Exclude CODEOWNERS from language statistics

Add CODEOWNERS (one staff approval)
Update README.md (#1667 )
2026-11-01 10:10:00 -05:00 · 2026-11-01 10:10:00 -05:00 · 2025-11-26 19:04:24 -06:00 · 2025-11-24 15:01:49 -06:00 · 2025-11-19 14:30:37 -06:00 · 2025-11-19 08:50:49 -06:00
338 changed files with 45487 additions and 8428 deletions
@@ -0,0 +1 @@
+.gitea/CODEOWNERS linguist-detectable=false
@@ -0,0 +1,3 @@
+# Pull requests request review from the eligible staff team(s).
+# One approval from either an Admin or Developer satisfies branch protection.
+*   @trueog/Admins @trueog/Developers
@@ -7,6 +7,7 @@ on:
      - "dev/v*.*.*"
      - "beta/v*.*.*"
      - "stable/v*.*.*"
+      - "staging/v*.*.*"
 jobs:
  prime_docker_cache:
    name: Prime docker cache
@@ -86,25 +86,3 @@ jobs:
          git push origin "$STABLE_BRANCH"

          echo "✅ Successfully merged '$BETA_BRANCH' into '$STABLE_BRANCH'."
-
-#      - name: Delete beta branch after successful merge
-#        run: |
-#          VERSION="${{ github.event.inputs.version }}"
-#          BETA_BRANCH="beta/v$VERSION"
-#
-#          # Delete beta branch locally and remotely
-#          git branch -d "$BETA_BRANCH"
-#          git push origin --delete "$BETA_BRANCH"
-#
-#          echo "✅ Successfully deleted '$BETA_BRANCH'."
-
-      - name: Create Pull Request to Main
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.PAT }}
-          commit-message: "Promote stable/v${{ github.event.inputs.version }} to main"
-          title: "Promote stable/v${{ github.event.inputs.version }} to main"
-          body: "This PR promotes stable/v${{ github.event.inputs.version }} to the main branch."
-          base: main
-          branch: stable/v${{ github.event.inputs.version }}
-          delete-branch: false
@@ -86,14 +86,3 @@ jobs:
          git push origin "$BETA_BRANCH"

          echo "✅ Successfully merged '$DEV_BRANCH' into '$BETA_BRANCH'."
-
-#      - name: Delete dev branch after successful merge
-#        run: |
-#          VERSION="${{ github.event.inputs.version }}"
-#          DEV_BRANCH="dev/v$VERSION"
-#
-#          # Delete dev branch locally and remotely
-#          git branch -d "$DEV_BRANCH"
-#          git push origin --delete "$DEV_BRANCH"
-#
-#          echo "✅ Successfully deleted '$DEV_BRANCH'."
@@ -59,8 +59,8 @@ jobs:
          target_commitish: ${{ github.sha }}
          token: ${{ secrets.PAT }}
          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
-          prerelease: false # change this to false when stable gets released
-          make_latest: true # change this to false when stable gets released
+          prerelease: true
+          make_latest: false
          draft: false
          generate_release_notes: true
          name: ${{ steps.extract_branch.outputs.tag_name }}
@@ -1,62 +0,0 @@
-name: dev release
-
-on:
-  push:
-    branches:
-      - "dev/v[0-9]+.[0-9]+.[0-9]+"
-
-permissions:
-  contents: write
-
-jobs:
-  push_release_to_registry:
-    name: Push release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{ secrets.PAT }}
-      - name: Extract metadata (tags, labels) for Docker and GHCR
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            gtstef/filebrowser
-            ghcr.io/gtsteffaniak/filebrowser
-      - name: Modify version names
-        id: modify-json
-        run: |
-          TAGS="${{ steps.meta.outputs.tags }}"
-          # Apply modifications to both docker.io and ghcr.io tags
-          CLEANED_TAGS=$(echo "$TAGS" | sed 's/filebrowser:dev-v/filebrowser:/g' | sed -E 's/(filebrowser:[0-9]+\.[0-9]+\.[0-9]+)/\1-dev/g')
-          # Add dev tag to both registries
-          CLEANED_TAGS="$CLEANED_TAGS,gtstef/filebrowser:dev,ghcr.io/gtsteffaniak/filebrowser:dev"
-          echo "cleaned_tag<<EOF" >> $GITHUB_OUTPUT
-          echo "$CLEANED_TAGS" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64
-          file: ./_docker/Dockerfile
-          push: true
-          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}
@@ -10,7 +10,7 @@ permissions:

 jobs:
  test_playwright:
-    name: Test Playwright
+    name: Test Playwright - regular
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
@@ -60,6 +60,7 @@ jobs:
          token: ${{ secrets.PAT }}
          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
          prerelease: false
+          make_latest: true
          draft: false
          generate_release_notes: true
          name: ${{ steps.extract_branch.outputs.tag_name }}
@@ -20,7 +20,6 @@ frontend/tsconfig.tsbuildinfo
 /frontend/screenshots
 /frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
-/frontend/package-lock.json
 /backend/vendor
 /backend/*.cov
 /backend/*test_config.yaml
@@ -53,3 +52,7 @@ bin/
 build/
 *__debug*
 backend/custom.css
+
+# Runtime cache directories created by tests/application
+backend/preview/heic/
+backend/preview/thumbnails/
@@ -2,6 +2,126 @@

 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).

+## v1.1.1-beta
+
+ **Notes**:
+ - [docker] upgraded ffmpeg 8.0 to 8.0.1
+ - stricter access control checks on file downloads.
+ - Wrong translation on Chinese "save" button #1650
+ - Incorrect Spanish Translations in Folder Creation and Rename Actions #1626
+ - duplicate file detector has stricter partial checksum match #1617
+
+ **BugFixes**:
+ - added missing exiftool to docker image for heic conversion orientation support
+ - v1.1.0-beta - Incorrect naming of 1 file in directory-info #1621
+ - disable only office viewing settings not applying
+ - OnlyOffice integration does not work behind proxy authentication #1422
+ - Newly created users "add on" to defined scope of previous user #1628 #1518
+ - disable chown on upload / file saving #1469 #1546
+ - Uploading a file will silently overwrite any existing file with the same name #1564
+ - share file url issue
+ - Fix drag and drop and rows in normal view #1651
+ - Some text based files are not able to edit. #1567
+
+## v1.1.0-beta
+
+ **New Features**:
+ - Added tools
+   - size analyzer -- quickly show largest files in interactive graphical chart
+   - duplicate finder -- find duplicate files larger than 1MB
+   - material icon picker and previewer
+ - Listing View Style updates
+   - Status bar for listing view #1459
+   - Duration field shows up if media is shown with duration
+   - More dynamic view modes with additional styling changes
+   - Total display modes consolidated into 3 main groups: list, gallery, normal. "icon" and "compact" mode exist as views based on display size setting.
+ - Customizable sidebar links
+   - Logged in users can have their preferences saved and synced
+   - Can rearrange, add custom links, and save your preferences.
+   - Can customize shares with their own custom sidebar links.
+ - Dynamic scopes for OIDC #1414 #1363
+ - Share and Access Rules validation
+   - If a file/path is moved/renamed in UI its rules and shares will always follow.
+   - If a file/path is moved/renamed outside UI, a warning message will show and ability to associate to new path
+ - Cascade delete access in Access Management when deleting a User #1347
+ - Enhanced notifications #1331
+   - Added "toast" notification type support -- most success messages show as toast now.
+   - multiple stacked notifications possible
+   - notification button support, such as click to open folder after moving file.
+   - notification history (not including toasts)
+   - Add swipe and visual timeout to notifications #1600
+ - Choose different bind ip via `server.listen` #1573
+ - Allow disabling clearing cache each startup via `server.cacheDirCleanup: false` in config #1576
+
+ **Notes**:
+ - more efficient user update actions. Successful PUT actions return only 204 if successful.
+ - Do not enter directory on "New Folder" action #1343
+ - Improved indexing performance - individual scanners per directory at root.
+ - Improved search memory efficiency
+ - Improved scrolling performance
+ - Static file handling has been streamlined, could potentially see some changes from this.
+ - No longer automatically publishing any dev builds to docker
+ - deprecated "DefaultLandingPage" option -- now determined by first source link in sidebar.
+ - Improve rename prompt #1608 #1556
+
+ **BugFixes**:
+ - uploading/editing/saving to password protected shares error
+ - updating a share with password protection without a password removed the password.
+ - per-user download counts were not persistant accross restarts
+ - "Update" button in Chinese wraps incorrectely #1542
+
+## v1.0.1-stable
+
+ **BugFixes**:
+ - UserDefault always applies to newly created users #1518
+ - Updating user's own password sometimes doesn't work
+ - Anonymous Share link with optional password does not allow downloads #1553
+ - Share options should go in the meta tags #1511
+ - Unable to select compression format when downloading multiple files/dir via Share link (v1.0.0) #1557
+ - fixed sidebar clipping on some browsers like safari
+ - Files show as Download is not available even though it is #1537
+
+## v1.0.1-beta & v1.0.0-stable
+
+ **New Features**:
+ - login icon support added via `frontend.loginIcon` config path variable
+
+ **Notes**:
+ - updated default login icon
+ - stopped publishing rolling `dev` docker tag.
+ - build requirement change -- from node 18 > node 20 with npm 9.0.0+
+ - version is not shown for unauthenticated users #1444
+ - adjusted how static assets are served to better handle icon standards
+ - fixed signup login #1444
+ - update makefile linker flags to properly set version and sha #1474
+ - better windows build support -- `make setup` and `make dev` work as long as git is installed on windows
+ - added better first initilization detection
+   - If filebrowser initialized and does not detect a database, a new warning message in server logs appears.
+   - If theres no database on start, any admin user's first login will see a welcome message in the ui.
+   - For docker, it defaults to ./data/database.db, but will also fallback to ./database.db without any additional configuration.
+
+ **BugFixes**:
+ - Generating multiple HEIC previews in parallel fails #1470
+ - ? in path not always encoded right #1447
+ - fixed some condition that the halloween background doesn't load properly
+ - some comments not showing up on config viewer in settings
+
+## v1.0.0-beta
+
+ **Notes**:
+ - Enhanced onlyoffice debugger with more wholistic backend logs
+ - Updated info prompt styling
+ - share qr code links to externalUrl for entire share if exists #1329
+
+ **BugFixes**:
+ - cookie host is set using x-Forwarded-Host to better support reverse proxies.
+ - HEIC conversion not working #1460
+ - 'Prevent user changing their password' also prevents admins changing the users password. #1365
+ - OnlyOffice write problem #1397 #1068
+ - Conditionals starting with a . seem to not work. #1455
+ - Last modified in file info is empty #1443
+ - Share links: 'Default View Mode' does not apply to subfolders. #1463
+
 ## v0.8.11-beta

 **New Features**:
@@ -5,9 +5,9 @@ Thank you for your interest in contributing to FileBrowser Quantum! This guide w
 ## Prerequisites

 - **Go 1.25+** (see `backend/go.mod`)
- **Node.js 18.0.0+** with npm 7.0.0+ (see `frontend/package.json`)
+- **Node.js 20.0.0+** with npm 9.0.0+ (see `frontend/package.json`)
 - **Docker** (optional, for containerized development)
- **Git**
+- **Git** especially improtant on windows -- needed for bash support.

 ### Optional Tools

@@ -2,7 +2,7 @@

  [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
-  [![latest version](https://img.shields.io/github/release/gtsteffaniak/filebrowser/all.svg)](https://github.com/gtsteffaniak/filebrowser/releases)
+  [![latest version](https://img.shields.io/github/v/release/gtsteffaniak/filebrowser)](https://github.com/gtsteffaniak/filebrowser/releases)
  [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
  [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)

@@ -15,12 +15,9 @@
  <img width="800" src="https://github.com/user-attachments/assets/162d7a95-33b7-49bd-976c-dd6822c0d22b">
 </div>

-> [!WARNING]
-> There is no stable version -- :construction: coming very soon!
-
 ## Pinned

-:loudspeaker: [Stable Release & v1.0.0 Update](https://github.com/gtsteffaniak/filebrowser/discussions/1293)
+:loudspeaker: [What's Coming Soon](https://github.com/gtsteffaniak/filebrowser/discussions/1622)

 :pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)

@@ -38,26 +35,26 @@ Ready to try it out? See [Getting Started Docs](https://filebrowserquantum.com/e

 FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:

-  1. ✅ Multiple sources support
+  1. ✅ Add and configure multiple sources
  2. ✅ Login support for OIDC, password + 2FA, and proxy.
  3. ✅ Beautiful, Responsive, and Customizable user interface.
-  4. ✅ Simplified configuration via `config.yaml` config file.
+  4. ✅ Streamlined configuration via `config.yaml` config file.
  5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
     - Real-time search results as you type.
     - Real-time monitoring and updates in the UI.
     - Search supports file and folder sizes, along with various filters.
  6. ✅ Better listing browsing
-     - More file type previews, such as **office** and **video** file previews
-     - Instantly switches view modes and sort order without reloading data.
-     - Folder sizes are displayed.
+     - Better thumbnail support including **office**, **video**, and **album artwork**
+     - Faster and more responsive views with animations.
+     - Folder sizes are displayed and support for thumbnails
     - Navigating remembers the last scroll position.
-  7. ✅ Highly configurable and customizable sharing options, incuding:
+  7. ✅ Highly configurable and customizable sharing options
     - share expiration time
     - users who can access share (including anonymous)
     - styling and themes
     - file viewing, editing, and uploading permissions
  8. ✅ Directory-level access control that can be scoped to user or group.
-  8. ✅ Developer API support
+  9. ✅ Developer API support
     - Ability to create long-lived API Tokens.
     - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.

@@ -105,11 +102,11 @@ Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Windows                       | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Self hostable                 | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Has Stable Release?           | :construction: | ✅ | ✅ | ✅ | ✅ | ✅ |
+Has Stable Release?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
 webdav support                | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
 FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Dedicated docs site?          | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
+Dedicated docs site?          | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Docker image size             | 180 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
 Min. Memory Requirements      | 256 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
@@ -1,4 +1,4 @@
-FROM gtstef/ffmpeg:8.0-decode AS ffmpeg
+FROM gtstef/ffmpeg:8.0.1-decode AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION
@@ -13,7 +13,7 @@ RUN go build -tags mupdf,musl -ldflags="-w -s \
  -o filebrowser .
 RUN upx filebrowser

-FROM node:lts-slim AS nbuild
+FROM node:jod-slim AS nbuild
 WORKDIR /app
 COPY ./frontend/package.json ./
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
@@ -28,19 +28,21 @@ COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
 ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
 ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
 ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata curl
+RUN apk --no-cache add ca-certificates mailcap tzdata curl exiftool
 RUN adduser -D -s /bin/true -u 1000 filebrowser
 USER filebrowser
 WORKDIR /home/filebrowser
 # copy config to two locations for compatibility
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "/app/config.yaml", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
 COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 RUN [ "ffmpeg", "-version" ]
 RUN [ "ffprobe", "-version" ]
+RUN [ "exiftool", "-ver" ]
 USER root
 # exposing default port for auto discovery.
 EXPOSE 80
@@ -15,5 +15,6 @@ RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser set -u testuser1,testuser1
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -14,4 +14,5 @@ RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -14,4 +14,5 @@ RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
-#RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -8,6 +8,8 @@ RUN mkdir -p ./http/dist
 COPY [ "./_docker/src/oidc/backend/", "./"]
 COPY ["./backend/filebrowser", "./"]
 COPY [ "./backend/http/embed/", "./http/dist/"]
+
 # Run tests
 WORKDIR /app/frontend
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -11,4 +11,5 @@ RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
 RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
 RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -2,16 +2,19 @@ FROM ghcr.io/gtsteffaniak/playwright-base:latest
 WORKDIR /app

 # Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/no-config/", "./" ]
+COPY [ "./_docker/src/settings/", "./" ]

 WORKDIR /app/frontend
-COPY [ "./_docker/src/no-config/frontend/", "./" ]
+COPY [ "./_docker/src/settings/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]

 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser*", "./"]
+COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
 RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN ./filebrowser set -u testuser1,testuser1
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -14,4 +14,5 @@ RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -11,7 +11,7 @@ RUN go build -ldflags="-w -s \
  -o filebrowser .
 RUN upx filebrowser

-FROM node:lts-slim AS nbuild
+FROM node:jod-slim AS nbuild
 WORKDIR /app
 COPY ./frontend/package.json ./
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
@@ -30,6 +30,7 @@ USER filebrowser
 WORKDIR /home/filebrowser
 COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
 COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
@@ -2,6 +2,7 @@ frontend-main: &frontend-main
  name: "Graham's Filebrowser"
  disableDefaultLinks: true
  styling:
+    disableEventThemes: true
    customThemes:
      no-rounded:
        description: "No rounded corners" # The description of the theme to display in the UI.
@@ -26,10 +26,17 @@ server:
              viewable: true
            - fileStartsWith: "startsWith"
            - folderEndsWith: "Folder"
+            - folderNames: 'folderNames'
+            - fileNames: 'fileNames'
+            - folderName: 'folderName'
+            - fileName: 'fileName'
+            - folderName: '.hiddenDir'
+            - fileName: '.hidden'

 auth:
  methods:
    noauth: true
+
 frontend:
  name: "Graham's Filebrowser"
  disableDefaultLinks: true
@@ -37,11 +44,11 @@ frontend:
    - text: "A playwright test"
      url: "https://playwright.dev/"
      title: "Playwright"
-userDefaults:
-  permissions:
-   realtime: true
+  styling:
+    disableEventThemes: true

 userDefaults:
+  showHidden: true
  preview:
    image: true
    popup: true
@@ -14,7 +14,8 @@ frontend:
    - text: "A playwright test"
      url: "https://playwright.dev/"
      title: "Playwright"
-
+  styling:
+    disableEventThemes: true
 auth:
  methods:
    password:
@@ -16,7 +16,8 @@ frontend:
    - text: "A playwright test"
      url: "https://playwright.dev/"
      title: "Playwright"
-
+  styling:
+    disableEventThemes: true
 auth:
  methods:
    password:
@@ -17,6 +17,7 @@ frontend:
  name: "Graham's Filebrowser"
  disableDefaultLinks: true
  styling:
+    disableEventThemes: true
    customThemes:
      no-rounded:
        description: "No rounded corners" # The description of the theme to display in the UI.
@@ -24,4 +25,9 @@ frontend:
  externalLinks:
    - text: "A playwright test"
      url: "https://playwright.dev/"
-      title: "Playwright"
+      title: "Playwright"
+
+auth:
+  methods:
+    password:
+      signup: true
@@ -11,14 +11,14 @@ import { defineConfig, devices } from "@playwright/test";
 */
 export default defineConfig({
  globalSetup: "./tests/playwright/global-setup",
-  timeout: 10000,
+  timeout: 3000,
  testDir: "./tests/playwright/settings",
  /* Run tests in files in parallel */
  fullyParallel: false,
  /* Fail the build on CI if you accidentally left test.only in the source code. */
  forbidOnly: false,
  /* Retry on CI only */
-  retries: 2,
+  retries: 1,
  /* Opt out of parallel tests on CI. */
  workers: 1,
  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
@@ -20,4 +20,6 @@ frontend:
  externalLinks:
    - text: "A playwright test"
      url: "https://playwright.dev/"
-      title: "Playwright"
+      title: "Playwright"
+  styling:
+    disableEventThemes: true
@@ -2,11 +2,11 @@ root = "."
 tmp_dir = "tmp"

 [build]
-  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/version.CommitSHA=testingCommit' -X 'github.com/gtsteffaniak/filebrowser/backend/version.Version=testing'\" ."
+  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=version'\" ."
  bin = "tmp/filebrowser"
  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser -c test_config.yaml"
  include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "http/dist", "http/embed", "swagger/docs"]
+  exclude_dir = ["tmp", "vendor", "http/dist", "http/embed", "swagger/docs", "preview/thumbnails", "preview/heic"]
  log = "air.log"
  delay = 1000 # ms

