updated with share property fix (#1467)

.devcontainer/devcontainer.json

@@ -1,39 +0,0 @@
-{
-  "name": "filebrowser",
-  "image": "mcr.microsoft.com/devcontainers/go:1.25-bookworm",
-  
-
-  "features": {
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "22"
-    },
-    "ghcr.io/devcontainers/features/docker-in-docker:2": {}
-  },
-
-  "containerEnv": {
-    "CGO_ENABLED": "1",
-    "FILEBROWSER_DEVMODE": "true"
-  },
-
-  "forwardPorts": [80],
-  "portsAttributes": {
-    "80": {
-      "label": "filebrowser app",
-      "onAutoForward": "notify"
-    }
-  },
-
-  "postCreateCommand": "make setup",
-
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "golang.go",
-        "Vue.volar",
-        "dbaeumer.vscode-eslint",
-        "esbenp.prettier-vscode",
-        "ms-azuretools.vscode-docker"
-      ]
-    }
-  }
-}

.dockerignore

@@ -1,15 +1,8 @@
 backend/**.db
-backend/*.sqlite
-backend/*.sqlite.*
-**/*.sqlite
-**/*.sqlite.*
-backend/filebrowser.sqlite*
-**.crt
-**.key
 backend/tmp
 backend/dist
 backend/backend*
-backend/internal/web/dist/**
+backend/http/dist/**
 backend/vendor/**
 
 frontend/dist/**

.editorconfig

@@ -1,15 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-indent_size = 2
-indent_style = space
-insert_final_newline = true
-trim_trailing_whitespace = true
-end_of_line = lf
-
-[*.go]
-indent_size = 4
-
-[{Makefile,makefile}]
-indent_style = tab

.github/scripts/docker-floating-tag-policy.sh

@@ -1,101 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-IMAGE_REPO="${IMAGE_REPO:-gtstef/filebrowser}"
-SLIM_SUFFIX="${SLIM_SUFFIX:-}"
-
-if [[ -z "${GITHUB_OUTPUT:-}" ]]; then
-  echo "GITHUB_OUTPUT is not set" >&2
-  exit 1
-fi
-
-write_outputs() {
-  local update_track="$1"
-  local update_major="$2"
-  echo "update_track=${update_track}" >> "$GITHUB_OUTPUT"
-  echo "update_major=${update_major}" >> "$GITHUB_OUTPUT"
-}
-
-registry_version() {
-  local tag="$1"
-  local ver err err_file
-  err_file="$(mktemp)"
-  if ! ver="$(docker buildx imagetools inspect "${IMAGE_REPO}:${tag}" \
-    --format '{{ with index .Image "linux/amd64" }}{{ index .Config.Labels "org.opencontainers.image.version" }}{{ end }}' 2>"$err_file")"; then
-    err="$(cat "$err_file")"
-    rm -f "$err_file"
-    if grep -qiE 'not found|manifest unknown' <<<"$err"; then
-      ver=""
-    else
-      echo "Failed to inspect ${IMAGE_REPO}:${tag}: ${err}" >&2
-      exit 1
-    fi
-  else
-    rm -f "$err_file"
-    if [[ -z "$ver" ]]; then
-      echo "Missing org.opencontainers.image.version on ${IMAGE_REPO}:${tag} (linux/amd64)" >&2
-      exit 1
-    fi
-  fi
-  ver="${ver#v}"
-  printf '%s' "$ver"
-}
-
-semver_allows_update() {
-  local new="$1"
-  local incumbent="$2"
-  if [[ -z "$incumbent" ]]; then
-    return 0
-  fi
-  local winner
-  winner="$(printf '%s\n' "$incumbent" "$new" | sort -V | tail -n1)"
-  [[ "$winner" == "$new" ]]
-}
-
-ref="${GITHUB_REF_NAME:-}"
-ref="${ref#v}"
-
-if [[ ! "$ref" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-(.+)$ ]]; then
-  echo "Tag '${GITHUB_REF_NAME:-}' has no X.Y.Z-suffix form; leaving major-only floats enabled, track floats disabled"
-  write_outputs false true
-  exit 0
-fi
-
-new_version="$ref"
-semver_core="${BASH_REMATCH[1]}"
-suffix="${BASH_REMATCH[2]}"
-major="$(echo "$semver_core" | cut -d. -f1)"
-
-track=""
-case "$suffix" in
-  beta) track="beta" ;;
-  stable) track="stable" ;;
-  *)
-    echo "Tag suffix '${suffix}' is not beta/stable; leaving major-only floats enabled, track floats disabled"
-    write_outputs false true
-    exit 0
-    ;;
-esac
-
-track_tag="${track}${SLIM_SUFFIX}"
-major_tag="${major}-${track}${SLIM_SUFFIX}"
-
-incumbent_track="$(registry_version "$track_tag")"
-incumbent_major="$(registry_version "$major_tag")"
-
-update_track=false
-if semver_allows_update "$new_version" "$incumbent_track"; then
-  update_track=true
-fi
-
-update_major=false
-if semver_allows_update "$new_version" "$incumbent_major"; then
-  update_major=true
-fi
-
-echo "Floating tag policy (${SLIM_SUFFIX:-full} image):"
-echo "  New version: ${new_version}"
-echo "  Track tag: ${track_tag} (incumbent: ${incumbent_track:-<none>}) -> update_track=${update_track}"
-echo "  Major tag: ${major_tag} (incumbent: ${incumbent_major:-<none>}) -> update_major=${update_major}"
-
-write_outputs "$update_track" "$update_major"

.github/workflows/create-dev-branch.yaml

@@ -11,7 +11,7 @@ on:
 jobs:
   create-dev-branch:
     name: Create Dev Branch
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
 
     steps:
       - name: Check out repository

.github/workflows/main.yaml

@@ -5,13 +5,10 @@ on:
     branches:
       - "main"
 
-permissions:
-  contents: write
-
 jobs:
   test_playwright:
     name: Test Playwright
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -20,8 +17,6 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3.0.0
       - uses: actions/setup-node@v4
-        with:
-          node-version-file: frontend/.nvmrc
       - working-directory: frontend
         run: npm i && npm run build
       - uses: actions/setup-go@v5

.github/workflows/pr.yaml

@@ -7,11 +7,10 @@ on:
       - "dev/v*.*.*"
       - "beta/v*.*.*"
       - "stable/v*.*.*"
-      - "staging/v*.*.*"
 jobs:
   prime_docker_cache:
     name: Prime docker cache
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -28,13 +27,11 @@ jobs:
             type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
   build_frontend:
     name: Build frontend
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - uses: actions/setup-node@v4
-        with:
-          node-version-file: frontend/.nvmrc
       - name: Build frontend
         working-directory: frontend
         run: npm i && npm run build
@@ -42,10 +39,10 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: dist
-          path: backend/internal/web/dist
+          path: backend/http/dist
   build_backend:
     name: Build backend
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -63,7 +60,7 @@ jobs:
   test_playwright:
     needs: [build_backend, build_frontend, prime_docker_cache]
     name: Test Playwright - ${{ matrix.name }}
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
@@ -82,14 +79,6 @@ jobs:
             dockerfile: ./_docker/Dockerfile.playwright-no-config
           - name: settings
             dockerfile: ./_docker/Dockerfile.playwright-settings
-          - name: screenshots
-            dockerfile: ./_docker/Dockerfile.playwright-screenshots
-          - name: previews
-            dockerfile: ./_docker/Dockerfile.playwright-previews
-          - name: jwt
-            dockerfile: ./_docker/Dockerfile.playwright-jwt
-          - name: performance
-            dockerfile: ./_docker/Dockerfile.playwright-performance
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -107,8 +96,8 @@ jobs:
         run: chmod +x backend/filebrowser
       - name: Copy frontend build to backend
         run: |
-          mkdir -p backend/internal/web/embed
-          cp -r frontend/dist/* backend/internal/web/embed
+          mkdir -p backend/http/embed
+          cp -r frontend/dist/* backend/http/embed
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3.0.0
       - name: Set up Docker Buildx
@@ -126,23 +115,9 @@ jobs:
             type=gha,scope=main-playwright-base
           cache-to: |
             type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
-      - name: Extract listing performance results
-        if: matrix.name == 'performance' && success()
-        run: |
-          mkdir -p perf-artifact
-          cid=$(docker create "${{ steps.build.outputs.imageid }}")
-          docker cp "$cid:/app/frontend/test-results/listing-performance-perf/results.json" perf-artifact/results.json
-          docker rm "$cid"
-      - name: Upload listing performance results
-        if: matrix.name == 'performance' && success()
-        uses: actions/upload-artifact@v4
-        with:
-          name: listing-performance-results
-          path: perf-artifact/results.json
-          retention-days: 7
   push_pr_to_registry:
     name: Build docker image
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/promote-beta-to-stable.yaml

@@ -0,0 +1,99 @@
+name: Promote Beta to Stable
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to promote (format: 0.0.0)"
+        required: true
+        type: string
+
+jobs:
+  promote-beta-to-stable:
+    name: Promote Beta to Stable
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }} # Uses Personal Access Token for branch operations
+
+      - name: Validate version format
+        id: validate_version
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ ERROR: Version must be in '0.0.0' format."
+            exit 1
+          fi
+          echo "✅ Version format validated: $VERSION"
+
+      - name: Check if beta branch exists
+        id: check_beta_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+
+          if ! git ls-remote --exit-code origin "$BETA_BRANCH"; then
+            echo "❌ ERROR: Beta branch '$BETA_BRANCH' does not exist!"
+            exit 1
+          fi
+          echo "✅ Beta branch '$BETA_BRANCH' exists."
+
+      - name: Check if stable branch already exists
+        id: check_stable_branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          if git ls-remote --exit-code origin "$STABLE_BRANCH"; then
+            echo "❌ ERROR: Stable branch '$STABLE_BRANCH' already exists!"
+            exit 1
+          fi
+          echo "✅ Stable branch '$STABLE_BRANCH' does not exist."
+
+      - name: Create and push new stable branch
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          # Fetch latest changes
+          git fetch origin "$BETA_BRANCH"
+
+          # Create new stable branch from beta branch
+          git checkout -b "$STABLE_BRANCH" origin/"$BETA_BRANCH"
+
+          # Push new stable branch to remote
+          git push origin "$STABLE_BRANCH"
+
+          echo "✅ Successfully created stable branch '$STABLE_BRANCH' from '$BETA_BRANCH'."
+
+      - name: Merge beta into stable
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+          STABLE_BRANCH="stable/v$VERSION"
+
+          # Checkout stable branch
+          git checkout "$STABLE_BRANCH"
+
+          # Merge beta into stable
+          git merge --no-ff "origin/$BETA_BRANCH" -m "Merge $BETA_BRANCH into $STABLE_BRANCH"
+
+          # Push merge changes
+          git push origin "$STABLE_BRANCH"
+
+          echo "✅ Successfully merged '$BETA_BRANCH' into '$STABLE_BRANCH'."
+
+      - name: Create Pull Request to Main
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.PAT }}
+          commit-message: "Promote stable/v${{ github.event.inputs.version }} to main"
+          title: "Promote stable/v${{ github.event.inputs.version }} to main"
+          body: "This PR promotes stable/v${{ github.event.inputs.version }} to the main branch."
+          base: main
+          branch: stable/v${{ github.event.inputs.version }}
+          delete-branch: false

.github/workflows/promote-dev-to-beta.yaml

@@ -11,7 +11,7 @@ on:
 jobs:
   promote-dev-to-beta:
     name: Promote Dev to Beta
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
 
     steps:
       - name: Check out repository

.github/workflows/regular-tests.yaml

@@ -7,30 +7,28 @@ on:
 
 jobs:
   test-backend:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version: 'stable'
       - working-directory: backend
-        run: go test -race -v ./... -timeout 30s
+        run: go test -race -v ./...
   lint-backend:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version: 'stable'
-      - name: Lint backend
-        run: |
-          GOLANGCI_LINT="$(cd backend/build && go tool -n golangci-lint)"
-          cd backend && "$GOLANGCI_LINT" run --path-prefix=backend
+      - uses: golangci/golangci-lint-action@v7
+        with:
+          version: 'v2.1.6'
+          working-directory: backend
+          install-mode: goinstall
   format-backend:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -39,52 +37,23 @@ jobs:
       - working-directory: backend
         run: go fmt ./...
   lint-frontend:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
-        with:
-          node-version-file: frontend/.nvmrc
       - working-directory: frontend
         run: npm i && npm run lint
   test-frontend:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
-        with:
-          node-version-file: frontend/.nvmrc
       - working-directory: frontend
         run: npm i && npm run test
   check-translations:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
-        with:
-          node-version-file: frontend/.nvmrc
       - working-directory: frontend
-        run: npm i && npm run i18n:check
-  check-docs:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - run: make generate-docs
-      - run: git diff --exit-code
-  check-icons:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: frontend/.nvmrc
-      - working-directory: frontend
-        run: npm i && npm run icons:check
+        run: npm i && npm run i18n:check

.github/workflows/release_beta.yaml

@@ -0,0 +1,66 @@
+name: beta release
+
+on:
+  push:
+    branches:
+      - "beta/v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  test_playwright:
+    name: Test Playwright - regular
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-general
+          push: false
+  create_release_tag:
+    needs: [ test_playwright ]
+    name: Create Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }}
+      - name: Extract branch name
+        shell: bash
+        run: |
+          original_branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "branch_name=$transformed_branch" >> $GITHUB_OUTPUT
+          tag_name=$(echo "$original_branch" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')-beta
+          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
+        id: extract_branch
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          target_commitish: ${{ github.sha }}
+          token: ${{ secrets.PAT }}
+          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
+          prerelease: false
+          make_latest: false
+          draft: false
+          generate_release_notes: true
+          name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/release_dev.yaml

@@ -0,0 +1,62 @@
+name: dev release
+
+on:
+  push:
+    branches:
+      - "dev/v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  push_release_to_registry:
+    name: Push release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{ secrets.PAT }}
+      - name: Extract metadata (tags, labels) for Docker and GHCR
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            gtstef/filebrowser
+            ghcr.io/gtsteffaniak/filebrowser
+      - name: Modify version names
+        id: modify-json
+        run: |
+          TAGS="${{ steps.meta.outputs.tags }}"
+          # Apply modifications to both docker.io and ghcr.io tags
+          CLEANED_TAGS=$(echo "$TAGS" | sed 's/filebrowser:dev-v/filebrowser:/g' | sed -E 's/(filebrowser:[0-9]+\.[0-9]+\.[0-9]+)/\1-dev/g')
+          # Add dev tag to both registries
+          CLEANED_TAGS="$CLEANED_TAGS,gtstef/filebrowser:dev,ghcr.io/gtsteffaniak/filebrowser:dev"
+          echo "cleaned_tag<<EOF" >> $GITHUB_OUTPUT
+          echo "$CLEANED_TAGS" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64
+          file: ./_docker/Dockerfile
+          push: true
+          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_stable.yaml

@@ -0,0 +1,66 @@
+name: stable release
+
+on:
+  push:
+    branches:
+      - "stable/v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  test_playwright:
+    name: Test Playwright - regular
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-general
+          push: false
+  create_release_tag:
+    needs: [ test_playwright ]
+    name: Create Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }}
+      - name: Extract branch name
+        shell: bash
+        run: |
+          original_branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "branch_name=$transformed_branch" >> $GITHUB_OUTPUT
+          tag_name=$(echo "$original_branch" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')-stable
+          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
+        id: extract_branch
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          target_commitish: ${{ github.sha }}
+          token: ${{ secrets.PAT }}
+          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
+          prerelease: false
+          make_latest: true
+          draft: false
+          generate_release_notes: true
+          name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/tag.yaml

