL }}/img/icons/android-chrome-256x256.png">
+  <link rel="apple-touch-icon" sizes="180x180" href="{{ .appIcon }}">

  <!-- Add to home screen for Windows -->
-  <meta name="msapplication-TileImage" content="{{ .StaticURL }}/img/icons/mstile-144x144.png">
-  <meta name="msapplication-TileColor" content="{{ if .Color }}{{ .Color }}{{ else }}#2979ff{{ end }}">
+  <meta name="msapplication-TileImage" content="{{ .winIcon }}">
+  <meta name="msapplication-TileColor" content="{{ .color }}">

-  <meta name="description" content="FileBrowser Quantum is a file manager for the web which can be used to manage files on your server">
+  <meta name="description" content="{{ .description }}">
  <link rel="canonical" href="https://github.com/gtsteffaniak/filebrowser">
  <link rel="canonical" href="https://github.com/gtsteffaniak">
  <link rel="canonical" href="https://github.com/quantumx-apps">

  <!-- Inject Some Variables and generate the manifest json -->
  <script>
-    window.FileBrowser = JSON.parse('{{ .globalVars }}');
+    window.filebrowser = JSON.parse('{{ .globalVars }}');
    var dynamicManifest = {
-      "name": window.FileBrowser.Name || 'FileBrowser Quantum',
+      "name": window.filebrowser.name || 'FileBrowser Quantum',
      "icons": [
        {
-          "src": window.location.origin + "{{ .StaticURL }}/img/icons/android-chrome-256x256.png",
+          "src": window.location.origin + "{{ .staticURL }}/img/icons/android-chrome-256x256.png",
          "sizes": "512x512",
          "type": "image/png"
        },
        {
-          "src": window.location.origin + "{{ .StaticURL }}/img/icons/android-chrome-192x192.png",
+          "src": window.location.origin + "{{ .staticURL }}/img/icons/android-chrome-192x192.png",
          "sizes": "192x192",
          "type": "image/png"
        },
      ],
-      "start_url": window.location.origin + "{{ .BaseURL }}",
+      "start_url": window.location.origin + "{{ .baseURL }}",
      "display": "standalone",
      "background_color": "#ffffff",
-      "theme_color": window.FileBrowser.Color || "#455a64"
+      "theme_color": "{{ .color }}"
    }

    const stringManifest = JSON.stringify(dynamicManifest);
@@ -59,6 +59,29 @@
  </script>

  <style>
+    /* Basic Styles */
+    :root {
+      --background: {{ .lightBackground }};
+      --alt-background: #ddd;
+      --surfacePrimary: gray;
+      --surfaceSecondary: lightgray;
+      --textPrimary: #546e7a;
+      --textSecondary: gray;
+      --iconBackground: #dddddd;
+      --activeWhiteIcon: gray;
+    }
+    .dark-mode {
+      --background: {{ .darkBackground }};
+      --alt-background: #283136;
+      --surfacePrimary: #20292F;
+      --surfaceSecondary: #3A4147;
+      --divider: rgba(255, 255, 255, 0.12);
+      --textPrimary: rgba(255, 255, 255, 0.87);
+      --textSecondary: rgba(255, 255, 255, 0.6);
+      --iconBackground: #1e1f20;
+      --activeWhiteIcon: white;
+    }
+
    #loading {
      position: fixed;
      top: 0;
@@ -132,6 +155,8 @@
        transform: scale(1.0);
      }
    }
+    {{ .customCSS }}
+    {{ .userSelectedTheme }}
  </style>
 </head>

@@ -157,9 +182,6 @@
  {{end}}
  <script type="module" src="/src/main.ts"></script>

-  {{ if .CSS }}
-  <link rel="stylesheet" href="{{ .StaticURL }}/custom.css">
-  {{ end }}
 </body>

 </html>
@@ -50,9 +50,15 @@ async function translateText(text, targetLanguage, keyPath = '') {
    return text;
  }

-  if (/\{[^}]+\}/.test(text)) {
-    console.log(`Skipping translation for placeholder string: "${text}"`);
-    return text;
+  const hasPlaceholders = /\{[^}]+\}/.test(text);
+  let textToTranslate = text;
+  const options = {};
+
+  if (hasPlaceholders) {
+    console.log(`Found placeholder in: "${text}". Wrapping for translation.`);
+    textToTranslate = text.replace(/(\{[^}]+\})/g, '<ph>$1</ph>');
+    options.tagHandling = 'xml';
+    options.ignoreTags = ['ph'];
  }

  try {
@@ -60,12 +66,19 @@ async function translateText(text, targetLanguage, keyPath = '') {

    let deeplTargetLang = deeplLangMap[targetLanguage.toLowerCase()] || targetLanguage.toUpperCase();

-    const result = await translator.translateText(text, masterLanguageCode, deeplTargetLang);
+    const result = await translator.translateText(textToTranslate, masterLanguageCode, deeplTargetLang, options);

    // Delay to avoid rate-limiting
    await new Promise(resolve => setTimeout(resolve, 100));

-    return result.text;
+    let translatedText = result.text;
+
+    if (hasPlaceholders) {
+      // Unwrap the placeholders. The translator might add spaces around tags.
+      translatedText = translatedText.replace(/<ph>\s*(\{[^}]+\})\s*<\/ph>/g, '$1');
+    }
+
+    return translatedText;