@@ -14,4 +14,4 @@ tmp_dir = "tmp"
  time = true

 [misc]
-  clean_on_exit = true
+  clean_on_exit = false
@@ -0,0 +1,21 @@
+root = "."
+tmp_dir = "tmp"
+
+[build]
+  cmd = "go build -o ./tmp/filebrowser.exe --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=version'\" ."
+  bin = "tmp/filebrowser.exe"
+  args_bin = ["-c", "test_config.yaml"]
+  include_ext = ["go", "tpl", "tmpl", "html"]
+  exclude_dir = ["tmp", "vendor", "http\\dist", "http\\embed", "swagger\\docs"]
+  exclude_unchanged = true
+  follow_symlink = false
+  poll = true
+  poll_interval = 1000
+  log = "air.log"
+  delay = 1000 # ms
+
+[log]
+  time = true
+
+[misc]
+  clean_on_exit = false
@@ -1,49 +0,0 @@
-FROM gtstef/ffmpeg:8.0-decode AS ffmpeg
-FROM golang:alpine AS base
-ARG VERSION
-ARG REVISION
-WORKDIR /app
-COPY ./backend ./
-RUN apk update && apk add --no-cache gcc musl-dev upx
-ENV CGO_ENABLED=1
-ENV GOEXPERIMENT=greenteagc
-RUN go build -tags mupdf,musl -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
-  -o filebrowser .
-RUN upx filebrowser
-
-FROM node:lts-slim AS nbuild
-WORKDIR /app
-COPY ./frontend/package.json ./
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
-    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
-    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN npm i --maxsockets 1
-COPY  ./frontend/ ./
-RUN npm run build:docker
-
-FROM alpine:latest
-COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
-ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
-ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
-ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata curl
-RUN adduser -D -s /bin/true -u 1000 filebrowser
-USER filebrowser
-WORKDIR /home/filebrowser
-# copy config to two locations for compatibility
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "/app/config.yaml", "./" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
-## sanity checks
-RUN [ "filebrowser", "version" ]
-RUN [ "ffmpeg", "-version" ]
-RUN [ "ffprobe", "-version" ]
-USER root
-# exposing default port for auto discovery.
-EXPOSE 80
-HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-  CMD curl -f http://localhost:80/health || exit 1
-ENTRYPOINT [ "./filebrowser" ]
@@ -1,4 +0,0 @@
-FROM node:22-slim
-WORKDIR /app/frontend
-RUN npm i @playwright/test oauth2-mock-server @types/node
-RUN npx playwright install --with-deps firefox
@@ -1,19 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/general/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/general/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-RUN ./filebrowser set -u testuser1,testuser1
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,17 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/no-config/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/no-config/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,17 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/noauth/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-COPY [ "./frontend/tests/playwright-files", "./tests/playwright-files2" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-#RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,13 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-
-COPY [ "./_docker/src/oidc/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-RUN mkdir -p ./http/dist
-COPY [ "./_docker/src/oidc/backend/", "./"]
-COPY ["./backend/filebrowser", "./"]
-COPY [ "./backend/http/embed/", "./http/dist/"]
-# Run tests
-WORKDIR /app/frontend
-RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,14 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-COPY [ "./_docker/src/proxy/", "./" ]
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-RUN apt update && apt install nginx -y
-RUN mv default.conf /etc/nginx/conf.d/default.conf
-RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
-RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
-RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,17 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/no-config/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/no-config/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,17 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/sharing/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/sharing/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
@@ -1,42 +0,0 @@
-FROM golang:alpine AS base
-ARG VERSION
-ARG REVISION
-WORKDIR /app
-COPY ./backend ./
-RUN apk update && apk add upx
-ENV GOEXPERIMENT=greenteagc
-RUN go build -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
-  -o filebrowser .
-RUN upx filebrowser
-
-FROM node:lts-slim AS nbuild
-WORKDIR /app
-COPY ./frontend/package.json ./
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
-    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
-    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN npm i --maxsockets 1
-COPY  ./frontend/ ./
-RUN npm run build:docker
-
-FROM alpine:latest
-ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
-ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata curl
-RUN adduser -D -s /bin/true -u 1000 filebrowser
-USER filebrowser
-WORKDIR /home/filebrowser
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
-## sanity checks
-RUN [ "filebrowser", "version" ]
-USER root
-# exposing default port for auto discovery.
-EXPOSE 80
-HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-  CMD curl -f http://localhost:80/health || exit 1
-ENTRYPOINT [ "./filebrowser" ]
@@ -1,17 +0,0 @@
-services:
-  nginx-proxy-auth:
-    image: nginx
-    container_name: nginx-proxy-auth
-    ports:
-      - "80:80"
-    volumes:
-      - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
-      - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
-  filebrowser:
-    hostname: filebrowser
-    volumes:
-      - '../frontend:/home/frontend'
-      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
-    build:
-      context: ../
-      dockerfile: ./_docker/Dockerfile.slim
@@ -1,15 +0,0 @@
-server:
-  <<: *server-main
-frontend:
-  <<: *frontend-main
-
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
-  permissions:
-    download: true
-    create: true
@@ -1,12 +0,0 @@
-frontend-main: &frontend-main
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  styling:
-    customThemes:
-      no-rounded:
-        description: "No rounded corners" # The description of the theme to display in the UI.
-        css: "no-rounded.css" # The css file path and filename to use for the theme.
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
@@ -1,15 +0,0 @@
-server-main: &server-main
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        disableIndexing: true
-        defaultEnabled: true
@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/global-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/general",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});
@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/no-config-setup",
-  timeout: 5000,
-  testDir: "./tests/playwright/no-config",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});
@@ -1,53 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/files/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "exclude"
-      config:
-        defaultEnabled: true
-        conditionals:
-          rules:
-            - folderPath: "excluded"
-            - folderPath: "excludedButVisible"
-              viewable: true
-    - path: "../frontend/tests/playwright-files2"
-      name: "include"
-      config:
-        defaultEnabled: true
-        conditionals:
-          rules:
-            - includeRootItem: "myfolder"
-            - includeRootItem: "subfolderExclusions"
-            - filePath: "/subfolderExclusions/exclusionlist.sh"
-            - folderPath: "/subfolderExclusions/folderItem"
-              viewable: true
-            - fileStartsWith: "startsWith"
-            - folderEndsWith: "Folder"
-
-auth:
-  methods:
-    noauth: true
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-userDefaults:
-  permissions:
-   realtime: true
-
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
-  permissions:
-    download: true
-    create: true
@@ -1,48 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/noauth-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/noauth",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    storageState: "noauth.json",
-    actionTimeout: 5000,
-    //storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});
@@ -1,46 +0,0 @@
-server:
-  logging:
-    - levels: "info|error|warning|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        createUserDir: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-
-auth:
-  methods:
-    password:
-      enabled: false
-    oidc:
-      enabled: true
-      createUser: true
-      clientId: "vyBrzOmcrU3OokiWEZoObdGBscw0eYPNJauBtOJr"
-      clientSecret: "gIMKbkEcckUhlGrnE2Vxi8eZhEcfxQqfwFgM0ATzk4DciHGrW2YRtQfqcpRTsmzrxEETkKvZ8yeK3sfoXnUV1IQTzqK7wxw3lEMtmeXi5clj0h7nH1rVGFq2Q3HL8zUe"
-      issuerUrl: "http://localhost:8080"
-      adminGroup: "Admins"
-
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
-  darkMode: true
-  disableSettings: false
-  singleClick: false
-  permissions:
-    admin: false
-    modify: true
-    share: false
-    api: false
-    download: true
-    create: true
@@ -1,60 +0,0 @@
-
-import { OAuth2Server } from 'oauth2-mock-server';
-
-// This is a list of pre-defined users. You can add more users here.
-// The filebrowser application will use this data when a user logs in.
-const users = {
-  // Default user
-  johndoe: {
-    sub: 'johndoe',
-    preferred_username: 'johndoe',
-    email: 'johndoe@example.com',
-    groups: ['Admins', 'Users'],
-  },
-  // Another example user
-  testuser: {
-    sub: 'testuser',
-    preferred_username: 'testuser',
-    email: 'testuser@example.com',
-    groups: ['Users'],
-  },
-};
-
-const server = new OAuth2Server();
-
-// Generate a new RSA key for the server.
-await server.issuer.keys.generate('RS256');
-
-/**
- * This hook is called before the ID token is signed.
- * We're using it to add claims to the ID token.
- * This is the primary way the application will get user information.
- */
-server.service.on('beforeIdTokenSigning', (token, req) => {
-  // By default, the mock server uses 'johndoe' as the subject.
-  const user = users[token.payload.sub] || users.johndoe;
-  console.log(`[ID Token] Customizing token for user: ${user.sub}`);
-  Object.assign(token.payload, user);
-});
-
-
-/**
- * This hook is called before the userinfo response is sent.
- * We're using it to provide user claims when the application calls the /userinfo endpoint.
- */
-server.service.on('beforeUserinfo', (userInfoResponse, req) => {
-    const user = users.johndoe;
-    console.log(`[UserInfo] Customizing userinfo for user: ${user.sub}`);
-    userInfoResponse.body = user;
-});
-
-
-const port = 8080;
-const host = '0.0.0.0'; // Bind to 0.0.0.0 to be accessible within Docker
-await server.start(port, host);
-console.log(`OAuth 2 Mock Server listening on http://${host}:${port}`);
-console.log(`Issuer URL: ${server.issuer.url}`);
-console.log('---');
-console.log('Pre-defined users:');
-console.log(JSON.stringify(users, null, 2));
-console.log('---');
@@ -1,48 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/oidc-setup",
-  timeout: 5000,
-  testDir: "./tests/playwright/oidc",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    storageState: "loginAuth.json",
-    actionTimeout: 5000,
-    //storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});
@@ -1 +0,0 @@
-demo-127.0.0.1:$apr1$j5FRA4Bc$RYdNFuM7YAAo9Qtie8w4b/
@@ -1,46 +0,0 @@
-server:
-  port: 8080
-  baseURL:  "/subpath"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        createUserDir: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-
-auth:
-  methods:
-    password:
-      enabled: false
-    proxy:
-      enabled: true
-      header: "X-Username"
-      createUser: true
-      logoutRedirectUrl: "https://localhost/api/auth/logout2"
-
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
-  darkMode: true
-  disableSettings: false
-  singleClick: false
-  permissions:
-    admin: false
-    modify: true
-    share: true
-    api: false
-    download: true
-    create: true
@@ -1,32 +0,0 @@
-
-map $remote_addr $uuid {
-    default "demo-${remote_addr}";
-}
-
-server {
-    listen 80;
-    server_name localhost 127.0.0.1;
-
-    location /subpath/public/ {
-        proxy_pass http://filebrowser:8080/subpath/public/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Username $uuid;
-    }
-
-    # requires basic auth demo-127.0.0.1:SecurePass123!
-    location /subpath {
-        auth_basic "Restricted Access";
-        auth_basic_user_file /etc/nginx/conf.d/.htpasswd;
-        proxy_set_header X-Username $uuid;
-        add_header X-Username $uuid;
-        proxy_pass http://filebrowser:8080/subpath;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-}
@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/proxy-setup.ts",
-  timeout: 5000,
-  testDir: "./tests/playwright/proxy",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});
@@ -1,27 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        disableIndexing: true
-        defaultEnabled: true
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  styling:
-    customThemes:
-      no-rounded:
-        description: "No rounded corners" # The description of the theme to display in the UI.
-        css: "no-rounded.css" # The css file path and filename to use for the theme.
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/global-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/settings",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});
@@ -1,23 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        private: true
-        defaultEnabled: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/global-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/sharing",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});
@@ -0,0 +1,138 @@
+package files
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"unicode/utf8"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetContent_UTF8Truncation(t *testing.T) {
+	// Get the path to the test file
+	// The test file is in frontend/tests/playwright-files/utf8-truncated.txt
+	// We need to find it relative to the test execution directory
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	// Navigate from backend/adapters/fs/files to the project root
+	// backend/adapters/fs/files -> backend/adapters/fs -> backend/adapters -> backend -> root
+	testFilePath := filepath.Join(cwd, "..", "..", "..", "..", "frontend", "tests", "playwright-files", "utf8-truncated.txt")
+
+	// Check if file exists, if not try alternative path
+	if _, err = os.Stat(testFilePath); os.IsNotExist(err) {
+		// Try from project root
+		testFilePath = filepath.Join("frontend", "tests", "playwright-files", "utf8-truncated.txt")
+		if _, err = os.Stat(testFilePath); os.IsNotExist(err) {
+			t.Skipf("Test file not found at %s, skipping test", testFilePath)
+			return
+		}
+	}
+
+	// Get absolute path
+	var absPath string
+	absPath, err = filepath.Abs(testFilePath)
+	require.NoError(t, err)
+
+	t.Run("file with UTF-8 truncation at 4096 byte boundary", func(t *testing.T) {
+		// The test file is longer than 4096 bytes, with valid UTF-8 throughout.
+		// However, when reading exactly 4096 bytes as a header, it cuts off in the
+		// middle of a multi-byte UTF-8 sequence (e6 9c, missing the last byte 88 of '月').
+		// This should trigger the truncation handling in getContent's header validation.
+		// The fix should trim the incomplete sequence from the header, allowing the
+		// header check to pass, and then the full file (which is valid UTF-8) should
+		// pass the full file validation.
+		content, err := getContent(absPath)
+
+		// Should not return an error - the header truncation is handled, and the full file is valid
+		require.NoError(t, err)
+
+		// The content should be the full valid UTF-8 file
+		require.NotEmpty(t, content, "Content should not be empty - full file is valid UTF-8")
+
+		// Verify it contains the expected text
+		require.Contains(t, content, "文件已备份", "Content should contain Chinese characters")
+		require.Contains(t, content, "2024年", "Content should contain date information")
+	})
+
+	t.Run("regular UTF-8 text file", func(t *testing.T) {
+		// Test with a simple text file to ensure normal files still work
+		tmpFile, err := os.CreateTemp("", "test-utf8-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tmpFile.Name())
+		defer tmpFile.Close()
+
+		testText := "Hello, 世界! This is a test file with UTF-8 characters.\n"
+		_, err = tmpFile.WriteString(testText)
+		require.NoError(t, err)
+		tmpFile.Close()
+
+		content, err := getContent(tmpFile.Name())
+		require.NoError(t, err)
+		require.Equal(t, testText, content)
+	})
+
+	t.Run("file smaller than header size", func(t *testing.T) {
+		// Test with a file smaller than 4096 bytes
+		tmpFile, err := os.CreateTemp("", "test-small-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tmpFile.Name())
+		defer tmpFile.Close()
+
+		testText := "Small file content"
+		_, err = tmpFile.WriteString(testText)
+		require.NoError(t, err)
+		tmpFile.Close()
+
+		content, err := getContent(tmpFile.Name())
+		require.NoError(t, err)
+		require.Equal(t, testText, content)
+	})
+
+	t.Run("file with Chinese characters at boundary", func(t *testing.T) {
+		// Create a file that's exactly 4094 bytes, ending with a complete Chinese character
+		tmpFile, err := os.CreateTemp("", "test-chinese-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tmpFile.Name())
+		defer tmpFile.Close()
+
+		// Create content that's exactly 4094 bytes, ending with complete UTF-8
+		baseText := "2024年 06月 17日 星期一 04:05:58 CST 文件已备份\n"
+		content := ""
+		for len([]byte(content)) < 4094 {
+			content += baseText
+		}
+		// Trim to exactly 4094 bytes
+		encoded := []byte(content)
+		if len(encoded) > 4094 {
+			encoded = encoded[:4094]
+		}
+		// Ensure it ends with a complete character by finding the last complete rune
+		for len(encoded) > 0 {
+			lastRune, _ := decodeLastRune(encoded)
+			if lastRune != 0xFFFD { // RuneError
+				break
+			}
+			encoded = encoded[:len(encoded)-1]
+		}
+
+		_, err = tmpFile.Write(encoded)
+		require.NoError(t, err)
+		tmpFile.Close()
+
+		result, err := getContent(tmpFile.Name())
+		require.NoError(t, err)
+		require.NotEmpty(t, result)
+		require.Equal(t, string(encoded), result)
+	})
+}
+
+// Helper function to check if last rune is valid
+func decodeLastRune(p []byte) (rune, int) {
+	if len(p) == 0 {
+		return 0, 0
+	}
+	r, size := utf8.DecodeLastRune(p)
+	return r, size
+}
@@ -98,11 +98,11 @@ func TestSortItems(t *testing.T) {
 					{Name: "apple"},
 					{Name: "Banana"},
 				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "File2.txt"},
-					{Name: "File10.txt"},
-					{Name: "File1"},
-					{Name: "banana"},
+				Files: []iteminfo.ExtendedItemInfo{
+					{ItemInfo: iteminfo.ItemInfo{Name: "File2.txt"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File10.txt"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File1"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "banana"}},
 				},
 			},
 			expected: iteminfo.FileInfo{
@@ -112,11 +112,11 @@ func TestSortItems(t *testing.T) {
 					{Name: "apple"},
 					{Name: "Banana"},
 				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "banana"},
-					{Name: "File1"},
-					{Name: "File10.txt"},
-					{Name: "File2.txt"},
+				Files: []iteminfo.ExtendedItemInfo{
+					{ItemInfo: iteminfo.ItemInfo{Name: "banana"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File1"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File10.txt"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File2.txt"}},
 				},
 			},
 		},
@@ -128,10 +128,10 @@ func TestSortItems(t *testing.T) {
 					{Name: "Cat.txt"},
 					{Name: "apple"},
 				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "Zebra"},
-					{Name: "apple"},
-					{Name: "cat"},
+				Files: []iteminfo.ExtendedItemInfo{
+					{ItemInfo: iteminfo.ItemInfo{Name: "Zebra"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "apple"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "cat"}},
 				},
 			},
 			expected: iteminfo.FileInfo{
@@ -140,10 +140,10 @@ func TestSortItems(t *testing.T) {
 					{Name: "Cat.txt"},
 					{Name: "dog.txt"},
 				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "apple"},
-					{Name: "cat"},
-					{Name: "Zebra"},
+				Files: []iteminfo.ExtendedItemInfo{
+					{ItemInfo: iteminfo.ItemInfo{Name: "apple"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "cat"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "Zebra"}},
 				},
 			},
 		},
@@ -153,7 +153,7 @@ func TestSortItems(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			test.input.SortItems()

-			getNames := func(items []iteminfo.ItemInfo) []string {
+			getFolderNames := func(items []iteminfo.ItemInfo) []string {
 				names := []string{}
 				for _, folder := range items {
 					names = append(names, folder.Name)
@@ -161,15 +161,23 @@ func TestSortItems(t *testing.T) {
 				return names
 			}

-			actualFolderNames := getNames(test.input.Folders)
-			expectedFolderNames := getNames(test.expected.Folders)
+			getFileNames := func(items []iteminfo.ExtendedItemInfo) []string {
+				names := []string{}
+				for _, file := range items {
+					names = append(names, file.Name)
+				}
+				return names
+			}
+
+			actualFolderNames := getFolderNames(test.input.Folders)
+			expectedFolderNames := getFolderNames(test.expected.Folders)

 			if !reflect.DeepEqual(actualFolderNames, expectedFolderNames) {
 				t.Errorf("Folders not sorted correctly.\nGot: %v\nExpected: %v", actualFolderNames, expectedFolderNames)
 			}

-			actualFileNames := getNames(test.input.Files)
-			expectedFileNames := getNames(test.expected.Files)
+			actualFileNames := getFileNames(test.input.Files)
+			expectedFileNames := getFileNames(test.expected.Files)

 			if !reflect.DeepEqual(actualFileNames, expectedFileNames) {
 				t.Errorf("Files not sorted correctly.\nGot: %v\nExpected: %v", actualFileNames, expectedFileNames)
@@ -178,73 +186,8 @@ func TestSortItems(t *testing.T) {
 	}
 }

-func TestDeleteFilesCacheClearing(t *testing.T) {
-	// Create a temporary directory for testing
-	tempDir, err := os.MkdirTemp("", "filebrowser_test")
-	if err != nil {
-		t.Fatalf("Failed to create temp dir: %v", err)
-	}
-	defer os.RemoveAll(tempDir)
-
-	// Create a test file
-	testFile := filepath.Join(tempDir, "Test Object")
-	err = os.WriteFile(testFile, []byte("test content"), 0644)
-	if err != nil {
-		t.Fatalf("Failed to create test file: %v", err)
-	}
-
-	// Initialize a mock index
-	idx := indexing.Index{
-		Source: settings.Source{
-			Path: tempDir,
-		},
-	}
-
-	// Get the real path and cache it
-	_, isDir, err := idx.GetRealPath("/Test Object")
-	if err != nil {
-		t.Fatalf("Failed to get real path: %v", err)
-	}
-
-	// Verify the file is detected as a file (not directory)
-	if isDir {
-		t.Errorf("Expected file to be detected as file, but got directory")
-	}
-
-	// Initialize the index in the indexing system
-	indexing.Initialize(&settings.Source{
-		Name: "test",
-		Path: tempDir,
-	}, true) // true for mock mode
-
-	// Delete the file
-	err = DeleteFiles("test", testFile, tempDir)
-	if err != nil {
-		t.Fatalf("Failed to delete file: %v", err)
-	}
-
-	// Create a directory with the same name
-	testDir := filepath.Join(tempDir, "Test Object")
-	err = os.Mkdir(testDir, 0755)
-	if err != nil {
-		t.Fatalf("Failed to create test directory: %v", err)
-	}
-
-	// Get the real path again - it should now detect it as a directory
-	// The cache should have been cleared, so it should re-detect the type
-	realPath2, isDir2, err := idx.GetRealPath("/Test Object")
-	if err != nil {
-		t.Fatalf("Failed to get real path after recreation: %v", err)
-	}
-
-	// Verify the directory is detected as a directory
-	if !isDir2 {
-		t.Errorf("Expected directory to be detected as directory, but got file. Real path: %s", realPath2)
-	}
-
-	// Clean up
-	os.RemoveAll(tempDir)
-}
+// TestDeleteFilesCacheClearing was removed because cache clearing is not performed
+// per design decision - RealPathCache is auxiliary and doesn't need clearing

 func TestOverrideDirectoryToFile(t *testing.T) {
 	// Initialize the index in mock mode (no filesystem operations)
@@ -282,9 +225,11 @@ func TestOverrideDirectoryToFile(t *testing.T) {
 	}

 	// Add the file to the parent's Files slice
-	rootInfo.Files = append(rootInfo.Files, iteminfo.ItemInfo{
-		Name: "Test Object",
-		Size: 25, // Length of "This is test file content"
+	rootInfo.Files = append(rootInfo.Files, iteminfo.ExtendedItemInfo{
+		ItemInfo: iteminfo.ItemInfo{
+			Name: "Test Object",
+			Size: 25, // Length of "This is test file content"
+		},
 	})

 	// Verify the directory was replaced with a file in the mock data
@@ -341,8 +286,8 @@ func TestOverrideFileToDirectory(t *testing.T) {
 			Name: "/",
 			Type: "directory",
 		},
-		Files: []iteminfo.ItemInfo{
-			{Name: "Test Object", Size: 12}, // Length of "test content"
+		Files: []iteminfo.ExtendedItemInfo{
+			{ItemInfo: iteminfo.ItemInfo{Name: "Test Object", Size: 12}}, // Length of "test content"
 		},
 	}

@@ -1,17 +1,17 @@
 package files

 import (
+	"context"
 	"encoding/base64"
 	"fmt"
 	"io"
-	"unicode"
-	"unicode/utf8"
-
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
+	"unicode"
+	"unicode/utf8"

 	"github.com/dhowden/tag"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
@@ -19,6 +19,7 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
@@ -80,9 +81,55 @@ func FileInfoFaster(opts utils.FileOptions, access *access.Storage) (*iteminfo.E
 			return response, err
 		}
 	}
-	if opts.Content || opts.Metadata {
+
+	// For directories, populate metadata for audio/video files ONLY if explicitly requested
+	// This avoids expensive ffprobe calls on every directory listing
+	if isDir && opts.Metadata {
+		startTime := time.Now()
+		metadataCount := 0
+
+		for i := range response.Files {
+			fileItem := &response.Files[i]
+			isItemAudio := strings.HasPrefix(fileItem.Type, "audio")
+			isItemVideo := strings.HasPrefix(fileItem.Type, "video")
+
+			if isItemAudio || isItemVideo {
+				// Get the real path for this file
+				itemRealPath, _, _ := index.GetRealPath(opts.Path, fileItem.Name)
+
+				// Extract metadata for audio files (without album art for performance)
+				if isItemAudio {
+					err := extractAudioMetadata(context.Background(), fileItem, itemRealPath, opts.AlbumArt || opts.Content, opts.Metadata)
+					if err != nil {
+						logger.Debugf("failed to extract metadata for file: "+fileItem.Name, err)
+					} else {
+						metadataCount++
+					}
+				} else if isItemVideo {
+					// Extract duration for video files
+					err := extractVideoMetadata(context.Background(), fileItem, itemRealPath)
+					if err != nil {
+						logger.Debugf("failed to extract video metadata for file: "+fileItem.Name, err)
+					} else {
+						metadataCount++
+					}
+				}
+			}
+		}
+
+		if metadataCount > 0 {
+			elapsed := time.Since(startTime)
+			logger.Debugf("Extracted metadata for %d audio/video files in %v (avg: %v per file)",
+				metadataCount, elapsed, elapsed/time.Duration(metadataCount))
+		}
+	}
+
+	// Extract content/metadata when explicitly requested OR for single file audio/video requests
+	isAudioVideo := strings.HasPrefix(info.Type, "audio") || strings.HasPrefix(info.Type, "video")
+	if opts.Content || opts.Metadata || (!isDir && isAudioVideo) {
 		processContent(response, index, opts)
 	}
+
 	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
 		response.OnlyOfficeId = generateOfficeId(realPath)
 	}
@@ -99,6 +146,18 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 	}

 	if isVideo {
+		// Extract duration for video
+		extItem := &iteminfo.ExtendedItemInfo{
+			ItemInfo: info.ItemInfo,
+		}
+		err := extractVideoMetadata(context.Background(), extItem, info.RealPath)
+		if err != nil {
+			logger.Debugf("failed to extract video metadata for file: "+info.RealPath, info.Name, err)
+		} else {
+			info.Metadata = extItem.Metadata
+		}
+
+		// Handle subtitles if requested
 		if opts.ExtractEmbeddedSubtitles {
 			parentPath := filepath.Dir(info.Path)
 			parentInfo, exists := idx.GetReducedMetadata(parentPath, true)
@@ -114,11 +173,17 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 	}

 	if isAudio {
-		err := extractAudioMetadata(info)
+		// Create an ExtendedItemInfo to hold the metadata
+		extItem := &iteminfo.ExtendedItemInfo{
+			ItemInfo: info.ItemInfo,
+		}
+		err := extractAudioMetadata(context.Background(), extItem, info.RealPath, opts.AlbumArt || opts.Content, opts.Metadata || opts.Content)
 		if err != nil {
 			logger.Debugf("failed to extract audio metadata for file: "+info.RealPath, info.Name, err)
 		} else {
-			info.HasPreview = info.AudioMeta.AlbumArt != ""
+			// Copy metadata to ExtendedFileInfo
+			info.Metadata = extItem.Metadata
+			info.HasPreview = extItem.Metadata != nil && extItem.Metadata.AlbumArt != ""
 		}
 		return
 	}
@@ -148,8 +213,9 @@ func generateOfficeId(realPath string) string {
 }

 // extractAudioMetadata extracts metadata from an audio file using dhowden/tag
-func extractAudioMetadata(item *iteminfo.ExtendedFileInfo) error {
-	file, err := os.Open(item.RealPath)
+// and optionally extracts duration using the ffmpeg service with concurrency control
+func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, getArt bool, getDuration bool) error {
+	file, err := os.Open(realPath)
 	if err != nil {
 		return err
 	}
@@ -172,7 +238,7 @@ func extractAudioMetadata(item *iteminfo.ExtendedFileInfo) error {
 		return err
 	}

-	item.AudioMeta = &iteminfo.AudioMetadata{
+	item.Metadata = &iteminfo.MediaMetadata{
 		Title:  m.Title(),
 		Artist: m.Artist(),
 		Album:  m.Album(),
@@ -182,50 +248,96 @@ func extractAudioMetadata(item *iteminfo.ExtendedFileInfo) error {

 	// Extract track number
 	track, _ := m.Track()
-	item.AudioMeta.Track = track
+	item.Metadata.Track = track
+
+	// Extract duration ONLY if explicitly requested using the ffmpeg VideoService
+	// This respects concurrency limits and gracefully handles missing ffmpeg
+	if getDuration {
+		ffmpegService := ffmpeg.NewFFmpegService(5, false, "")
+		if ffmpegService != nil {
+			startTime := time.Now()
+			if duration, err := ffmpegService.GetMediaDuration(ctx, realPath); err == nil {
+				item.Metadata.Duration = int(duration)
+				elapsed := time.Since(startTime)
+				if elapsed > 50*time.Millisecond {
+					logger.Debugf("Duration extraction took %v for file: %s", elapsed, item.Name)
+				}
+			}
+		}
+	}
+
+	if !getArt {
+		return nil
+	}