@@ -11,14 +11,12 @@ permissions:
 jobs:
   update_tag:
     name: Update Release tag
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Set up Node.js
         uses: actions/setup-node@v4
-        with:
-          node-version-file: frontend/.nvmrc
       - name: Install dependencies and build frontend
         run: npm i && npm run build
         working-directory: frontend
@@ -61,47 +59,24 @@ jobs:
           images: |
             gtstef/filebrowser
             ghcr.io/gtsteffaniak/filebrowser
-      - name: Decide floating Docker tags
-        id: floating
-        run: bash .github/scripts/docker-floating-tag-policy.sh
-      - name: Modify tags (strip 'v' and add version tags)
+      - name: Modify tags (strip 'v' and add 'beta'/'stable' if needed)
         id: modify-json
         run: |
           JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq \
-            --argjson updateTrack '${{ steps.floating.outputs.update_track == 'true' }}' \
-            --argjson updateMajor '${{ steps.floating.outputs.update_major == 'true' }}' '
+          MODIFIED_JSON=$(echo "$JSON" | jq '
             .tags |= map(
               sub(":v"; ":")      # Strip the 'v'
               | select(test(":latest") | not)
             ) |
-            # Find all version tags with suffix (X.Y.Z-suffix) and add major.minor (always) and major tags (when allowed)
-            .tags += [
-              .tags[]
-              | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
-              | split(":")
-              | .[-1] as $version
-              | ($version | split("-")) as $version_split
-              | ($version_split[0] | split(".")) as $version_parts
-              | ($version_split[1:] | join("-")) as $suffix
-              | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
-              | ($version_parts[0]) as $major
-              | "gtstef/filebrowser:\($major_minor)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
-                if $updateMajor then
-                  "gtstef/filebrowser:\($major)-\($suffix)",
-                  "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
-                else empty end
-            ] |
-            # Add suffix-only tags for beta when semver policy allows
-            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-beta")) then
+            if any(.tags[]; test("beta")) then
               .tags += [
                 "gtstef/filebrowser:beta",
-                "ghcr.io/gtsteffaniak/filebrowser:beta"
+                "ghcr.io/gtsteffaniak/filebrowser:beta",
+                "gtstef/filebrowser:latest",
+                "ghcr.io/gtsteffaniak/filebrowser:latest"
               ]
             else . end |
-            # Add suffix-only tags for stable (and latest) when semver policy allows
-            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-stable")) then
+            if any(.tags[]; test("stable")) then
               .tags += [
                 "gtstef/filebrowser:stable",
                 "ghcr.io/gtsteffaniak/filebrowser:stable",
@@ -153,50 +128,23 @@ jobs:
           images: |
             gtstef/filebrowser
             ghcr.io/gtsteffaniak/filebrowser
-      - name: Decide floating Docker tags
-        id: floating
-        env:
-          SLIM_SUFFIX: -slim
-        run: bash .github/scripts/docker-floating-tag-policy.sh
       - name: Modify tags (strip 'v' and add 'slim' if needed)
         id: modify-json-slim
         run: |
           JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq \
-            --argjson updateTrack '${{ steps.floating.outputs.update_track == 'true' }}' \
-            --argjson updateMajor '${{ steps.floating.outputs.update_major == 'true' }}' '
+          MODIFIED_JSON=$(echo "$JSON" | jq '
             .tags |= map(
               sub(":v"; ":")                 # Strip the 'v'
               | select(test(":latest") | not) # Remove the "latest" tag
               | . + "-slim"                   # Append "-slim" to the versioned tag
             ) |
-            # Find all version tags with suffix (X.Y.Z-suffix-slim) and add major.minor (always) and major tags (when allowed)
-            .tags += [
-              .tags[]
-              | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
-              | split(":")
-              | .[-1] as $version
-              | ($version | split("-")) as $version_split
-              | ($version_split[0] | split(".")) as $version_parts
-              | ($version_split[1:] | join("-")) as $suffix
-              | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
-              | ($version_parts[0]) as $major
-              | "gtstef/filebrowser:\($major_minor)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
-                if $updateMajor then
-                  "gtstef/filebrowser:\($major)-\($suffix)",
-                  "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
-                else empty end
-            ] |
-            # Add suffix-only tags for beta-slim when semver policy allows
-            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-beta-slim")) then
+            if any(.tags[]; test("beta")) then
               .tags += [
                 "gtstef/filebrowser:beta-slim",
                 "ghcr.io/gtsteffaniak/filebrowser:beta-slim"
               ]
             else . end |
-            # Add suffix-only tags for stable-slim when semver policy allows
-            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-stable-slim")) then
+            if any(.tags[]; test("stable")) then
               .tags += [
                 "gtstef/filebrowser:stable-slim",
                 "ghcr.io/gtsteffaniak/filebrowser:stable-slim"

.github/workflows/update-build-images.yaml

@@ -7,7 +7,7 @@ on:
 jobs:
   publish_playwright_base:
     name: Publish playwright-base to GHCR
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
@@ -27,7 +27,7 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/gtsteffaniak/playwright-base
-          tags: chromium
+          tags: latest
       - name: Build and push playwright-base
         uses: docker/build-push-action@v6
         with:

.gitignore

@@ -1,12 +1,7 @@
 *.db
-*.db.old
-# Playwright settings migration fixture (BoltDB → SQLite tests + Docker settings image)
-!_docker/src/settings/backend/database.db.old
-*.sqlite**
 *.bak
 *.log
 *.mjs
-!frontend/scripts/serve-perf-dashboard.mjs
 _old
 rice-box.go
 .idea/
@@ -20,33 +15,19 @@ frontend/tsconfig.tsbuildinfo
 /backend/dist
 /frontend/dist
 /frontend/pkg
-/frontend/.cache
 /frontend/test-results
-# Playwright's default HTML report output dir (written when a config enables the
-# "html" reporter). Generated output, never committed.
-/frontend/playwright-report
 /frontend/playwright-files
 /frontend/screenshots
-/frontend/generated
-frontend/.venv-icons
-frontend/.tmp-icons-*
 /frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
-/frontend/tests/playwright/performance/results.json
-# Generated perf report artifacts. NOTE: perf-baseline.json is intentionally NOT
-# ignored — it is the committed chromium baseline that CI gates against.
-/frontend/tests/playwright/performance/report.json
-/frontend/tests/playwright/performance/report.md
-/frontend/sharePrepStorage.json
+/frontend/package-lock.json
 /backend/vendor
 /backend/*.cov
 /backend/*test_config.yaml
 /backend/generated.yaml
 /backend/srv
-/backend/internal/web/dist
-/backend/internal/web/embed
-/backend/debug
-/backend/http
+/backend/http/dist
+/backend/http/embed
 
 .DS_Store
 node_modules
@@ -69,10 +50,6 @@ yarn-error.log*
 *.sln
 *.sw*
 bin/
-/build/
+build/
 *__debug*
 backend/custom.css
-
-# Runtime cache directories created by tests/application
-backend/preview/heic/
-backend/preview/thumbnails/

CONTRIBUTING.md

@@ -5,13 +5,13 @@ Thank you for your interest in contributing to FileBrowser Quantum! This guide w
 ## Prerequisites
 
 - **Go 1.25+** (see `backend/go.mod`)
-- **Node.js 22.0.0+** with npm 9.0.0+ (see `frontend/package.json`)
+- **Node.js 18.0.0+** with npm 7.0.0+ (see `frontend/package.json`)
 - **Docker** (optional, for containerized development)
-- **Git** especially important on Windows -- needed for bash support.
+- **Git**
 
 ### Optional Tools
 
-- **ffmpeg/ffprobe**: For media features (subtitles, thumbnails, heic)
+- **ffmpeg**: For media features (subtitles, thumbnails, heic)
   - Ubuntu/Debian: `sudo apt-get install ffmpeg`
   - macOS: `brew install ffmpeg`
   - Windows: Download from [ffmpeg.org](https://ffmpeg.org/download.html)
@@ -42,12 +42,11 @@ make dev
 
 ### Backend (Go)
 - **Entry Point**: `backend/main.go` → `backend/cmd/`
-- **HTTP Server**: `backend/internal/web/` - API routes, middleware, auth
-- **Storage**: SQLite via `backend/internal/database/`
-- **Authentication**: Multiple providers in `backend/internal/auth/`
-- **Indexing**: Real-time search in `backend/pkg/indexing/`
-- **Previews**: Image/video/document generation in `backend/internal/preview/`
-- **Activity**: Query, recording, and export logic in `backend/internal/activity/`
+- **HTTP Server**: `backend/http/` - API routes, middleware, auth
+- **Storage**: BoltDB via `backend/database/storage/`
+- **Authentication**: Multiple providers in `backend/auth/`
+- **Indexing**: Real-time search in `backend/indexing/`
+- **Previews**: Image/video/document generation in `backend/preview/`
 
 ### Frontend (Vue.js + TypeScript)
 - **Framework**: Vue 3 + Vite + TypeScript
@@ -91,6 +90,18 @@ make test-playwright   # E2E tests in Docker
 
 E2E tests run with three authentication modes: standard auth, no auth, and proxy auth.
 
+### Coverage & Performance
+```bash
+cd backend
+./run_check_coverage.sh  # Coverage report with HTML output
+./run_benchmark.sh       # Benchmarks
+```
+
+**Code Coverage:**
+- View report: Open `backend/coverage.html` after running coverage script
+- CI enforces coverage for critical packages
+- Use `go test -cover` for quick package coverage
+
 ## Code Standards
 
