updated (#1287)

.dockerignore

@@ -1,5 +1,6 @@
 backend/**.db
 backend/tmp
+backend/dist
 backend/backend*
 backend/vendor/**
 frontend/dist/**

CHANGELOG.md

@@ -11,6 +11,9 @@ All notable changes to this project will be documented in this file. For commit
  **BugFixes**:
  - error when running without a config file #1280
  - Issue persist in 0.8.7 with Access Management #1282
+ - all static resources go through /public/static url to fix logout loop #995
+ - "realtime" Permission of API keys is not working #1141
+ - "Path not found" when trying to share a file or folder inside a sub-directory #1139
 
 ## v0.8.7-beta
 

backend/http/api.go

@@ -46,10 +46,11 @@ func createApiKeyHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 	}
 	// Parse permissions from the query parameter
 	permissions := users.Permissions{
-		Api:    strings.Contains(permissionsStr, "api") && d.user.Permissions.Api,
-		Admin:  strings.Contains(permissionsStr, "admin") && d.user.Permissions.Admin,
-		Modify: strings.Contains(permissionsStr, "modify") && d.user.Permissions.Modify,
-		Share:  strings.Contains(permissionsStr, "share") && d.user.Permissions.Share,
+		Api:      strings.Contains(permissionsStr, "api") && d.user.Permissions.Api,
+		Admin:    strings.Contains(permissionsStr, "admin") && d.user.Permissions.Admin,
+		Modify:   strings.Contains(permissionsStr, "modify") && d.user.Permissions.Modify,
+		Share:    strings.Contains(permissionsStr, "share") && d.user.Permissions.Share,
+		Realtime: strings.Contains(permissionsStr, "realtime") && d.user.Permissions.Realtime,
 	}
 
 	// Convert the duration string to an int64

backend/http/share.go

@@ -257,7 +257,12 @@ func sharePostHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 	if idx == nil {
 		return http.StatusForbidden, fmt.Errorf("source with name not found: %s", body.Source)
 	}
-
+	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, source.Name)
+	if err != nil {
+		return http.StatusForbidden, err
+	}
+	scopePath := utils.JoinPathAsUnix(userscope, body.Path)
+	body.Path = scopePath
 	// validate path exists as file or folder
 	_, exists := idx.GetReducedMetadata(body.Path, true) // true to check if it exists
 	if !exists {
@@ -267,13 +272,6 @@ func sharePostHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 			return http.StatusForbidden, fmt.Errorf("path not found: %s", body.Path)
 		}
 	}
-
-	userscope, err := settings.GetScopeFromSourceName(d.user.Scopes, source.Name)
-	if err != nil {
-		return http.StatusForbidden, err
-	}
-	scopePath := utils.JoinPathAsUnix(userscope, body.Path)
-	body.Path = scopePath
 	body.Source = source.Path // backend source is path
 	s = &share.Link{
 		Expire:       expire,

backend/http/static.go

@@ -51,10 +51,7 @@ func handleWithStaticData(w http.ResponseWriter, r *http.Request, d *requestCont
 	}
 
 	defaultThemeColor := "#455a64"
-	staticURL := config.Server.BaseURL + "static"
-	if d.share != nil {
-		staticURL = config.Server.BaseURL + "public/static"
-	}
+	staticURL := config.Server.BaseURL + "public/static"
 
 	// Use custom favicon if configured and validated, otherwise fall back to default
 	var favicon string

backend/swagger/docs/docs.go

@@ -499,11 +499,6 @@ const docTemplate = `{
         },
         "/api/auth/otp/generate": {
             "post": {
-                "security": [
-                    {
-                        "ApiKeyAuth": []
-                    }
-                ],
                 "description": "Generates a new TOTP secret and QR code for the authenticated user.",
                 "consumes": [
                     "application/json"
@@ -534,16 +529,16 @@ const docTemplate = `{
                             }
                         }
                     }
-                }
-            }
-        },
-        "/api/auth/otp/verify": {
-            "post": {
+                },
                 "security": [
                     {
                         "ApiKeyAuth": []
                     }
-                ],
+                ]
+            }
+        },
+        "/api/auth/otp/verify": {
+            "post": {
                 "description": "Verifies the provided TOTP code for the authenticated user.",
                 "consumes": [
                     "application/json"
@@ -580,7 +575,12 @@ const docTemplate = `{
                             }
                         }
                     }
-                }
+                },
+                "security": [
+                    {
+                        "ApiKeyAuth": []
+                    }
+                ]
             }
         },
         "/api/auth/token": {

backend/swagger/docs/swagger.json

@@ -488,11 +488,6 @@
         },
         "/api/auth/otp/generate": {
             "post": {
-                "security": [
-                    {
-                        "ApiKeyAuth": []
-                    }
-                ],
                 "description": "Generates a new TOTP secret and QR code for the authenticated user.",
                 "consumes": [
                     "application/json"
@@ -523,16 +518,16 @@
                             }
                         }
                     }
-                }
-            }
-        },
-        "/api/auth/otp/verify": {
-            "post": {
+                },
                 "security": [
                     {
                         "ApiKeyAuth": []
                     }
-                ],
+                ]
+            }
+        },
+        "/api/auth/otp/verify": {
+            "post": {
                 "description": "Verifies the provided TOTP code for the authenticated user.",
                 "consumes": [
                     "application/json"
@@ -569,7 +564,12 @@
                             }
                         }
                     }
-                }
+                },
+                "security": [
+                    {
+                        "ApiKeyAuth": []
+                    }
+                ]
             }
         },
         "/api/auth/token": {

frontend/src/utils/auth.js

@@ -76,11 +76,9 @@ export async function logout() {
       // Handle potential errors from the API, e.g., res.status 401, 500
       console.error("Logout API call failed:", res.status, res.statusText);
     }
-
   } catch (e) {
     console.error("An error occurred during logout:", e);
   }
-
 }
 
 // Helper function to retrieve the value of a specific cookie