 	// Extract album art and encode as base64 with strict size limits
 	if picture := m.Picture(); picture != nil && picture.Data != nil {
 		// More aggressive size limit to prevent memory issues (max 5MB)
 		if len(picture.Data) <= 5*1024*1024 {
-			item.AudioMeta.AlbumArt = base64.StdEncoding.EncodeToString(picture.Data)
+			item.Metadata.AlbumArt = base64.StdEncoding.EncodeToString(picture.Data)
 		} else {
-			logger.Debugf("Skipping album art for %s: too large (%d bytes)", item.RealPath, len(picture.Data))
+			logger.Debugf("Skipping album art for %s: too large (%d bytes)", realPath, len(picture.Data))
 		}
 	}

 	return nil
 }

-func DeleteFiles(source, absPath string, absDirPath string) error {
-	err := os.RemoveAll(absPath)
-	if err != nil {
-		return err
+// extractVideoMetadata extracts duration from video files using ffprobe
+func extractVideoMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string) error {
+	// Extract duration using the ffmpeg VideoService with concurrency control
+	videoService := ffmpeg.NewFFmpegService(10, false, "")
+	if videoService != nil {
+		duration, err := videoService.GetMediaDuration(ctx, realPath)
+		if err != nil {
+			return err
+		}
+		if duration > 0 {
+			item.Metadata = &iteminfo.MediaMetadata{
+				Duration: int(duration),
+			}
+		}
+		return nil
 	}
+	return nil
+}
+
+func DeleteFiles(source, absPath string, absDirPath string, isDir bool) error {
 	index := indexing.GetIndex(source)
 	if index == nil {
 		return fmt.Errorf("could not get index: %v ", source)
 	}
-	if index.Config.DisableIndexing {
-		return nil
-	}

-	// Clear RealPathCache entries for the deleted path to prevent cache issues
-	// when a folder with the same name is created later
-	indexPath := index.MakeIndexPath(absPath)
-	realPath, _, err := index.GetRealPath(indexPath)
-	if err == nil {
-		// Clear both the path and the isdir cache entries
-		indexing.RealPathCache.Delete(realPath)
-		indexing.RealPathCache.Delete(realPath + ":isdir")
-	}
+	if !index.Config.DisableIndexing {
+		indexPath := index.MakeIndexPath(absPath)

-	refreshConfig := utils.FileOptions{Path: index.MakeIndexPath(absDirPath), IsDir: true}
-	err = index.RefreshFileInfo(refreshConfig)
-	if err != nil {
+		// Perform the physical deletion
+		err := os.RemoveAll(absPath)
+		if err != nil {
+			return err
+		}
+
+		// Remove metadata from index
+		if isDir {
+			// Recursively remove directory and all subdirectories from index
+			index.DeleteMetadata(indexPath, true, true)
+		} else {
+			// Remove file from parent's file list
+			index.DeleteMetadata(indexPath, false, false)
+		}
+
+		// Refresh the parent directory to recalculate sizes and update counts
+		// This will traverse up the tree and update all parent sizes correctly
+		refreshConfig := utils.FileOptions{
+			Path:  index.MakeIndexPath(absDirPath),
+			IsDir: true,
+		}
+		err = index.RefreshFileInfo(refreshConfig)
 		return err
 	}
-	return nil
+
+	// Indexing disabled, just delete the file
+	return os.RemoveAll(absPath)
 }

 func RefreshIndex(source string, path string, isDir bool, recursive bool) error {
@@ -249,6 +361,21 @@ func RefreshIndex(source string, path string, isDir bool, recursive bool) error
 		return nil
 	}

+	// For directories, check if the path exists on disk
+	// If it doesn't exist, remove it from the index
+	if isDir {
+		realPath, _, err := idx.GetRealPath(path)
+		if err == nil {
+			// Check if the directory exists on disk
+			if !Exists(realPath) {
+				// Directory no longer exists, remove it from the index
+				// This clears both Directories and DirectoriesLedger maps
+				idx.DeleteMetadata(path, true, false)
+				return nil
+			}
+		}
+	}
+
 	err := idx.RefreshFileInfo(utils.FileOptions{Path: path, IsDir: isDir, Recursive: recursive})
 	return err
 }
@@ -282,21 +409,17 @@ func validateMoveDestination(src, dst string, isSrcDir bool) error {
 	return nil
 }

-func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string, s *share.Storage) error {
+func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string, s *share.Storage, a *access.Storage) error {
+	// Check if source and destination are the same file
+	if realsrc == realdst {
+		return fmt.Errorf("cannot move a file to itself: %s", realsrc)
+	}
+
 	// Validate the move operation before executing
 	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
 		return err
 	}

-	err := fileutils.MoveFile(realsrc, realdst)
-	if err != nil {
-		return err
-	}
-
-	// For move operations:
-	// 1. Delete the source from the index (recursively if it's a directory)
-	// 2. Recursively index the destination to capture the entire moved tree
-
 	// Get indexes for deletion and refresh operations
 	srcIdx := indexing.GetIndex(sourceIndex)
 	if srcIdx == nil {
@@ -307,44 +430,71 @@ func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 		return fmt.Errorf("could not get destination index: %v", destIndex)
 	}

-	// Delete from source index (recursively for directories)
-	go srcIdx.DeleteMetadata(realsrc, isSrcDir, isSrcDir) //nolint:errcheck
-
-	// Clear RealPathCache entries for the moved path to prevent cache issues
-	// when a file/folder with the same name is created later
+	// Prepare paths for index operations
 	srcIndexPath := srcIdx.MakeIndexPath(realsrc)
-	srcRealPath, _, err := srcIdx.GetRealPath(srcIndexPath)
-	if err == nil {
-		// Clear both the path and the isdir cache entries
-		indexing.RealPathCache.Delete(srcRealPath)
-		indexing.RealPathCache.Delete(srcRealPath + ":isdir")
+	srcParentPath := filepath.Dir(realsrc)
+
+	// Perform the physical move
+	err := fileutils.MoveFile(realsrc, realdst)
+	if err != nil {
+		return err
 	}

-	// For move operations, refresh the moved item and its new parent directory
-	// Run all refresh operations in a goroutine to avoid blocking the API
-	if isSrcDir {
-		go func() {
-			// When moving a folder, refresh the folder itself recursively FIRST
-			// Must complete before parent refresh to avoid race condition
-			RefreshIndex(destIndex, realdst, true, true) //nolint:errcheck
+	// Handle SOURCE cleanup (treat as deletion)
+	if !srcIdx.Config.DisableIndexing {
+		// Remove metadata from source index
+		if isSrcDir {
+			// Recursively remove directory and all subdirectories from source index
+			srcIdx.DeleteMetadata(srcIndexPath, true, true)
+		} else {
+			// Remove file from source parent's file list
+			srcIdx.DeleteMetadata(srcIndexPath, false, false)
+		}

-			// THEN refresh the parent directory so it sees the newly indexed child
+		// Refresh the source parent directory to recalculate sizes and update counts
+		go RefreshIndex(sourceIndex, srcParentPath, true, false) //nolint:errcheck
+	}
+
+	// Handle DESTINATION indexing
+	if !dstIdx.Config.DisableIndexing {
+		if isSrcDir {
+			go func() {
+				// When moving a folder, refresh the folder itself recursively FIRST
+				// Must complete before parent refresh to avoid race condition
+				RefreshIndex(destIndex, realdst, true, true) //nolint:errcheck
+
+				// THEN refresh the parent directory so it sees the newly indexed child
+				parentDir := filepath.Dir(realdst)
+				RefreshIndex(destIndex, parentDir, true, false) //nolint:errcheck
+			}()
+		} else {
+			// If moving a file, just refresh the parent directory
 			parentDir := filepath.Dir(realdst)
-			RefreshIndex(destIndex, parentDir, true, false) //nolint:errcheck
-		}()
-	} else {
-		// If moving a file, just refresh the parent directory
-		parentDir := filepath.Dir(realdst)
-		go RefreshIndex(destIndex, parentDir, true, false) //nolint:errcheck
+			go RefreshIndex(destIndex, parentDir, true, false) //nolint:errcheck
+		}
 	}

 	// Use backend source paths to match how shares are stored
 	go s.UpdateShares(srcIdx.Path, srcIdx.MakeIndexPath(realsrc), dstIdx.Path, dstIdx.MakeIndexPath(realdst)) //nolint:errcheck

+	// Update access rules for the moved path
+	if a != nil {
+		// If moving within the same source, update the rules
+		if srcIdx.Path == dstIdx.Path {
+			go a.UpdateRules(srcIdx.Path, srcIdx.MakeIndexPath(realsrc), dstIdx.MakeIndexPath(realdst)) //nolint:errcheck
+		}
+		// Cross-source moves don't preserve access rules (they're source-specific)
+	}
+
 	return nil
 }

 func CopyResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string) error {
+	// Check if source and destination are the same file
+	if realsrc == realdst {
+		return fmt.Errorf("cannot copy a file to itself: %s", realsrc)
+	}
+
 	// Validate the copy operation before executing
 	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
 		return err
@@ -397,26 +547,15 @@ func WriteDirectory(opts utils.FileOptions) error {
 		if err != nil {
 			return fmt.Errorf("could not remove existing file to create directory: %v", err)
 		}
-		// Clear the cache for the removed file
-		realPath, _, err = idx.GetRealPath(opts.Path)
-		if err == nil {
-			indexing.RealPathCache.Delete(realPath)
-			indexing.RealPathCache.Delete(realPath + ":isdir")
-		}
 	}

 	// Ensure the parent directories exist
+	// Permissions are set by MkdirAll (subject to umask, which is usually acceptable)
 	err = os.MkdirAll(realPath, fileutils.PermDir)
 	if err != nil {
 		return err
 	}

-	// Explicitly set directory permissions to bypass umask
-	err = os.Chmod(realPath, fileutils.PermDir)
-	if err != nil {
-		return err
-	}
-
 	return RefreshIndex(idx.Name, opts.Path, true, true)
 }

@@ -436,18 +575,20 @@ func WriteFile(source, path string, in io.Reader) error {
 	}
 	var stat os.FileInfo
 	// Check if the destination exists and is a directory
-	if stat, err = os.Stat(realPath); err == nil && stat.IsDir() {
-		// If it's a directory and we're trying to create a file, remove the directory first
-		err = os.RemoveAll(realPath)
-		if err != nil {
-			return fmt.Errorf("could not remove existing directory to create file: %v", err)
+	if stat, err = os.Stat(realPath); err == nil {
+		if stat.IsDir() {
+			// If it's a directory and we're trying to create a file, remove the directory first
+			err = os.RemoveAll(realPath)
+			if err != nil {
+				return fmt.Errorf("could not remove existing directory to create file: %v", err)
+			}
 		}
-		// Clear the cache for the removed directory (use realPath without re-fetching)
-		indexing.RealPathCache.Delete(realPath)
-		indexing.RealPathCache.Delete(realPath + ":isdir")
+		// If file exists, its permissions will be preserved (O_TRUNC doesn't change permissions)
 	}

 	// Open the file for writing (create if it doesn't exist, truncate if it does)
+	// For new files: permissions are set to fileutils.PermFile (subject to umask, which is usually acceptable)
+	// For existing files: permissions are preserved automatically (O_TRUNC doesn't change them)
 	file, err := os.OpenFile(realPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileutils.PermFile)
 	if err != nil {
 		return err
@@ -460,12 +601,6 @@ func WriteFile(source, path string, in io.Reader) error {
 		return err
 	}

-	// Explicitly set file permissions to bypass umask
-	err = os.Chmod(realPath, fileutils.PermFile)
-	if err != nil {
-		return err
-	}
-
 	return RefreshIndex(source, path, false, false)
 }

@@ -496,9 +631,31 @@ func getContent(realPath string) (string, error) {
 	// --- Start of new heuristic checks ---

 	if n > 0 {
+		// Trim header to last complete UTF-8 rune to avoid false negatives
+		// when the header read cuts off in the middle of a multi-byte sequence.
+		// We decode runes from the end until we find a valid one, trimming
+		// any incomplete sequences at the end.
+		trimmedHeader := actualHeader
+		for len(trimmedHeader) > 0 {
+			lastRune, size := utf8.DecodeLastRune(trimmedHeader)
+			if lastRune != utf8.RuneError {
+				// Found a valid complete rune
+				break
+			}
+			// RuneError occurred - this could be an incomplete sequence or invalid byte
+			// Trim the last byte and try again
+			if size == 1 && len(trimmedHeader) > 0 {
+				trimmedHeader = trimmedHeader[:len(trimmedHeader)-1]
+			} else {
+				// Shouldn't happen, but break to avoid infinite loop
+				break
+			}
+		}
+
 		// 1. Basic Check: Is the header valid UTF-8?
 		// If not, it's unlikely an editable UTF-8 text file.
-		if !utf8.Valid(actualHeader) {
+		// Use trimmed header to avoid false negatives from truncated sequences
+		if len(trimmedHeader) > 0 && !utf8.Valid(trimmedHeader) {
 			return "", nil // Not an error, just not the text file we want
 		}

@@ -6,6 +6,7 @@ import (
 	"path/filepath"

 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

@@ -31,11 +32,14 @@ func MakeUserDirs(u *users.User, disableScopeChange bool) error {
 		if filepath.Base(scope.Scope) != cleanedUserName && source.Config.CreateUserDir && !disableScopeChange {
 			fullPath := filepath.Join(source.Path, scope.Scope, cleanedUserName)
 			parentDir := filepath.Join(source.Path, scope.Scope)
-			// validate that scope path exists
+			// If parent directory doesn't exist and createUserDir is enabled, create it
 			if !Exists(parentDir) {
-				return fmt.Errorf("MakeUserDirs: scope path does not exist: %s", scope.Scope)
+				if err := MakeUserDir(parentDir); err != nil {
+					return fmt.Errorf("MakeUserDirs: failed to create parent scope directory: %s - %v", scope.Scope, err)
+				}
 			}
-			scope.Scope = filepath.Join(scope.Scope, cleanedUserName)
+			// Use JoinPathAsUnix to ensure scope remains in Unix format (forward slashes)
+			scope.Scope = utils.JoinPathAsUnix(scope.Scope, cleanedUserName)
 			err := MakeUserDir(fullPath)
 			if err != nil {
 				return fmt.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
@@ -62,6 +62,13 @@ func CopyFile(source, dest string) error {

 // copySingleFile handles copying a single file.
 func copySingleFile(source, dest string) error {
+	// Get source file info to preserve permissions
+	srcInfo, err := os.Stat(source)
+	if err != nil {
+		return err
+	}
+	sourcePerms := srcInfo.Mode().Perm()
+
 	// Open the source file.
 	src, err := os.Open(source)
 	if err != nil {
@@ -75,8 +82,8 @@ func copySingleFile(source, dest string) error {
 		return err
 	}

-	// Create the destination file.
-	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, PermFile)
+	// Create the destination file with source permissions
+	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, sourcePerms)
 	if err != nil {
 		return err
 	}
@@ -88,11 +95,13 @@ func copySingleFile(source, dest string) error {
 		return err
 	}

-	// Set the configured file permissions instead of copying from source
-	err = os.Chmod(dest, PermFile)
-
+	// Preserve source file permissions
+	// Handle chmod errors gracefully (e.g., in rootless containers where chmod may be restricted)
+	err = os.Chmod(dest, sourcePerms)
 	if err != nil {
-		return err
+		// Log but don't fail - chmod may be restricted in some environments
+		// The file was copied successfully, so we continue
+		logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", dest, err)
 	}

 	return nil
@@ -3,81 +3,106 @@
 /usr/local/go/bin/go
 ?   	github.com/gtsteffaniak/filebrowser/backend	[no test files]
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/diskcache	0.004s
+ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/diskcache	0.005s
+2025/11/07 17:48:07 [INFO] initializing index: [test]
+2025/11/07 17:48:07 [INFO] Setting up multi-scanner system for [test]
+2025/11/07 17:48:07 [ERROR] Failed to open root directory: open /tmp/filebrowser_test3280924123/: no such file or directory
+2025/11/07 17:48:07 [DEBUG] Created 1 scanners for [test] (1 root + 0 children)
+2025/11/07 17:48:07 [INFO] initializing index: [test]
+2025/11/07 17:48:07 [INFO] initializing index: [test]
+2025/11/07 17:48:07 [ERROR] Root scanner error: open /tmp/filebrowser_test3280924123/: no such file or directory
+2025/11/07 17:48:07 [INFO] Setting up multi-scanner system for [test]
+2025/11/07 17:48:07 [ERROR] Failed to open root directory: open /tmp/filebrowser_test3280924123/: no such file or directory
+2025/11/07 17:48:07 [DEBUG] Time spent indexing [test]: 0s seconds
+2025/11/07 17:48:07 [DEBUG] Skipping source update event for mock index.
+2025/11/07 17:48:07 [INFO] Setting up multi-scanner system for [test]
+2025/11/07 17:48:07 [ERROR] Failed to open root directory: open /mock/path/: no such file or directory
+2025/11/07 17:48:07 [DEBUG] Created 1 scanners for [test] (1 root + 0 children)
+2025/11/07 17:48:07 [ERROR] Root scanner error: open /mock/path/: no such file or directory
+2025/11/07 17:48:07 [ERROR] Root scanner error: open /mock/path/: no such file or directory
+2025/11/07 17:48:07 [ERROR] Failed to open root directory: open /mock/path/: no such file or directory
+2025/11/07 17:48:07 [ERROR] Failed to open root directory: open /mock/path/: no such file or directory
+2025/11/07 17:48:07 [DEBUG] Time spent indexing [test]: 0s seconds
+2025/11/07 17:48:07 [DEBUG] Skipping source update event for mock index.
+2025/11/07 17:48:07 [DEBUG] Time spent indexing [test]: 0s seconds
+2025/11/07 17:48:07 [DEBUG] Skipping source update event for mock index.
+2025/11/07 17:48:07 [ERROR] Failed to open root directory: open /mock/path/: no such file or directory
+2025/11/07 17:48:07 [DEBUG] Created 1 scanners for [test] (1 root + 0 children)
 PASS
 ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files	0.006s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils	0.003s
+ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils	0.002s
 ?   	github.com/gtsteffaniak/filebrowser/backend/auth	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/cmd	[no test files]
-?   	github.com/gtsteffaniak/go-cache/cache	[no test files]
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/cmd	0.014s
 ?   	github.com/gtsteffaniak/filebrowser/backend/common/errors	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/common/logger	[no test files]
-2025/05/11 20:42:56 Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable
-2025/05/11 20:42:56 Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable
+goos: linux
+goarch: amd64
+pkg: github.com/gtsteffaniak/filebrowser/backend/common/settings
+cpu: 11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz
+      10	    374600 ns/op	  192030 B/op	    3237 allocs/op
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/common/settings	0.006s
+ok  	github.com/gtsteffaniak/filebrowser/backend/common/settings	0.139s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/common/utils	0.003s
+ok  	github.com/gtsteffaniak/filebrowser/backend/common/utils	0.004s
 ?   	github.com/gtsteffaniak/filebrowser/backend/common/version	[no test files]
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/database/access	0.287s
+?   	github.com/gtsteffaniak/filebrowser/backend/database/crud	[no test files]
 ?   	github.com/gtsteffaniak/filebrowser/backend/database/share	[no test files]
 ?   	github.com/gtsteffaniak/filebrowser/backend/database/storage	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt	[no test files]
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/database/users	0.002s
+ok  	github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt	0.842s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/database/users	0.003s
+?   	github.com/gtsteffaniak/filebrowser/backend/docs	[no test files]
 ?   	github.com/gtsteffaniak/filebrowser/backend/events	[no test files]
-2025/05/11 20:42:56 [DEBUG]  Saving user [admin] changepass: true
-2025/05/11 20:42:56 [DEBUG]  Saving user [non-admin] changepass: true
+goos: linux
+goarch: amd64
+pkg: github.com/gtsteffaniak/filebrowser/backend/ffmpeg
+cpu: 11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz
+BenchmarkGetOrientationFilter-8   	      10	        63.00 ns/op	       0 B/op	       0 allocs/op
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/http	0.197s
-2025/05/11 20:42:57 initializing index: [test]
-2025/05/11 20:42:57 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:57 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:57 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:57 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:57 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:57 [DEBUG]  Next scan in 1m0s
-2025/05/11 20:42:58 initializing index: [test]
-2025/05/11 20:42:58 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:58 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:58 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:58 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:58 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:58 [DEBUG]  Next scan in 1m0s
+ok  	github.com/gtsteffaniak/filebrowser/backend/ffmpeg	0.006s
+2025/11/07 17:48:08 [DEBUG] Saving user [admin] changepass: true
+2025/11/07 17:48:08 [DEBUG] Saving user [non-admin] changepass: true
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/http	0.248s
+2025/11/07 17:48:08 [INFO] initializing index: [test]
+2025/11/07 17:48:08 [INFO] Setting up multi-scanner system for [test]
+2025/11/07 17:48:08 [DEBUG] Created 1 scanners for [test] (1 root + 0 children)
+2025/11/07 17:48:08 [DEBUG] Time spent indexing [test]: 0s seconds
+2025/11/07 17:48:08 [DEBUG] Skipping source update event for mock index.
+2025/11/07 17:48:08 [INFO] initializing index: [test]
+2025/11/07 17:48:08 [INFO] Setting up multi-scanner system for [test]
+2025/11/07 17:48:08 [DEBUG] Created 1 scanners for [test] (1 root + 0 children)
+2025/11/07 17:48:08 [DEBUG] Time spent indexing [test]: 0s seconds
+2025/11/07 17:48:08 [DEBUG] Skipping source update event for mock index.
 goos: linux
 goarch: amd64
 pkg: github.com/gtsteffaniak/filebrowser/backend/indexing
 cpu: 11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz
-BenchmarkFillIndex-8                     	2025/05/11 20:42:59 initializing index: [test]
-2025/05/11 20:42:59 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:59 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:59 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:59 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:59 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:59 [DEBUG]  Next scan in 1m0s
-      10	   3548759 ns/op	   38032 B/op	     452 allocs/op
-BenchmarkCheckIndexExclude-8             	      10	       172.6 ns/op	       0 B/op	       0 allocs/op
-BenchmarkCheckIndexConditionsInclude-8   	      10	       118.2 ns/op	       0 B/op	       0 allocs/op
-2025/05/11 20:43:01 initializing index: [test]
-2025/05/11 20:43:01 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:01 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:43:01 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:43:01 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:43:01 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:01 [DEBUG]  Next scan in 1m0s
-BenchmarkSearchAllIndexes-8              	2025/05/11 20:43:02 initializing index: [test]
-2025/05/11 20:43:02 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:02 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:43:02 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:43:02 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:43:02 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:02 [DEBUG]  Next scan in 1m0s
-      10	    781119 ns/op	   38515 B/op	     900 allocs/op
+BenchmarkFillIndex-8          	2025/11/07 17:48:08 [INFO] initializing index: [test]
+2025/11/07 17:48:08 [INFO] Setting up multi-scanner system for [test]
+2025/11/07 17:48:08 [DEBUG] Created 1 scanners for [test] (1 root + 0 children)
+2025/11/07 17:48:08 [DEBUG] Time spent indexing [test]: 0s seconds
+2025/11/07 17:48:08 [DEBUG] Skipping source update event for mock index.
+      10	   3611835 ns/op	  323676 B/op	    1655 allocs/op
+2025/11/07 17:48:08 [INFO] initializing index: [test]
+2025/11/07 17:48:08 [INFO] Setting up multi-scanner system for [test]
+2025/11/07 17:48:08 [DEBUG] Created 1 scanners for [test] (1 root + 0 children)
+2025/11/07 17:48:08 [DEBUG] Time spent indexing [test]: 0s seconds
+2025/11/07 17:48:08 [DEBUG] Skipping source update event for mock index.
+BenchmarkSearchAllIndexes-8   	2025/11/07 17:48:08 [INFO] initializing index: [test]
+2025/11/07 17:48:08 [INFO] Setting up multi-scanner system for [test]
+2025/11/07 17:48:08 [DEBUG] Created 1 scanners for [test] (1 root + 0 children)
+2025/11/07 17:48:08 [DEBUG] Time spent indexing [test]: 0s seconds
+2025/11/07 17:48:08 [DEBUG] Skipping source update event for mock index.
+      10	    784497 ns/op	   97700 B/op	    1061 allocs/op
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/indexing	5.097s
+ok  	github.com/gtsteffaniak/filebrowser/backend/indexing	0.077s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo	0.005s
+ok  	github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo	0.006s
 PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/preview	0.128s
+ok  	github.com/gtsteffaniak/filebrowser/backend/preview	0.130s
 ?   	github.com/gtsteffaniak/filebrowser/backend/swagger/docs	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/tools	[no test files]
@@ -15,9 +15,6 @@ func validateAccessRules() {
 	if store.Access == nil {
 		return
 	}
-
-	logger.Info("Validating and migrating access rules to new format...")
-
 	// Get all sources
 	for sourcePath := range settings.Config.Server.SourceMap {
 		// Clear cache before migration to ensure we get fresh data
@@ -50,8 +47,6 @@ func validateAccessRules() {
 				// Create the new path with trailing slash
 				newPath := oldPath + "/"