 ### Backend (Go)
@@ -145,3 +156,53 @@ type(scope): description
 
 Types: feat, fix, docs, refactor, test, chore
 ```
+
+## Roadmap
+
+Check the [Project Roadmap](https://github.com/users/gtsteffaniak/projects/4/views/2) to see issues sorted by priority. This helps you understand what features are planned and where you can contribute most effectively.
+
+## Troubleshooting
+
+### Common Issues
+
+**Build failures:**
+```bash
+# Frontend
+cd frontend && rm -rf node_modules && npm install
+
+# Backend
+cd backend && go mod tidy && go clean -modcache
+```
+
+**Authentication Issues:**
+
+Always first enable debug logging in your config file if you have issues.
+
+1. **OIDC Login Fails:**
+   - Check redirect URLs match your config
+   - Verify OIDC provider settings
+   - Enable debug logs to see auth flow
+   - Common issue: mismatched callback URLs
+
+2. **Proxy Auth Not Working:**
+   - Verify header names match config
+   - Check nginx/reverse proxy passes headers
+   - Test with: `curl -H "X-Auth: username" localhost:8080`
+   - Enable `--log-level debug` to see headers
+
+3. **TOTP Issues:**
+   - Ensure server time is synchronized
+   - Check QR code generation in logs
+   - Test with authenticator app time settings
+   - Database might have stale TOTP secrets
+
+4. **Session/Cookie Problems:**
+   - Clear browser cookies and localStorage
+   - Verify cookie domain settings
+   - Try incognito/private browsing mode
+
+### Getting Help
+
+- **Wiki**: [Project Wiki](https://github.com/gtsteffaniak/filebrowser/wiki)
+- **Issues**: [GitHub Issues](https://github.com/gtsteffaniak/filebrowser/issues)
+- **PR Template**: See `.github/PULL_REQUEST_TEMPLATE.md`

README.md

@@ -1,30 +1,34 @@
 <div align="center">
 
-  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/0b548794f2ac4871a0cf7aa9ecab049f)](https://app.codacy.com/gh/gtsteffaniak/filebrowser/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
-  [![latest version](https://img.shields.io/github/v/release/gtsteffaniak/filebrowser)](https://github.com/gtsteffaniak/filebrowser/releases)
+  [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
+  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
+  [![latest version](https://img.shields.io/github/release/gtsteffaniak/filebrowser/all.svg)](https://github.com/gtsteffaniak/filebrowser/releases)
   [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
   [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
 
   [![Donate](https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif)](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A#is-there-a-way-to-donate-or-support-this-project)
 
-  <img width="150" alt="FileBrowser Quantum logo" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174">
+  <img width="150" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" title="Logo">
   <h3>FileBrowser Quantum</h3>
   The best free self-hosted web-based file manager.
   <br/><br/>
-  <img width="800" alt="FileBrowser Quantum file listing in dark mode" src="https://filebrowserquantum.com/images/generated/listing/view-mode-normal-dark.jpg">
+  <img width="800" src="https://github.com/user-attachments/assets/162d7a95-33b7-49bd-976c-dd6822c0d22b">
 </div>
 
+> [!WARNING]
+> There is no stable version -- :construction: coming very soon!
+
 ## Pinned
 
-:pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)
+:loudspeaker: [Stable Release & v1.0.0 Update](https://github.com/gtsteffaniak/filebrowser/discussions/1293)
 
-:pushpin: [v2.0.0 is now stable!](https://filebrowserquantum.com/en/docs/getting-started/v2/about/) --> See [migration support discussion](https://github.com/gtsteffaniak/filebrowser/discussions/3105)
+:pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)
 
 ## About
 
 FileBrowser Quantum provides an easy way to access and manage your files from the web. It has a modern responsive interface that has many advanced features to manage users, access, sharing, and file preview and editing.
 
-This version is called "Quantum" because it packs tons of advanced features into a tiny and easy-to-run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
+This version is called "Quantum" because it packs tons of advanced features into a tiny easy to run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
 
 The goal for this repo is to become the best open-source self-hosted file browsing application that exists -- **all for free**. This repo will always be free and open-source.
 
@@ -34,104 +38,114 @@ Ready to try it out? See [Getting Started Docs](https://filebrowserquantum.com/e
 
 FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:
 
-  1. ✅ Better source configuration - multiple sources, include/exclude rules, and [more](https://filebrowserquantum.com/en/docs/configuration/sources/)
-  2. ✅ Login support for OIDC, LDAP, JWT, password + 2FA, and proxy.
+  1. ✅ Multiple sources support
+  2. ✅ Login support for OIDC, password + 2FA, and proxy.
   3. ✅ Beautiful, Responsive, and Customizable user interface.
-  4. ✅ Streamlined configuration via `config.yaml` config file.
-  5. ✅ Efficient search
+  4. ✅ Simplified configuration via `config.yaml` config file.
+  5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
      - Real-time search results as you type.
      - Real-time monitoring and updates in the UI.
      - Search supports file and folder sizes, along with various filters.
   6. ✅ Better listing browsing
-     - Thumbnails support includes **office**, **video**, and **album artwork**, and **3D models**.
-     - Faster and more responsive views with animations.
-     - **Folder sizes** are displayed and support thumbnails
+     - More file type previews, such as **office** and **video** file previews
+     - Instantly switches view modes and sort order without reloading data.
+     - Folder sizes are displayed.
      - Navigating remembers the last scroll position.
-     - WebDAV support
-     - Granular permissions
-  7. ✅ Highly configurable and [customizable sharing options](https://filebrowserquantum.com/en/docs/shares/options/)
+  7. ✅ Highly configurable and customizable sharing options, incuding:
      - share expiration time
      - users who can access share (including anonymous)
      - styling and themes
      - file viewing, editing, and uploading permissions
-  8. ✅ Access control that can be scoped to user or group and source path.
-  9. ✅ Developer API support
+  8. ✅ Directory-level access control that can be scoped to user or group.
+  8. ✅ Developer API support
      - Ability to create long-lived API Tokens.
      - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.
 
 Notable features that this fork *does not* have (removed):
+
+ - :construction: jobs are not supported yet.
  - ❌ shell commands are completely removed and will not be returned.
 
 FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.
 
+## System Requirements
+
+> [!WARNING]
+> Every file and directory in the source gets indexed (by default). This enables powerful features such as instant search, but large source filesystems can increase your system requirements. [See indexing wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) for more info.
+
+ - **Memory**: depends on configured source complexity. See [how much RAM does it require?](https://github.com/gtsteffaniak/filebrowser/discussions/787)
+ - **GPU**: Not currently used (planned)
+
 ## The UI
 
 The UI has a simple three-component navigation system:
 
   1. (Left) Multi-action button with slide-out panel.
-  2. (Middle) The powerful search bar / title
-  3. (Right) The view change toggle / overflow menu
+  2. (Middle) The powerful search bar.
+  3. (Right) The view change toggle.
 
 All other functions are moved either into the action menu or pop-up menus.
 If the action does not depend on context, it will exist in the slide-out
 action panel. If the action is available based on context, it will show up as
 a pop-up menu.
 
-<img width="1200" height="750" alt="Aug-07-2026 14-54-55" src="https://github.com/user-attachments/assets/fd1c1747-f30f-4e21-b991-f45744416d7e" />
+<p align="center">
+  <img width="1000" src="https://github.com/user-attachments/assets/aa32b05c-f917-47bb-b07f-857edc5e47f7" title="Search GIF">
+</p>
 
 ## Official Docs
 
 See the [Official Docs](https://filebrowserquantum.com/). Contributions are welcome and encouraged! See [FilebrowserDocs Github](https://github.com/quantumx-apps/filebrowserDocs).
 
 ## Comparison Chart
-Application Name | <img width="48" alt="" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" > Quantum | <img width="48" alt="" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" alt="" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" alt="" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" alt="" src="https://cdn.iconscout.com/icon/free/png-256/free-google-drive-logo-icon-svg-download-png-2476481.png" > Google_Drive | <img width="48" alt="" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
+Application Name | <img width="48" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
 --- | --- | --- | --- | --- | --- | --- |
-Filesystem support            | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
+Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Windows                       | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Self hostable                 | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Has Stable Release?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Has Stable Release?           | :construction: | ✅ | ✅ | ✅ | ✅ | ✅ |
 S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
-webdav support                | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+webdav support                | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
 FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Dedicated docs site?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Dedicated docs site?          | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
 Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Docker image size             | 180 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
-Min. Memory Requirements      | 512 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
-has standalone binary         | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
+Min. Memory Requirements      | 256 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
+has standalone binary         | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
 price                         | free | free | free | free tier | free tier | $99+ |
 rich media preview            | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Advanced Search?              | ✅ | ❌ | ✅ | configurable | ✅ | ✅ |
-Indexed Search?               | ✅ | ❌ | ✅ | configurable | ✅ | ✅ |
-Content-aware search?         | ❌ | ❌ | ✅ | configurable | ✅ | ✅ |
-Custom job support            | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
+Advanced Search?              | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
+Indexed Search?               | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
+Content-aware search?         | ❌ | ❌ | ❌ | configurable | ✅ | ✅ |
+Custom job support            | :construction: | ✅ | ❌ | ✅ | ❌ | ✅ |
 Multiple users                | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Single sign-on support        | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-LDAP sign-on support          | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+Single sign-on support        | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
+LDAP sign-on support          | :construction: | ❌ | ❌ | ✅ | ❌ | ✅ |
 Long-live API key support     | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-API documentation page        | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+API documentation page        | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Mobile App                    | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ |
 open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
-tags support                  | :construction: | ❌ | ✅ | ✅ | ❌ | ✅ |
+tags support                  | :construction: | ❌ | ❌ | ✅ | ❌ | ✅ |
 shareable web links?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Event-based notifications     | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Metrics                       | :construction: | ❌ | ✅ | ✅ | ❌ | ❌ |
-file space quotas             | ✅ | ❌ | ✅ | ❌ | ✅ | ✅ |
+Event-based notifications     | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
+Metrics                       | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
+file space quotas             | :construction: | ❌ | ❌ | ❌ | ✅ | ✅ |
 text-based files editor       | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
-Themes                        | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Branding support              | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-activity log                  | ✅ | ❌ | ✅ | ✅ | ✅ | ✅
-Comments support              | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ |
-trash support                 | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
-Starred/pinned files          | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+Themes                        | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
+Branding support              | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
+activity log                  | :construction: | ❌ | ❌ | ✅ | ✅ | ✅ |
+Comments support              | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+trash support                 | :construction: | ❌ | ❌ | ✅ | ✅ | ✅ |
+Starred/pinned files          | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
 Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
 Share collections of files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can archive selected files    | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can browse archive files      | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Can convert documents         | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Can convert videos            | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
-Can convert photos            | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
+Can archive selected files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can browse archive files      | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can convert documents         | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can convert videos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
+Can convert photos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |

_docker/Dockerfile

@@ -1,48 +1,47 @@
-FROM gtstef/ffmpeg:9.0.2-decode AS ffmpeg
+FROM gtstef/ffmpeg:8.0-decode AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION
 WORKDIR /app
 COPY ./backend ./
-RUN apk update && apk add --no-cache gcc musl-dev
-RUN go mod download && go run ./scripts/setup-gofitz-cgo
+RUN apk update && apk add --no-cache gcc musl-dev upx
 ENV CGO_ENABLED=1
-RUN go build -tags analytics,mupdf,musl -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=${REVISION}'" \
+ENV GOEXPERIMENT=greenteagc
+RUN go build -tags mupdf,musl -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
   -o filebrowser .
+RUN upx filebrowser
 
-FROM node:jod-slim AS nbuild
-WORKDIR /build
-COPY ./frontend/package.json ./frontend/package-lock.json ./frontend/
+FROM node:lts-slim AS nbuild
+WORKDIR /app
+COPY ./frontend/package.json ./
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && git config --global url."https://github.com/".insteadOf "git@github.com:" \
     && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN cd frontend && npm ci --maxsockets 1
-COPY ./frontend/ ./frontend/
-WORKDIR /build/frontend
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
 RUN npm run build:docker
 
 FROM alpine:latest
 COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
 ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
-ENV FILEBROWSER_DATABASE_PATH="/home/filebrowser/data/database.sqlite"
-ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
+ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
 ENV PATH="$PATH:/home/filebrowser"
 RUN apk --no-cache add ca-certificates mailcap tzdata curl
 RUN adduser -D -s /bin/true -u 1000 filebrowser
 USER filebrowser
 WORKDIR /home/filebrowser
 # copy config to two locations for compatibility
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/build/backend/internal/web/dist/", "./internal/web/dist/" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 RUN [ "ffmpeg", "-version" ]
 RUN [ "ffprobe", "-version" ]
+USER root
 # exposing default port for auto discovery.
 EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \

_docker/Dockerfile.playwright-base

@@ -1,7 +1,4 @@
 FROM node:22-slim
 WORKDIR /app/frontend
-
-COPY frontend/package-lock.json /tmp/package-lock.json
-RUN PW_VERSION=$(node -p "require('/tmp/package-lock.json').packages['node_modules/@playwright/test'].version") \
-  && npm i "@playwright/test@${PW_VERSION}" oauth2-mock-server @types/node
-RUN npx playwright install --with-deps chromium-headless-shell
+RUN npm i @playwright/test oauth2-mock-server @types/node
+RUN npx playwright install --with-deps firefox

_docker/Dockerfile.playwright-general

@@ -9,14 +9,11 @@ COPY [ "./_docker/src/general/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]
 
 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
+COPY [ "./backend/filebrowser*", "./"]
 COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
-
-# generate duplicate 1.1MB files
-RUN dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1MB.bin bs=1024 count=1126 && dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1mb.bin bs=1024 count=1126
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 
 # Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser user set testuser1 --password testuser1 && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+RUN ./filebrowser set -u testuser1,testuser1
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-local

@@ -1,22 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-WORKDIR /app/frontend
-COPY [ "./frontend/tests/", "./tests" ]
-COPY [ "./frontend/tests/playwright-files", "/tests/playwright-files" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./_docker/src/settings/backend/config.yaml", "./"]
-COPY [ "./_docker/src/settings/backend/database.db.old", "./"]
-COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
-
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser user set testuser1 --password testuser1
-RUN ./filebrowser set rule -s access -p / -r user -v admin --allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded/showme.txt -r user -v admin --allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /denied -r user -v admin -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded -r user -v admin -c config.yaml
-ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-no-config

@@ -9,11 +9,9 @@ COPY [ "./_docker/src/no-config/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]
 
 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 
 # Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-ENV FILEBROWSER_ADMIN_PASSWORD=playwright-password
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-noauth

@@ -10,9 +10,8 @@ COPY [ "./frontend/tests/playwright-files", "./tests/playwright-files2" ]
 
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 
 # Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-oidc

@@ -4,12 +4,10 @@ COPY [ "./_docker/src/oidc/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]
 