  } catch (err) {
    console.error(`⚠️ Translation failed for "${text}" (${keyPath}):`, err?.message || err);
@@ -76,6 +89,8 @@ async function translateText(text, targetLanguage, keyPath = '') {
 // --- Recursive key processor ---
 async function processKeys(masterObj, targetObj, targetLangCode, currentPathParts = []) {
  let changesMade = false;
+
+  // First pass: Add/update keys from master to target
  for (const key in masterObj) {
    if (Object.prototype.hasOwnProperty.call(masterObj, key)) {
      const currentPathPartsNext = [...currentPathParts, key];
@@ -123,6 +138,24 @@ async function processKeys(masterObj, targetObj, targetLangCode, currentPathPart
      }
    }
  }
+
+  // Second pass: Remove obsolete keys that exist in target but not in master
+  const keysToRemove = [];
+  for (const key in targetObj) {
+    if (Object.prototype.hasOwnProperty.call(targetObj, key)) {
+      if (!masterObj.hasOwnProperty(key)) {
+        keysToRemove.push(key);
+      }
+    }
+  }
+
+  for (const key of keysToRemove) {
+    const currentKeyPath = [...currentPathParts, key].join('.');
+    console.log(`🗑️  Removing obsolete key "${currentKeyPath}" from ${targetLangCode}.json`);
+    delete targetObj[key];
+    changesMade = true;
+  }
+
  return changesMade;
 }

@@ -0,0 +1,55 @@
+import { fetchJSON } from './utils'
+import { getApiPath } from '@/utils/url.js'
+
+/**
+ * @param {string} source
+ * @param {string} path
+ * @returns {Promise<any>}
+ */
+export async function get(source, path) {
+  const apiPath = getApiPath('api/access', { source, path })
+  return fetchJSON(apiPath)
+}
+/**
+ * @param {string} source
+ * @returns {Promise<any>}
+ */
+export async function getAll(source) {
+  const apiPath = getApiPath('api/access', { source })
+  return fetchJSON(apiPath)
+}
+/**
+ * @returns {Promise<{groups: string[]}>}
+ */
+export async function getGroups() {
+  const apiPath = getApiPath('api/access/groups')
+  return fetchJSON(apiPath)
+}
+/**
+ * @param {string} source
+ * @param {string} path
+ * @param {object} body
+ * @returns {Promise<any>}
+ */
+export async function add(source, path, body) {
+  const apiPath = getApiPath('api/access', { source, path });
+  return fetchJSON(apiPath, {
+    method: 'POST',
+    body: JSON.stringify(body),
+    headers: { 'Content-Type': 'application/json' }
+  });
+}
+/**
+ * @param {string} source
+ * @param {string} path
+ * @param {{ allow: boolean; ruleCategory: string; value: string; }} body
+ * @returns {Promise<any>}
+ */
+export async function del(source, path, body) {
+  const ruleType = body.allow ? 'allow' : 'deny';
+  const { ruleCategory, value } = body;
+  const apiPath = getApiPath('api/access', { source, path, ruleType, ruleCategory, value });
+  return fetchJSON(apiPath, {
+    method: 'DELETE'
+  });
+}
Author	SHA1	Message	Date
NotAlexNoyle	97e5f12f7a	Fix typo in Configuration Setup	2025-09-10 08:56:54 -04:00
Graham Steffaniak Max Kurami	256f4ca0b8	Beta/v0.8.4 (#1187 ) Co-authored-by: Max <mail@kjmax.com> Co-authored-by: Kurami <kurami32_kbm@proton.me>	2025-09-05 18:56:18 -05:00
Graham Steffaniak	831708fe65	Add go tool (#1154 )	2025-08-28 18:26:29 -05:00
Graham Steffaniak	50bd853266	Beta/v0.8.3 (#1150 )	2025-08-28 15:04:08 -05:00
Graham Steffaniak	206180de0d	Beta/v0.8.2 (#1123 )	2025-08-25 10:58:31 -05:00
Graham Steffaniak	5b0f388fa5	Beta/v0.8.1 (#1106 )	2025-08-22 17:45:44 -05:00
Graham Steffaniak Kurami Socramk	7d0707ebe0	Beta/v0.8.0 (#1080 ) Co-authored-by: Kurami <178341547+Kurami32@users.noreply.github.com> Co-authored-by: Socramk <155040241+socramcaro2@users.noreply.github.com>	2025-08-20 10:04:44 -05:00
Kurami	41cb97a1c5	Updated translation for spanish (#1076 )	2025-08-19 16:03:10 -05:00
Socramk	0b212ce1b4	Traduccion es (#1063 )	2025-08-16 11:44:49 -05:00
Kurami	7f0a0209af	Update translation for spanish (#1055 )	2025-08-12 09:25:38 -05:00
Graham Steffaniakandmordillo	642333ec68	Beta/v0.7.18 (#1034 ) Co-authored-by: mordillo <121123040+mordilloSan@users.noreply.github.com>	2025-07-30 17:50:07 -05:00
Graham Steffaniakandmordillo	ec43926d3c	Beta/v0.7.17 (#1017 ) Co-authored-by: mordillo <121123040+mordilloSan@users.noreply.github.com>	2025-07-25 17:46:00 -05:00
Graham Steffaniak	9202043000	Update pr.yaml to run against main (#998 )	2025-07-22 13:53:21 -05:00
Graham Steffaniak	4d04e02c31	v0.7.16-beta (#991 ) (#992 )	2025-07-21 18:21:31 -05:00
Graham Steffaniak	04d72998b6	Beta/v0.7.15 (#988 )	2025-07-20 11:38:03 -05:00
Graham Steffaniak	f836a2c4df	Beta/v0.7.14 (#964 )	2025-07-12 16:57:31 -05:00
				`@@ -0,0 +1 @@`
				`demo-127.0.0.1:$apr1$j5FRA4Bc$RYdNFuM7YAAo9Qtie8w4b/`