-				logger.Debugf("Migrating access rule from '%s' to '%s'", oldPath, newPath)
-
 				// Migrate the rule to the new path
 				if err := migrateAccessRule(sourcePath, oldPath, newPath, rule); err != nil {
 					logger.Errorf("Failed to migrate rule from %s to %s: %v", oldPath, newPath, err)
@@ -74,8 +69,6 @@ func validateAccessRules() {
 			logger.Infof("Migrated %d access rules for source %s", migratedCount, sourcePath)
 		}
 	}
-
-	logger.Info("Access rules validation completed")
 }

 // migrateAccessRule creates a new access rule with the new path format
@@ -110,9 +110,9 @@ func runCLI() bool {
 				} else {
 					logger.Infof("Creating non-admin user: %s\n", username)
 				}
-				newUser.Permissions = settings.Config.UserDefaults.Permissions
+				newUser.Permissions = settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Permissions)
 				newUser.Permissions.Admin = asAdmin
-				err = storage.CreateUser(newUser)
+				err = storage.CreateUser(newUser, newUser.Permissions)
 				if err != nil {
 					logger.Errorf("could not create user: %v", err)
 				}
@@ -128,6 +128,10 @@ func runCLI() bool {
 			if asAdmin {
 				user.Permissions.Admin = true
 			}
+			// Ensure version is set for existing users being updated
+			if user.Version == 0 {
+				user.Version = 1
+			}
 			err = store.Users.Save(user, true, false)
 			if err != nil {
 				logger.Errorf("could not update user: %v", err)
@@ -350,8 +354,7 @@ func createConfig(configpath string) {

 func generateYaml() {
 	generateConfig := os.Getenv("FILEBROWSER_GENERATE_CONFIG") == "true"
-	devMode := os.Getenv("FILEBROWSER_DEVMODE") == "true"
-	if generateConfig || devMode {
+	if generateConfig || settings.Env.IsDevMode {
 		logger.Info("Generating config.yaml")
 		settings.GenerateYaml()
 	}
@@ -15,6 +15,7 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
@@ -79,11 +80,10 @@ func StartFilebrowser() {
 	}

 	// Dev mode enables development features like template hot-reloading
-	devMode := os.Getenv("FILEBROWSER_DEVMODE") == "true"
 	_, err := os.Stat("http/dist")
 	// In dev mode, always use filesystem assets. Otherwise, check if http/dist exists
-	if !devMode {
-		settings.Config.Server.EmbeddedFs = os.IsNotExist(err)
+	if !settings.Env.IsDevMode {
+		settings.Env.EmbeddedFs = os.IsNotExist(err)
 	}

 	sourceList := []string{}
@@ -95,7 +95,7 @@ func StartFilebrowser() {
 	logger.Infof("Auth Methods             : %v", settings.Config.Auth.AuthMethods)
 	logger.Info(database)
 	logger.Infof("Sources                  : %v", sourceList)
-	logger.Debugf("Using Embedded FS        : %v", settings.Config.Server.EmbeddedFs)
+	logger.Debugf("Using Embedded FS        : %v", settings.Env.EmbeddedFs)

 	serverConfig := settings.Config.Server
 	swagInfo := docs.SwaggerInfo
@@ -111,6 +111,7 @@ func StartFilebrowser() {
 	validateUserInfo(!dbExists)
 	validateOfficeIntegration()
 	validateAccessRules()
+	validateShareInfo()
 	// Start the rootCMD in a goroutine
 	go func() {
 		if err := rootCMD(ctx, store, &serverConfig, shutdownComplete); err != nil {
@@ -126,7 +127,9 @@ func StartFilebrowser() {
 	case <-done:
 		logger.Info("Server stopped unexpectedly. Shutting down...")
 	}
-	fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
+	if !*settings.Config.Server.CacheDirCleanup {
+		fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
+	}

 	<-shutdownComplete // Ensure we don't exit prematurely
 	// Wait for the server to stop
@@ -139,9 +142,10 @@ func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.
 	}
 	cacheDir := settings.Config.Server.CacheDir
 	numWorkers := settings.Config.Server.NumImageProcessors
-	ffpmpegPath := settings.Config.Integrations.Media.FfmpegPath
+	ffmpeg.SetFFmpegPaths()
+
 	// setup disk cache
-	err := preview.StartPreviewGenerator(numWorkers, ffpmpegPath, cacheDir)
+	err := preview.StartPreviewGenerator(numWorkers, cacheDir)
 	if err != nil {
 		logger.Fatalf("Error starting preview service: %v", err)
 	}
@@ -0,0 +1,57 @@
+package cmd
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// validateShareInfo migrates share links to add default sidebar links
+func validateShareInfo() {
+	if store.Share == nil {
+		return
+	}
+
+	// Get all shares
+	shares, err := store.Share.All()
+	if err != nil {
+		logger.Debugf("No shares found or error getting shares: %v", err)
+		return
+	}
+
+	migratedCount := 0
+	for _, link := range shares {
+		// Check if this share needs migration (version not set or 0)
+		if link.Version == 0 {
+			// Add default sidebar links
+			link.SidebarLinks = []users.SidebarLink{
+				{
+					Name:     "Share QR Code and Info",
+					Category: "shareInfo",
+					Target:   "#",
+					Icon:     "qr_code",
+				},
+				{
+					Name:     "Download",
+					Category: "download",
+					Target:   "#",
+					Icon:     "download",
+				},
+			}
+
+			// Set version to 1 to indicate migration is complete
+			link.Version = 1
+
+			// Save the updated share
+			if err := store.Share.Save(link); err != nil {
+				logger.Errorf("Failed to migrate share %s: %v", link.Hash, err)
+				continue
+			}
+
+			migratedCount++
+		}
+	}
+
+	if migratedCount > 0 {
+		logger.Infof("Migrated %d share links with default sidebar links", migratedCount)
+	}
+}
@@ -34,6 +34,9 @@ func validateUserInfo(newDB bool) {
 		if updateLoginType(user) {
 			updateUser = true
 		}
+		if updateShowFirstLogin(user) {
+			updateUser = true
+		}
 		adminUser := settings.Config.Auth.AdminUsername
 		adminPass := settings.Config.Auth.AdminPassword
 		passwordEnabled := settings.Config.Auth.Methods.PasswordAuth.Enabled
@@ -73,27 +76,23 @@ func updateUserScopes(user *users.User) bool {

 	// Preserve order by using Config.Server.Sources
 	for _, src := range settings.Config.Server.Sources {
-		realsource, ok := settings.Config.Server.NameToSource[src.Name]
-		if !ok {
-			continue
-		}
-		existingScope, ok := existing[realsource.Path]
+		existingScope, ok := existing[src.Path]
 		if ok {
 			// If scope is empty and there's a default, apply default
 			if existingScope.Scope == "" {
 				existingScope.Scope = src.Config.DefaultUserScope
 			}
-		} else if realsource.Config.DefaultEnabled {
-			existingScope.Scope = realsource.Config.DefaultUserScope
+		} else if src.Config.DefaultEnabled {
+			existingScope.Scope = src.Config.DefaultUserScope
 		} else {
 			continue
 		}

 		newScopes = append(newScopes, users.SourceScope{
-			Name:  realsource.Path,
+			Name:  src.Path,
 			Scope: existingScope.Scope,
 		})
-		seen[realsource.Path] = struct{}{}
+		seen[src.Path] = struct{}{}
 	}

 	// Preserve user-defined scopes not matching current sources, append to end
@@ -107,6 +106,14 @@ func updateUserScopes(user *users.User) bool {
 	return changed
 }

+func updateShowFirstLogin(user *users.User) bool {
+	if user.ShowFirstLogin && !settings.Env.IsFirstLoad {
+		user.ShowFirstLogin = false
+		return true
+	}
+	return false
+}
+
 // func to convert legacy user with perm key to permissions
 func updatePermissions(user *users.User) bool {
 	if user.Version == 1 {
@@ -15,6 +15,7 @@ import (
 	"github.com/go-playground/validator/v10"
 	"github.com/goccy/go-yaml"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
@@ -33,6 +34,9 @@ func Initialize(configFile string) {
 		time.Sleep(5 * time.Second) // allow sleep time before exiting to give docker/kubernetes time before restarting
 		logger.Fatal(err.Error())
 	}
+	setupLogging()
+	// setup logging first to ensure we log any errors
+	setupEnv()
 	err = ValidateConfig(Config)
 	if err != nil {
 		errmsg := "The provided config file failed validation. "
@@ -44,12 +48,29 @@ func Initialize(configFile string) {
 		logger.Fatal(err.Error())
 	}
 	setupFs()
-	setupLogging()
+	setupServer()
 	setupAuth(false)
 	setupSources(false)
 	setupUrls()
 	setupFrontend(false)
-	setupVideoPreview()
+	setupMedia()
+}
+
+func setupServer() {
+	if Config.Server.ListenAddress == "" {
+		Config.Server.ListenAddress = "0.0.0.0"
+	}
+}
+
+func setupEnv() {
+	Env.IsPlaywright = os.Getenv("FILEBROWSER_PLAYWRIGHT_TEST") == "true"
+	if Env.IsPlaywright {
+		logger.Warning("Running in playwright test mode. This is not recommended for production.")
+	}
+	Env.IsDevMode = os.Getenv("FILEBROWSER_DEVMODE") == "true"
+	if Env.IsDevMode {
+		logger.Warning("Running in dev mode. This is not recommended for production.")
+	}
 }

 func setupFs() {
@@ -80,6 +101,8 @@ func setupFs() {
 }

 func setupFrontend(generate bool) {
+	// Load login icon configuration at startup
+	loadLoginIcon()
 	if Config.Server.MinSearchLength == 0 {
 		Config.Server.MinSearchLength = 3
 	}
@@ -99,7 +122,13 @@ func setupFrontend(generate bool) {
 	}
 	Config.Frontend.Styling.LightBackground = FallbackColor(Config.Frontend.Styling.LightBackground, "#f5f5f5")
 	Config.Frontend.Styling.DarkBackground = FallbackColor(Config.Frontend.Styling.DarkBackground, "#141D24")
-	Config.Frontend.Styling.CustomCSSRaw = readCustomCSS(Config.Frontend.Styling.CustomCSS)
+	var err error
+	if Config.Frontend.Styling.CustomCSS != "" {
+		Config.Frontend.Styling.CustomCSSRaw, err = readCustomCSS(Config.Frontend.Styling.CustomCSS)
+		if err != nil {
+			logger.Warning(err.Error())
+		}
+	}
 	Config.Frontend.Styling.CustomThemeOptions = map[string]CustomTheme{}
 	if Config.Frontend.Styling.CustomThemes == nil {
 		Config.Frontend.Styling.CustomThemes = map[string]CustomTheme{}
@@ -129,7 +158,7 @@ func setupFrontend(generate bool) {
 	loadCustomFavicon()
 }

-func setupVideoPreview() {
+func setupMedia() {
 	// If VideoPreview is not initialized, initialize with all types enabled
 	if Config.Integrations.Media.Convert.VideoPreview == nil {
 		Config.Integrations.Media.Convert.VideoPreview = make(map[VideoPreviewType]bool)
@@ -167,14 +196,6 @@ func setupVideoPreview() {
 	}
 }

-func checkPathExists(realPath string) error {
-	// check path exists
-	if _, err := os.Stat(realPath); os.IsNotExist(err) {
-		return fmt.Errorf("source path %v is currently not available", realPath)
-	}
-	return nil
-}
-
 func setupSources(generate bool) {
 	if len(Config.Server.Sources) == 0 {
 		logger.Fatal("There are no `server.sources` configured. If you have `server.root` configured, please update the config and add at least one `server.sources` with a `path` configured.")
@@ -187,9 +208,9 @@ func setupSources(generate bool) {
 			if err != nil {
 				logger.Fatalf("error getting real path for source %v: %v", source.Path, err)
 			}
-			err = checkPathExists(realPath)
-			if err != nil {
-				logger.Warningf("error checking path exists: %v", err)
+			exists := utils.CheckPathExists(realPath)
+			if !exists {
+				logger.Warningf("source path %v is currently not available", realPath)
 			}
 			name := filepath.Base(realPath)
 			if name == "\\" {
@@ -493,6 +514,14 @@ func setDefaults(generate bool) Settings {
 	database := os.Getenv("FILEBROWSER_DATABASE")
 	if database == "" {
 		database = "database.db"
+	} else {
+		// check if database file exists
+		if _, err := os.Stat(database); os.IsNotExist(err) {
+			database = "database.db"
+		}
+	}
+	if _, err := os.Stat(database); os.IsNotExist(err) {
+		logger.Warning("database file could not be found. If this is unexpected, the default path is `./database.db`, but it can be configured in the config file under `server.database`.")
 	}
 	s := Settings{
 		Server: Server{
@@ -504,6 +533,7 @@ func setDefaults(generate bool) Settings {
 			NameToSource:       map[string]*Source{},
 			MaxArchiveSizeGB:   50,
 			CacheDir:           "tmp",
+			CacheDirCleanup:    boolPtr(true),
 			Filesystem: Filesystem{
 				CreateFilePermission:      "644",
 				CreateDirectoryPermission: "755",
@@ -525,21 +555,32 @@ func setDefaults(generate bool) Settings {
 		},

 		UserDefaults: UserDefaults{
-			DisableOnlyOfficeExt: ".md .txt .pdf",
+			DisableOnlyOfficeExt: ".md .txt .pdf .html .xml",
 			StickySidebar:        true,
 			LockPassword:         false,
 			ShowHidden:           false,
-			DarkMode:             true,
+			DarkMode:             boolPtr(true),
 			DisableSettings:      false,
 			ViewMode:             "normal",
 			Locale:               "en",
 			GallerySize:          3,
 			ThemeColor:           "var(--blue)",
-			Permissions: users.Permissions{
-				Modify: false,
-				Share:  false,
-				Admin:  false,
-				Api:    false,
+			Permissions: UserDefaultsPermissions{
+				Modify:   false,
+				Share:    false,
+				Admin:    false,
+				Api:      false,
+				Download: boolPtr(true), // defaults to true
+			},
+			Preview: UserDefaultsPreview{
+				HighQuality:        boolPtr(true),
+				Image:              boolPtr(true),
+				Video:              boolPtr(true),
+				MotionVideoPreview: boolPtr(true),
+				Office:             boolPtr(true),
+				PopUp:              boolPtr(true),
+				AutoplayMedia:      boolPtr(true),
+				Folder:             boolPtr(true),
 			},
 			FileLoading: users.FileLoading{
 				MaxConcurrent: 10,
@@ -561,164 +602,106 @@ func setDefaults(generate bool) Settings {
 	return s
 }

-func ConvertToBackendScopes(scopes []users.SourceScope) ([]users.SourceScope, error) {
-	if len(scopes) == 0 {
-		return Config.UserDefaults.DefaultScopes, nil
+// validateCustomImage validates a custom image file path and returns the absolute path or error
+func validateCustomImage(configPath, imageName string, maxSize int64, allowedFormats []string) (absolutePath string, err error) {
+	// Get absolute path
+	absolutePath, err = filepath.Abs(configPath)
+	if err != nil {
+		return "", fmt.Errorf("could not resolve path: %w", err)
 	}
-	newScopes := []users.SourceScope{}
-	for _, scope := range scopes {

-		// first check if its already a path name and keep it
-		source, ok := Config.Server.SourceMap[scope.Name]
-		if ok {
-			if scope.Scope == "" {
-				scope.Scope = source.Config.DefaultUserScope
-			}
-			if !strings.HasPrefix(scope.Scope, "/") {
-				scope.Scope = "/" + scope.Scope
-			}
-			if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
-				scope.Scope = strings.TrimSuffix(scope.Scope, "/")
-			}
-			newScopes = append(newScopes, users.SourceScope{
-				Name:  source.Path, // backend name is path
-				Scope: scope.Scope,
-			})
-			continue
-		}
-
-		// check if its the name of a source and convert it to a path
-		source, ok = Config.Server.NameToSource[scope.Name]
-		if !ok {
-			// source might no longer be configured
-			continue
-		}
-		if scope.Scope == "" {
-			scope.Scope = source.Config.DefaultUserScope
-		}
-		if !strings.HasPrefix(scope.Scope, "/") {
-			scope.Scope = "/" + scope.Scope
-		}
-		if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
-			scope.Scope = strings.TrimSuffix(scope.Scope, "/")
-		}
-		newScopes = append(newScopes, users.SourceScope{
-			Name:  source.Path, // backend name is path
-			Scope: scope.Scope,
-		})
+	// Check if file exists
+	stat, err := os.Stat(absolutePath)
+	if err != nil {
+		return "", fmt.Errorf("could not access file: %w", err)
 	}
-	return newScopes, nil
-}

-func ConvertToFrontendScopes(scopes []users.SourceScope) []users.SourceScope {
-	newScopes := []users.SourceScope{}
-	for _, scope := range scopes {
-		if source, ok := Config.Server.SourceMap[scope.Name]; ok {
-			// Replace scope.Name with source.Path while keeping the same Scope value
-			newScopes = append(newScopes, users.SourceScope{
-				Name:  source.Name,
-				Scope: scope.Scope,
-			})
+	// Check file size
+	if stat.Size() > maxSize {
+		return "", fmt.Errorf("file too large (%d bytes), maximum allowed is %d bytes", stat.Size(), maxSize)
+	}
+
+	// Validate file format
+	ext := strings.ToLower(filepath.Ext(absolutePath))
+	validFormat := false
+	for _, format := range allowedFormats {
+		if ext == format {
+			validFormat = true
+			break
 		}
 	}
-	return newScopes
-}
-
-func HasSourceByPath(scopes []users.SourceScope, sourcePath string) bool {
-	for _, scope := range scopes {
-		if scope.Name == sourcePath {
-			return true
-		}
+	if !validFormat {
+		return "", fmt.Errorf("unsupported format '%s', supported formats: %v", ext, allowedFormats)
 	}
-	return false
-}

-func GetScopeFromSourceName(scopes []users.SourceScope, sourceName string) (string, error) {
-	source, ok := Config.Server.NameToSource[sourceName]
-	if !ok {
-		logger.Debug("Could not get scope from source name: ", sourceName)
-		return "", fmt.Errorf("source with name not found %v", sourceName)
-	}
-	for _, scope := range scopes {
-		if scope.Name == source.Path {
-			return scope.Scope, nil
-		}
-	}
-	logger.Debugf("scope not found for source %v", sourceName)
-	return "", fmt.Errorf("scope not found for source %v", sourceName)
-}
-
-func GetScopeFromSourcePath(scopes []users.SourceScope, sourcePath string) (string, error) {
-	for _, scope := range scopes {
-		if scope.Name == sourcePath {
-			return scope.Scope, nil
-		}
-	}
-	return "", fmt.Errorf("scope not found for source %v", sourcePath)
-}
-
-// assumes backend style scopes
-func GetSources(u *users.User) []string {
-	sources := []string{}
-
-	// preserves order of sources
-	for _, source := range Config.Server.Sources {
-		_, err := GetScopeFromSourcePath(u.Scopes, source.Path)
-		if err != nil {
-			logger.Warningf("could not get scope for source %v: %v", source.Path, err)
-			continue
-		}
-		sources = append(sources, source.Name)
-	}
-	return sources
+	return absolutePath, nil
 }

 func loadCustomFavicon() {
+	const imageName = "favicon"
+	const maxSize = 1024 * 1024 // 1MB
+	allowedFormats := []string{".ico", ".png", ".svg"}
+
+	// Set default embedded favicon path
+	Env.FaviconEmbeddedPath = "img/icons/favicon.ico"
+
 	// Check if a custom favicon path is configured
 	if Config.Frontend.Favicon == "" {
-		logger.Debug("No custom favicon configured, using default")
+		Env.FaviconPath = Env.FaviconEmbeddedPath
+		Env.FaviconIsCustom = false
 		return
 	}

-	// Get absolute path for the favicon
-	faviconPath, err := filepath.Abs(Config.Frontend.Favicon)
+	// Validate custom favicon
+	validatedPath, err := validateCustomImage(Config.Frontend.Favicon, imageName, maxSize, allowedFormats)
 	if err != nil {
-		logger.Warningf("Could not resolve favicon path '%v': %v", Config.Frontend.Favicon, err)
-		Config.Frontend.Favicon = "" // Unset invalid path
+		logger.Warningf("Custom favicon validation failed: %v, using default", err)
+		Config.Frontend.Favicon = ""
+		Env.FaviconPath = Env.FaviconEmbeddedPath
+		Env.FaviconIsCustom = false
 		return
 	}

-	// Check if the favicon file exists and get info
-	stat, err := os.Stat(faviconPath)
+	// Update to validated path and mark as custom
+	Config.Frontend.Favicon = validatedPath
+	Env.FaviconPath = validatedPath
+	Env.FaviconIsCustom = true
+	logger.Infof("Using custom favicon: %s", Env.FaviconPath)
+}
+
+func loadLoginIcon() {
+	const imageName = "login icon"
+	const maxSize = 1024 * 1024 // 1MB
+	allowedFormats := []string{".svg", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".ico"}
+
+	// Set default embedded icon path based on dark mode preference
+	isDarkMode := Config.UserDefaults.DarkMode != nil && *Config.UserDefaults.DarkMode
+	if isDarkMode {
+		Env.LoginIconEmbeddedPath = "img/icons/favicon.svg" // Dark mode: dark background
+	} else {
+		Env.LoginIconEmbeddedPath = "img/icons/favicon-light.svg" // Light mode: light background
+	}
+
+	// Check if a custom login icon path is configured
+	if Config.Frontend.LoginIcon == "" {
+		Env.LoginIconPath = Env.LoginIconEmbeddedPath
+		Env.LoginIconIsCustom = false
+		return
+	}
+
+	// Validate custom login icon
+	validatedPath, err := validateCustomImage(Config.Frontend.LoginIcon, imageName, maxSize, allowedFormats)
 	if err != nil {
-		logger.Warningf("Could not access custom favicon file '%v': %v", faviconPath, err)
-		Config.Frontend.Favicon = "" // Unset invalid path
+		logger.Warningf("Custom login icon validation failed: %v, using default", err)
+		Env.LoginIconPath = Env.LoginIconEmbeddedPath
+		Env.LoginIconIsCustom = false
 		return
 	}

-	// Check file size (limit to 1MB for security)
-	const maxFaviconSize = 1024 * 1024 // 1MB
-	if stat.Size() > maxFaviconSize {
-		logger.Warningf("Favicon file '%v' is too large (%d bytes), maximum allowed is %d bytes", faviconPath, stat.Size(), maxFaviconSize)
-		Config.Frontend.Favicon = "" // Unset invalid path
-		return
-	}
-
-	// Validate file format based on extension
-	ext := strings.ToLower(filepath.Ext(faviconPath))
-	switch ext {
-	case ".ico", ".png", ".svg":
-		// Valid favicon formats
-	default:
-		logger.Warningf("Unsupported favicon format '%v', supported formats: .ico, .png, .svg", ext)
-		Config.Frontend.Favicon = "" // Unset invalid path
-		return
-	}
-
-	// Update to absolute path and mark as valid
-	Config.Frontend.Favicon = faviconPath
-
-	logger.Infof("Successfully validated custom favicon at '%v' (%d bytes, %s)", faviconPath, stat.Size(), ext)
+	// Update to validated path and mark as custom
+	Env.LoginIconPath = validatedPath
+	Env.LoginIconIsCustom = true
+	logger.Infof("Using custom login icon: %s", Env.LoginIconPath)
 }