 WORKDIR /app/backend/
-RUN mkdir -p ./internal/web/dist
+RUN mkdir -p ./http/dist
 COPY [ "./_docker/src/oidc/backend/", "./"]
 COPY ["./backend/filebrowser", "./"]
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
-
+COPY [ "./backend/http/embed/", "./http/dist/"]
 # Run tests
 WORKDIR /app/frontend
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-perf-base

@@ -1,12 +0,0 @@
-# Local listing-performance only (see docker-compose local-playwright-performance).
-# CI uses ghcr.io/gtsteffaniak/playwright-base:chromium + Dockerfile.playwright-performance.
-FROM node:22-slim
-WORKDIR /app/frontend
-
-COPY frontend/package-lock.json /tmp/package-lock.json
-RUN PW_VERSION=$(node -p "require('/tmp/package-lock.json').packages['node_modules/@playwright/test'].version") \
-  && npm i "@playwright/test@${PW_VERSION}"
-
-ARG PLAYWRIGHT_BROWSERS=chromium,firefox,webkit
-ENV PLAYWRIGHT_BROWSERS=${PLAYWRIGHT_BROWSERS}
-RUN bash -ec 'set -euo pipefail; for b in ${PLAYWRIGHT_BROWSERS//,/ }; do npx playwright install --with-deps "$b"; done'

_docker/Dockerfile.playwright-performance

@@ -1,52 +0,0 @@
-# CI: same ghcr.io playwright-base:chromium + GHA cache as screenshots/previews (chromium only).
-# Local all-browser runs: make playwright-perf-base + compose PLAYWRIGHT_BASE_IMAGE.
-ARG PLAYWRIGHT_BASE_IMAGE=ghcr.io/gtsteffaniak/playwright-base:chromium
-FROM ${PLAYWRIGHT_BASE_IMAGE} AS perf
-WORKDIR /app
-
-COPY [ "./_docker/src/performance/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./frontend/tests/", "./tests" ]
-COPY [ "./frontend/playwright.performance.config.ts", "./playwright.config.ts" ]
-
-# The base image's /app/frontend/package.json is generated by `npm i` and has no
-# "type" field, so /app/frontend is a CommonJS package. Playwright transpiles the
-# suite accordingly (emitting `exports.x = ...`), but its ESM loader reparses these
-# files as ES modules because their syntax is unambiguous ESM. The result is
-# "ReferenceError: exports is not defined in ES module scope" before a single test
-# runs. The perf harness is real ESM, so declare it as such — this matches
-# frontend/package.json in the repo (also "type": "module").
-RUN node -e 'const fs=require("fs");const p="package.json";const j=JSON.parse(fs.readFileSync(p,"utf8"));j.type="module";fs.writeFileSync(p,JSON.stringify(j,null,2)+"\n")'
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
-
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-ENV CI=true
-ENV PERF_BASE_URL=http://127.0.0.1/
-ENV PERF_SCALES=100,1000,10000
-ENV PERF_WORKERS=6
-ENV PERF_TEST_TIMEOUT_MS=480000
-# CI runs a single pass per scenario (N=1) for fast PR feedback; local runs
-# default to N=3 and take the median. The baseline records the worker count and
-# this setting, so an incomparable comparison is reported rather than silently
-# producing a bogus regression.
-ENV PERF_REPEATS=1
-# Stamped into the baseline environment fingerprint so a mismatch is detectable.
-ENV PERF_IMAGE_TAG=playwright-base-chromium
-# Lets the harness report container-specific remedies (e.g. rebuild the base
-# image) instead of host-oriented advice when a browser is missing.
-ENV PERF_IN_CONTAINER=1
-
-# CI / make test-playwright-performance (chromium only — same base as other Playwright images)
-FROM perf AS ci
-ENV PERF_BROWSERS=chromium
-# The committed baseline (frontend/tests/playwright/performance/perf-baseline.json)
-# is copied in by the `COPY ./frontend/tests/` layer above. This step exits
-# non-zero when a gated metric regresses beyond its tolerance, which is what
-# makes the performance check gate the PR.
-RUN ./filebrowser & sleep 5 && cd ../frontend && npx playwright test -c playwright.config.ts

_docker/Dockerfile.playwright-previews

@@ -1,17 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/previews/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
-
-# Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-proxy

@@ -5,11 +5,10 @@ WORKDIR /app/frontend
 COPY [ "./frontend/tests", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
 RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
 RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-screenshots

@@ -1,16 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-COPY [ "./_docker/src/screenshots/frontend/", "./" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-COPY [ "./_docker/src/screenshots/backend/*", "./"]
-
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
-
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots

_docker/Dockerfile.playwright-settings

@@ -2,24 +2,16 @@ FROM ghcr.io/gtsteffaniak/playwright-base:latest
 WORKDIR /app
 
 # Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/settings/", "./" ]
+COPY [ "./_docker/src/no-config/", "./" ]
 
 WORKDIR /app/frontend
-COPY [ "./_docker/src/settings/frontend/", "./" ]
+COPY [ "./_docker/src/no-config/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]
-COPY [ "./frontend/tests/playwright-files", "/tests/playwright-files" ]
 
 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 
 # Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser user set testuser1 --password testuser1
-RUN ./filebrowser set rule -s access -p / -r user -v admin --allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded/showme.txt -r user -v admin --allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /denied -r user -v admin -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded -r user -v admin -c config.yaml
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-sharing

@@ -9,10 +9,9 @@ COPY [ "./_docker/src/sharing/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]
 
 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 
 # Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.slim

@@ -3,26 +3,26 @@ ARG VERSION
 ARG REVISION
 WORKDIR /app
 COPY ./backend ./
-RUN apk update && apk add
-RUN go build -tags analytics -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=${REVISION}'" \
+RUN apk update && apk add upx
+ENV GOEXPERIMENT=greenteagc
+RUN go build -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
   -o filebrowser .
+RUN upx filebrowser
 
-FROM node:jod-slim AS nbuild
-WORKDIR /build
-COPY ./frontend/package.json ./frontend/package-lock.json ./frontend/
+FROM node:lts-slim AS nbuild
+WORKDIR /app
+COPY ./frontend/package.json ./
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && git config --global url."https://github.com/".insteadOf "git@github.com:" \
     && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN cd frontend && npm ci
-COPY ./frontend/ ./frontend/
-WORKDIR /build/frontend
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
 RUN npm run build:docker
 
 FROM alpine:latest
-ENV FILEBROWSER_DATABASE_PATH="/home/filebrowser/data/database.sqlite"
-ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
+ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
 ENV PATH="$PATH:/home/filebrowser"
 RUN apk --no-cache add ca-certificates mailcap tzdata curl
 RUN adduser -D -s /bin/true -u 1000 filebrowser
@@ -30,11 +30,11 @@ USER filebrowser
 WORKDIR /home/filebrowser
 COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/build/backend/internal/web/dist/", "./internal/web/dist/" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
+USER root
 # exposing default port for auto discovery.
 EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \

_docker/docker-compose.yaml

@@ -1,55 +1,4 @@
 services:
-  local-playwright:
-    container_name: local-playwright
-    ports:
-      - "8080:8080"
-    build:
-      dockerfile: ./_docker/Dockerfile.playwright-local
-      context: ../
-  local-playwright-screenshots:
-    container_name: local-playwright
-    volumes:
-      - ../frontend/generated:/app/frontend/generated
-    entrypoint: ["/bin/sh", "-c", "./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots && npx playwright test --project light-screenshots"]
-    build:
-      dockerfile: ./_docker/Dockerfile.playwright-screenshots
-      context: ../
-  local-playwright-performance:
-    container_name: local-playwright-performance
-    working_dir: /app/backend
-    volumes:
-      - ../frontend/test-results/playwright-performance:/app/frontend/test-results/playwright-performance
-      - ../frontend/test-results/listing-performance-perf:/app/frontend/test-results/listing-performance-perf
-      - ../frontend/tests/playwright/performance:/out/report
-    environment:
-      PERF_RESULTS_DIR: /app/frontend/test-results/listing-performance-perf
-      PERF_REPORT_DIR: /out/report
-      PERF_GREP: ${PERF_GREP:-}
-      PERF_BROWSERS: ${PERF_BROWSERS:-}
-      # Local runs repeat each scenario and take the median to average out noise.
-      # CI overrides this to 1 for fast feedback.
-      PERF_REPEATS: ${PERF_REPEATS:-3}
-      # Set to 1 to rewrite the committed chromium baseline from this run.
-      PERF_UPDATE_BASELINE: ${PERF_UPDATE_BASELINE:-0}
-      # Local comparisons are advisory unless explicitly enforced.
-      PERF_ENFORCE_BASELINE: ${PERF_ENFORCE_BASELINE:-0}
-      PERF_IMAGE_TAG: ${PERF_IMAGE_TAG:-local}
-      PERF_IN_CONTAINER: "1"
-      # When PERF_UPDATE_BASELINE=1, write through the mounted report dir (host:
-      # frontend/tests/playwright/performance/perf-baseline.json).
-      PERF_BASELINE_PATH: /out/report/perf-baseline.json
-    entrypoint:
-      [
-        "/bin/sh",
-        "-c",
-        "./filebrowser & sleep 5 && cd ../frontend && npx playwright test -c playwright.config.ts $${PERF_GREP:+-g \"$$PERF_GREP\"}",
-      ]
-    build:
-      dockerfile: ./_docker/Dockerfile.playwright-performance
-      target: perf
-      context: ../
-      args:
-        PLAYWRIGHT_BASE_IMAGE: ${PLAYWRIGHT_BASE_IMAGE:-filebrowser-playwright-perf-base:latest}
   nginx-proxy-auth:
     image: nginx
     container_name: nginx-proxy-auth
@@ -58,30 +7,11 @@ services:
     volumes:
       - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
       - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
-  nginx-proxy-jwt:
-    image: nginx
-    container_name: nginx-proxy-jwt
-    ports:
-      - "8081:8081"  # Admin user
-      - "8082:8082"  # Regular user
-      - "8083:8083"  # Wrong key
-      - "8084:8084"  # No user
-    volumes:
-      - ./src/jwt/backend/default.conf:/etc/nginx/conf.d/default.conf
-      - ./src/jwt/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
-  filebrowser-jwt:
-    hostname: filebrowser
-    volumes:
-      - '../frontend:/home/frontend'
-      - "./src/jwt/backend/config.yaml:/home/filebrowser/data/config.yaml"
-    build:
-      context: ../
-      dockerfile: ./_docker/Dockerfile.slim
   filebrowser:
     hostname: filebrowser
     volumes:
       - '../frontend:/home/frontend'
-      - "./src/proxy/backend/config.yaml:/home/filebrowser/data/config.yaml"
+      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
     build:
       context: ../
       dockerfile: ./_docker/Dockerfile.slim

_docker/src/general/backend/config.yaml

@@ -1,22 +1,15 @@
 server:
   <<: *server-main
-http:
-  <<: *http-main
 frontend:
   <<: *frontend-main
 
-auth:
-  <<: *auth-main
-
 userDefaults:
   preview:
     image: true
     popup: true
     video: true
-    audio: true
-    models: true
     office: true
     highQuality: true
-  account:
-    permissions:
-      share: true
+  permissions:
+    download: true
+    create: true

_docker/src/general/backend/frontend-config.yaml

@@ -2,7 +2,6 @@ frontend-main: &frontend-main
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
   styling:
-    disableEventThemes: true
     customThemes:
       no-rounded:
         description: "No rounded corners" # The description of the theme to display in the UI.

_docker/src/general/backend/server-config.yaml

@@ -1,27 +1,15 @@
-http-main: &http-main
+server-main: &server-main
   port: 80
   baseURL:  "/"
-server-main: &server-main
   logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
+    - levels: "info|error|debug"
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"
       config:
         defaultEnabled: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
     - path: "."
       name: "docker"
       config:
-        defaultEnabled: true
-        rules:
-          - folderPath: "/"
-            viewable: true
-
-auth-main: &auth-main
-  adminPassword: "playwright-password"
+        disableIndexing: true
+        defaultEnabled: true

_docker/src/jwt/backend/config.yaml

@@ -1,53 +0,0 @@
-http:
-  port: 8080
-server:
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        createUserDir: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true
-auth:
-  methods:
-    password:
-      enabled: false
-    jwt:
-      enabled: true
-      secret: "test-jwt-secret-key-for-development-only-do-not-use-in-production"
-      algorithm: "HS256"
-      header: "X-JWT-Assertion"
-      userIdentifier: "sub"
-      groupsClaim: "mygroup"
-      adminGroup: "admin"
-userDefaults:
-  ui:
-    darkMode: true
-  account:
-    disableSettings: false
-    permissions:
-      share: true
-  listing:
-    singleClick: false
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true

_docker/src/jwt/backend/default.conf

@@ -1,66 +0,0 @@
-# Admin user (port 8081)
-server {
-    listen 8081;
-    server_name localhost 127.0.0.1;
-    
-    set $admin_token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RhZG1pbkBleGFtcGxlLmNvbSIsImV4cCI6MjA4NzU2NTc2NiwiZ3JvdXBzIjpbImFkbWluIl0sImlhdCI6MTc3MjIwNTc2NiwibmFtZSI6IlRlc3QgQWRtaW4iLCJuYmYiOjE3NzIyMDU3NjYsInN1YiI6InRlc3RhZG1pbiJ9.pxuKGyMmEe94m0xQ7y1QzcUZgU-lZSvqjoKUVoVd3F4";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $admin_token;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# Regular user (port 8082)
-server {
-    listen 8082;
-    server_name localhost 127.0.0.1;
-    
-    set $regular_token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20iLCJleHAiOjIwODc1NjU2OTIsImdyb3VwcyI6WyJteWdyb3VwIl0sImlhdCI6MTc3MjIwNTY5MiwibmFtZSI6IlRlc3QgVXNlciIsIm5iZiI6MTc3MjIwNTY5Miwic3ViIjoidGVzdHVzZXIifQ.X8fUYbhnZpgvP5CnGdms9eGo8yRLyNhRbj7xUSxEgl8";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $regular_token;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# Valid token but signed with different secret (port 8083)
-server {
-    listen 8083;
-    server_name localhost 127.0.0.1;
-    
-    # Valid JWT token structure, but signed with wrong secret - should fail signature verification
-    set $wrong_key "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RhZG1pbkBleGFtcGxlLmNvbSIsImV4cCI6MjA4NzU2NjAyMywiZ3JvdXBzIjpbImFkbWluIl0sImlhdCI6MTc3MjIwNjAyMywibmFtZSI6IlRlc3QgQWRtaW4iLCJuYmYiOjE3NzIyMDYwMjMsInN1YiI6InRlc3RhZG1pbiJ9.afBobbJ3VQ-fKnUebGr-gxFIqegyICi6E3EgkUSeFNw";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $wrong_key;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# No authentication (port 8084)
-server {
-    listen 8084;
-    server_name localhost 127.0.0.1;
-    
-    location / {
-        proxy_set_header X-JWT-Assertion "";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}

_docker/src/jwt/backend/generate-jwt.go

@@ -1,101 +0,0 @@
-package main
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-)
-
-// Simple JWT generator without external dependencies
-func main() {
-	// Secret key - must match the one in your config file
-	secret := "wrong-key"
-
-	// Check if custom secret provided via command line
-	if len(os.Args) > 1 {
-		secret = os.Args[1]
-	}
-
-	// Create token claims with 10 year expiration
-	now := time.Now()
-	expiresAt := now.Add(10 * 365 * 24 * time.Hour) // 10 years
-
-	header := map[string]interface{}{
-		"alg": "HS256",
-		"typ": "JWT",
-	}
-
-	claims := map[string]interface{}{
-		"sub":    "testadmin",             // username (subject)
-		"email":  "testadmin@example.com", // email claim
-		"name":   "Test Admin",            // full name
-		"groups": []string{"admin"},       // groups - includes admin for testing
-		"iat":    now.Unix(),              // issued at
-		"exp":    expiresAt.Unix(),        // expires at
-		"nbf":    now.Unix(),              // not before
-	}
-
-	// Encode header
-	headerJSON, err := json.Marshal(header)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error encoding header: %v\n", err)
-		os.Exit(1)
-	}
-	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)
-
-	// Encode claims
-	claimsJSON, err := json.Marshal(claims)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error encoding claims: %v\n", err)
-		os.Exit(1)
-	}
-	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)
-
-	// Create signature
-	message := headerB64 + "." + claimsB64
-	h := hmac.New(sha256.New, []byte(secret))
-	h.Write([]byte(message))
-	signature := base64.RawURLEncoding.EncodeToString(h.Sum(nil))
-
-	// Combine to form complete JWT
-	tokenString := message + "." + signature
-
-	// Output the token
-	fmt.Println("=== JWT Token Generated ===")
-	fmt.Println()
-	fmt.Println("Token:")
-	fmt.Println(tokenString)
-	fmt.Println()
-	// Verify token can be decoded
-	parts := strings.Split(tokenString, ".")
-	if len(parts) == 3 {
-		fmt.Println("✓ Token structure is valid (3 parts)")
-	} else {
-		fmt.Fprintf(os.Stderr, "✗ Invalid token structure\n")
-		os.Exit(1)
-	}
-
-	// Save to file for easy access
-	filename := "test-jwt-token.txt"
-	if err := os.WriteFile(filename, []byte(tokenString), 0644); err != nil {
-		fmt.Fprintf(os.Stderr, "Warning: Could not write token to file: %v\n", err)
-	} else {
-		fmt.Printf("✓ Token saved to: %s\n", filename)
-		fmt.Println()
-	}
-
-	// Also save to shell script for easy sourcing
-	scriptContent := fmt.Sprintf("#!/bin/bash\n# Source this file to set JWT token as environment variable\n# Usage: source jwt-env.sh\nexport TEST_JWT_TOKEN=\"%s\"\necho \"JWT token loaded into TEST_JWT_TOKEN\"\n", tokenString)
-	if err := os.WriteFile("jwt-env.sh", []byte(scriptContent), 0755); err != nil {
-		fmt.Fprintf(os.Stderr, "Warning: Could not write shell script: %v\n", err)
-	} else {
-		fmt.Println("✓ Shell script saved to: jwt-env.sh")
-		fmt.Println("  Usage: source jwt-env.sh")
-		fmt.Println()
-	}
-}

_docker/src/jwt/backend/go.mod

@@ -1,3 +0,0 @@
-module test
-
-go 1.25.6

_docker/src/noauth/backend/config.yaml

@@ -1,46 +1,37 @@
-http:
+server:
   port: 80
   baseURL:  "/files/"
-server:
   logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
+    - levels: "info|error|debug"
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "exclude"
       config:
         defaultEnabled: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
-        rules:
-          - folderPath: "excluded"
-          - folderPath: "excludedButVisible"
-            viewable: true
-          - fileStartsWith: "startsWith"
-          - fileName: "dontshow.txt"
+        conditionals:
+          rules:
+            - folderPath: "excluded"
+            - folderPath: "excludedButVisible"
+              viewable: true
     - path: "../frontend/tests/playwright-files2"
       name: "include"
       config:
         defaultEnabled: true
-        useLogicalSize: true
-        rules:
-          - includeRootItem: "myfolder"
-          - includeRootItem: "subfolderExclusions"
-          - includeRootItem: "folder#hash"
-          - includeRootItem: "files"
-          - filePath: "/subfolderExclusions/exclusionlist.sh"
-          - folderPath: "/subfolderExclusions/folderItem"
-            viewable: true
-          - fileStartsWith: "startsWith"
-          - folderEndsWith: "Folder"
-          - folderName: "folderName"
-          - fileName: "fileName"
-          - fileName: "fileNames"
-          - folderName: ".hiddenDir"
-          - fileName: ".hidden"
+        conditionals:
+          rules:
+            - includeRootItem: "myfolder"