 // setConditionalsMap builds optimized map structures from conditional rules for O(1) lookups
@@ -770,6 +753,18 @@ func setConditionals(config *Source) {
 		if rule.IncludeRootItem != "" {
 			resolved.IncludeRootItems[rule.IncludeRootItem] = struct{}{}
 		}
+		if rule.FileNames != "" {
+			resolved.FileNames[rule.FileNames] = rule
+		}
+		if rule.FolderNames != "" {
+			resolved.FolderNames[rule.FolderNames] = rule
+		}
+		if rule.FileName != "" {
+			resolved.FileNames[rule.FileName] = rule
+		}
+		if rule.FolderName != "" {
+			resolved.FolderNames[rule.FolderName] = rule
+		}
 	}
 	config.Config.ResolvedConditionals = resolved
 }
@@ -1,9 +1,13 @@
 package settings

 func CanConvertImage(ext string) bool {
-	return Config.Integrations.Media.FfmpegPath != "" && Config.Integrations.Media.Convert.ImagePreview[ImagePreviewType(ext)]
+	return MediaEnabled() && Config.Integrations.Media.Convert.ImagePreview[ImagePreviewType(ext)]
 }

 func CanConvertVideo(ext string) bool {
-	return Config.Integrations.Media.FfmpegPath != "" && Config.Integrations.Media.Convert.VideoPreview[VideoPreviewType(ext)]
+	return MediaEnabled() && Config.Integrations.Media.Convert.VideoPreview[VideoPreviewType(ext)]
+}
+
+func MediaEnabled() bool {
+	return Env.FFmpegPath != "" && Env.FFprobePath != ""
 }
@@ -0,0 +1,166 @@
+package settings
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+func ConvertToBackendScopes(scopes []users.SourceScope) ([]users.SourceScope, error) {
+	if len(scopes) == 0 {
+		return Config.UserDefaults.DefaultScopes, nil
+	}
+	newScopes := []users.SourceScope{}
+	for _, scope := range scopes {
+
+		// first check if its already a path name and keep it
+		source, ok := Config.Server.SourceMap[scope.Name]
+		if ok {
+			if scope.Scope == "" {
+				scope.Scope = source.Config.DefaultUserScope
+			}
+			if !strings.HasPrefix(scope.Scope, "/") {
+				scope.Scope = "/" + scope.Scope
+			}
+			if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
+				scope.Scope = strings.TrimSuffix(scope.Scope, "/")
+			}
+			newScopes = append(newScopes, users.SourceScope{
+				Name:  source.Path, // backend name is path
+				Scope: scope.Scope,
+			})
+			continue
+		}
+
+		// check if its the name of a source and convert it to a path
+		source, ok = Config.Server.NameToSource[scope.Name]
+		if !ok {
+			// source might no longer be configured
+			continue
+		}
+		if scope.Scope == "" {
+			scope.Scope = source.Config.DefaultUserScope
+		}
+		if !strings.HasPrefix(scope.Scope, "/") {
+			scope.Scope = "/" + scope.Scope
+		}
+		if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
+			scope.Scope = strings.TrimSuffix(scope.Scope, "/")
+		}
+		newScopes = append(newScopes, users.SourceScope{
+			Name:  source.Path, // backend name is path
+			Scope: scope.Scope,
+		})
+	}
+	return newScopes, nil
+}
+
+func ConvertToFrontendScopes(scopes []users.SourceScope) []users.SourceScope {
+	newScopes := []users.SourceScope{}
+	for _, scope := range scopes {
+		if source, ok := Config.Server.SourceMap[scope.Name]; ok {
+			// Replace scope.Name with source.Path while keeping the same Scope value
+			newScopes = append(newScopes, users.SourceScope{
+				Name:  source.Name,
+				Scope: scope.Scope,
+			})
+		}
+	}
+	return newScopes
+}
+
+func ConvertToFrontendSidebarLinks(links []users.SidebarLink) []users.SidebarLink {
+	newLinks := []users.SidebarLink{}
+	for _, link := range links {
+		// For source links, validate that the source still exists
+		if link.Category == "source" {
+			if link.SourceName == "" {
+				logger.Warningf("source link missing sourceName: %v", link.Name)
+				continue
+			}
+			// Check if source exists
+			sourceInfo, ok := Config.Server.SourceMap[link.SourceName]
+			if !ok {
+				logger.Warningf("source not found: %v (link name: %v)", link.SourceName, link.Name)
+				continue
+			}
+			link.SourceName = sourceInfo.Name
+		}
+		// For share links, just pass through (shares are validated separately)
+		// For all other links, pass through as-is
+		newLinks = append(newLinks, link)
+	}
+	return newLinks
+}
+
+func ConvertToBackendSidebarLinks(links []users.SidebarLink) ([]users.SidebarLink, error) {
+	newLinks := []users.SidebarLink{}
+	for _, link := range links {
+		// For source links, validate that the source exists using SourceName
+		if link.Category == "source" {
+			if link.SourceName == "" {
+				return nil, fmt.Errorf("source link missing sourceName (link name: %v)", link.Name)
+			}
+			// Validate source exists
+			sourceInfo, ok := Config.Server.NameToSource[link.SourceName]
+			if !ok {
+				return nil, fmt.Errorf("source not found: %v (link name: %v)", link.SourceName, link.Name)
+			}
+			link.SourceName = sourceInfo.Path // if name chages keep link alive
+		}
+		// Store the link as-is with all fields preserved
+		newLinks = append(newLinks, link)
+	}
+	return newLinks, nil
+}
+
+func HasSourceByPath(scopes []users.SourceScope, sourcePath string) bool {
+	for _, scope := range scopes {
+		if scope.Name == sourcePath {
+			return true
+		}
+	}
+	return false
+}
+
+func GetScopeFromSourceName(scopes []users.SourceScope, sourceName string) (string, error) {
+	source, ok := Config.Server.NameToSource[sourceName]
+	if !ok {
+		logger.Debug("Could not get scope from source name: ", sourceName)
+		return "", fmt.Errorf("source with name not found %v", sourceName)
+	}
+	for _, scope := range scopes {
+		if scope.Name == source.Path {
+			return scope.Scope, nil
+		}
+	}
+	logger.Debugf("scope not found for source %v", sourceName)
+	return "", fmt.Errorf("scope not found for source %v", sourceName)
+}
+
+func GetScopeFromSourcePath(scopes []users.SourceScope, sourcePath string) (string, error) {
+	for _, scope := range scopes {
+		if scope.Name == sourcePath {
+			return scope.Scope, nil
+		}
+	}
+	return "", fmt.Errorf("scope not found for source %v", sourcePath)
+}
+
+// assumes backend style scopes
+func GetSources(u *users.User) []string {
+	sources := []string{}
+
+	// preserves order of sources
+	for _, source := range Config.Server.Sources {
+		_, err := GetScopeFromSourcePath(u.Scopes, source.Path)
+		if err != nil {
+			logger.Warningf("could not get scope for source %v: %v", source.Path, err)
+			continue
+		}
+		sources = append(sources, source.Name)
+	}
+	return sources
+}
@@ -577,7 +577,8 @@ func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.V
 			// Check if this field should be redacted as a secret
 			var valNode *yaml.Node
 			var err error
-			if secrets[typeName][sf.Name] {
+			generateConfig := os.Getenv("FILEBROWSER_GENERATE_CONFIG") == "true"
+			if secrets[typeName][sf.Name] && !generateConfig {
 				// Check if the secret value is empty
 				fieldValue := currentField.Interface()
 				if str, ok := fieldValue.(string); ok && str == "" {
@@ -726,7 +727,7 @@ func GenerateYaml() {

 	setupSources(true)
 	setupUrls()
-	setupVideoPreview()
+	setupMedia()
 	setupFrontend(true)

 	// Restore original paths so the YAML output has the correct paths, not the placeholder
@@ -9,10 +9,11 @@ import (
 func TestGenerateConfigYaml_Basic(t *testing.T) {
 	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
 	// Test using the actual source directory structure
+	trueVal := true
 	config := &Settings{
 		UserDefaults: UserDefaults{
 			Locale:                  "es",          // Non-default value
-			DarkMode:                true,          // Default value
+			DarkMode:                &trueVal,      // Default value
 			DisableOfficePreviewExt: ".docx .xlsx", // This field is deprecated
 		},
 		Auth: Auth{
@@ -104,6 +105,11 @@ func TestGenerateConfigYaml_Basic(t *testing.T) {
 							continue
 						}

+						// Check if it's null (should NOT be quoted - it's a YAML literal for nil)
+						if value == "null" {
+							continue
+						}
+
 						// Everything else should be a quoted string
 						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
 							// Add debug info to see what's wrong
@@ -108,6 +108,11 @@ type Auth struct {
 					continue
 				}

+				// Check if it's null (should NOT be quoted - it's a YAML literal for nil)
+				if value == "null" {
+					continue
+				}
+
 				// Everything else should be a quoted string
 				if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
 					t.Errorf("String value should be quoted: %s (value: '%s')", line, value)
@@ -204,10 +209,11 @@ type UserDefaults struct {
 	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]

 	// Create a config with both default and non-default values
+	trueVal := true
 	config := &Settings{
 		UserDefaults: UserDefaults{
-			DarkMode: true, // This matches default
-			Locale:   "es", // This differs from default ("en")
+			DarkMode: &trueVal, // This matches default
+			Locale:   "es",     // This differs from default ("en")
 		},
 	}

@@ -278,10 +284,11 @@ func TestGenerateConfigYaml_CommentsOnOff(t *testing.T) {
 func TestGenerateConfigYaml_IntegrationTest(t *testing.T) {
 	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
 	// Comprehensive test with all features
+	trueVal := true
 	config := &Settings{
 		UserDefaults: UserDefaults{
 			Locale:                  "es",          // Non-default
-			DarkMode:                true,          // Default
+			DarkMode:                &trueVal,      // Default
 			DisableOfficePreviewExt: ".docx .xlsx", // This is deprecated
 		},
 		Auth: Auth{
@@ -400,8 +407,8 @@ func TestGenerateConfigYaml_IntegrationTest(t *testing.T) {
 							continue
 						}

-						// Skip arrays, objects, and empty values
-						if value == "" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") || strings.Contains(value, ":") {
+						// Skip arrays, objects, empty values, and null
+						if value == "" || value == "null" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") || strings.Contains(value, ":") {
 							continue
 						}

@@ -433,8 +440,8 @@ func TestGenerateConfigYaml_EdgeCases(t *testing.T) {
 			name: "only_defaults",
 			config: &Settings{
 				UserDefaults: UserDefaults{
-					DarkMode: true, // default value
-					Locale:   "en", // default value
+					DarkMode: boolPtr(true), // default value
+					Locale:   "en",          // default value
 				},
 			},
 			desc: "Config with only default values",
@@ -214,7 +214,7 @@ frontend:
 	}

 	// Verify user defaults
-	if Config.UserDefaults.DarkMode != true {
+	if Config.UserDefaults.DarkMode == nil || !*Config.UserDefaults.DarkMode {
 		t.Errorf("Expected dark mode true, got %v", Config.UserDefaults.DarkMode)
 	}

@@ -7,6 +7,33 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

+// boolPtr returns a pointer to a bool value
+func boolPtr(b bool) *bool {
+	return &b
+}
+
+// boolValueOrDefault returns the value of a bool pointer, or the default if nil
+func boolValueOrDefault(ptr *bool, defaultValue bool) bool {
+	if ptr != nil {
+		return *ptr
+	}
+	return defaultValue
+}
+
+// ConvertPermissionsToUsers converts UserDefaultsPermissions to users.Permissions
+func ConvertPermissionsToUsers(p UserDefaultsPermissions) users.Permissions {
+	return users.Permissions{
+		Api:      p.Api,
+		Admin:    p.Admin,
+		Modify:   p.Modify,
+		Share:    p.Share,
+		Realtime: p.Realtime,
+		Delete:   p.Delete,
+		Create:   p.Create,
+		Download: boolValueOrDefault(p.Download, true),
+	}
+}
+
 const DefaultUsersHomeBasePath = "/users"

 // AuthMethod describes an authentication method.
@@ -41,12 +68,36 @@ func AdminPerms() users.Permissions {
 func ApplyUserDefaults(u *users.User) {
 	u.StickySidebar = Config.UserDefaults.StickySidebar
 	u.DisableSettings = Config.UserDefaults.DisableSettings
-	u.DarkMode = Config.UserDefaults.DarkMode
+
+	// Handle DarkMode with default - dereference pointer from config
+	u.DarkMode = boolValueOrDefault(Config.UserDefaults.DarkMode, true)
+
 	u.Locale = Config.UserDefaults.Locale
 	u.ViewMode = Config.UserDefaults.ViewMode
 	u.SingleClick = Config.UserDefaults.SingleClick
-	u.Permissions = Config.UserDefaults.Permissions
-	u.Preview = Config.UserDefaults.Preview
+
+	// Handle Permissions - convert from pointer-based defaults to regular bools
+	u.Permissions.Api = Config.UserDefaults.Permissions.Api
+	u.Permissions.Admin = Config.UserDefaults.Permissions.Admin
+	u.Permissions.Modify = Config.UserDefaults.Permissions.Modify
+	u.Permissions.Share = Config.UserDefaults.Permissions.Share
+	u.Permissions.Realtime = Config.UserDefaults.Permissions.Realtime
+	u.Permissions.Delete = Config.UserDefaults.Permissions.Delete
+	u.Permissions.Create = Config.UserDefaults.Permissions.Create
+	u.Permissions.Download = boolValueOrDefault(Config.UserDefaults.Permissions.Download, true)
+
+	// Handle Preview - convert from pointer-based defaults to regular bools
+	u.Preview.DisableHideSidebar = Config.UserDefaults.Preview.DisableHideSidebar
+	u.Preview.HighQuality = boolValueOrDefault(Config.UserDefaults.Preview.HighQuality, true)
+	u.Preview.Image = boolValueOrDefault(Config.UserDefaults.Preview.Image, true)
+	u.Preview.Video = boolValueOrDefault(Config.UserDefaults.Preview.Video, true)
+	u.Preview.MotionVideoPreview = boolValueOrDefault(Config.UserDefaults.Preview.MotionVideoPreview, true)
+	u.Preview.Office = boolValueOrDefault(Config.UserDefaults.Preview.Office, true)
+	u.Preview.PopUp = boolValueOrDefault(Config.UserDefaults.Preview.PopUp, true)
+	u.Preview.AutoplayMedia = boolValueOrDefault(Config.UserDefaults.Preview.AutoplayMedia, true)
+	u.Preview.DefaultMediaPlayer = Config.UserDefaults.Preview.DefaultMediaPlayer
+	u.Preview.Folder = boolValueOrDefault(Config.UserDefaults.Preview.Folder, true)
+
 	u.ShowHidden = Config.UserDefaults.ShowHidden
 	u.DateFormat = Config.UserDefaults.DateFormat
 	u.DisableViewingExt = Config.UserDefaults.DisableViewingExt
@@ -6,6 +6,8 @@ import (

 type AllowedMethods string

+var Env Environment
+
 const (
 	ProxyAuth    AllowedMethods = "proxyAuth"
 	NoAuth       AllowedMethods = "noAuth"
@@ -20,6 +22,22 @@ type Settings struct {
 	Integrations Integrations `json:"integrations"`
 }

+type Environment struct {
+	IsPlaywright          bool   `json:"-"`
+	IsDevMode             bool   `json:"-"`
+	IsFirstLoad           bool   `json:"-"` // used internally to track if this is the first load of the application
+	MuPdfAvailable        bool   `json:"-"` // used internally if compiled with mupdf support
+	EmbeddedFs            bool   `json:"-"` // used internally if compiled with embedded fs support
+	FFmpegPath            string `json:"-"`
+	FFprobePath           string `json:"-"`
+	LoginIconPath         string `json:"-"` // resolved login icon path (filesystem or embedded)
+	LoginIconIsCustom     bool   `json:"-"` // true if login icon is from custom filesystem path
+	LoginIconEmbeddedPath string `json:"-"` // embedded asset path for default icon
+	FaviconPath           string `json:"-"` // resolved favicon path (filesystem or embedded)
+	FaviconIsCustom       bool   `json:"-"` // true if favicon is from custom filesystem path
+	FaviconEmbeddedPath   string `json:"-"` // embedded asset path for default favicon
+}
+
 type Server struct {
 	MinSearchLength              int         `json:"minSearchLength" yaml:"minSearchLength"` // minimum length of search query to begin searching (default: 3)
 	DisableUpdateCheck           bool        `json:"disableUpdateCheck"`                     // disables backend update check service
@@ -31,20 +49,20 @@ type Server struct {
 	DisableResize                bool        `json:"disablePreviewResize"`                   // disable resizing of previews for faster loading over slow connections
 	DisableTypeDetectionByHeader bool        `json:"disableTypeDetectionByHeader"`           // disable type detection by header, useful if filesystem is slow.
 	Port                         int         `json:"port"`                                   // port to listen on
+	ListenAddress                string      `json:"listen"`                                 // address to listen on (default: 0.0.0.0)
 	BaseURL                      string      `json:"baseURL"`                                // base URL for the server, the subpath that the server is running on.
 	Logging                      []LogConfig `json:"logging" yaml:"logging"`
 	Database                     string      `json:"database"` // path to the database file
 	Sources                      []*Source   `json:"sources" validate:"required,dive"`
-	ExternalUrl                  string      `json:"externalUrl"`    // used by share links if set (eg. http://mydomain.com)
-	InternalUrl                  string      `json:"internalUrl"`    // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
-	CacheDir                     string      `json:"cacheDir"`       // path to the cache directory, used for thumbnails and other cached files
-	MaxArchiveSizeGB             int64       `json:"maxArchiveSize"` // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
-	Filesystem                   Filesystem  `json:"filesystem"`     // filesystem settings
+	ExternalUrl                  string      `json:"externalUrl"`     // used by share links if set (eg. http://mydomain.com)
+	InternalUrl                  string      `json:"internalUrl"`     // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
+	CacheDir                     string      `json:"cacheDir"`        // path to the cache directory, used for thumbnails and other cached files
+	CacheDirCleanup              *bool       `json:"cacheDirCleanup"` // whether to automatically cleanup the cache directory. Note: docker must also mount a persistent volume to persist the cache (default: true)
+	MaxArchiveSizeGB             int64       `json:"maxArchiveSize"`  // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
+	Filesystem                   Filesystem  `json:"filesystem"`      // filesystem settings
 	// not exposed to config
-	SourceMap      map[string]*Source `json:"-" validate:"omitempty"` // uses realpath as key
-	NameToSource   map[string]*Source `json:"-" validate:"omitempty"` // uses name as key
-	MuPdfAvailable bool               `json:"-"`                      // used internally if compiled with mupdf support
-	EmbeddedFs     bool               `json:"-"`                      // used internally if compiled with embedded fs support
+	SourceMap    map[string]*Source `json:"-" validate:"omitempty"` // uses realpath as key
+	NameToSource map[string]*Source `json:"-" validate:"omitempty"` // uses name as key
 }

 type Filesystem struct {
@@ -163,12 +181,12 @@ type SourceConfig struct {
 	DenyByDefault    bool              `json:"denyByDefault,omitempty"`           // deny access unless an "allow" access rule was specifically created.
 	Private          bool              `json:"private"`                           // designate as source as private -- currently just means no sharing permitted.
 	Disabled         bool              `json:"disabled,omitempty"`                // disable the source, this is useful so you don't need to remove it from the config file
-	IndexingInterval uint32            `json:"indexingIntervalMinutes,omitempty"` // optional manual overide interval in minutes to re-index the source
-	DisableIndexing  bool              `json:"disableIndexing,omitempty"`         // disable the indexing of this source
+	IndexingInterval uint32            `json:"indexingIntervalMinutes,omitempty"` // (optional) not recommended: manual overide interval in minutes to re-index the source
+	DisableIndexing  bool              `json:"disableIndexing,omitempty"`         // (optional) not recommended: disable the indexing of this source
 	Conditionals     ConditionalFilter `json:"conditionals"`                      // conditional rules to apply when indexing to include/exclude certain items
-	DefaultUserScope string            `json:"defaultUserScope"`                  // default "/" should match folders under path
+	DefaultUserScope string            `json:"defaultUserScope"`                  // defaults to root of index "/" should match folders under path
 	DefaultEnabled   bool              `json:"defaultEnabled"`                    // should be added as a default source for new users?
-	CreateUserDir    bool              `json:"createUserDir"`                     // create a user directory for each user
+	CreateUserDir    bool              `json:"createUserDir"`                     // create a user directory for each user under defaultUserScope + username
 	// hidden but used internally - optimized map lookups for conditional rules
 	ResolvedConditionals *ResolvedConditionalsConfig `json:"-"`
 }
@@ -228,6 +246,7 @@ type Frontend struct {
 	Styling               StylingConfig  `json:"styling"`
 	Favicon               string         `json:"favicon"`     // path to a favicon to use for the frontend
 	Description           string         `json:"description"` // description that shows up in html head meta description
+	LoginIcon             string         `json:"loginIcon"`   // path to an image file for the login page icon
 }

 type StylingConfig struct {
@@ -253,38 +272,64 @@ type ExternalLink struct {
 	Url   string `json:"url" validate:"required"`  // the url to link to
 }

+// UserDefaultsPreview holds preview settings with pointer types for defaults
+type UserDefaultsPreview struct {
+	DisableHideSidebar bool  `json:"disableHideSidebar"` // keep sidebar open when previewing files
+	HighQuality        *bool `json:"highQuality"`        // use high quality thumbnails
+	Image              *bool `json:"image"`              // show thumbnails for image files
+	Video              *bool `json:"video"`              // show thumbnails for video files
+	MotionVideoPreview *bool `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
+	Office             *bool `json:"office"`             // show thumbnails for office files
+	PopUp              *bool `json:"popup"`              // show larger popup preview when hovering over thumbnail
+	AutoplayMedia      *bool `json:"autoplayMedia"`      // autoplay media files in preview
+	DefaultMediaPlayer bool  `json:"defaultMediaPlayer"` // disable the styled feature-rich media player for browser default
+	Folder             *bool `json:"folder"`             // show thumbnails for folders that have previewable contents
+}
+
+// UserDefaultsPermissions holds permission settings with pointer types for defaults
+type UserDefaultsPermissions struct {
+	Api      bool  `json:"api"`      // allow api access
+	Admin    bool  `json:"admin"`    // allow admin access
+	Modify   bool  `json:"modify"`   // allow modifying files
+	Share    bool  `json:"share"`    // allow sharing files
+	Realtime bool  `json:"realtime"` // allow realtime updates
+	Delete   bool  `json:"delete"`   // allow deleting files
+	Create   bool  `json:"create"`   // allow creating or uploading files
+	Download *bool `json:"download"` // allow downloading files
+}
+
 // UserDefaults is a type that holds the default values
 // for some fields on User.
 type UserDefaults struct {
-	EditorQuickSave            bool                `json:"editorQuickSave"`           // show quick save button in editor
-	HideSidebarFileActions     bool                `json:"hideSidebarFileActions"`    // hide the file actions in the sidebar
-	DisableQuickToggles        bool                `json:"disableQuickToggles"`       // disable the quick toggles in the sidebar
-	DisableSearchOptions       bool                `json:"disableSearchOptions"`      // disable the search options in the search bar
-	StickySidebar              bool                `json:"stickySidebar"`             // keep sidebar open when navigating
-	DarkMode                   bool                `json:"darkMode"`                  // should dark mode be enabled
-	Locale                     string              `json:"locale"`                    // language to use: eg. de, en, or fr
-	ViewMode                   string              `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
-	SingleClick                bool                `json:"singleClick"`               // open directory on single click, also enables middle click to open in new tab
-	ShowHidden                 bool                `json:"showHidden"`                // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-	DateFormat                 bool                `json:"dateFormat"`                // when false, the date is relative, when true, the date is an exact timestamp
-	GallerySize                int                 `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
-	ThemeColor                 string              `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-	QuickDownload              bool                `json:"quickDownload"`             // show icon to download in one click
-	DisablePreviewExt          string              `json:"disablePreviewExt"`         // space separated list of file extensions to disable preview for
-	DisableViewingExt          string              `json:"disableViewingExt"`         // space separated list of file extensions to disable viewing for
-	LockPassword               bool                `json:"lockPassword"`              // disable the user from changing their password
-	DisableSettings            bool                `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
-	Preview                    users.Preview       `json:"preview"`
-	DefaultScopes              []users.SourceScope `json:"-"`
-	Permissions                users.Permissions   `json:"permissions"`
-	LoginMethod                string              `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
-	DisableUpdateNotifications bool                `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
-	DeleteWithoutConfirming    bool                `json:"deleteWithoutConfirming"`    // delete files without confirmation
-	FileLoading                users.FileLoading   `json:"fileLoading"`                // upload and download settings
-	DisableOfficePreviewExt    string              `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
-	DisableOnlyOfficeExt       string              `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
-	CustomTheme                string              `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
-	ShowSelectMultiple         bool                `json:"showSelectMultiple"`         // show select multiple files on desktop
-	DebugOffice                bool                `json:"debugOffice"`                // debug onlyoffice editor
-	DefaultLandingPage         string              `json:"defaultLandingPage"`         // default landing page to use if no redirect is specified: eg. /files/mysource/mysubpath, /settings, etc.
+	EditorQuickSave            bool                    `json:"editorQuickSave"`           // show quick save button in editor
+	HideSidebarFileActions     bool                    `json:"hideSidebarFileActions"`    // hide the file actions in the sidebar
+	DisableQuickToggles        bool                    `json:"disableQuickToggles"`       // disable the quick toggles in the sidebar
+	DisableSearchOptions       bool                    `json:"disableSearchOptions"`      // disable the search options in the search bar
+	StickySidebar              bool                    `json:"stickySidebar"`             // keep sidebar open when navigating
+	DarkMode                   *bool                   `json:"darkMode"`                  // should dark mode be enabled
+	Locale                     string                  `json:"locale"`                    // language to use: eg. de, en, or fr
+	ViewMode                   string                  `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
+	SingleClick                bool                    `json:"singleClick"`               // open directory on single click, also enables middle click to open in new tab
+	ShowHidden                 bool                    `json:"showHidden"`                // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	DateFormat                 bool                    `json:"dateFormat"`                // when false, the date is relative, when true, the date is an exact timestamp
+	GallerySize                int                     `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
+	ThemeColor                 string                  `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+	QuickDownload              bool                    `json:"quickDownload"`             // show icon to download in one click
+	DisablePreviewExt          string                  `json:"disablePreviewExt"`         // space separated list of file extensions to disable preview for
+	DisableViewingExt          string                  `json:"disableViewingExt"`         // space separated list of file extensions to disable viewing for
+	LockPassword               bool                    `json:"lockPassword"`              // disable the user from changing their password
+	DisableSettings            bool                    `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
+	Preview                    UserDefaultsPreview     `json:"preview"`
+	DefaultScopes              []users.SourceScope     `json:"-"`
+	Permissions                UserDefaultsPermissions `json:"permissions"`
+	LoginMethod                string                  `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
+	DisableUpdateNotifications bool                    `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
+	DeleteWithoutConfirming    bool                    `json:"deleteWithoutConfirming"`    // delete files without confirmation
+	FileLoading                users.FileLoading       `json:"fileLoading"`                // upload and download settings
+	DisableOfficePreviewExt    string                  `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
+	DisableOnlyOfficeExt       string                  `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
+	CustomTheme                string                  `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
+	ShowSelectMultiple         bool                    `json:"showSelectMultiple"`         // show select multiple files on desktop
+	DebugOffice                bool                    `json:"debugOffice"`                // debug onlyoffice editor
+	DefaultLandingPage         string                  `json:"defaultLandingPage"`         // deprecated: determined by sidebar link order since 1.1.0
 }
@@ -1,6 +1,8 @@
 package settings

 import (
+	"errors"
+	"fmt"
 	"os"
 	"regexp"
 	"strings"
@@ -83,31 +85,36 @@ func addCustomTheme(name, description, cssFilePath string) {
 	// Load CSS content for runtime use (frontend consumption)
 	cssContent := ""
 	if cssFilePath != "" {
-		cssContent = readCustomCSS(cssFilePath)
+		var err error
+		cssContent, err = readCustomCSS(cssFilePath)
+		if err != nil {
+			logger.Warning(err.Error())
+			return
+		}
+
 	}
 	Config.Frontend.Styling.CustomThemeOptions[name] = CustomTheme{
 		Description: description,
 		CSS:         cssFilePath,
 		CssRaw:      cssContent, // Store loaded content
 	}
+	logger.Debugf("Added custom theme: %s", name)
 }