+            - includeRootItem: "subfolderExclusions"
+            - filePath: "/subfolderExclusions/exclusionlist.sh"
+            - folderPath: "/subfolderExclusions/folderItem"
+              viewable: true
+            - fileStartsWith: "startsWith"
+            - folderEndsWith: "Folder"
+            - folderNames: 'folderNames'
+            - fileNames: 'fileNames'
+            - folderName: 'folderName'
+            - fileName: 'fileName'
+            - folderName: '.hiddenDir'
+            - fileName: '.hidden'
 
 auth:
   methods:
@@ -53,15 +44,15 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
-  styling:
-    disableEventThemes: true
 
 userDefaults:
-  listing:
-    showHidden: true
+  showHidden: true
   preview:
     image: true
     popup: true
     video: true
     office: true
-    highQuality: true
+    highQuality: true
+  permissions:
+    download: true
+    create: true

_docker/src/oidc/backend/config.yaml

@@ -1,17 +1,11 @@
 server:
   logging:
     - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       config:
         defaultEnabled: true
         createUserDir: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
 
 frontend:
   name: "Graham's Filebrowser"
@@ -20,8 +14,7 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
-  styling:
-    disableEventThemes: true
+
 auth:
   methods:
     password:
@@ -41,13 +34,13 @@ userDefaults:
     video: true
     office: true
     highQuality: true
-  ui:
-    darkMode: true
-  listing:
-    singleClick: false
-  account:
-    disableSettings: false
-    permissions:
-      admin: false
-      share: false
-      api: false
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: false
+    api: false
+    download: true
+    create: true

_docker/src/performance/backend/server-config.yaml

@@ -1,27 +0,0 @@
-http-main: &http-main
-  port: 80
-  baseURL:  "/"
-server-main: &server-main
-  logging:
-    - levels: "warning|error"
-      apiLevels: disabled
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
-    - path: "."
-      name: "docker"
-      config:
-        defaultEnabled: true
-        rules:
-          - folderPath: "/"
-            viewable: true
-
-auth-main: &auth-main
-  adminPassword: "playwright-password"

_docker/src/previews/backend/config.yaml

@@ -1,41 +0,0 @@
-http:
-  port: 80
-  baseURL:  "/"
-server:
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
-
-auth:
-  methods:
-    noauth: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true
-
-userDefaults:
-  listing:
-    showHidden: true
-  preview:
-    image: true
-    popup: true
-    video: true
-    audio: true
-    office: true
-    models: true
-    highQuality: true

_docker/src/proxy/backend/config.yaml

@@ -1,21 +1,13 @@
-http:
-  port: 8080
-  baseURL: "/subpath"
-  trustProxyHeaders: true
 server:
+  port: 8080
+  baseURL:  "/subpath"
   logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
+    - levels: "info|error|debug"
   sources:
     - path: "../frontend/tests/playwright-files"
       config:
         defaultEnabled: true
         createUserDir: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
 
 frontend:
   name: "Graham's Filebrowser"
@@ -24,8 +16,7 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
-  styling:
-    disableEventThemes: true
+
 auth:
   methods:
     password:
@@ -37,6 +28,19 @@ auth:
       logoutRedirectUrl: "https://localhost/api/auth/logout2"
 
 userDefaults:
-  account:
-    permissions:
-      share: true
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: true
+    api: false
+    download: true
+    create: true

_docker/src/proxy/frontend/playwright.config.ts

@@ -11,14 +11,14 @@ import { defineConfig, devices } from "@playwright/test";
  */
 export default defineConfig({
   globalSetup: "./tests/playwright/proxy-setup.ts",
-  timeout: 10000,
+  timeout: 5000,
   testDir: "./tests/playwright/proxy",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: false,
   /* Retry on CI only */
-  retries: 3,
+  retries: 2,
   /* Opt out of parallel tests on CI. */
   workers: 1, // required for now! todo parallel some tests
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */

_docker/src/screenshots/backend/config.yaml

@@ -1,22 +0,0 @@
-http:
-  port: 8080
-  baseURL:  "/files/"
-auth:
-  adminPassword: "playwright-password"
-
-server:
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright"
-      config:
-        defaultEnabled: true
-userDefaults:
-  listing:
-    viewMode: "normal"
-    # Size 4: switch-view "gallery" family resolves to icons (not gallery); list family → list.
-    gallerySize: 3
-  account:
-    showAdvancedProfile: true

_docker/src/settings/backend/config.yaml

@@ -1,36 +1,22 @@
-http:
+server:
   port: 80
   baseURL:  "/"
-server:
-  database:
-    migrateFrom: "database.db.old"
   logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
+    - levels: "info|error|debug"
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"
       config:
         defaultEnabled: true
-        defaultPermissions:
-          modify: false
     - path: "."
       name: "docker"
       config:
+        disableIndexing: true
         defaultEnabled: true
-        rules:
-          - folderPath: "/"
-            viewable: true
-    - path: "/tests/playwright-files"
-      name: "access"
-      config:
-        defaultEnabled: true
-        denyByDefault: true
 frontend:
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
   styling:
-    disableEventThemes: true
     customThemes:
       no-rounded:
         description: "No rounded corners" # The description of the theme to display in the UI.
@@ -38,14 +24,4 @@ frontend:
   externalLinks:
     - text: "A playwright test"
       url: "https://playwright.dev/"
-      title: "Playwright"
-
-auth:
-  adminPassword: "playwright-password"
-  methods:
-    password:
-      signup: true
-
-userDefaults:
-  listing:
-    showHidden: true
+      title: "Playwright"

_docker/src/settings/frontend/playwright.config.ts

@@ -11,14 +11,14 @@ import { defineConfig, devices } from "@playwright/test";
  */
 export default defineConfig({
   globalSetup: "./tests/playwright/global-setup",
-  timeout: 5000,
+  timeout: 10000,
   testDir: "./tests/playwright/settings",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: false,
   /* Retry on CI only */
-  retries: 1,
+  retries: 2,
   /* Opt out of parallel tests on CI. */
   workers: 1,
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */

_docker/src/sharing/backend/config.yaml

@@ -1,10 +1,8 @@
-http:
+server:
   port: 80
   baseURL:  "/"
-server:
   logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
+    - levels: "info|error|debug"
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"
@@ -16,15 +14,10 @@ server:
         private: true
         defaultEnabled: true
 
-auth:
-  adminPassword: "playwright-password"
-
 frontend:
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
   externalLinks:
     - text: "A playwright test"
       url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true
+      title: "Playwright"

backend/.air.env

@@ -1 +0,0 @@
-FILEBROWSER_DEVMODE=true

backend/.air.toml

@@ -1,24 +1,17 @@
 root = "."
 tmp_dir = "tmp"
-env_files = [".air.env"]
 
 [build]
-  cmd = "bash ./scripts/air-build.sh"
-  entrypoint = "./tmp/filebrowser"
-  args_bin = ["-c", "test_config.yaml"]
+  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/version.CommitSHA=testingCommit' -X 'github.com/gtsteffaniak/filebrowser/backend/version.Version=testing'\" ."
+  bin = "tmp/filebrowser"
+  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser -c test_config.yaml"
   include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "internal/web/dist", "internal/web/embed", "internal/preview/testdata", "internal/preview/thumbnails", "internal/preview/heic", "swagger/docs", "internal/preview/gofitzinclude"]
-  poll = true
-  poll_interval = 1000
+  exclude_dir = ["tmp", "vendor", "http/dist", "http/embed", "swagger/docs"]
   log = "air.log"
   delay = 1000 # ms
 
-[build.windows]
-  cmd = "bash ./scripts/air-build.sh"
-  entrypoint = "./tmp/filebrowser.exe"
-
 [log]
   time = true
 
 [misc]
-  clean_on_exit = false
+  clean_on_exit = true

backend/.gitignore

@@ -3,4 +3,3 @@ air.log
 filebrowser
 generated.yaml
 test_config.yaml
-/data

backend/.goreleaser.yaml

@@ -2,11 +2,6 @@
 project_name: filebrowser
 version: 2
 
-before:
-  hooks:
-    - go mod download
-    - go run ./scripts/setup-gofitz-cgo
-
 builds:
   # Build configuration for linux amd64
   - id: linux-amd64
@@ -14,11 +9,10 @@ builds:
       - CGO_ENABLED=1
       - CC=zig cc -target x86_64-linux-musl
     tags:
-      - analytics
       - mupdf
       - musl
     ldflags: &ldflags
-      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=v{{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA={{ .ShortCommit }}
+      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/common/version.Version=v{{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA={{ .ShortCommit }}
     main: main.go
     binary: filebrowser
     goos:
@@ -38,7 +32,6 @@ builds:
       - CGO_ENABLED=1
       - CC=zig cc -target aarch64-linux-musl
     tags:
-      - analytics
       - mupdf
       - musl
     goos:
@@ -49,29 +42,11 @@ builds:
       post:
         - upx {{ .Path }}
 
-  # Build configuration for linux riscv64
-  - id: linux-riscv64
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    env:
-      - CC=zig cc -target riscv64-linux-musl
-    # go-fitz does not provide riscv64 MuPDF libraries yet: https://github.com/gen2brain/go-fitz/tree/master/libs
-    tags:
-      - analytics
-      - musl
-    goos:
-      - linux
-    goarch:
-      - riscv64
-
   # Build configuration for linux
   - id: linux-arm32
     ldflags: *ldflags
     main: main.go
     binary: filebrowser
-    tags:
-      - analytics
     goos:
       - linux
     goarch:
@@ -87,10 +62,8 @@ builds:
   - id: windows
     env:
       - CGO_ENABLED=1
-      # windows-gnu avoids zig rejecting Go's -tsaware when cross-compiling from macOS
-      - CC=zig cc -target x86_64-windows-gnu -lc
+      - CC=zig cc -target x86_64-windows
     tags:
-      - analytics
       - mupdf
     ldflags: *ldflags
     main: main.go
@@ -108,20 +81,16 @@ builds:
     ldflags: *ldflags
     main: main.go
     binary: filebrowser
-    tags:
-      - analytics
     goos:
       - freebsd
     goarch:
       - amd64
 
-  # Build configuration for macos without upx (no mupdf: CGO cross-compile from Linux CI is unsupported)
+  # Build configuration for macos without upx
   - id: macos
     ldflags: *ldflags
     main: main.go
     binary: filebrowser
-    tags:
-      - analytics
     goos:
       - darwin
     goarch:

backend/_docker/Dockerfile

@@ -0,0 +1,49 @@
+FROM gtstef/ffmpeg:8.0-decode AS ffmpeg
+FROM golang:alpine AS base
+ARG VERSION
+ARG REVISION
+WORKDIR /app
+COPY ./backend ./
+RUN apk update && apk add --no-cache gcc musl-dev upx
+ENV CGO_ENABLED=1
+ENV GOEXPERIMENT=greenteagc
+RUN go build -tags mupdf,musl -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
+  -o filebrowser .
+RUN upx filebrowser
+
+FROM node:lts-slim AS nbuild
+WORKDIR /app
+COPY ./frontend/package.json ./
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
+    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
+RUN npm run build:docker
+
+FROM alpine:latest
+COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
+ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
+ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
+ENV PATH="$PATH:/home/filebrowser"
+RUN apk --no-cache add ca-certificates mailcap tzdata curl
+RUN adduser -D -s /bin/true -u 1000 filebrowser
+USER filebrowser
+WORKDIR /home/filebrowser
+# copy config to two locations for compatibility
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "/app/config.yaml", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
+## sanity checks
+RUN [ "filebrowser", "version" ]
+RUN [ "ffmpeg", "-version" ]
+RUN [ "ffprobe", "-version" ]
+USER root
+# exposing default port for auto discovery.
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:80/health || exit 1
+ENTRYPOINT [ "./filebrowser" ]

backend/_docker/Dockerfile.playwright-base

@@ -0,0 +1,4 @@
+FROM node:22-slim
+WORKDIR /app/frontend
+RUN npm i @playwright/test oauth2-mock-server @types/node
+RUN npx playwright install --with-deps firefox

backend/_docker/Dockerfile.playwright-general

@@ -0,0 +1,19 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/general/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./_docker/src/general/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+RUN ./filebrowser set -u testuser1,testuser1
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

backend/_docker/Dockerfile.playwright-no-config

@@ -0,0 +1,17 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/no-config/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./_docker/src/no-config/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

backend/_docker/Dockerfile.playwright-noauth

@@ -0,0 +1,17 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/noauth/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./frontend/tests", "./tests" ]
+COPY [ "./frontend/tests/playwright-files", "./tests/playwright-files2" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+#RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

backend/_docker/Dockerfile.playwright-oidc

@@ -0,0 +1,13 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+
+COPY [ "./_docker/src/oidc/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
+WORKDIR /app/backend/
+RUN mkdir -p ./http/dist
+COPY [ "./_docker/src/oidc/backend/", "./"]
+COPY ["./backend/filebrowser", "./"]
+COPY [ "./backend/http/embed/", "./http/dist/"]
+# Run tests
+WORKDIR /app/frontend
+RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

backend/_docker/Dockerfile.playwright-proxy

@@ -1,14 +1,14 @@
 FROM ghcr.io/gtsteffaniak/playwright-base:latest
 WORKDIR /app
-COPY [ "./_docker/src/jwt/", "./" ]
+COPY [ "./_docker/src/proxy/", "./" ]
 WORKDIR /app/frontend
 COPY [ "./frontend/tests", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
+RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
 RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

backend/_docker/Dockerfile.playwright-settings

@@ -0,0 +1,17 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/no-config/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./_docker/src/no-config/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

backend/_docker/Dockerfile.playwright-sharing

@@ -0,0 +1,17 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/sharing/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./_docker/src/sharing/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

backend/_docker/Dockerfile.primecache

@@ -0,0 +1 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest

backend/_docker/Dockerfile.slim

@@ -0,0 +1,42 @@
+FROM golang:alpine AS base
+ARG VERSION
+ARG REVISION
+WORKDIR /app
+COPY ./backend ./
+RUN apk update && apk add upx
+ENV GOEXPERIMENT=greenteagc
+RUN go build -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
+  -o filebrowser .
+RUN upx filebrowser
+
+FROM node:lts-slim AS nbuild
+WORKDIR /app
+COPY ./frontend/package.json ./
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
+    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
+RUN npm run build:docker
+
+FROM alpine:latest
+ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
+ENV PATH="$PATH:/home/filebrowser"
+RUN apk --no-cache add ca-certificates mailcap tzdata curl
+RUN adduser -D -s /bin/true -u 1000 filebrowser
+USER filebrowser
+WORKDIR /home/filebrowser
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
+## sanity checks
+RUN [ "filebrowser", "version" ]
+USER root
+# exposing default port for auto discovery.
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:80/health || exit 1
+ENTRYPOINT [ "./filebrowser" ]

backend/_docker/docker-compose.yaml

@@ -0,0 +1,17 @@
+services:
+  nginx-proxy-auth:
+    image: nginx
+    container_name: nginx-proxy-auth
+    ports:
+      - "80:80"
+    volumes:
+      - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
+      - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
+  filebrowser:
+    hostname: filebrowser
+    volumes:
+      - '../frontend:/home/frontend'
+      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
+    build:
+      context: ../
+      dockerfile: ./_docker/Dockerfile.slim

backend/_docker/src/general/backend/config.yaml

@@ -1,20 +1,15 @@
 server:
   <<: *server-main
-http:
-  <<: *http-main
 frontend:
   <<: *frontend-main
-auth:
-  <<: *auth-main
+
 userDefaults:
   preview:
     image: true
     popup: true
     video: true
-    audio: true
-    models: true
     office: true
     highQuality: true
-  account:
-    permissions:
-      share: true
+  permissions:
+    download: true
+    create: true

backend/_docker/src/general/backend/frontend-config.yaml

@@ -2,7 +2,6 @@ frontend-main: &frontend-main
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
   styling:
-    disableEventThemes: true
     customThemes:
       no-rounded:
         description: "No rounded corners" # The description of the theme to display in the UI.

backend/_docker/src/general/backend/server-config.yaml

@@ -0,0 +1,15 @@
+server-main: &server-main
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      name: "playwright + files"
+      config:
+        defaultEnabled: true
+    - path: "."
+      name: "docker"
+      config:
+        disableIndexing: true
+        defaultEnabled: true

backend/_docker/src/general/frontend/playwright.config.ts

@@ -1,5 +1,4 @@
 import { defineConfig, devices } from "@playwright/test";
-import type { PlaywrightFixtureOptions } from "./tests/playwright/test-setup";
 
 /**
  * Read environment variables from file.
@@ -10,34 +9,26 @@ import type { PlaywrightFixtureOptions } from "./tests/playwright/test-setup";
 /**
  * See https://playwright.dev/docs/test-configuration.
  */
-export default defineConfig<PlaywrightFixtureOptions>({
-  globalSetup: "./tests/playwright/screenshots-setup.ts",
-  timeout: 60_000,
-  testDir: "./tests/playwright/screenshots",
+export default defineConfig({
+  globalSetup: "./tests/playwright/global-setup",
+  timeout: 10000,
+  testDir: "./tests/playwright/general",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: false,
   /* Retry on CI only */
-  retries: 1,
+  retries: 2,
   /* Opt out of parallel tests on CI. */
+  workers: 1,
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */
   reporter: "line",
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
-    launchOptions: {
-      args: [
-        '--disable-gpu',
-        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
-        '--enable-webgl',
-        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
-        '--no-sandbox',  // Required for Docker
-      ],
-    },
     actionTimeout: 5000,
     storageState: "loginAuth.json",
     /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://localhost:8080",
+    baseURL: "http://127.0.0.1/",
 
     /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
     trace: "on-first-retry",
@@ -49,18 +40,8 @@ export default defineConfig<PlaywrightFixtureOptions>({
   /* Configure projects for major browsers */
   projects: [
     {
-      name: "dark-screenshots",
-      use: {
-        ...devices["Desktop Chrome"],
-        theme: 'dark',
-      },
-    },
-    {
-      name: "light-screenshots",
-      use: {
-        ...devices["Desktop Chrome"],
-        theme: 'light',
-      },
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
     },
   ],
 });

backend/_docker/src/no-config/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/no-config-setup",