-func readCustomCSS(path string) string {
+func readCustomCSS(path string) (string, error) {
 	if path == "" {
-		return ""
+		return "", errors.New("path is empty")
 	}
 	content, err := os.ReadFile(path)
 	if err != nil {
-		// Only log if the file exists but cannot be read (e.g., permission error)
-		if !os.IsNotExist(err) {
-			logger.Warningf("Could not read custom CSS file %s: %v", path, err)
-			return ""
-		}
+		return "", fmt.Errorf("could not read custom CSS file: %v", err)
 	}
 	if len(content) > 128*1024 {
-		logger.Warningf("Custom CSS file %s is too large (%d bytes), ignoring", path, len(content))
-		return ""
+		return "", fmt.Errorf("custom CSS file is too large (%d bytes)", len(content))
+	}
+	if len(content) == 0 {
+		return "", fmt.Errorf("custom CSS file is empty: %s", path)
 	}
 	logger.Debugf("Loaded custom CSS from: %s (%d bytes)", path, len(content))
-	return string(content)
+	return string(content), nil
 }
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"os"
 	"strings"
 	"time"

@@ -30,6 +31,10 @@ func CheckForUpdates() (updateInfo, error) {
 	repoOwner := "gtsteffaniak"
 	repoName := "filebrowser"
 	currentVersion := version.Version
+	isDevMode := os.Getenv("FILEBROWSER_DEVMODE") == "true"
+	if currentVersion == "untracked" || currentVersion == "testing" || currentVersion == "" || isDevMode {
+		return updateInfo{}, nil
+	}
 	splitVersion := strings.Split(currentVersion, "-")
 	versionCategory := "stable"
 	if len(splitVersion) > 1 {
@@ -51,13 +56,13 @@ func CheckForUpdates() (updateInfo, error) {
 	if err := json.NewDecoder(resp.Body).Decode(&tags); err != nil {
 		return updateInfo{}, err
 	}
-	// Find the latest beta version greater than the current one
+	// Find the latest version greater than the current one that matches the version category
 	var NewVersion string
 	for _, tag := range tags {
-		// Check if the version is valid, is a pre-release, and contains "beta"
+		// Check if the version is valid and the prerelease contains the version category
 		if semver.IsValid(tag.Name) && strings.Contains(semver.Prerelease(tag.Name), versionCategory) {
 			// Check if this tag is greater than the current version
-			// and also greater than any other beta version we've found so far
+			// and also greater than any other version we've found so far
 			if semver.Compare(tag.Name, currentVersion) > 0 {
 				if NewVersion == "" || semver.Compare(tag.Name, NewVersion) > 0 {
 					NewVersion = tag.Name
@@ -54,4 +54,5 @@ type FileOptions struct {
 	Recursive                bool // whether to recursively index directories
 	Metadata                 bool // whether to get metadata
 	ExtractEmbeddedSubtitles bool // whether to extract embedded subtitles from media files
+	AlbumArt                 bool // whether to get album art from media files
 }
@@ -6,6 +6,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	math "math/rand"
+	"os"
 	"path/filepath"
 	"reflect"
 	"runtime"
@@ -128,3 +129,23 @@ func Ternary[T any](cond bool, vtrue, vfalse T) T {
 	}
 	return vfalse
 }
+
+// NormalizeRulePath ensures directory paths have trailing slashes for consistent rule storage
+func AddTrailingSlashIfNotExists(indexPath string) string {
+	// Root path stays as "/"
+	if indexPath == "/" {
+		return "/"
+	}
+	// For all other paths, ensure they have trailing slashes
+	if !strings.HasSuffix(indexPath, "/") {
+		return indexPath + "/"
+	}
+	return indexPath
+}
+
+func CheckPathExists(realPath string) bool {
+	if _, err := os.Stat(realPath); os.IsNotExist(err) {
+		return false
+	}
+	return true
+}
@@ -11,7 +11,7 @@ userDefaults:
  disableQuickToggles: false              # disable the quick toggles in the sidebar
  disableSearchOptions: false             # disable the search options in the search bar
  stickySidebar: true                     # keep sidebar open when navigating
-  darkMode: true                          # should dark mode be enabled
+  darkMode: true                          # should dark mode be enabled (defaults to true if not set)
  viewMode: "normal"                      # view mode to use: eg. normal, list, grid, or compact
  singleClick: false                      # open directory on single click, also enables middle click to open in new tab
  showHidden: false                       # show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
@@ -24,16 +24,16 @@ userDefaults:
  lockPassword: false                     # disable the user from changing their password
  disableSettings: false                  # disable the user from viewing the settings page
  preview:
-    disableHideSidebar: true             # disable the hide sidebar preview for previews and editors
-    highQuality: true                    # generate high quality thumbnail preview images
-    image: true                          # show thumbnail preview image for image files
-    video: true                          # show thumbnail preview image for video files
-    motionVideoPreview: true             # show multiple frames for videos in thumbnail preview when hovering
-    office: true                         # show thumbnail preview image for office files
-    popup: true                          # show larger popup preview when hovering over thumbnail
-    autoplayMedia: true                  # autoplay media files in preview
-    defaultMediaPlayer: true             # disable html5 media player and use the default media player
-    folder: true                         # show thumbnail preview image for folder files
+    disableHideSidebar: false             # disable the hide sidebar preview for previews and editors
+    highQuality: true                     # generate high quality thumbnail preview images (defaults to true if not set)
+    image: true                           # show thumbnail preview image for image files (defaults to true if not set)
+    video: true                           # show thumbnail preview image for video files (defaults to true if not set)
+    motionVideoPreview: true              # show multiple frames for videos in thumbnail preview when hovering (defaults to true if not set)
+    office: true                          # show thumbnail preview image for office files (defaults to true if not set)
+    popup: true                           # show larger popup preview when hovering over thumbnail (defaults to true if not set)
+    autoplayMedia: true                   # autoplay media files in preview (defaults to true if not set)
+    defaultMediaPlayer: false             # disable html5 media player and use the default media player
+    folder: true                          # show thumbnail preview image for folder files (defaults to true if not set)
  permissions:
    api: false                            # allow api access
    admin: false                          # allow admin access
@@ -42,9 +42,10 @@ userDefaults:
    realtime: false                       # allow realtime updates
    delete: false                         # allow deleting files
    create: false                         # allow creating or uploading files
-    download: true                        # allow downloading files
+    download: true                        # allow downloading files (defaults to true if not set)
  disableUpdateNotifications: false       # disable update notifications banner for admin users
  deleteWithoutConfirming: false          # delete files without confirmation
-  disableOnlyOfficeExt: ".md .txt .pdf"   # list of file extensions to disable onlyoffice editor for
+  disableOnlyOfficeExt: ".md .txt .pdf .html .xml"   # list of file extensions to disable onlyoffice editor for
+  customTheme: ""                         # Name of theme to use chosen from custom themes config.
  showSelectMultiple: false               # show select multiple files on desktop
-  defaultLandingPage: ""                  # default landing page to use if no redirect is specified: eg. /files/mysource/mysubpath, /settings, etc.
+  debugOffice: false                      # debug onlyoffice editor
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"maps"
+	"path/filepath"
 	"slices"
 	"sort"
 	"strings"
@@ -63,6 +64,7 @@ type FrontendAccessRule struct {
 	Deny              FrontendRuleSet `json:"deny"`
 	Allow             FrontendRuleSet `json:"allow"`
 	SourceDenyDefault bool            `json:"sourceDenyDefault"`
+	PathExists        bool            `json:"pathExists"`
 }

 // GroupMap maps group names to a set of usernames.
@@ -197,24 +199,11 @@ func (s *Storage) RemoveRuleByPath(sourcePath, indexPath string) {
 	}
 }

-// normalizeRulePath ensures directory paths have trailing slashes for consistent rule storage
-func normalizeRulePath(indexPath string) string {
-	// Root path stays as "/"
-	if indexPath == "/" {
-		return "/"
-	}
-	// For all other paths, ensure they have trailing slashes
-	if !strings.HasSuffix(indexPath, "/") {
-		return indexPath + "/"
-	}
-	return indexPath
-}
-
 // getOrCreateRuleNL ensures a rule exists for the given source and index path.
 // The caller must hold the lock.
 func (s *Storage) getOrCreateRuleNL(sourcePath, indexPath string) *AccessRule {
 	// Normalize the path to ensure consistent rule storage
-	normalizedPath := normalizeRulePath(indexPath)
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
 	if _, ok := s.AllRules[sourcePath]; !ok {
 		s.AllRules[sourcePath] = make(RuleMap)
 	}
@@ -412,7 +401,7 @@ func (s *Storage) getRuleAtExactPath(sourcePath, indexPath string) (*AccessRule,
 		return nil, false
 	}
 	// Normalize the path to ensure consistent rule lookup
-	normalizedPath := normalizeRulePath(indexPath)
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
 	rule, ok := rulesBySource[normalizedPath]
 	return rule, ok
 }
@@ -471,8 +460,12 @@ func (s *Storage) GetFrontendRules(sourcePath, indexPath string) (FrontendAccess
 		sourceDenyDefault = sourceInfo.Config.DenyByDefault
 	}

+	// Check if path exists on filesystem
+	pathExists := utils.CheckPathExists(filepath.Join(sourcePath, indexPath))
+
 	frontendRules := FrontendAccessRule{
 		SourceDenyDefault: sourceDenyDefault,
+		PathExists:        pathExists,
 		Deny: FrontendRuleSet{
 			Users:  make([]string, 0),
 			Groups: make([]string, 0),
@@ -532,10 +525,14 @@ func (s *Storage) GetAllRules(sourcePath string) (map[string]FrontendAccessRule,
 		// This ensures consistency between internal storage and frontend display
 		frontendPath := indexPath

+		// Check if path exists on filesystem
+		pathExists := utils.CheckPathExists(filepath.Join(sourcePath, indexPath))
+
 		// Convert AccessRule to FrontendAccessRule
 		frontendRules[frontendPath] = FrontendAccessRule{
 			DenyAll:           rule.DenyAll,
 			SourceDenyDefault: sourceDenyDefault,
+			PathExists:        pathExists,
 			Deny: FrontendRuleSet{
 				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
 				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
@@ -653,7 +650,7 @@ func (s *Storage) RemoveUserFromGroup(group, username string) error {
 func (s *Storage) RemoveAllowUser(sourcePath, indexPath, username string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	normalizedPath := normalizeRulePath(indexPath)
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
 	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
@@ -686,7 +683,7 @@ func (s *Storage) RemoveAllowUser(sourcePath, indexPath, username string) (bool,
 func (s *Storage) RemoveAllowGroup(sourcePath, indexPath, groupname string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	normalizedPath := normalizeRulePath(indexPath)
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
 	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
@@ -719,7 +716,7 @@ func (s *Storage) RemoveAllowGroup(sourcePath, indexPath, groupname string) (boo
 func (s *Storage) RemoveDenyUser(sourcePath, indexPath, username string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	normalizedPath := normalizeRulePath(indexPath)
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
 	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
@@ -752,7 +749,7 @@ func (s *Storage) RemoveDenyUser(sourcePath, indexPath, username string) (bool,
 func (s *Storage) RemoveDenyGroup(sourcePath, indexPath, groupname string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	normalizedPath := normalizeRulePath(indexPath)
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
 	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
@@ -785,7 +782,7 @@ func (s *Storage) RemoveDenyGroup(sourcePath, indexPath, groupname string) (bool
 func (s *Storage) RemoveDenyAll(sourcePath, indexPath string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	normalizedPath := normalizeRulePath(indexPath)
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
 	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
@@ -1116,3 +1113,206 @@ func (s *Storage) HasAnyVisibleItems(sourcePath, parentPath string, itemNames []

 	return false
 }
+
+// RemoveUserCascade removes a user from either the allow or deny list for a given path and all its subpaths.
+// This is used for cascade delete operations when deleting user access from a directory tree.
+// The allow parameter determines which list to remove from: true for allow list, false for deny list.
+func (s *Storage) RemoveUserCascade(sourcePath, indexPath, username string, allow bool) (int, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return 0, nil
+	}
+
+	changed := false
+	removedCount := 0
+
+	// Iterate through all rules for this source
+	for rulePath, rule := range rulesBySource {
+		// Check if this rule path matches or is a subpath of the target path
+		if rulePath == normalizedPath || strings.HasPrefix(rulePath, normalizedPath) {
+			if allow {
+				// Remove user from allow list only
+				if _, exists := rule.Allow.Users[username]; exists {
+					delete(rule.Allow.Users, username)
+					changed = true
+					removedCount++
+				}
+			} else {
+				// Remove user from deny list only
+				if _, exists := rule.Deny.Users[username]; exists {
+					delete(rule.Deny.Users, username)
+					changed = true
+					removedCount++
+				}
+			}
+
+			// If rule is now empty, mark it for deletion
+			if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 &&
+				len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 && !rule.DenyAll {
+				delete(s.AllRules[sourcePath], rulePath)
+			}
+		}
+	}
+
+	// If no rules left for this source, remove the source entry
+	if len(s.AllRules[sourcePath]) == 0 {
+		delete(s.AllRules, sourcePath)
+	}
+
+	if changed {
+		s.incrementSourceVersion(sourcePath)
+		accessCache.Set(accessChangedKey+sourcePath, "false")
+		rulesCache.Delete(accessChangedKey + sourcePath)
+		return removedCount, s.SaveToDB()
+	}
+
+	return 0, nil
+}
+
+// RemoveGroupCascade removes a group from either the allow or deny list for a given path and all its subpaths.
+// This is used for cascade delete operations when deleting group access from a directory tree.
+// The allow parameter determines which list to remove from: true for allow list, false for deny list.
+func (s *Storage) RemoveGroupCascade(sourcePath, indexPath, groupname string, allow bool) (int, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return 0, nil
+	}
+
+	changed := false
+	removedCount := 0
+
+	// Iterate through all rules for this source
+	for rulePath, rule := range rulesBySource {
+		// Check if this rule path matches or is a subpath of the target path
+		if rulePath == normalizedPath || strings.HasPrefix(rulePath, normalizedPath) {
+			if allow {
+				// Remove group from allow list only
+				if _, exists := rule.Allow.Groups[groupname]; exists {
+					delete(rule.Allow.Groups, groupname)
+					changed = true
+					removedCount++
+				}
+			} else {
+				// Remove group from deny list only
+				if _, exists := rule.Deny.Groups[groupname]; exists {
+					delete(rule.Deny.Groups, groupname)
+					changed = true
+					removedCount++
+				}
+			}
+
+			// If rule is now empty, mark it for deletion
+			if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 &&
+				len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 && !rule.DenyAll {
+				delete(s.AllRules[sourcePath], rulePath)
+			}
+		}
+	}
+
+	// If no rules left for this source, remove the source entry
+	if len(s.AllRules[sourcePath]) == 0 {
+		delete(s.AllRules, sourcePath)
+	}
+
+	if changed {
+		s.incrementSourceVersion(sourcePath)
+		accessCache.Set(accessChangedKey+sourcePath, "false")
+		rulesCache.Delete(accessChangedKey + sourcePath)
+		return removedCount, s.SaveToDB()
+	}
+
+	return 0, nil
+}
+
+// UpdateRules updates all access rules that match oldPath to point to newPath.
+// Handles both exact matches and subdirectories. Similar to share.Storage.UpdateShares.
+func (s *Storage) UpdateRules(sourcePath, oldPath, newPath string) (int, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return 0, nil // No rules for this source, not an error
+	}
+
+	// Normalize paths (always add trailing slash for access rules)
+	oldPath = utils.AddTrailingSlashIfNotExists(oldPath)
+	newPath = utils.AddTrailingSlashIfNotExists(newPath)
+
+	updated := 0
+	rulesToUpdate := make(map[string]string) // old path -> new path
+
+	// Find all rules that need to be updated
+	for rulePath := range rulesBySource {
+		if rulePath == oldPath {
+			// Exact match
+			rulesToUpdate[rulePath] = newPath
+		} else if strings.HasPrefix(rulePath, oldPath) {
+			// Subdirectory - replace prefix
+			newRulePath := newPath + strings.TrimPrefix(rulePath, oldPath)
+			rulesToUpdate[rulePath] = newRulePath
+		}
+	}
+
+	// Update all matched rules
+	for oldRulePath, newRulePath := range rulesToUpdate {
+		rule := rulesBySource[oldRulePath]
+		delete(rulesBySource, oldRulePath)
+		rulesBySource[newRulePath] = rule
+		logger.Info("access rule updated", "source", sourcePath, "fromPath", oldRulePath, "toPath", newRulePath)
+		updated++
+	}
+
+	if updated > 0 {
+		// Invalidate caches
+		s.incrementSourceVersion(sourcePath)
+		accessCache.Set(accessChangedKey+sourcePath, "false")
+		rulesCache.Delete(accessChangedKey + sourcePath)
+
+		if err := s.SaveToDB(); err != nil {
+			return updated, err
+		}
+	}
+
+	return updated, nil
+}
+
+// UpdateRulePath updates the path for a specific access rule (used by PATCH API endpoint).
+func (s *Storage) UpdateRulePath(sourcePath, oldPath, newPath string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	// Normalize paths
+	oldPath = utils.AddTrailingSlashIfNotExists(oldPath)
+	newPath = utils.AddTrailingSlashIfNotExists(newPath)
+
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return fmt.Errorf("no rules found for source: %s", sourcePath)
+	}
+
+	rule, ok := rulesBySource[oldPath]
+	if !ok {
+		return fmt.Errorf("no rule found for path: %s", oldPath)
+	}
+
+	// Remove the old rule and add it with the new path
+	delete(rulesBySource, oldPath)
+	rulesBySource[newPath] = rule
+
+	// Invalidate caches
+	s.incrementSourceVersion(sourcePath)
+	accessCache.Set(accessChangedKey+sourcePath, "false")
+	rulesCache.Delete(accessChangedKey + sourcePath)
+
+	logger.Debugf("access rule path updated: source=%s, fromPath=%s, toPath=%s", sourcePath, oldPath, newPath)
+	return s.SaveToDB()
+}
@@ -1203,3 +1203,513 @@ func TestHasAnyVisibleItems(t *testing.T) {

 	t.Log("✓ HasAnyVisibleItems correctly checks access permissions for items")
 }
+
+// TestRemoveUserCascade_OnlyRemovesSpecificList tests that cascade delete only removes from the specified list
+func TestRemoveUserCascade_OnlyRemovesSpecificList(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Set up rules: alice has both allow and deny rules on different paths
+	if err = s.AllowUser("mnt/storage", "/docs/", "alice"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.AllowUser("mnt/storage", "/docs/public/", "alice"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.DenyUser("mnt/storage", "/docs/", "alice"); err != nil {
+		t.Fatalf("DenyUser failed: %v", err)
+	}
+	if err = s.DenyUser("mnt/storage", "/docs/private/", "alice"); err != nil {
+		t.Fatalf("DenyUser failed: %v", err)
+	}
+
+	// Cascade delete only allow rules
+	var count int
+	count, err = s.RemoveUserCascade("mnt/storage", "/docs/", "alice", true)
+	if err != nil {
+		t.Fatalf("RemoveUserCascade failed: %v", err)
+	}
+	if count != 2 {
+		t.Errorf("Expected 2 allow rules removed, got %d", count)
+	}
+
+	// Verify allow rules are gone
+	rule, ok := s.GetFrontendRules("mnt/storage", "/docs/")
+	if ok && len(rule.Allow.Users) != 0 {
+		t.Error("Allow rule should be removed from /docs/")
+	}
+	rule, ok = s.GetFrontendRules("mnt/storage", "/docs/public/")
+	if ok && len(rule.Allow.Users) != 0 {
+		t.Error("Allow rule should be removed from /docs/public/")
+	}
+
+	// Verify deny rules are still present
+	rule, ok = s.GetFrontendRules("mnt/storage", "/docs/")
+	if !ok || len(rule.Deny.Users) == 0 {
+		t.Error("Deny rule should still exist on /docs/")
+	}
+	rule, ok = s.GetFrontendRules("mnt/storage", "/docs/private/")
+	if !ok || len(rule.Deny.Users) == 0 {
+		t.Error("Deny rule should still exist on /docs/private/")
+	}
+
+	t.Log("✓ Cascade delete correctly removes only allow rules, leaving deny rules intact")
+}
+
+// TestRemoveUserCascade_DenyRules tests cascade delete for deny rules specifically
+func TestRemoveUserCascade_DenyRules(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "bob")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Set up both allow and deny rules
+	if err = s.AllowUser("mnt/storage", "/projects/", "bob"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.AllowUser("mnt/storage", "/projects/team/", "bob"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.DenyUser("mnt/storage", "/projects/", "bob"); err != nil {
+		t.Fatalf("DenyUser failed: %v", err)
+	}
+	if err = s.DenyUser("mnt/storage", "/projects/secret/", "bob"); err != nil {
+		t.Fatalf("DenyUser failed: %v", err)
+	}
+
+	// Cascade delete only deny rules
+	var count int
+	count, err = s.RemoveUserCascade("mnt/storage", "/projects/", "bob", false)
+	if err != nil {
+		t.Fatalf("RemoveUserCascade failed: %v", err)
+	}
+	if count != 2 {
+		t.Errorf("Expected 2 deny rules removed, got %d", count)
+	}
+
+	// Verify deny rules are gone
+	rule, ok := s.GetFrontendRules("mnt/storage", "/projects/")
+	if !ok || len(rule.Deny.Users) != 0 {
+		t.Error("Deny rule should be removed from /projects/")
+	}
+	rule, ok = s.GetFrontendRules("mnt/storage", "/projects/secret/")
+	if ok && len(rule.Deny.Users) != 0 {
+		t.Error("Deny rule should be removed from /projects/secret/")
+	}
+
+	// Verify allow rules are still present
+	rule, ok = s.GetFrontendRules("mnt/storage", "/projects/")
+	if !ok || len(rule.Allow.Users) == 0 {
+		t.Error("Allow rule should still exist on /projects/")
+	}
+	rule, ok = s.GetFrontendRules("mnt/storage", "/projects/team/")
+	if !ok || len(rule.Allow.Users) == 0 {
+		t.Error("Allow rule should still exist on /projects/team/")
+	}
+
+	t.Log("✓ Cascade delete correctly removes only deny rules, leaving allow rules intact")
+}
+
+// TestRemoveUserCascade_MultipleSubpaths tests cascade delete across multiple subpath levels
+func TestRemoveUserCascade_MultipleSubpaths(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "carol")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Set up a deep hierarchy of allow rules
+	paths := []string{
+		"/data/",
+		"/data/2024/",
+		"/data/2024/q1/",
+		"/data/2024/q1/jan/",
+		"/data/2024/q1/feb/",
+		"/data/2024/q2/",
+		"/data/2024/q2/apr/",
+		"/data/2025/",
+	}
+
+	for _, path := range paths {
+		if err = s.AllowUser("mnt/storage", path, "carol"); err != nil {
+			t.Fatalf("AllowUser failed for %s: %v", path, err)
+		}
+	}
+
+	// Cascade delete from /data/2024/ should remove all 2024 subpaths
+	var count int
+	count, err = s.RemoveUserCascade("mnt/storage", "/data/2024/", "carol", true)
+	if err != nil {
+		t.Fatalf("RemoveUserCascade failed: %v", err)
+	}
+	if count != 6 {
+		t.Errorf("Expected 6 rules removed (2024 + 5 subpaths), got %d", count)
+	}
+
+	// Verify 2024 paths are gone
+	for _, path := range []string{"/data/2024/", "/data/2024/q1/", "/data/2024/q1/jan/", "/data/2024/q1/feb/", "/data/2024/q2/", "/data/2024/q2/apr/"} {
+		rule, ok := s.GetFrontendRules("mnt/storage", path)
+		if ok && len(rule.Allow.Users) > 0 {
+			t.Errorf("Rule should be removed from %s", path)
+		}
+	}
+
+	// Verify other paths still exist
+	rule, ok := s.GetFrontendRules("mnt/storage", "/data/")
+	if !ok || len(rule.Allow.Users) == 0 {
+		t.Error("Rule should still exist on /data/")
+	}
+	rule, ok = s.GetFrontendRules("mnt/storage", "/data/2025/")
+	if !ok || len(rule.Allow.Users) == 0 {
+		t.Error("Rule should still exist on /data/2025/")
+	}
+
+	t.Log("✓ Cascade delete correctly removes rules from all subpath levels")
+}
+
+// TestRemoveGroupCascade_OnlyRemovesSpecificList tests cascade delete for groups
+func TestRemoveGroupCascade_OnlyRemovesSpecificList(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Create a group
+	if err = s.AddUserToGroup("editors", "alice"); err != nil {
+		t.Fatalf("AddUserToGroup failed: %v", err)
+	}
+
+	// Set up both allow and deny rules for the group
+	if err = s.AllowGroup("mnt/storage", "/content/", "editors"); err != nil {
+		t.Fatalf("AllowGroup failed: %v", err)
+	}
+	if err = s.AllowGroup("mnt/storage", "/content/articles/", "editors"); err != nil {
+		t.Fatalf("AllowGroup failed: %v", err)
+	}
+	if err = s.DenyGroup("mnt/storage", "/content/", "editors"); err != nil {
+		t.Fatalf("DenyGroup failed: %v", err)
+	}
+	if err = s.DenyGroup("mnt/storage", "/content/drafts/", "editors"); err != nil {
+		t.Fatalf("DenyGroup failed: %v", err)
+	}
+
+	// Cascade delete only allow rules
+	count, err := s.RemoveGroupCascade("mnt/storage", "/content/", "editors", true)
+	if err != nil {
+		t.Fatalf("RemoveGroupCascade failed: %v", err)
+	}
+	if count != 2 {
+		t.Errorf("Expected 2 allow rules removed, got %d", count)
+	}
+
+	// Verify allow rules are gone
+	rule, ok := s.GetFrontendRules("mnt/storage", "/content/")
+	if !ok || len(rule.Allow.Groups) != 0 {
+		t.Error("Allow rule should be removed from /content/")
+	}
+
+	// Verify deny rules are still present
+	rule, ok = s.GetFrontendRules("mnt/storage", "/content/")
+	if !ok || len(rule.Deny.Groups) == 0 {
+		t.Error("Deny rule should still exist on /content/")
+	}
+	rule, ok = s.GetFrontendRules("mnt/storage", "/content/drafts/")
+	if !ok || len(rule.Deny.Groups) == 0 {
+		t.Error("Deny rule should still exist on /content/drafts/")
+	}
+
+	t.Log("✓ Cascade delete for groups correctly removes only allow rules")
+}
+
+// TestRemoveGroupCascade_DenyRules tests cascade delete for group deny rules specifically
+func TestRemoveGroupCascade_DenyRules(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "alice")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Create a group
+	if err = s.AddUserToGroup("contractors", "alice"); err != nil {
+		t.Fatalf("AddUserToGroup failed: %v", err)
+	}
+
+	// Set up both allow and deny rules for the group
+	if err = s.AllowGroup("mnt/storage", "/work/", "contractors"); err != nil {
+		t.Fatalf("AllowGroup failed: %v", err)
+	}
+	if err = s.AllowGroup("mnt/storage", "/work/public/", "contractors"); err != nil {
+		t.Fatalf("AllowGroup failed: %v", err)
+	}
+	if err = s.DenyGroup("mnt/storage", "/work/", "contractors"); err != nil {
+		t.Fatalf("DenyGroup failed: %v", err)
+	}
+	if err = s.DenyGroup("mnt/storage", "/work/confidential/", "contractors"); err != nil {
+		t.Fatalf("DenyGroup failed: %v", err)
+	}
+
+	// Cascade delete only deny rules
+	var count int
+	count, err = s.RemoveGroupCascade("mnt/storage", "/work/", "contractors", false)
+	if err != nil {
+		t.Fatalf("RemoveGroupCascade failed: %v", err)
+	}
+	if count != 2 {
+		t.Errorf("Expected 2 deny rules removed, got %d", count)
+	}
+
+	// Verify deny rules are gone
+	rule, ok := s.GetFrontendRules("mnt/storage", "/work/")
+	if ok && len(rule.Deny.Groups) != 0 {
+		t.Error("Deny rule should be removed from /work/")
+	}
+	rule, ok = s.GetFrontendRules("mnt/storage", "/work/confidential/")
+	if ok && len(rule.Deny.Groups) != 0 {
+		t.Error("Deny rule should be removed from /work/confidential/")
+	}
+
+	// Verify allow rules are still present
+	rule, ok = s.GetFrontendRules("mnt/storage", "/work/")
+	if !ok || len(rule.Allow.Groups) == 0 {
+		t.Error("Allow rule should still exist on /work/")
+	}
+	rule, ok = s.GetFrontendRules("mnt/storage", "/work/public/")
+	if !ok || len(rule.Allow.Groups) == 0 {
+		t.Error("Allow rule should still exist on /work/public/")
+	}
+
+	t.Log("✓ Cascade delete for groups correctly removes only deny rules, leaving allow rules intact")
+}
+
+// TestRemoveUserCascade_EmptyResult tests cascade delete when no rules exist
+func TestRemoveUserCascade_EmptyResult(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "dave")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Try to cascade delete when no rules exist
+	var count int
+	count, err = s.RemoveUserCascade("mnt/storage", "/nonexistent/", "dave", true)
+	if err != nil {
+		t.Fatalf("RemoveUserCascade should not error on nonexistent rules: %v", err)
+	}
+	if count != 0 {
+		t.Errorf("Expected 0 rules removed, got %d", count)
+	}
+
+	t.Log("✓ Cascade delete correctly returns 0 when no rules exist")
+}
+
+// TestRemoveUserCascade_ExactPathOnly tests that exact path is included in cascade
+func TestRemoveUserCascade_ExactPathOnly(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "eve")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Add rule only on exact path, no subpaths
+	if err = s.AllowUser("mnt/storage", "/single/", "eve"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+
+	// Cascade delete should remove the exact path rule
+	var count int
+	count, err = s.RemoveUserCascade("mnt/storage", "/single/", "eve", true)
+	if err != nil {
+		t.Fatalf("RemoveUserCascade failed: %v", err)
+	}
+	if count != 1 {
+		t.Errorf("Expected 1 rule removed, got %d", count)
+	}
+
+	// Verify rule is gone
+	rule, ok := s.GetFrontendRules("mnt/storage", "/single/")
+	if ok && len(rule.Allow.Users) > 0 {
+		t.Error("Rule should be removed from /single/")
+	}
+
+	t.Log("✓ Cascade delete correctly removes the exact path rule")
+}
+
+// TestRemoveUserCascade_DoesNotAffectParentPaths tests that parent paths are not affected
+func TestRemoveUserCascade_DoesNotAffectParentPaths(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "frank")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Set up rules on parent and child paths
+	if err = s.AllowUser("mnt/storage", "/parent/", "frank"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.AllowUser("mnt/storage", "/parent/child/", "frank"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.AllowUser("mnt/storage", "/parent/child/grandchild/", "frank"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+
+	// Cascade delete from child path
+	count, err := s.RemoveUserCascade("mnt/storage", "/parent/child/", "frank", true)
+	if err != nil {
+		t.Fatalf("RemoveUserCascade failed: %v", err)
+	}
+	if count != 2 {
+		t.Errorf("Expected 2 rules removed (child + grandchild), got %d", count)
+	}
+
+	// Verify parent rule still exists
+	rule, ok := s.GetFrontendRules("mnt/storage", "/parent/")
+	if !ok || len(rule.Allow.Users) == 0 {
+		t.Error("Parent rule should still exist")
+	}
+
+	// Verify child rules are gone
+	rule, ok = s.GetFrontendRules("mnt/storage", "/parent/child/")
+	if ok && len(rule.Allow.Users) > 0 {
+		t.Error("Child rule should be removed")
+	}
+
+	t.Log("✓ Cascade delete does not affect parent paths")
+}
+
+// TestRemoveUserCascade_CleanupEmptyRules tests that empty rules are cleaned up
+func TestRemoveUserCascade_CleanupEmptyRules(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "grace")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Add only allow rule (no deny rules)
+	if err = s.AllowUser("mnt/storage", "/temp/", "grace"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.AllowUser("mnt/storage", "/temp/files/", "grace"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+
+	// Verify rules exist
+	allRules, err := s.GetAllRules("mnt/storage")
+	if err != nil {
+		t.Fatalf("GetAllRules failed: %v", err)
+	}
+	if len(allRules) < 2 {
+		t.Error("Expected at least 2 rules to exist")
+	}
+
+	// Cascade delete - should remove rules and cleanup empty rule objects
+	var count int
+	count, err = s.RemoveUserCascade("mnt/storage", "/temp/", "grace", true)
+	if err != nil {
+		t.Fatalf("RemoveUserCascade failed: %v", err)
+	}
+	if count != 2 {
+		t.Errorf("Expected 2 rules removed, got %d", count)
+	}
+
+	// Verify rules are completely gone (not just empty)
+	allRules, err = s.GetAllRules("mnt/storage")
+	if err != nil {
+		t.Fatalf("GetAllRules failed: %v", err)
+	}
+	if _, exists := allRules["/temp/"]; exists {
+		t.Error("Empty rule should be cleaned up from /temp/")
+	}
+	if _, exists := allRules["/temp/files/"]; exists {
+		t.Error("Empty rule should be cleaned up from /temp/files/")
+	}
+
+	t.Log("✓ Cascade delete correctly cleans up empty rules")
+}
+
+// TestRemoveUserCascade_MixedUsers tests that cascade delete only affects the specified user
+func TestRemoveUserCascade_MixedUsers(t *testing.T) {
+	setupTestSources()
+	s, userStore := createTestStorage(t)
+	createTestUser(t, userStore, "henry")
+	createTestUser(t, userStore, "iris")
+	err := s.LoadFromDB()
+	if err != nil && err != storm.ErrNotFound {
+		t.Errorf("unexpected error loading from DB: %v", err)
+	}
+
+	// Add rules for both users on same paths
+	if err = s.AllowUser("mnt/storage", "/shared/", "henry"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.AllowUser("mnt/storage", "/shared/", "iris"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.AllowUser("mnt/storage", "/shared/docs/", "henry"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+	if err = s.AllowUser("mnt/storage", "/shared/docs/", "iris"); err != nil {
+		t.Fatalf("AllowUser failed: %v", err)
+	}
+
+	// Cascade delete only henry's rules
+	var count int
+	count, err = s.RemoveUserCascade("mnt/storage", "/shared/", "henry", true)
+	if err != nil {
+		t.Fatalf("RemoveUserCascade failed: %v", err)
+	}
+	if count != 2 {
+		t.Errorf("Expected 2 rules removed for henry, got %d", count)
+	}
+
+	// Verify henry's rules are gone
+	rule, ok := s.GetFrontendRules("mnt/storage", "/shared/")
+	if !ok {
+		t.Fatal("Rule should still exist (iris's rule)")
+	}
+	hasHenry := false
+	for _, user := range rule.Allow.Users {
+		if user == "henry" {
+			hasHenry = true
+		}
+	}
+	if hasHenry {
+		t.Error("henry should be removed from allow list")
+	}
+
+	// Verify iris's rules still exist
+	hasIris := false
+	for _, user := range rule.Allow.Users {
+		if user == "iris" {
+			hasIris = true
+		}
+	}
+	if !hasIris {
+		t.Error("iris should still be in allow list")
+	}
+
+	t.Log("✓ Cascade delete only affects the specified user")
+}
@@ -32,7 +32,7 @@ func (s *Storage) CheckChildItemAccess(response *iteminfo.ExtendedFileInfo, inde

 	// Filter and return only the items the user has access to
 	response.Folders = make([]iteminfo.ItemInfo, 0)
-	response.Files = make([]iteminfo.ItemInfo, 0)
+	response.Files = make([]iteminfo.ExtendedItemInfo, 0)

 	// Check each subfolder for access permissions
 	for _, folder := range originalFolders {
@@ -1,39 +1,46 @@
 package share

-import "sync"
+import (
+	"sync"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)

 type CommonShare struct {
-	DownloadsLimit           int      `json:"downloadsLimit,omitempty"`
-	ShareTheme               string   `json:"shareTheme,omitempty"`
-	DisableAnonymous         bool     `json:"disableAnonymous,omitempty"`
-	MaxBandwidth             int      `json:"maxBandwidth,omitempty"`
-	DisableThumbnails        bool     `json:"disableThumbnails,omitempty"`
-	KeepAfterExpiration      bool     `json:"keepAfterExpiration,omitempty"`
-	AllowedUsernames         []string `json:"allowedUsernames,omitempty"`
-	ThemeColor               string   `json:"themeColor,omitempty"`
-	Banner                   string   `json:"banner,omitempty"`
-	Title                    string   `json:"title,omitempty"`
-	Description              string   `json:"description,omitempty"`
-	Favicon                  string   `json:"favicon,omitempty"`
-	QuickDownload            bool     `json:"quickDownload,omitempty"`
-	HideNavButtons           bool     `json:"hideNavButtons,omitempty"`
-	DisableSidebar           bool     `json:"disableSidebar"`
-	Source                   string   `json:"source,omitempty"` // backend source is path to maintain between name changes
-	Path                     string   `json:"path,omitempty"`
-	DownloadURL              string   `json:"downloadURL,omitempty"`
-	DisableShareCard         bool     `json:"disableShareCard,omitempty"`
-	EnforceDarkLightMode     string   `json:"enforceDarkLightMode,omitempty"` // "dark" or "light"
-	ViewMode                 string   `json:"viewMode,omitempty"`             // default view mode for anonymous users: "list", "compact", "normal", "gallery"
-	EnableOnlyOffice         bool     `json:"enableOnlyOffice,omitempty"`
-	ShareType                string   `json:"shareType"` // type of share: normal, upload, max
-	PerUserDownloadLimit     bool     `json:"perUserDownloadLimit,omitempty"`
-	ExtractEmbeddedSubtitles bool     `json:"extractEmbeddedSubtitles,omitempty"` // can be io intensive for large files and take 10-30 seconds.
-	AllowDelete              bool     `json:"allowDelete,omitempty"`
-	AllowCreate              bool     `json:"allowCreate,omitempty"`       // allow creating files
-	AllowModify              bool     `json:"allowModify,omitempty"`       // allow modifying files
-	DisableFileViewer        bool     `json:"disableFileViewer,omitempty"` // don't allow viewing files
-	DisableDownload          bool     `json:"disableDownload,omitempty"`   // don't allow downloading files
-	AllowReplacements        bool     `json:"allowReplacements,omitempty"` // allow replacements of files
+	DownloadsLimit           int                 `json:"downloadsLimit,omitempty"`
+	ShareTheme               string              `json:"shareTheme,omitempty"`
+	DisableAnonymous         bool                `json:"disableAnonymous,omitempty"`
+	MaxBandwidth             int                 `json:"maxBandwidth,omitempty"`
+	DisableThumbnails        bool                `json:"disableThumbnails,omitempty"`
+	KeepAfterExpiration      bool                `json:"keepAfterExpiration,omitempty"`
+	AllowedUsernames         []string            `json:"allowedUsernames,omitempty"`
+	ThemeColor               string              `json:"themeColor,omitempty"`
+	Banner                   string              `json:"banner,omitempty"`
+	Title                    string              `json:"title,omitempty"`
+	Description              string              `json:"description,omitempty"`
+	Favicon                  string              `json:"favicon,omitempty"`
+	QuickDownload            bool                `json:"quickDownload,omitempty"`
+	HideNavButtons           bool                `json:"hideNavButtons,omitempty"`
+	DisableSidebar           bool                `json:"disableSidebar"`
+	Source                   string              `json:"source,omitempty"` // backend source is path to maintain between name changes
+	Path                     string              `json:"path,omitempty"`
+	DownloadURL              string              `json:"downloadURL,omitempty"`
+	ShareURL                 string              `json:"shareURL,omitempty"`
+	DisableShareCard         bool                `json:"disableShareCard,omitempty"`
+	EnforceDarkLightMode     string              `json:"enforceDarkLightMode,omitempty"` // "dark" or "light"
+	ViewMode                 string              `json:"viewMode,omitempty"`             // default view mode for anonymous users: "list", "compact", "normal", "gallery"
+	EnableOnlyOffice         bool                `json:"enableOnlyOffice,omitempty"`
+	ShareType                string              `json:"shareType"` // type of share: normal, upload, max
+	PerUserDownloadLimit     bool                `json:"perUserDownloadLimit,omitempty"`
+	ExtractEmbeddedSubtitles bool                `json:"extractEmbeddedSubtitles,omitempty"` // can be io intensive for large files and take 10-30 seconds.
+	AllowDelete              bool                `json:"allowDelete,omitempty"`
+	AllowCreate              bool                `json:"allowCreate,omitempty"`       // allow creating files
+	AllowModify              bool                `json:"allowModify,omitempty"`       // allow modifying files
+	DisableFileViewer        bool                `json:"disableFileViewer,omitempty"` // don't allow viewing files
+	DisableDownload          bool                `json:"disableDownload,omitempty"`   // don't allow downloading files
+	AllowReplacements        bool                `json:"allowReplacements,omitempty"` // allow replacements of files
+	SidebarLinks             []users.SidebarLink `json:"sidebarLinks"`                // customizable sidebar links
+	HasPassword              bool                `json:"hasPassword,omitempty"`
 }
 type CreateBody struct {
 	CommonShare
@@ -57,6 +64,6 @@ type Link struct {
 	Token string `json:"token,omitempty"`

 	Mu            sync.Mutex     `json:"-"`
-	UserDownloads map[string]int `json:"-"` // Track downloads per username (not persisted)
-
+	UserDownloads map[string]int `json:"userDownloads,omitempty"` // Track downloads per username
+	Version       int            `json:"version,omitempty"`
 }
@@ -6,6 +6,7 @@ import (
 	"time"

 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/crud"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
@@ -16,6 +17,7 @@ type StorageBackend interface {
 	All() ([]*Link, error)
 	FindByUserID(id uint) ([]*Link, error)
 	GetByHash(hash string) (*Link, error)
+	GetCommonShareByHash(hash string) (*CommonShare, error)
 	GetPermanent(path, source string, id uint) (*Link, error)
 	GetBySourcePath(path, source string) ([]*Link, error)
 	Gets(path, source string, id uint) ([]*Link, error)
@@ -220,51 +222,84 @@ func (s *Storage) GetBySourcePath(path, source string) ([]*Link, error) {
 	return filtered, nil
 }

-// UpdateShares updates all shares that exactly match oldSource and oldPath
-// to point to newSource and newPath. Returns the number of updated shares.
+// UpdateShares updates all shares that match oldSource and oldPath to point to newSource and newPath.
+// Handles both exact matches and subdirectories, regardless of trailing slashes.
 func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (int, error) {
 	links, err := s.back.All()
 	if err != nil && err != errors.ErrNotExist {
 		logger.Error("failed to list shares", "error", err)
 		return 0, err
 	}
+
+	// Normalize paths for comparison (remove trailing slashes)
+	oldPath = utils.AddTrailingSlashIfNotExists(oldPath)
+	newPath = utils.AddTrailingSlashIfNotExists(newPath)
+
 	updated := 0
 	for _, l := range links {
-		if l == nil {
-			continue
-		}
-		if l.Source != oldSource {
+		if l == nil || l.Source != oldSource {
 			continue
 		}
+		l.Path = utils.AddTrailingSlashIfNotExists(l.Path)
+
 		pos := strings.Index(l.Path, oldPath)
 		if pos < 0 {
 			continue
 		}
+
 		oldFullPath := l.Path
 		l.Source = newSource
-		l.Path = oldFullPath[:pos] + newPath + oldFullPath[pos+len(oldPath):]
+		l.Path = newPath
+
 		if err := s.back.Save(l); err != nil {
 			logger.Error("failed to save updated share", "hash", l.Hash, "error", err)
 			return updated, err
 		}
+
 		s.mu.Lock()
 		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
-			// update existing cached pointer fields
 			existing.Source = l.Source
 			existing.Path = l.Path
 		} else {
 			s.shareCache[l.Hash] = l
 		}
 		s.mu.Unlock()
+
 		logger.Info("share updated", "hash", l.Hash, "fromPath", oldFullPath, "toPath", l.Path)
 		updated++
 	}
+
 	if updated == 0 {
 		logger.Warning("no matching shares to update for provided source/path")
 	}
 	return updated, nil
 }

+// UpdateSharePath updates the path for a specific share identified by hash
+func (s *Storage) UpdateSharePath(hash, newPath string) error {
+	link, err := s.GetByHash(hash)
+	if err != nil {
+		return err
+	}
+
+	oldPath := link.Path
+	link.Path = newPath
+
+	if err := s.back.Save(link); err != nil {
+		logger.Error("failed to save updated share", "hash", hash, "error", err)
+		return err
+	}
+
+	s.mu.Lock()
+	if existing, ok := s.shareCache[hash]; ok && existing != nil {
+		existing.Path = newPath
+	}
+	s.mu.Unlock()
+
+	logger.Debug("share path updated", "hash", hash, "fromPath", oldPath, "toPath", newPath)
+	return nil
+}
+
 // Save wraps StorageBackend.Save
 func (s *Storage) Save(l *Link) error {
 	if err := s.back.Save(l); err != nil {
@@ -321,3 +356,8 @@ func (s *Storage) filterExpired(links []*Link) ([]*Link, error) {
 	}
 	return filtered, nil
 }
+
+// GetCommonShareByHash retrieves only the CommonShare attributes for a given hash
+func (s *Storage) GetCommonShareByHash(hash string) (*CommonShare, error) {
+	return s.back.GetCommonShareByHash(hash)
+}
@@ -45,6 +45,23 @@ func (s shareBackend) GetByHash(hash string) (*share.Link, error) {
 	return &v, err
 }