+  timeout: 5000,
+  testDir: "./tests/playwright/no-config",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1,
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1/",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

backend/_docker/src/noauth/backend/config.yaml

@@ -0,0 +1,53 @@
+server:
+  port: 80
+  baseURL:  "/files/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      name: "exclude"
+      config:
+        defaultEnabled: true
+        conditionals:
+          rules:
+            - folderPath: "excluded"
+            - folderPath: "excludedButVisible"
+              viewable: true
+    - path: "../frontend/tests/playwright-files2"
+      name: "include"
+      config:
+        defaultEnabled: true
+        conditionals:
+          rules:
+            - includeRootItem: "myfolder"
+            - includeRootItem: "subfolderExclusions"
+            - filePath: "/subfolderExclusions/exclusionlist.sh"
+            - folderPath: "/subfolderExclusions/folderItem"
+              viewable: true
+            - fileStartsWith: "startsWith"
+            - folderEndsWith: "Folder"
+
+auth:
+  methods:
+    noauth: true
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+userDefaults:
+  permissions:
+   realtime: true
+
+userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
+  permissions:
+    download: true
+    create: true

backend/_docker/src/noauth/frontend/playwright.config.ts

@@ -10,30 +10,24 @@ import { defineConfig, devices } from "@playwright/test";
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-  globalSetup: "./tests/playwright/previews-setup",
+  globalSetup: "./tests/playwright/noauth-setup",
   timeout: 10000,
-  testDir: "./tests/playwright/previews",
+  testDir: "./tests/playwright/noauth",
   /* Run tests in files in parallel */
-  fullyParallel: true,
+  fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: false,
   /* Retry on CI only */
   retries: 2,
-  workers: 10,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
   reporter: "line",
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
-    launchOptions: {
-      args: [
-        '--disable-gpu',
-        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
-        '--enable-webgl',
-        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
-        '--no-sandbox',  // Required for Docker
-      ],
-    },
-    storageState: "previews.json",
+    storageState: "noauth.json",
     actionTimeout: 5000,
+    //storageState: "loginAuth.json",
     /* Base URL to use in actions like `await page.goto('/')`. */
     baseURL: "http://127.0.0.1",
 
@@ -47,8 +41,8 @@ export default defineConfig({
   /* Configure projects for major browsers */
   projects: [
     {
-      name: "chromium",
-      use: { ...devices["Desktop Chrome"] },
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
     },
   ],
 });

backend/_docker/src/oidc/backend/config.yaml

@@ -0,0 +1,46 @@
+server:
+  logging:
+    - levels: "info|error|warning|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      config:
+        defaultEnabled: true
+        createUserDir: true
+
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+
+auth:
+  methods:
+    password:
+      enabled: false
+    oidc:
+      enabled: true
+      createUser: true
+      clientId: "vyBrzOmcrU3OokiWEZoObdGBscw0eYPNJauBtOJr"
+      clientSecret: "gIMKbkEcckUhlGrnE2Vxi8eZhEcfxQqfwFgM0ATzk4DciHGrW2YRtQfqcpRTsmzrxEETkKvZ8yeK3sfoXnUV1IQTzqK7wxw3lEMtmeXi5clj0h7nH1rVGFq2Q3HL8zUe"
+      issuerUrl: "http://localhost:8080"
+      adminGroup: "Admins"
+
+userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: false
+    api: false
+    download: true
+    create: true

backend/_docker/src/oidc/frontend/mock-oidc-server.js

@@ -0,0 +1,60 @@
+
+import { OAuth2Server } from 'oauth2-mock-server';
+
+// This is a list of pre-defined users. You can add more users here.
+// The filebrowser application will use this data when a user logs in.
+const users = {
+  // Default user
+  johndoe: {
+    sub: 'johndoe',
+    preferred_username: 'johndoe',
+    email: 'johndoe@example.com',
+    groups: ['Admins', 'Users'],
+  },
+  // Another example user
+  testuser: {
+    sub: 'testuser',
+    preferred_username: 'testuser',
+    email: 'testuser@example.com',
+    groups: ['Users'],
+  },
+};
+
+const server = new OAuth2Server();
+
+// Generate a new RSA key for the server.
+await server.issuer.keys.generate('RS256');
+
+/**
+ * This hook is called before the ID token is signed.
+ * We're using it to add claims to the ID token.
+ * This is the primary way the application will get user information.
+ */
+server.service.on('beforeIdTokenSigning', (token, req) => {
+  // By default, the mock server uses 'johndoe' as the subject.
+  const user = users[token.payload.sub] || users.johndoe;
+  console.log(`[ID Token] Customizing token for user: ${user.sub}`);
+  Object.assign(token.payload, user);
+});
+
+
+/**
+ * This hook is called before the userinfo response is sent.
+ * We're using it to provide user claims when the application calls the /userinfo endpoint.
+ */
+server.service.on('beforeUserinfo', (userInfoResponse, req) => {
+    const user = users.johndoe;
+    console.log(`[UserInfo] Customizing userinfo for user: ${user.sub}`);
+    userInfoResponse.body = user;
+});
+
+
+const port = 8080;
+const host = '0.0.0.0'; // Bind to 0.0.0.0 to be accessible within Docker
+await server.start(port, host);
+console.log(`OAuth 2 Mock Server listening on http://${host}:${port}`);
+console.log(`Issuer URL: ${server.issuer.url}`);
+console.log('---');
+console.log('Pre-defined users:');
+console.log(JSON.stringify(users, null, 2));
+console.log('---');

backend/_docker/src/oidc/frontend/playwright.config.ts

@@ -10,9 +10,9 @@ import { defineConfig, devices } from "@playwright/test";
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-  globalSetup: "./tests/playwright/jwt-setup.ts",
+  globalSetup: "./tests/playwright/oidc-setup",
   timeout: 5000,
-  testDir: "./tests/playwright/jwt",
+  testDir: "./tests/playwright/oidc",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -25,42 +25,24 @@ export default defineConfig({
   reporter: "line",
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
+    storageState: "loginAuth.json",
     actionTimeout: 5000,
+    //storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1",
+
     /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
     trace: "on-first-retry",
+
     /* Set default locale to English (US) */
     locale: "en-US",
   },
 
-  /* Configure projects for different JWT test scenarios */
+  /* Configure projects for major browsers */
   projects: [
     {
-      name: "admin-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8081", // Admin user JWT
-      },
-    },
-    {
-      name: "regular-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8082", // Regular user JWT
-      },
-    },
-    {
-      name: "wrong-key",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8083", // Wrong secret key
-      },
-    },
-    {
-      name: "no-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8084", // No JWT token
-      },
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
     },
   ],
 });

backend/_docker/src/proxy/backend/.htpasswd

@@ -0,0 +1 @@
+demo-127.0.0.1:$apr1$j5FRA4Bc$RYdNFuM7YAAo9Qtie8w4b/

backend/_docker/src/proxy/backend/config.yaml

@@ -0,0 +1,46 @@
+server:
+  port: 8080
+  baseURL:  "/subpath"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      config:
+        defaultEnabled: true
+        createUserDir: true
+
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+
+auth:
+  methods:
+    password:
+      enabled: false
+    proxy:
+      enabled: true
+      header: "X-Username"
+      createUser: true
+      logoutRedirectUrl: "https://localhost/api/auth/logout2"
+
+userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: true
+    api: false
+    download: true
+    create: true

backend/_docker/src/proxy/backend/default.conf

@@ -0,0 +1,32 @@
+
+map $remote_addr $uuid {
+    default "demo-${remote_addr}";
+}
+
+server {
+    listen 80;
+    server_name localhost 127.0.0.1;
+
+    location /subpath/public/ {
+        proxy_pass http://filebrowser:8080/subpath/public/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Username $uuid;
+    }
+
+    # requires basic auth demo-127.0.0.1:SecurePass123!
+    location /subpath {
+        auth_basic "Restricted Access";
+        auth_basic_user_file /etc/nginx/conf.d/.htpasswd;
+        proxy_set_header X-Username $uuid;
+        add_header X-Username $uuid;
+        proxy_pass http://filebrowser:8080/subpath;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+}

backend/_docker/src/proxy/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/proxy-setup.ts",
+  timeout: 5000,
+  testDir: "./tests/playwright/proxy",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

backend/_docker/src/settings/backend/config.yaml

@@ -0,0 +1,27 @@
+server:
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      name: "playwright + files"
+      config:
+        defaultEnabled: true
+    - path: "."
+      name: "docker"
+      config:
+        disableIndexing: true
+        defaultEnabled: true
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  styling:
+    customThemes:
+      no-rounded:
+        description: "No rounded corners" # The description of the theme to display in the UI.
+        css: "no-rounded.css" # The css file path and filename to use for the theme.
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"

backend/_docker/src/settings/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/global-setup",
+  timeout: 10000,
+  testDir: "./tests/playwright/settings",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1,
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1/",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

backend/_docker/src/sharing/backend/config.yaml

@@ -0,0 +1,23 @@
+server:
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      name: "playwright + files"
+      config:
+        defaultEnabled: true
+    - path: "."
+      name: "docker"
+      config:
+        private: true
+        defaultEnabled: true
+
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"

backend/_docker/src/sharing/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/global-setup",
+  timeout: 10000,
+  testDir: "./tests/playwright/sharing",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1,
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1/",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

backend/adapters/fs/diskcache/file_cache.go

@@ -10,9 +10,6 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
-
-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/go-logger/logger"
 )
 
 // Cache interface for caching operations
@@ -32,61 +29,9 @@ type FileCache struct {
 	}
 }
 
+// NewFileCache creates a new FileCache
 func NewFileCache(dir string) (*FileCache, error) {
-	cacheDir := filepath.Join(dir, "diskcache")
-
-	// Migrate existing cache files from old structure (if any)
-	if err := migrateOldCacheStructure(dir, cacheDir); err != nil {
-		logger.Warningf("failed to migrate old cache structure: %v\n", err)
-	}
-
-	// Create the cache directory immediately with proper permissions
-	if err := os.MkdirAll(cacheDir, fileutils.PermDir); err != nil {
-		return nil, fmt.Errorf("failed to create cache directory: %w", err)
-	}
-	return &FileCache{dir: cacheDir}, nil
-}
-
-// migrateOldCacheStructure moves cache files from old structure (dir/a/...) to new structure (dir/diskcache/a/...)
-func migrateOldCacheStructure(oldDir, newDir string) error {
-	// Read the old cache directory
-	entries, err := os.ReadDir(oldDir)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil // Directory doesn't exist yet, nothing to migrate
-		}
-		return err
-	}
-
-	migrated := 0
-	for _, entry := range entries {
-		// Only migrate single-character directories (cache hash directories like a, b, c, etc.)
-		if !entry.IsDir() || len(entry.Name()) != 1 {
-			continue
-		}
-
-		// Skip if it's already the diskcache directory
-		if entry.Name() == "d" && filepath.Join(oldDir, entry.Name()) == newDir {
-			continue
-		}
-
-		oldPath := filepath.Join(oldDir, entry.Name())
-		newPath := filepath.Join(newDir, entry.Name())
-
-		// Create parent directory in new location
-		if err := os.MkdirAll(newDir, fileutils.PermDir); err != nil {
-			return err
-		}
-
-		// Move the directory
-		if err := os.Rename(oldPath, newPath); err != nil {
-			// If rename fails (e.g., cross-device), skip this one
-			continue
-		}
-		migrated++
-	}
-
-	return nil
+	return &FileCache{dir: dir}, nil
 }
 
 func (f *FileCache) Store(ctx context.Context, key string, value []byte) error {
@@ -95,11 +40,11 @@ func (f *FileCache) Store(ctx context.Context, key string, value []byte) error {
 	defer mu.Unlock()
 
 	fileName := f.getFileName(key)
-	if err := os.MkdirAll(filepath.Dir(fileName), fileutils.PermDir); err != nil {
+	if err := os.MkdirAll(filepath.Dir(fileName), 0700); err != nil {
 		return err
 	}
 
-	if err := os.WriteFile(fileName, value, fileutils.PermFile); err != nil {
+	if err := os.WriteFile(fileName, value, 0600); err != nil {
 		return err
 	}
 

backend/adapters/fs/diskcache/file_cache_test.go

@@ -6,7 +6,6 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
 	"github.com/stretchr/testify/require"
 )
 
@@ -20,9 +19,6 @@ func TestFileCache(t *testing.T) {
 		cachedFilePath = "a/62/a62f2225bf70bfaccbc7f1ef2a397836717377de"
 	)
 
-	// Set up file permissions before creating cache
-	fileutils.SetFsPermissions(0644, 0755)
-
 	// Create temporary directory for the cache
 	cacheDir, err := os.MkdirTemp("", cacheRoot)
 	require.NoError(t, err)
@@ -32,20 +28,19 @@ func TestFileCache(t *testing.T) {
 	require.NoError(t, err)
 
 	// store new key
-	// Note: NewFileCache creates a "diskcache" subdirectory, so the actual path includes it
 	err = cache.Store(ctx, key, []byte(value))
 	require.NoError(t, err)
-	checkValue(t, ctx, cache, filepath.Join(cacheDir, "diskcache", cachedFilePath), key, value)
+	checkValue(t, ctx, cache, filepath.Join(cacheDir, cachedFilePath), key, value)
 
 	// update existing key
 	err = cache.Store(ctx, key, []byte(newValue))
 	require.NoError(t, err)
-	checkValue(t, ctx, cache, filepath.Join(cacheDir, "diskcache", cachedFilePath), key, newValue)
+	checkValue(t, ctx, cache, filepath.Join(cacheDir, cachedFilePath), key, newValue)
 
 	// delete key
 	err = cache.Delete(ctx, key)
 	require.NoError(t, err)
-	exists := fileExists(filepath.Join(cacheDir, "diskcache", cachedFilePath))
+	exists := fileExists(filepath.Join(cacheDir, cachedFilePath))
 	require.False(t, exists)
 }
 

backend/adapters/fs/files/file_test.go

@@ -0,0 +1,397 @@
+package files
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+)
+
+func Test_GetRealPath(t *testing.T) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return
+	}
+	trimPrefix := filepath.Dir(filepath.Dir(cwd))
+	tests := []struct {
+		name  string
+		paths []string
+		want  struct {
+			path  string
+			isDir bool
+		}
+	}{
+		{
+			name: "current directory",
+			paths: []string{
+				"./",
+			},
+			want: struct {
+				path  string
+				isDir bool
+			}{
+				path:  "",
+				isDir: true,
+			},
+		},
+		{
+			name: "current directory",
+			paths: []string{
+				"./files/file.go",
+			},
+			want: struct {
+				path  string
+				isDir bool
+			}{
+				path:  "/files/file.go",
+				isDir: false,
+			},
+		},
+		{
+			name: "other test case",
+			paths: []string{
+				"/mnt/doesnt/exist",
+			},
+			want: struct {
+				path  string
+				isDir bool
+			}{
+				path:  "/mnt/doesnt/exist",
+				isDir: false,
+			},
+		},
+	}
+	idx := indexing.Index{
+		Source: settings.Source{
+			Path: trimPrefix,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			realPath, isDir, _ := idx.GetRealPath(tt.paths...)
+			adjustedRealPath := strings.TrimPrefix(realPath, trimPrefix)
+			if tt.want.path != adjustedRealPath || tt.want.isDir != isDir {
+				t.Errorf("expected %v:%v but got: %v:%v", tt.want.path, tt.want.isDir, adjustedRealPath, isDir)
+			}
+		})
+	}
+}
+
+func TestSortItems(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    iteminfo.FileInfo
+		expected iteminfo.FileInfo
+	}{
+		{
+			name: "Numeric and Lexicographical Sorting",
+			input: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
+					{Name: "10.txt"},
+					{Name: "2.txt"},
+					{Name: "apple"},
+					{Name: "Banana"},
+				},
+				Files: []iteminfo.ItemInfo{
+					{Name: "File2.txt"},
+					{Name: "File10.txt"},
+					{Name: "File1"},
+					{Name: "banana"},
+				},
+			},
+			expected: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
+					{Name: "2.txt"},
+					{Name: "10.txt"},
+					{Name: "apple"},
+					{Name: "Banana"},
+				},
+				Files: []iteminfo.ItemInfo{
+					{Name: "banana"},
+					{Name: "File1"},
+					{Name: "File10.txt"},
+					{Name: "File2.txt"},
+				},
+			},
+		},
+		{
+			name: "Only Lexicographical Sorting",
+			input: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
+					{Name: "dog.txt"},
+					{Name: "Cat.txt"},
+					{Name: "apple"},
+				},
+				Files: []iteminfo.ItemInfo{
+					{Name: "Zebra"},
+					{Name: "apple"},
+					{Name: "cat"},
+				},
+			},
+			expected: iteminfo.FileInfo{
+				Folders: []iteminfo.ItemInfo{
+					{Name: "apple"},
+					{Name: "Cat.txt"},
+					{Name: "dog.txt"},
+				},
+				Files: []iteminfo.ItemInfo{
+					{Name: "apple"},
+					{Name: "cat"},
+					{Name: "Zebra"},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			test.input.SortItems()
+
+			getNames := func(items []iteminfo.ItemInfo) []string {
+				names := []string{}
+				for _, folder := range items {
+					names = append(names, folder.Name)
+				}
+				return names
+			}
+
+			actualFolderNames := getNames(test.input.Folders)
+			expectedFolderNames := getNames(test.expected.Folders)
+
+			if !reflect.DeepEqual(actualFolderNames, expectedFolderNames) {
+				t.Errorf("Folders not sorted correctly.\nGot: %v\nExpected: %v", actualFolderNames, expectedFolderNames)
+			}
+
+			actualFileNames := getNames(test.input.Files)
+			expectedFileNames := getNames(test.expected.Files)
+
+			if !reflect.DeepEqual(actualFileNames, expectedFileNames) {
+				t.Errorf("Files not sorted correctly.\nGot: %v\nExpected: %v", actualFileNames, expectedFileNames)
+			}
+		})
+	}
+}
+
+func TestDeleteFilesCacheClearing(t *testing.T) {
+	// Create a temporary directory for testing
+	tempDir, err := os.MkdirTemp("", "filebrowser_test")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	// Create a test file
+	testFile := filepath.Join(tempDir, "Test Object")
+	err = os.WriteFile(testFile, []byte("test content"), 0644)
+	if err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	// Initialize a mock index
+	idx := indexing.Index{
+		Source: settings.Source{
+			Path: tempDir,
+		},
+	}
+
+	// Get the real path and cache it
+	_, isDir, err := idx.GetRealPath("/Test Object")
+	if err != nil {
+		t.Fatalf("Failed to get real path: %v", err)
+	}
+
+	// Verify the file is detected as a file (not directory)
+	if isDir {
+		t.Errorf("Expected file to be detected as file, but got directory")
+	}
+
+	// Initialize the index in the indexing system
+	indexing.Initialize(&settings.Source{
+		Name: "test",
+		Path: tempDir,
+	}, true) // true for mock mode
+
+	// Delete the file
+	err = DeleteFiles("test", testFile, tempDir)
+	if err != nil {
+		t.Fatalf("Failed to delete file: %v", err)
+	}
+
+	// Create a directory with the same name
+	testDir := filepath.Join(tempDir, "Test Object")
+	err = os.Mkdir(testDir, 0755)
+	if err != nil {
+		t.Fatalf("Failed to create test directory: %v", err)