+func (s shareBackend) GetCommonShareByHash(hash string) (*share.CommonShare, error) {
+	var v share.Link
+	err := s.db.One("Hash", hash, &v)
+	if err == storm.ErrNotFound {
+		return nil, errors.ErrNotExist
+	}
+	if err != nil {
+		return nil, err
+	}
+	v.Source = ""
+	v.Path = ""
+	v.AllowedUsernames = nil
+	v.DownloadsLimit = 0
+	v.CommonShare.HasPassword = v.HasPassword()
+	return &v.CommonShare, nil
+}
+
 func (s shareBackend) GetPermanent(path, source string, id uint) (*share.Link, error) {
 	var v share.Link
 	// TODO remove legacy and return notfound errors
@@ -74,20 +74,28 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 	if err != nil {
 		return err
 	}
+
 	passwordUser := existingUser.LoginMethod == users.LoginMethodPassword
 	enforcedOtp := settings.Config.Auth.Methods.PasswordAuth.EnforcedOtp
 	if passwordUser && enforcedOtp && !user.OtpEnabled {
 		return errors.ErrNoTotpConfigured
 	}
+	if user.LoginMethod == "" {
+		user.LoginMethod = existingUser.LoginMethod
+	}
 	fields, err = parseFields(user, fields, actorIsAdmin)
 	if err != nil {
 		return err
 	}

+	if user.LoginMethod == "" {
+		user.LoginMethod = existingUser.LoginMethod
+	}
+
 	if !slices.Contains(fields, "Password") {
 		user.Password = existingUser.Password
 	} else {
-		if existingUser.LockPassword {
+		if existingUser.LockPassword && !actorIsAdmin {
 			return fmt.Errorf("password cannot be changed when lock password is enabled")
 		}
 	}
@@ -112,6 +120,14 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 			return err
 		}
 	}
+	// converting scopes to map of paths intead of names (names can change)
+	if slices.Contains(fields, "SidebarLinks") {
+		adjustedLinks, err := settings.ConvertToBackendSidebarLinks(user.SidebarLinks)
+		if err != nil {
+			return err
+		}
+		user.SidebarLinks = adjustedLinks
+	}
 	// Use reflection to access struct fields
 	userFields := reflect.ValueOf(user).Elem() // Get struct value
 	for _, field := range fields {
@@ -275,6 +291,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 		if capitalField == "Password" {
 			// Only process password if it's actually being updated (not empty)
 			if user.Password != "" {
+				logger.Debugf("Updating password for user [%s] loginMethod: %s", user.Username, user.LoginMethod)
 				if user.LoginMethod != users.LoginMethodPassword {
 					return nil, fmt.Errorf("password cannot be changed when login method is not password")
 				}
@@ -42,6 +42,11 @@ func InitializeDb(path string) (*bolt.BoltStore, bool, error) {
 		return nil, exists, err
 	}
 	if !exists {
+		if settings.Env.IsPlaywright || settings.Env.IsDevMode {
+			settings.Env.IsFirstLoad = false
+		} else {
+			settings.Env.IsFirstLoad = true
+		}
 		quickSetup(store)
 	}

@@ -94,6 +99,7 @@ func quickSetup(store *bolt.BoltStore) {
 		}
 		user.LockPassword = false
 		user.Permissions = settings.AdminPerms()
+		user.ShowFirstLogin = settings.Env.IsFirstLoad && user.Permissions.Admin
 		logger.Debugf("Creating user as admin: %v %v", user.Username, user.Password)
 		err = store.Users.Save(user, true, true)
 		utils.CheckErr("store.Users.Save", err)
@@ -101,8 +107,9 @@ func quickSetup(store *bolt.BoltStore) {
 }

 // create new user
-func CreateUser(userInfo users.User) error {
+func CreateUser(userInfo users.User, permissions users.Permissions) error {
 	newUser := &userInfo
+	newUser.ShowFirstLogin = settings.Env.IsFirstLoad && newUser.Permissions.Admin
 	if userInfo.LoginMethod == "password" {
 		if userInfo.Password == "" {
 			return fmt.Errorf("password is required to create a password login user")
@@ -118,6 +125,8 @@ func CreateUser(userInfo users.User) error {
 	if userInfo.Username == "" {
 		return fmt.Errorf("username is required to create a user")
 	}
+	settings.ApplyUserDefaults(newUser)
+	newUser.Permissions = permissions
 	logger.Debugf("Creating user: %v %v", userInfo.Username, userInfo.Scopes)
 	// create new home directories
 	err := userStore.Save(newUser, true, false)
@@ -72,8 +72,9 @@ type User struct {
 	LoginMethod     LoginMethod          `json:"loginMethod"`
 	OtpEnabled      bool                 `json:"otpEnabled"` // true if TOTP is enabled, false otherwise
 	// legacy for migration purposes... og filebrowser has perm attribute
-	Perm    Permissions `json:"perm,omitzero"`
-	Version int         `json:"version"`
+	Perm           Permissions `json:"perm,omitzero"`
+	Version        int         `json:"version"`
+	ShowFirstLogin bool        `json:"showFirstLogin"`
 }

 type SourceScope struct {
@@ -83,35 +84,36 @@ type SourceScope struct {

 // json tags must match variable name with smaller case first letter
 type NonAdminEditable struct {
-	EditorQuickSave            bool        `json:"editorQuickSave"`         // show quick save button in editor
-	HideSidebarFileActions     bool        `json:"hideSidebarFileActions"`  // hide the file actions in the sidebar
-	DisableQuickToggles        bool        `json:"disableQuickToggles"`     // disable the quick toggles in the sidebar
-	DisableSearchOptions       bool        `json:"disableSearchOptions"`    // disable the search options in the search bar
-	DeleteWithoutConfirming    bool        `json:"deleteWithoutConfirming"` // delete files without confirmation
-	Preview                    Preview     `json:"preview"`
-	StickySidebar              bool        `json:"stickySidebar"` // keep sidebar open when navigating
-	DarkMode                   bool        `json:"darkMode"`      // should dark mode be enabled
-	Password                   string      `json:"password,omitempty"`
-	Locale                     string      `json:"locale"`      // language to use: eg. de, en, or fr
-	ViewMode                   string      `json:"viewMode"`    // view mode to use: eg. normal, list, grid, or compact
-	SingleClick                bool        `json:"singleClick"` // open directory on single click, also enables middle click to open in new tab
-	Sorting                    Sorting     `json:"sorting"`
-	ShowHidden                 bool        `json:"showHidden"`                 // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-	DateFormat                 bool        `json:"dateFormat"`                 // when false, the date is relative, when true, the date is an exact timestamp
-	GallerySize                int         `json:"gallerySize"`                // 0-9 - the size of the gallery thumbnails
-	ThemeColor                 string      `json:"themeColor"`                 // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-	QuickDownload              bool        `json:"quickDownload"`              // show icon to download in one click
-	DisableUpdateNotifications bool        `json:"disableUpdateNotifications"` // disable update notifications
-	FileLoading                FileLoading `json:"fileLoading"`                // upload and download settings
-	DisableOfficePreviewExt    string      `json:"disableOfficePreviewExt"`    // deprecated
-	DisableOnlyOfficeExt       string      `json:"disableOnlyOfficeExt"`       // deprecated
-	DisablePreviewExt          string      `json:"disablePreviewExt"`          // space separated list of file extensions to disable preview for
-	DisableViewingExt          string      `json:"disableViewingExt"`          // space separated list of file extensions to disable viewing for
-	CustomTheme                string      `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
-	ShowSelectMultiple         bool        `json:"showSelectMultiple"`         // show select multiple files on desktop
-	DebugOffice                bool        `json:"debugOffice"`                // debug onlyoffice editor
-	OtpEnabled                 bool        `json:"otpEnabled"`                 // allow non-admin users to disable their own OTP
-	DefaultLandingPage         string      `json:"defaultLandingPage"`         // default landing page to use: eg. /files/mysource/mysubpath, /settings, etc.
+	EditorQuickSave            bool          `json:"editorQuickSave"`         // show quick save button in editor
+	HideSidebarFileActions     bool          `json:"hideSidebarFileActions"`  // hide the file actions in the sidebar
+	DisableQuickToggles        bool          `json:"disableQuickToggles"`     // disable the quick toggles in the sidebar
+	DisableSearchOptions       bool          `json:"disableSearchOptions"`    // disable the search options in the search bar
+	DeleteWithoutConfirming    bool          `json:"deleteWithoutConfirming"` // delete files without confirmation
+	Preview                    Preview       `json:"preview"`
+	StickySidebar              bool          `json:"stickySidebar"` // keep sidebar open when navigating
+	DarkMode                   bool          `json:"darkMode"`      // should dark mode be enabled
+	Password                   string        `json:"password,omitempty"`
+	Locale                     string        `json:"locale"`      // language to use: eg. de, en, or fr
+	ViewMode                   string        `json:"viewMode"`    // view mode to use: eg. normal, list, grid, or compact
+	SingleClick                bool          `json:"singleClick"` // open directory on single click, also enables middle click to open in new tab
+	Sorting                    Sorting       `json:"sorting"`
+	ShowHidden                 bool          `json:"showHidden"`                 // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	DateFormat                 bool          `json:"dateFormat"`                 // when false, the date is relative, when true, the date is an exact timestamp
+	GallerySize                int           `json:"gallerySize"`                // 0-9 - the size of the gallery thumbnails
+	ThemeColor                 string        `json:"themeColor"`                 // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+	QuickDownload              bool          `json:"quickDownload"`              // show icon to download in one click
+	DisableUpdateNotifications bool          `json:"disableUpdateNotifications"` // disable update notifications
+	FileLoading                FileLoading   `json:"fileLoading"`                // upload and download settings
+	DisableOfficePreviewExt    string        `json:"disableOfficePreviewExt"`    // deprecated
+	DisableOnlyOfficeExt       string        `json:"disableOnlyOfficeExt"`       // deprecated
+	DisablePreviewExt          string        `json:"disablePreviewExt"`          // space separated list of file extensions to disable preview for
+	DisableViewingExt          string        `json:"disableViewingExt"`          // space separated list of file extensions to disable viewing for
+	CustomTheme                string        `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
+	ShowSelectMultiple         bool          `json:"showSelectMultiple"`         // show select multiple files on desktop
+	DebugOffice                bool          `json:"debugOffice"`                // debug onlyoffice editor
+	OtpEnabled                 bool          `json:"otpEnabled"`                 // allow non-admin users to disable their own OTP
+	DefaultLandingPage         string        `json:"defaultLandingPage"`         // deprecated: determined by sidebar link order instead
+	SidebarLinks               []SidebarLink `json:"sidebarLinks"`               // customizable sidebar links
 }

 type FileLoading struct {
@@ -120,6 +122,15 @@ type FileLoading struct {
 	ClearAll      bool `json:"clearAll"`
 }

+// SidebarLink represents a customizable link in the sidebar.
+type SidebarLink struct {
+	Name       string `json:"name"`                 // Display name of the link
+	Category   string `json:"category"`             // Category type: "source", "share", "tool", "custom", etc.
+	Target     string `json:"target"`               // Target path/URL for the link (relative for source/share)
+	Icon       string `json:"icon"`                 // Material icon name
+	SourceName string `json:"sourceName,omitempty"` // Source identifier for source-type links
+}
+
 func CleanUsername(s string) string {
 	// Remove any trailing space to avoid ending on -
 	s = strings.Trim(s, " ")
@@ -0,0 +1,13 @@
+package ffmpeg
+
+import (
+	"time"
+
+	"github.com/gtsteffaniak/go-cache/cache"
+)
+
+var (
+	MediaCache           = cache.NewCache[[]SubtitleTrack](24 * time.Hour) // subtitles get cached for 24 hours
+	SubtitleContentCache = cache.NewCache[string](24 * time.Hour)          // subtitle content gets cached for 24 hours
+	MetadataCache        = cache.NewCache[float64](24 * time.Hour)         // media duration gets cached for 24 hours
+)
@@ -13,41 +13,8 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 )

-// ImageService handles image operations with ffmpeg
-type ImageService struct {
-	ffmpegPath  string
-	ffprobePath string
-	debug       bool
-	cacheDir    string
-	semaphore   chan struct{}
-}
-
-// NewImageService creates a new image service instance
-func NewImageService(ffmpegPath, ffprobePath string, maxConcurrent int, debug bool, cacheDir string) *ImageService {
-	return &ImageService{
-		ffmpegPath:  ffmpegPath,
-		ffprobePath: ffprobePath,
-		debug:       debug,
-		cacheDir:    cacheDir,
-		semaphore:   make(chan struct{}, maxConcurrent),
-	}
-}
-
-func (s *ImageService) Acquire(ctx context.Context) error {
-	select {
-	case s.semaphore <- struct{}{}:
-		return nil
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
-func (s *ImageService) Release() {
-	<-s.semaphore
-}
-
 // GetImageOrientation extracts the EXIF orientation from an image file using exiftool
-func (s *ImageService) GetImageOrientation(imagePath string) (string, error) {
+func (s *FFmpegService) GetImageOrientation(imagePath string) (string, error) {
 	// Use exiftool to get orientation information
 	cmd := exec.Command("exiftool", "-Orientation", "-s3", imagePath)
 	var out bytes.Buffer
@@ -67,7 +34,7 @@ func (s *ImageService) GetImageOrientation(imagePath string) (string, error) {
 }

 // GetOrientationFilter converts EXIF orientation to FFmpeg filter
-func (s *ImageService) GetOrientationFilter(orientation string) string {
+func (s *FFmpegService) GetOrientationFilter(orientation string) string {
 	switch orientation {
 	// Text-based EXIF orientation values (from exiftool)
 	case "Rotate 90 CW", "Right-top":
@@ -111,7 +78,7 @@ func (s *ImageService) GetOrientationFilter(orientation string) string {
 }

 // GetImageDimensions extracts the dimensions of an image file using ffprobe
-func (s *ImageService) GetImageDimensions(imagePath string) (width, height int, err error) {
+func (s *FFmpegService) GetImageDimensions(imagePath string) (width, height int, err error) {

 	// Get HEIC dimensions (fallback to individual stream dimensions for nowe re
 	probeCmd := exec.Command(
@@ -161,7 +128,7 @@ func (s *ImageService) GetImageDimensions(imagePath string) (width, height int,
 }

 // ConvertHEICToJPEGDirect converts a HEIC file to JPEG using direct FFmpeg conversion (fast method)
-func (s *ImageService) ConvertHEICToJPEGDirect(ctx context.Context, heicPath string, targetWidth, targetHeight int, quality string) ([]byte, error) {
+func (s *FFmpegService) ConvertHEICToJPEGDirect(ctx context.Context, heicPath string, targetWidth, targetHeight int, quality string) ([]byte, error) {
 	// Check if context is cancelled before starting
 	if ctx.Err() != nil {
 		return nil, ctx.Err()
@@ -229,15 +196,13 @@ func (s *ImageService) ConvertHEICToJPEGDirect(ctx context.Context, heicPath str
 }

 // ConvertHEICToJPEG converts a HEIC file to JPEG with specified dimensions and quality using proper tile extraction
-func (s *ImageService) ConvertHEICToJPEG(ctx context.Context, heicPath string, targetWidth, targetHeight int, quality string) ([]byte, error) {
+func (s *FFmpegService) ConvertHEICToJPEG(ctx context.Context, heicPath string, targetWidth, targetHeight int, quality string) ([]byte, error) {
 	// Check if context is cancelled before starting
 	if ctx.Err() != nil {
 		return nil, ctx.Err()
 	}
 	// Create temporary directory for tile processing
-	outputDir := s.cacheDir
-	tempDir := filepath.Join(outputDir, fmt.Sprintf("heic_tiles_%d", os.Getpid()))
-	err := os.MkdirAll(tempDir, fileutils.PermDir)
+	tempDir, err := os.MkdirTemp(s.cacheDir, "heic_convert")
 	if err != nil {
 		return nil, fmt.Errorf("failed to create temp directory: %w", err)
 	}
@@ -1,14 +1,13 @@
 package ffmpeg

 import (
-	"context"
 	"os"
 	"path/filepath"
 	"testing"
 )

 func TestGetOrientationFilter(t *testing.T) {
-	service := &ImageService{}
+	service := &FFmpegService{}

 	tests := []struct {
 		name        string
@@ -125,7 +124,7 @@ func TestGetImageOrientation(t *testing.T) {
 	}
 	defer os.RemoveAll(tempDir)

-	service := NewImageService("ffmpeg", "ffprobe", 2, false, tempDir)
+	service := NewFFmpegService(2, false, "/tmp/test_cache")

 	t.Run("Non-existent file", func(t *testing.T) {
 		nonExistentFile := filepath.Join(tempDir, "non_existent.heic")
@@ -153,94 +152,9 @@ func TestGetImageOrientation(t *testing.T) {
 	})
 }

-func TestNewImageService(t *testing.T) {
-	ffmpegPath := "/usr/bin/ffmpeg"
-	ffprobePath := "/usr/bin/ffprobe"
-	debug := true
-	cacheDir := "/tmp/test_cache"
-
-	service := NewImageService(ffmpegPath, ffprobePath, 2, debug, cacheDir)
-
-	if service.ffmpegPath != ffmpegPath {
-		t.Errorf("Expected ffmpegPath %q, got %q", ffmpegPath, service.ffmpegPath)
-	}
-	if service.ffprobePath != ffprobePath {
-		t.Errorf("Expected ffprobePath %q, got %q", ffprobePath, service.ffprobePath)
-	}
-	if service.debug != debug {
-		t.Errorf("Expected debug %v, got %v", debug, service.debug)
-	}
-	if service.cacheDir != cacheDir {
-		t.Errorf("Expected cacheDir %q, got %q", cacheDir, service.cacheDir)
-	}
-}
-
-// Integration test for orientation handling in direct conversion
-func TestConvertHEICToJPEGDirect_OrientationHandling(t *testing.T) {
-	// Skip this test if ffmpeg is not available
-	if testing.Short() {
-		t.Skip("Skipping integration test in short mode")
-	}
-
-	// Create a temporary directory for testing
-	tempDir, err := os.MkdirTemp("", "ffmpeg_integration_test")
-	if err != nil {
-		t.Fatalf("Failed to create temp directory: %v", err)
-	}
-	defer os.RemoveAll(tempDir)
-
-	service := NewImageService("ffmpeg", "ffprobe", 2, true, tempDir)
-
-	t.Run("Direct conversion with orientation detection", func(t *testing.T) {
-		// This test requires actual HEIC files to work properly
-		// For CI/CD environments, we can mock this or skip if files don't exist
-
-		heicTestFiles := []string{
-			"/Users/steffag/Downloads/heic/IMG_6660.heic",
-			"/Users/steffag/Downloads/heic/IMG_2919.HEIC",
-			"/Users/steffag/Downloads/heic/shelf-christmas-decoration.heic",
-		}
-
-		for _, testFile := range heicTestFiles {
-			// Check if test file exists
-			if _, err := os.Stat(testFile); os.IsNotExist(err) {
-				t.Logf("Skipping test for %s (file not found)", filepath.Base(testFile))
-				continue
-			}
-
-			t.Logf("Testing orientation handling for %s", filepath.Base(testFile))
-
-			// Test orientation detection
-			orientation, err := service.GetImageOrientation(testFile)
-			if err != nil {
-				t.Errorf("Failed to get orientation for %s: %v", filepath.Base(testFile), err)
-				continue
-			}
-			t.Logf("Detected orientation: %s", orientation)
-
-			// Test filter generation
-			filter := service.GetOrientationFilter(orientation)
-			t.Logf("Generated filter: %s", filter)
-
-			// Test actual conversion (small size for speed)
-			jpegBytes, err := service.ConvertHEICToJPEGDirect(context.Background(), testFile, 100, 100, "5")
-			if err != nil {
-				t.Errorf("Failed to convert %s: %v", filepath.Base(testFile), err)
-				continue
-			}
-
-			if len(jpegBytes) < 400 {
-				t.Errorf("Converted image too small (%d bytes), likely conversion failed", len(jpegBytes))
-			}
-
-			t.Logf("Successfully converted %s to %d bytes", filepath.Base(testFile), len(jpegBytes))
-		}
-	})
-}
-
 // Benchmark the orientation filter generation
 func BenchmarkGetOrientationFilter(b *testing.B) {
-	service := &ImageService{}
+	service := &FFmpegService{}
 	orientations := []string{
 		"Horizontal (normal)",
 		"Rotate 90 CW",
@@ -258,7 +172,7 @@ func BenchmarkGetOrientationFilter(b *testing.B) {

 // Test table for all EXIF orientation values
 func TestGetOrientationFilter_AllEXIFValues(t *testing.T) {
-	service := &ImageService{}
+	service := &FFmpegService{}

 	// Test all possible EXIF orientation values according to EXIF spec
 	exifTests := []struct {
Author	SHA1	Message	Date
NotAlexNoyle	53411da695	Exclude CODEOWNERS from language statistics	2026-11-01 10:10:00 -05:00
NotAlexNoyle	e3bbadc419	Add CODEOWNERS (one staff approval)	2026-11-01 10:10:00 -05:00
Graham Steffaniak	37596b1e23	Update README.md (#1667 )	2025-11-26 19:04:24 -06:00
Graham Steffaniak dependabot[bot]Kevin B.Swedish Wiking Pyro lps-rocks contributor Ironic Sarabanga ✿ corey	d35fb56587	Beta/v1.1.1 (#1655 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Kevin B. <kurami32_kbm@proton.me> Co-authored-by: Swedish Wiking <121635232+Swedish-Wiking@users.noreply.github.com> Co-authored-by: Pyro <pyrodd@gmail.com> Co-authored-by: lps-rocks <10893911+lps-rocks@users.noreply.github.com> Co-authored-by: contributor <foss.contributor@gmail.com> Co-authored-by: Ironic <202444094+YoureIronic@users.noreply.github.com> Co-authored-by: Sarabanga <96509626+Sarabanga@users.noreply.github.com> Co-authored-by: ✿ corey <corey@x64.co>	2025-11-24 15:01:49 -06:00
Graham Steffaniak	5dab4c7b30	Update README.md (#1624 )	2025-11-19 14:30:37 -06:00
Graham Steffaniak Swedish Wiking Pyro Kevin B.lps-rocks contributor Ironic Sarabanga ✿ corey	a33dbfc464	Beta/v1.1.0 (#1614 ) Co-authored-by: Swedish Wiking <121635232+Swedish-Wiking@users.noreply.github.com> Co-authored-by: Pyro <pyrodd@gmail.com> Co-authored-by: Kevin B. <kurami32_kbm@proton.me> Co-authored-by: lps-rocks <10893911+lps-rocks@users.noreply.github.com> Co-authored-by: contributor <foss.contributor@gmail.com> Co-authored-by: Ironic <202444094+YoureIronic@users.noreply.github.com> Co-authored-by: Sarabanga <96509626+Sarabanga@users.noreply.github.com> Co-authored-by: ✿ corey <corey@x64.co>	2025-11-19 08:50:49 -06:00
Graham Steffaniak Pyro Kevin B.lps-rocks contributor Sarabanga Ironic	18738b3273	Stable/v1.0.1 (#1559 ) Co-authored-by: Pyro <pyrodd@gmail.com> Co-authored-by: Kevin B. <kurami32_kbm@proton.me> Co-authored-by: lps-rocks <10893911+lps-rocks@users.noreply.github.com> Co-authored-by: contributor <foss.contributor@gmail.com> Co-authored-by: Sarabanga <96509626+Sarabanga@users.noreply.github.com> Co-authored-by: Ironic <202444094+YoureIronic@users.noreply.github.com>	2025-11-10 10:57:17 -06:00
Ironic	1d8c74dbd9	Remove unstable version warning from README (#1512 )	2025-11-04 08:05:18 -05:00
Graham Steffaniak Pyro Kevin B.lps-rocks contributor Sarabanga	0ab22e3a89	Beta/v1.0.1 (#1500 ) Co-authored-by: Pyro <pyrodd@gmail.com> Co-authored-by: Kevin B. <kurami32_kbm@proton.me> Co-authored-by: lps-rocks <10893911+lps-rocks@users.noreply.github.com> Co-authored-by: contributor <foss.contributor@gmail.com> Co-authored-by: Sarabanga <96509626+Sarabanga@users.noreply.github.com>	2025-11-02 15:40:06 -06:00
				`@@ -0,0 +1 @@`
				`.gitea/CODEOWNERS linguist-detectable=false`
				`@@ -1 +0,0 @@`
				`FROM ghcr.io/gtsteffaniak/playwright-base:latest`
				`@@ -1 +0,0 @@`
				`demo-127.0.0.1:$apr1$j5FRA4Bc$RYdNFuM7YAAo9Qtie8w4b/`