+	}
+
+	// Get the real path again - it should now detect it as a directory
+	// The cache should have been cleared, so it should re-detect the type
+	realPath2, isDir2, err := idx.GetRealPath("/Test Object")
+	if err != nil {
+		t.Fatalf("Failed to get real path after recreation: %v", err)
+	}
+
+	// Verify the directory is detected as a directory
+	if !isDir2 {
+		t.Errorf("Expected directory to be detected as directory, but got file. Real path: %s", realPath2)
+	}
+
+	// Clean up
+	os.RemoveAll(tempDir)
+}
+
+func TestOverrideDirectoryToFile(t *testing.T) {
+	// Initialize the index in mock mode (no filesystem operations)
+	indexing.Initialize(&settings.Source{
+		Name: "test",
+		Path: "/mock/path",
+	}, true) // true for mock mode
+
+	// Get the index and set up mock data
+	idx := indexing.GetIndex("test")
+	if idx == nil { //nolint:staticcheck // t.Fatal terminates execution
+		t.Fatal("Failed to get test index")
+	}
+
+	// Create mock directory structure
+	idx.Directories["/"] = &iteminfo.FileInfo{ //nolint:staticcheck // t.Fatal terminates execution
+		Path: "/",
+		ItemInfo: iteminfo.ItemInfo{
+			Name: "/",
+			Type: "directory",
+		},
+		Folders: []iteminfo.ItemInfo{
+			{Name: "Test Object", Type: "directory"},
+		},
+	}
+
+	// Simulate the directory-to-file override by updating the mock data
+	// Remove the directory from the parent's Folders slice
+	rootInfo := idx.Directories["/"] //nolint:staticcheck // t.Fatal terminates execution
+	for i, folder := range rootInfo.Folders {
+		if folder.Name == "Test Object" {
+			rootInfo.Folders = append(rootInfo.Folders[:i], rootInfo.Folders[i+1:]...)
+			break
+		}
+	}
+
+	// Add the file to the parent's Files slice
+	rootInfo.Files = append(rootInfo.Files, iteminfo.ItemInfo{
+		Name: "Test Object",
+		Size: 25, // Length of "This is test file content"
+	})
+
+	// Verify the directory was replaced with a file in the mock data
+	rootInfo, exists := idx.GetMetadataInfo("/", true)
+	if !exists {
+		t.Fatal("Root metadata not found")
+	}
+
+	// Check that the directory was removed from Folders
+	foundDir := false
+	for _, folder := range rootInfo.Folders {
+		if folder.Name == "Test Object" {
+			foundDir = true
+			break
+		}
+	}
+	if foundDir {
+		t.Error("Directory 'Test Object' should have been removed from Folders")
+	}
+
+	// Check that the file was added to Files
+	foundFile := false
+	for _, file := range rootInfo.Files {
+		if file.Name == "Test Object" {
+			foundFile = true
+			if file.Size != 25 {
+				t.Errorf("Expected file size 25, got %d", file.Size)
+			}
+			break
+		}
+	}
+	if !foundFile {
+		t.Error("File 'Test Object' should have been added to Files")
+	}
+}
+
+func TestOverrideFileToDirectory(t *testing.T) {
+	// Initialize the index in mock mode (no filesystem operations)
+	indexing.Initialize(&settings.Source{
+		Name: "test",
+		Path: "/mock/path",
+	}, true) // true for mock mode
+
+	// Get the index and set up mock data
+	idx := indexing.GetIndex("test")
+	if idx == nil { //nolint:staticcheck // t.Fatal terminates execution
+		t.Fatal("Failed to get test index")
+	}
+
+	// Create mock directory structure with a file
+	idx.Directories["/"] = &iteminfo.FileInfo{ //nolint:staticcheck // t.Fatal terminates execution
+		Path: "/",
+		ItemInfo: iteminfo.ItemInfo{
+			Name: "/",
+			Type: "directory",
+		},
+		Files: []iteminfo.ItemInfo{
+			{Name: "Test Object", Size: 12}, // Length of "test content"
+		},
+	}
+
+	// Simulate the file-to-directory override by updating the mock data
+	// Remove the file from the parent's Files slice
+	rootInfo := idx.Directories["/"] //nolint:staticcheck // t.Fatal terminates execution
+	for i, file := range rootInfo.Files {
+		if file.Name == "Test Object" {
+			rootInfo.Files = append(rootInfo.Files[:i], rootInfo.Files[i+1:]...)
+			break
+		}
+	}
+
+	// Add the directory to the parent's Folders slice
+	rootInfo.Folders = append(rootInfo.Folders, iteminfo.ItemInfo{
+		Name: "Test Object",
+		Type: "directory",
+	})
+
+	// Verify the file was replaced with a directory in the mock data
+	rootInfo, exists := idx.GetMetadataInfo("/", true)
+	if !exists {
+		t.Fatal("Root metadata not found")
+	}
+
+	// Check that the file was removed from Files
+	foundFile := false
+	for _, file := range rootInfo.Files {
+		if file.Name == "Test Object" {
+			foundFile = true
+			break
+		}
+	}
+	if foundFile {
+		t.Error("File 'Test Object' should have been removed from Files")
+	}
+
+	// Check that the directory was added to Folders
+	foundDir := false
+	for _, folder := range rootInfo.Folders {
+		if folder.Name == "Test Object" {
+			foundDir = true
+			if folder.Type != "directory" {
+				t.Errorf("Expected directory type, got %s", folder.Type)
+			}
+			break
+		}
+	}
+	if !foundDir {
+		t.Error("Directory 'Test Object' should have been added to Folders")
+	}
+}

backend/adapters/fs/files/files.go

@@ -0,0 +1,613 @@
+package files
+
+import (
+	"encoding/base64"
+	"fmt"
+	"io"
+	"unicode"
+	"unicode/utf8"
+
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/dhowden/tag"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+func FileInfoFaster(opts utils.FileOptions, access *access.Storage) (*iteminfo.ExtendedFileInfo, error) {
+	response := &iteminfo.ExtendedFileInfo{}
+	index := indexing.GetIndex(opts.Source)
+	if index == nil {
+		return response, fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	if !strings.HasPrefix(opts.Path, "/") {
+		opts.Path = "/" + opts.Path
+	}
+	realPath, isDir, err := index.GetRealPath(opts.Path)
+	if err != nil {
+		return response, fmt.Errorf("could not get real path for requested path: %v, error: %v", opts.Path, err)
+	}
+	if !strings.HasSuffix(opts.Path, "/") && isDir {
+		opts.Path = opts.Path + "/"
+	}
+	opts.IsDir = isDir
+	var info *iteminfo.FileInfo
+
+	// Check if path is viewable (allows filesystem access without indexing)
+	isViewable := index.IsViewable(isDir, opts.Path)
+
+	// For non-viewable paths, verify they are indexed
+	// Skip this check if indexing is disabled for the entire source
+	if !isViewable && !index.Config.DisableIndexing {
+		err = index.RefreshFileInfo(opts)
+		if err != nil {
+			return response, fmt.Errorf("path not accessible: %v", err)
+		}
+	}
+
+	if isDir {
+		info, err = index.GetFsDirInfo(opts.Path)
+		if err != nil {
+			return response, err
+		}
+	} else {
+		// For files, get info from parent directory to ensure HasPreview is set correctly
+		info, err = index.GetFsDirInfo(opts.Path)
+		if err != nil {
+			return response, err
+		}
+	}
+
+	response.FileInfo = *info
+	response.RealPath = realPath
+	response.Source = opts.Source
+
+	if access != nil && !access.Permitted(index.Path, opts.Path, opts.Username) {
+		// User doesn't have access to the current folder, but check if they have access to any subitems
+		// This allows specific allow rules on subfolders/files to work even when parent is denied
+		err := access.CheckChildItemAccess(response, index, opts.Username)
+		if err != nil {
+			return response, err
+		}
+	}
+	if opts.Content || opts.Metadata {
+		processContent(response, index, opts)
+	}
+	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
+		response.OnlyOfficeId = generateOfficeId(realPath)
+	}
+
+	return response, nil
+}
+
+func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts utils.FileOptions) {
+	isVideo := strings.HasPrefix(info.Type, "video")
+	isAudio := strings.HasPrefix(info.Type, "audio")
+	isFolder := info.Type == "directory"
+	if isFolder {
+		return
+	}
+
+	if isVideo {
+		if opts.ExtractEmbeddedSubtitles {
+			parentPath := filepath.Dir(info.Path)
+			parentInfo, exists := idx.GetReducedMetadata(parentPath, true)
+			if exists {
+				info.DetectSubtitles(parentInfo)
+				err := info.LoadSubtitleContent()
+				if err != nil {
+					logger.Debug("failed to load subtitle content: " + err.Error())
+				}
+			}
+		}
+		return
+	}
+
+	if isAudio {
+		err := extractAudioMetadata(info)
+		if err != nil {
+			logger.Debugf("failed to extract audio metadata for file: "+info.RealPath, info.Name, err)
+		} else {
+			info.HasPreview = info.AudioMeta.AlbumArt != ""
+		}
+		return
+	}
+
+	// Process text content for non-video, non-audio files
+	if info.Size < 20*1024*1024 { // 20 megabytes in bytes
+		content, err := getContent(info.RealPath)
+		if err != nil {
+			logger.Debugf("could not get content for file: "+info.RealPath, info.Name, err)
+			return
+		}
+		info.Content = content
+	} else {
+		logger.Debug("skipping large text file contents (20MB limit): "+info.Path, info.Name, info.Type)
+	}
+}
+
+func generateOfficeId(realPath string) string {
+	key, ok := utils.OnlyOfficeCache.Get(realPath)
+	if !ok {
+		timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)
+		documentKey := utils.HashSHA256(realPath + timestamp)
+		utils.OnlyOfficeCache.Set(realPath, documentKey)
+		return documentKey
+	}
+	return key
+}
+
+// extractAudioMetadata extracts metadata from an audio file using dhowden/tag
+func extractAudioMetadata(item *iteminfo.ExtendedFileInfo) error {
+	file, err := os.Open(item.RealPath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	// Check file size first to prevent reading extremely large files
+	fileInfo, err := file.Stat()
+	if err != nil {
+		return err
+	}
+
+	// Skip files larger than 300MB to prevent memory issues
+	maxSize := int64(300)
+	if fileInfo.Size() > maxSize*1024*1024 {
+		return fmt.Errorf("file with size %d MB exceeds metadata check limit: %d MB", fileInfo.Size()/1024/1024, maxSize)
+	}
+
+	m, err := tag.ReadFrom(file)
+	if err != nil {
+		return err
+	}
+
+	item.AudioMeta = &iteminfo.AudioMetadata{
+		Title:  m.Title(),
+		Artist: m.Artist(),
+		Album:  m.Album(),
+		Year:   m.Year(),
+		Genre:  m.Genre(),
+	}
+
+	// Extract track number
+	track, _ := m.Track()
+	item.AudioMeta.Track = track
+
+	// Extract album art and encode as base64 with strict size limits
+	if picture := m.Picture(); picture != nil && picture.Data != nil {
+		// More aggressive size limit to prevent memory issues (max 5MB)
+		if len(picture.Data) <= 5*1024*1024 {
+			item.AudioMeta.AlbumArt = base64.StdEncoding.EncodeToString(picture.Data)
+		} else {
+			logger.Debugf("Skipping album art for %s: too large (%d bytes)", item.RealPath, len(picture.Data))
+		}
+	}
+
+	return nil
+}
+
+func DeleteFiles(source, absPath string, absDirPath string) error {
+	err := os.RemoveAll(absPath)
+	if err != nil {
+		return err
+	}
+	index := indexing.GetIndex(source)
+	if index == nil {
+		return fmt.Errorf("could not get index: %v ", source)
+	}
+	if index.Config.DisableIndexing {
+		return nil
+	}
+
+	// Clear RealPathCache entries for the deleted path to prevent cache issues
+	// when a folder with the same name is created later
+	indexPath := index.MakeIndexPath(absPath)
+	realPath, _, err := index.GetRealPath(indexPath)
+	if err == nil {
+		// Clear both the path and the isdir cache entries
+		indexing.RealPathCache.Delete(realPath)
+		indexing.RealPathCache.Delete(realPath + ":isdir")
+	}
+
+	refreshConfig := utils.FileOptions{Path: index.MakeIndexPath(absDirPath), IsDir: true}
+	err = index.RefreshFileInfo(refreshConfig)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func RefreshIndex(source string, path string, isDir bool, recursive bool) error {
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		return fmt.Errorf("could not get index: %v ", source)
+	}
+	if idx.Config.DisableIndexing {
+		return nil
+	}
+	// Always normalize path using MakeIndexPath
+	path = idx.MakeIndexPath(path)
+
+	// MakeIndexPath always adds trailing slash, but for files we need to remove it
+	if !isDir {
+		path = strings.TrimSuffix(path, "/")
+	}
+
+	// Skip indexing for viewable paths (viewable: true means don't index, just allow FS access)
+	if idx.IsViewable(isDir, path) {
+		return nil
+	}
+
+	err := idx.RefreshFileInfo(utils.FileOptions{Path: path, IsDir: isDir, Recursive: recursive})
+	return err
+}
+
+// validateMoveDestination checks if a move/rename operation is valid
+// It prevents moving a directory into itself or its subdirectories
+func validateMoveDestination(src, dst string, isSrcDir bool) error {
+	// Clean and normalize paths
+	src = filepath.Clean(src)
+	dst = filepath.Clean(dst)
+
+	// If source is a directory, check if destination is within source
+	if isSrcDir {
+		// Get the parent directory of the destination
+		dstParent := filepath.Dir(dst)
+
+		// Check if destination parent is the source directory or a subdirectory of it
+		if strings.HasPrefix(dstParent+string(filepath.Separator), src+string(filepath.Separator)) || dstParent == src {
+			return fmt.Errorf("cannot move directory '%s' to a location within itself: '%s'", src, dst)
+		}
+	}
+
+	// Check if destination parent directory exists
+	dstParent := filepath.Dir(dst)
+	if dstParent != "." && dstParent != "/" {
+		if _, err := os.Stat(dstParent); os.IsNotExist(err) {
+			return fmt.Errorf("destination directory does not exist: '%s'", dstParent)
+		}
+	}
+
+	return nil
+}
+
+func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string, s *share.Storage) error {
+	// Validate the move operation before executing
+	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
+		return err
+	}
+
+	err := fileutils.MoveFile(realsrc, realdst)
+	if err != nil {
+		return err
+	}
+
+	// For move operations:
+	// 1. Delete the source from the index (recursively if it's a directory)
+	// 2. Recursively index the destination to capture the entire moved tree
+
+	// Get indexes for deletion and refresh operations
+	srcIdx := indexing.GetIndex(sourceIndex)
+	if srcIdx == nil {
+		return fmt.Errorf("could not get source index: %v", sourceIndex)
+	}
+	dstIdx := indexing.GetIndex(destIndex)
+	if dstIdx == nil {
+		return fmt.Errorf("could not get destination index: %v", destIndex)
+	}
+
+	// Delete from source index (recursively for directories)
+	go srcIdx.DeleteMetadata(realsrc, isSrcDir, isSrcDir) //nolint:errcheck
+
+	// Clear RealPathCache entries for the moved path to prevent cache issues
+	// when a file/folder with the same name is created later
+	srcIndexPath := srcIdx.MakeIndexPath(realsrc)
+	srcRealPath, _, err := srcIdx.GetRealPath(srcIndexPath)
+	if err == nil {
+		// Clear both the path and the isdir cache entries
+		indexing.RealPathCache.Delete(srcRealPath)
+		indexing.RealPathCache.Delete(srcRealPath + ":isdir")
+	}
+
+	// For move operations, refresh the moved item and its new parent directory
+	// Run all refresh operations in a goroutine to avoid blocking the API
+	if isSrcDir {
+		go func() {
+			// When moving a folder, refresh the folder itself recursively FIRST
+			// Must complete before parent refresh to avoid race condition
+			RefreshIndex(destIndex, realdst, true, true) //nolint:errcheck
+
+			// THEN refresh the parent directory so it sees the newly indexed child
+			parentDir := filepath.Dir(realdst)
+			RefreshIndex(destIndex, parentDir, true, false) //nolint:errcheck
+		}()
+	} else {
+		// If moving a file, just refresh the parent directory
+		parentDir := filepath.Dir(realdst)
+		go RefreshIndex(destIndex, parentDir, true, false) //nolint:errcheck
+	}
+
+	// Use backend source paths to match how shares are stored
+	go s.UpdateShares(srcIdx.Path, srcIdx.MakeIndexPath(realsrc), dstIdx.Path, dstIdx.MakeIndexPath(realdst)) //nolint:errcheck
+
+	return nil
+}
+
+func CopyResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string) error {
+	// Validate the copy operation before executing
+	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
+		return err
+	}
+
+	err := fileutils.CopyFile(realsrc, realdst)
+	if err != nil {
+		return err
+	}
+
+	// For copy operations:
+	// 1. Shallow refresh of source (just to update access times if needed)
+	// 2. Recursively index the destination to capture the entire copied tree
+
+	// Refresh source (parent directory if it's a file)
+	srcRefreshPath := realsrc
+	srcRefreshIsDir := isSrcDir
+	if !isSrcDir {
+		srcRefreshPath = filepath.Dir(realsrc)
+		srcRefreshIsDir = true
+	}
+
+	go RefreshIndex(sourceIndex, srcRefreshPath, srcRefreshIsDir, false) //nolint:errcheck
+
+	// Refresh destination (parent directory if it's a file)
+	dstRefreshPath := realdst
+	if !isSrcDir {
+		// If copying a file (regardless of destination), refresh the parent directory
+		dstRefreshPath = filepath.Dir(realdst)
+	}
+
+	go RefreshIndex(destIndex, dstRefreshPath, true, true) //nolint:errcheck
+
+	return nil
+}
+
+func WriteDirectory(opts utils.FileOptions) error {
+	idx := indexing.GetIndex(opts.Source)
+	if idx == nil {
+		return fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	realPath, _, _ := idx.GetRealPath(opts.Path)
+
+	var stat os.FileInfo
+	var err error
+	// Check if the destination exists and is a file
+	if stat, err = os.Stat(realPath); err == nil && !stat.IsDir() {
+		// If it's a file and we're trying to create a directory, remove the file first
+		err = os.Remove(realPath)
+		if err != nil {
+			return fmt.Errorf("could not remove existing file to create directory: %v", err)
+		}
+		// Clear the cache for the removed file
+		realPath, _, err = idx.GetRealPath(opts.Path)
+		if err == nil {
+			indexing.RealPathCache.Delete(realPath)
+			indexing.RealPathCache.Delete(realPath + ":isdir")
+		}
+	}
+
+	// Ensure the parent directories exist
+	err = os.MkdirAll(realPath, fileutils.PermDir)
+	if err != nil {
+		return err
+	}
+
+	// Explicitly set directory permissions to bypass umask
+	err = os.Chmod(realPath, fileutils.PermDir)
+	if err != nil {
+		return err
+	}
+
+	return RefreshIndex(idx.Name, opts.Path, true, true)
+}
+
+func WriteFile(source, path string, in io.Reader) error {
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		return fmt.Errorf("could not get index: %v ", source)
+	}
+	realPath, _, _ := idx.GetRealPath(path)
+	// Strip trailing slash from realPath if it's meant to be a file
+	realPath = strings.TrimRight(realPath, "/")
+	// Ensure the parent directories exist
+	parentDir := filepath.Dir(realPath)
+	err := os.MkdirAll(parentDir, fileutils.PermDir)
+	if err != nil {
+		return err
+	}
+	var stat os.FileInfo
+	// Check if the destination exists and is a directory
+	if stat, err = os.Stat(realPath); err == nil && stat.IsDir() {
+		// If it's a directory and we're trying to create a file, remove the directory first
+		err = os.RemoveAll(realPath)
+		if err != nil {
+			return fmt.Errorf("could not remove existing directory to create file: %v", err)
+		}
+		// Clear the cache for the removed directory (use realPath without re-fetching)
+		indexing.RealPathCache.Delete(realPath)
+		indexing.RealPathCache.Delete(realPath + ":isdir")
+	}
+
+	// Open the file for writing (create if it doesn't exist, truncate if it does)
+	file, err := os.OpenFile(realPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileutils.PermFile)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	// Copy the contents from the reader to the file
+	_, err = io.Copy(file, in)
+	if err != nil {
+		return err
+	}
+
+	// Explicitly set file permissions to bypass umask
+	err = os.Chmod(realPath, fileutils.PermFile)
+	if err != nil {
+		return err
+	}
+
+	return RefreshIndex(source, path, false, false)
+}
+
+// getContent reads and returns the file content if it's considered an editable text file.
+func getContent(realPath string) (string, error) {
+	const headerSize = 4096
+	// Thresholds for detecting binary-like content (these can be tuned)
+	const maxNullBytesInHeaderAbs = 10    // Max absolute null bytes in header
+	const maxNullByteRatioInHeader = 0.1  // Max 10% null bytes in header
+	const maxNullByteRatioInFile = 0.05   // Max 5% null bytes in the entire file
+	const maxNonPrintableRuneRatio = 0.05 // Max 5% non-printable runes in the entire file
+
+	// Open file
+	f, err := os.Open(realPath)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	// Read header
+	headerBytes := make([]byte, headerSize)
+	n, err := f.Read(headerBytes)
+	if err != nil && err != io.EOF {
+		return "", err
+	}
+	actualHeader := headerBytes[:n]
+
+	// --- Start of new heuristic checks ---
+
+	if n > 0 {
+		// 1. Basic Check: Is the header valid UTF-8?
+		// If not, it's unlikely an editable UTF-8 text file.
+		if !utf8.Valid(actualHeader) {
+			return "", nil // Not an error, just not the text file we want
+		}
+
+		// 2. Check for excessive null bytes in the header
+		nullCountInHeader := 0
+		for _, b := range actualHeader {
+			if b == 0x00 {
+				nullCountInHeader++
+			}
+		}
+		// Reject if too many nulls absolutely or relatively in the header
+		if nullCountInHeader > 0 { // Only perform check if there are any nulls
+			if nullCountInHeader > maxNullBytesInHeaderAbs ||
+				(float64(nullCountInHeader)/float64(n) > maxNullByteRatioInHeader) {
+				return "", nil // Too many nulls in header
+			}
+		}
+
+		// 3. Check for other non-text ASCII control characters in the header
+		// (C0 controls excluding \t, \n, \r)
+		for _, b := range actualHeader {
+			if b < 0x20 && b != '\t' && b != '\n' && b != '\r' {
+				return "", nil // Found problematic control character
+			}
+			// C1 control characters (0x80-0x9F) would be caught by utf8.Valid if part of invalid sequences,
+			// or by the non-printable rune check later if they form valid (but undesirable) codepoints.
+		}
+
+		// Optional: Use http.DetectContentType for an additional check on the header
+		// contentType := http.DetectContentType(actualHeader)
+		// if !strings.HasPrefix(contentType, "text/") && contentType != "application/octet-stream" {
+		//     // If it's clearly a non-text MIME type (e.g., "image/jpeg"), reject it.
+		//     // "application/octet-stream" is ambiguous, so we rely on other heuristics.
+		//     return "", nil
+		// }
+	}
+	// --- End of new heuristic checks for header ---
+
+	// Now read the full file (original logic)
+	content, err := os.ReadFile(realPath)
+	if err != nil {
+		return "", err
+	}
+	// Handle empty file (original logic - returns specific string)
+	if len(content) == 0 {
+		return "empty-file-x6OlSil", nil
+	}
+
+	stringContent := string(content)
+
+	// 4. Final UTF-8 validation for the entire file
+	// (This is crucial as the header might be fine, but the rest of the file isn't)
+	if !utf8.ValidString(stringContent) {
+		return "", nil
+	}
+
+	// 5. Check for excessive null bytes in the entire file content
+	if len(content) > 0 { // Check only for non-empty files
+		totalNullCount := 0
+		for _, b := range content {
+			if b == 0x00 {
+				totalNullCount++
+			}
+		}
+		if float64(totalNullCount)/float64(len(content)) > maxNullByteRatioInFile {
+			return "", nil // Too many nulls in the entire file
+		}
+	}
+
+	// 6. Check for excessive non-printable runes in the entire file content
+	// (Excluding tab, newline, carriage return, which are common in text files)
+	if len(stringContent) > 0 { // Check only for non-empty strings
+		nonPrintableRuneCount := 0
+		totalRuneCount := 0
+		for _, r := range stringContent {
+			totalRuneCount++
+			// unicode.IsPrint includes letters, numbers, punctuation, symbols, and spaces.
+			// It excludes control characters. We explicitly allow \t, \n, \r.
+			if !unicode.IsPrint(r) && r != '\t' && r != '\n' && r != '\r' {
+				nonPrintableRuneCount++
+			}
+		}
+
+		if totalRuneCount > 0 { // Avoid division by zero
+			if float64(nonPrintableRuneCount)/float64(totalRuneCount) > maxNonPrintableRuneRatio {
+				return "", nil // Too many non-printable runes
+			}
+		}
+	}
+
+	// The file has passed all checks and is considered editable text.
+	return stringContent, nil
+}
+
+func IsNamedPipe(mode os.FileMode) bool {
+	return mode&os.ModeNamedPipe != 0
+}
+
+func IsSymlink(mode os.FileMode) bool {
+	return mode&os.ModeSymlink != 0
+}
+
+func Exists(path string) bool {
+	_, err := os.Stat(path)
+	if err == nil {
+		return true
+	}
+	if os.IsNotExist(err) {
+		return false
+	}
+	return false
+}

backend/adapters/fs/files/mime.go

@@ -108,6 +108,7 @@ var types = map[string]string{
 	".chrt":      "application/vnd.kde.kchart",
 	".class":     "application/java",
 	".com":       ContentTextHeaderValue,
+	".conf":      ContentTextHeaderValue,
 	".cpio":      "application/x-cpio",
 	".cpp":       "text/x-c",
 	".cpt":       "application/mac-compactpro",
@@ -148,11 +149,7 @@ var types = map[string]string{
 	".es":        "application/x-esrehber",
 	".etx":       "text/x-setext",
 	".evy":       "application/envoy",
-	".exe":       "application/x-msdownload",
-	".dll":       "application/x-msdownload",
-	".bat":       "application/x-msdos-program",
-	".cmd":       "application/x-msdos-program",
-	".msi":       "application/x-msdownload",
+	".exe":       "application/octet-stream",
 	".f77":       "text/x-fortran",
 	".f90":       "text/x-fortran",
 	".f":         "text/x-fortran",
@@ -228,6 +225,7 @@ var types = map[string]string{
 	".js":        ContentJavascriptHeaderValue,
 	".mjs":       ContentJavascriptHeaderValue,
 	".json":      ContentJSONHeaderValue,
+	".vue":       ContentJavascriptHeaderValue,
 	".jut":       "image/jutvision",
 	".kar":       "audio/midi",
 	".karbon":    "application/vnd.kde.karbon",
@@ -245,8 +243,8 @@ var types = map[string]string{
 	".la":        "audio/nspaudio",
 	".lam":       "audio/x-liveaudio",
 	".latex":     "application/x-latex",
-	".lha":       "application/x-lzh-compressed",
-	".lhx":       "application/x-lzh-compressed",
+	".lha":       "application/lha",
+	".lhx":       "application/octet-stream",
 	".list":      ContentTextHeaderValue,
 	".lma":       "audio/nspaudio",
 	".log":       ContentTextHeaderValue,
@@ -259,6 +257,7 @@ var types = map[string]string{
 	".m1v":       "video/mpeg",
 	".m2a":       "audio/mpeg",
 	".m2v":       "video/mpeg",
+	".m3u":       "audio/x-mpegurl",
 	".m":         "text/x-m",
 	".man":       "application/x-troff-man",
 	".manifest":  "text/cache-manifest",
@@ -308,6 +307,7 @@ var types = map[string]string{
 	".ncm":       "application/vndnokiaconfiguration-message",
 	".nif":       "image/x-niff",
 	".niff":      "image/x-niff",
+	".nix":       "application/x-mix-transfer",
 	".nsc":       "application/x-conference",
 	".nvd":       "application/x-navidoc",
 	".o":         "application/octet-stream",
@@ -343,14 +343,15 @@ var types = map[string]string{
 	".p7m":       "application/pkcs7-mime",
 	".p7r":       "application/x-pkcs7-certreqresp",
 	".p7s":       "application/pkcs7-signature",
+	".p":         "text/x-pascal",
 	".part":      "application/pro_eng",
+	".pas":       "text/pascal",
 	".pbm":       "image/x-portable-bitmap",
 	".pcl":       "application/vndhp-pcl",
 	".pct":       "image/x-pict",
 	".pcx":       "image/x-pcx",
 	".pdb":       "chemical/x-pdb",
 	".pdf":       "application/pdf",
-	".pdfa":      "application/pdf",
 	".pfunk":     "audio/make",
 	".pgm":       "image/x-portable-graymap",
 	".pic":       "image/pict",
@@ -374,7 +375,7 @@ var types = map[string]string{
 	".pre":       "application/x-freelance",
 	".prt":       "application/pro_eng",
 	".ps":        "application/postscript",
-	".psd":       "image/vnd.adobe.photoshop",
+	".psd":       "application/octet-stream",
 	".pvu":       "paleovu/x-pv",
 	".pwz":       "application/vndms-powerpoint",
 	".py":        "text/x-scriptphyton",
@@ -442,13 +443,9 @@ var types = map[string]string{
 	".sprite":    "application/x-sprite",
 	".spx":       "audio/ogg",
 	".src":       "application/x-wais-source",
-	".srt":       "text/subtitle-srt",
-	".ass":       "text/subtitle-ass",
-	".vtt":       "text/subtitle-vtt",
-	".ssa":       "text/subtitle-ssa",
-	".lrc":       "text/lyrics",
-	".elrc":      "text/lyrics",
+	".srt":       "text/plain",
 	".sbv":       "text/plain",
+	".ssa":       "text/plain",
 	".ssi":       "text/x-server-parsed-html",
 	".ssm":       "application/streamingmedia",
 	".sst":       "application/vndms-pkicertstore",
@@ -600,105 +597,11 @@ var types = map[string]string{
 	".ogx":       "application/ogg",
 	".m4v":       "video/mp4",
 	".mkv":       "video/x-matroska",
-	".webm":      "video/webm",
-	".weba":      "audio/webm",
 	".caf":       "audio/x-caf",
-	".m3u":       "text/x-mpegurl", // .m3u and .m3u8 are playlist files - They contain paths, we set it as text to allow edition.
-	".m3u8":      "text/x-mpegURL",
-	".pls":       "text/x-scpls",
-	".xspf":      "application/xspf+xml",
+	".m3u8":      "application/x-mpegURL",
 	".mpd":       "application/dash+xml",
 	".webp":      "image/webp",
 	".epub":      "application/epub+zip",
-	".db":        "application/x-db",
-	".db2":       "application/x-db",
-	".db3":       "application/x-db",
-	".sql":       "application/sql",
-	".sqlite":    "application/vnd.sqlite3",
-	".sqlite3":   "application/vnd.sqlite3",
-	".yaml":      "application/yaml",
-	".app":       "application/x-application",
-	".geojson":   "application/geo+json",
-	".sketch":    "application/x-sketch",
-	".bak":       "application/backup",
-	".backup":    "application/backup",
-	".xfc":       "application/x-xcf",
-	".vue":       "text/vue",
-	".conf":      "text/config-file",
-	".ini":       "text/ini",
-	".ps1":       "application/x-powershell",
-	".ps2":       "application/x-powershell",
-	".ps3":       "application/x-powershell",
-	".dart":      "application/vnd.dart",
-	".flutter":   "text/flutter",
-	".tsx":       "text/x-typescript",
-	".ts":        "text/x-typescript",
-	".php":       "application/x-php",
-	".php2":      "application/x-php",
-	".php3":      "application/x-php",
-	".phtml":     "application/x-php",
-	".p":         "text/x-pascal",
-	".pas":       "text/x-pascal",
-	".zig":       "text/x-zig",
-	".ex":        "text/x-elixir",
-	".exs":       "text/x-elixir",
-	".json5":     "application/json5",
-	".pmx":       "model/x-pmx",
-	".nix":       "text/nix-lang",
-	".cjs":       "text/javascript",
-	".torrent":   "application/x-bittorrent",
-	".tmp":       "text/tmp",
-	".temp":      "text/tmp",
-	// the ones below are some from: https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types
-	".adp":       "audio/adpcm",
-	".mp4a":      "audio/mp4",
-	".mp2a":      "audio/mpeg",
-	".m3a":       "audio/mpeg",
-	".sil":       "audio/silk",
-	".uva":       "audio/vnd.dece.audio",
-	".uvva":      "audio/vnd.dece.audio",
-	".eol":       "audio/vnd.digital-winds",
-	".dra":       "audio/vnd.dra",
-	".dts":       "audio/vnd.dts",
-	".dtshd":     "audio/vnd.dts.hd",
-	".lvp":       "audio/vnd.lucent.voice",
-	".pya":       "audio/vnd.ms-playready.media.pya",
-	".rip":       "audio/vnd.rip",
-	".mka":       "audio/x-matroska",
-	".h261":      "video/h261",
-	".h263":      "video/h263",
-	".h264":      "video/h264",
-	".jpgv":      "video/jpeg",
-	".jpm":       "video/jpm",
-	".jpgm":      "video/jpm",
-	".mj2":       "video/mj2",
-	".mjp2":      "video/mj2",
-	".m2t":       "video/mp2t",
-	".m2ts":      "video/mp2t",
-	".mts":       "video/mp2t",
-	".mp4v":      "video/mp4",
-	".mpg4":      "video/mp4",
-	".uvh":       "video/vnd.dece.hd",
-	".uvvh":      "video/vnd.dece.hd",
-	".uvm":       "video/vnd.dece.mobile",
-	".uvvm":      "video/vnd.dece.mobile",
-	".uvp":       "video/vnd.dece.pd",
-	".uvvp":      "video/vnd.dece.pd",
-	".uvs":       "video/vnd.dece.sd",
-	".uvvs":      "video/vnd.dece.sd",
-	".uvv":       "video/vnd.dece.video",
-	".uvvv":      "video/vnd.dece.video",
-	".dvb":       "video/vnd.dvb.file",
-	".fvt":       "video/vnd.fvt",
-	".mxu":       "video/vnd.mpegurl",
-	".pyv":       "video/vnd.ms-playready.media.pyv",
-	".uvu":       "video/vnd.uvvu.mp4",
-	".uvvu":      "video/vnd.uvvu.mp4",
-	".f4v":       "video/x-f4v",
-	".mk3d":      "video/x-matroska",
-	".mks":       "video/x-matroska",
-	".vob":       "video/x-ms-vob",
-	".smv":       "video/x-smv",
 }
 
 //nolint:gochecknoinits

backend/adapters/fs/files/user.go

@@ -0,0 +1,64 @@
+package files
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// MakeUserDir makes the user directory according to settings.
+func MakeUserDir(fullPath string) error {
+	if err := os.MkdirAll(fullPath, os.ModePerm); err != nil {
+		return err
+	}
+	return nil
+}
+
+func MakeUserDirs(u *users.User, disableScopeChange bool) error {
+	cleanedUserName := users.CleanUsername(u.Username)
+	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
+		return fmt.Errorf("MakeUserDirs: invalid user for home dir creation: [%s]", u.Username)
+	}
+	for i, scope := range u.Scopes {
+		source, ok := settings.Config.Server.SourceMap[scope.Name]
+		if !ok {
+			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
+		}
+		// create directory and append user name
+		if filepath.Base(scope.Scope) != cleanedUserName && source.Config.CreateUserDir && !disableScopeChange {
+			fullPath := filepath.Join(source.Path, scope.Scope, cleanedUserName)
+			parentDir := filepath.Join(source.Path, scope.Scope)
+			// validate that scope path exists
+			if !Exists(parentDir) {
+				return fmt.Errorf("MakeUserDirs: scope path does not exist: %s", scope.Scope)
+			}
+			scope.Scope = filepath.Join(scope.Scope, cleanedUserName)
+			err := MakeUserDir(fullPath)
+			if err != nil {
+				return fmt.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
+			}
+		} else if filepath.Base(scope.Scope) == cleanedUserName && source.Config.CreateUserDir {
+			// create directory exactly as specified
+			fullPath := filepath.Join(source.Path, scope.Scope)
+			parentDir := filepath.Dir(fullPath)
+			if !Exists(parentDir) {
+				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", parentDir)
+			}
+			err := MakeUserDir(fullPath)
+			if err != nil {
+				return fmt.Errorf("create user: failed to create user home dir: %s", err)
+			}
+		} else {
+			// just assigning scope to path provided, so just check that it exists
+			path := filepath.Join(source.Path, scope.Scope)
+			if !Exists(path) {
+				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", path)
+			}
+		}
+		u.Scopes[i] = scope
+	}
+	return nil
+}

backend/adapters/fs/fileutils/dir.go

@@ -53,10 +53,6 @@ func CopyDir(source, dest string) error {
 			}
 		}
 	}
-	// Preserve directory mod times
-	if err := os.Chtimes(dest, srcinfo.ModTime(), srcinfo.ModTime()); err != nil {
-		errs = append(errs, err)
-	}
 
 	var errString string
 	for _, err := range errs {

backend/adapters/fs/fileutils/file.go

@@ -0,0 +1,197 @@
+package fileutils
+
+import (
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+var PermFile os.FileMode
+var PermDir os.FileMode
+
+func SetFsPermissions(PermFileOctal os.FileMode, PermDirOctal os.FileMode) {
+	PermFile = PermFileOctal
+	PermDir = PermDirOctal
+}
+
+// MoveFile moves a file from src to dst.
+// By default, the rename system call is used. If src and dst point to different volumes,
+// the file copy is used as a fallback.
+func MoveFile(src, dst string) error {
+	err := os.Rename(src, dst)
+	if err == nil {
+		return nil
+	}
+
+	// fallback
+	err = CopyFile(src, dst)
+	if err != nil {
+		logger.Errorf("CopyFile failed %v", err)
+		return err
+	}
+
+	go func() {
+		err = os.RemoveAll(src)
+		if err != nil {
+			logger.Errorf("os.Remove failed %v", err)
+		}
+	}()
+
+	return nil
+}
+
+// CopyFile copies a file or directory from source to dest and returns an error if any.
+func CopyFile(source, dest string) error {
+	// Check if the source exists and whether it's a file or directory.
+	info, err := os.Stat(source)
+	if err != nil {
+		return err
+	}
+
+	if info.IsDir() {
+		// If the source is a directory, copy it recursively.
+		return copyDirectory(source, dest)
+	}
+
+	// If the source is a file, copy the file.
+	return copySingleFile(source, dest)
+}
+
+// copySingleFile handles copying a single file.
+func copySingleFile(source, dest string) error {
+	// Open the source file.
+	src, err := os.Open(source)
+	if err != nil {
+		return err
+	}
+	defer src.Close()
+
+	// Create the destination directory if needed.
+	err = os.MkdirAll(filepath.Dir(dest), PermDir)
+	if err != nil {
+		return err
+	}
+
+	// Create the destination file.
+	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, PermFile)
+	if err != nil {
+		return err
+	}
+	defer dst.Close()
+
+	// Copy the contents of the file.
+	_, err = io.Copy(dst, src)
+	if err != nil {
+		return err
+	}
+
+	// Set the configured file permissions instead of copying from source
+	err = os.Chmod(dest, PermFile)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// copyDirectory handles copying directories recursively.
+func copyDirectory(source, dest string) error {
+	// Create the destination directory.
+	err := os.MkdirAll(dest, PermDir)
+	if err != nil {
+		return err
+	}
+
+	// Read the contents of the source directory.
+	entries, err := os.ReadDir(source)
+	if err != nil {
+		return err
+	}
+
+	// Iterate over each entry in the directory.
+	for _, entry := range entries {
+		srcPath := filepath.Join(source, entry.Name())
+		destPath := filepath.Join(dest, entry.Name())
+
+		if entry.IsDir() {
+			// Recursively copy subdirectories.
+			err = copyDirectory(srcPath, destPath)
+			if err != nil {
+				return err
+			}
+		} else {
+			// Copy files.
+			err = copySingleFile(srcPath, destPath)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// CommonPrefix returns the common directory path of provided files.
+func CommonPrefix(sep byte, paths ...string) string {
+	// Handle special cases.
+	switch len(paths) {
+	case 0:
+		return ""
+	case 1:
+		return path.Clean(paths[0])
+	}
+
+	// Treat string as []byte, not []rune as is often done in Go.
+	c := []byte(path.Clean(paths[0]))
+
+	// Add a trailing sep to handle the case where the common prefix directory
+	// is included in the path list.
+	c = append(c, sep)
+
+	// Ignore the first path since it's already in c.
+	for _, v := range paths[1:] {
+		// Clean up each path before testing it.
+		v = path.Clean(v) + string(sep)
+
+		// Find the first non-common byte and truncate c.
+		if len(v) < len(c) {
+			c = c[:len(v)]
+		}
+		for i := 0; i < len(c); i++ {
+			if v[i] != c[i] {
+				c = c[:i]
+				break
+			}
+		}
+	}
+
+	// Remove trailing non-separator characters and the final separator.
+	for i := len(c) - 1; i >= 0; i-- {
+		if c[i] == sep {
+			c = c[:i]
+			break
+		}
+	}
+
+	return string(c)
+}
+
+func ClearCacheDir(cacheDir string) {
+	entries, err := os.ReadDir(cacheDir)
+	if err != nil {
+		logger.Errorf("failed clear cache dir: %v", err)
+	}
+
+	for _, entry := range entries {
+		path := filepath.Join(cacheDir, entry.Name())
+		err = os.RemoveAll(path)
+		if err != nil {
+			logger.Errorf("failed clear cache dir: %v", err)
+		}
+	}
+
+}

backend/adapters/fs/fileutils/file_test.go

@@ -0,0 +1,46 @@
+package fileutils
+
+import "testing"
+
+func TestCommonPrefix(t *testing.T) {
+	testCases := map[string]struct {
+		paths []string
+		want  string
+	}{
+		"same lvl": {
+			paths: []string{
+				"/home/user/file1",
+				"/home/user/file2",
+			},
+			want: "/home/user",
+		},
+		"sub folder": {
+			paths: []string{
+				"/home/user/folder",
+				"/home/user/folder/file",
+			},
+			want: "/home/user/folder",
+		},
+		"relative path": {
+			paths: []string{
+				"/home/user/folder",
+				"/home/user/folder/../folder2",
+			},
+			want: "/home/user",
+		},
+		"no common path": {
+			paths: []string{
+				"/home/user/folder",
+				"/etc/file",
+			},
+			want: "",
+		},
+	}
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			if got := CommonPrefix('/', tt.paths...); got != tt.want {
+				t.Errorf("CommonPrefix() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

backend/auth/auth.go

@@ -0,0 +1,34 @@
+package auth
+
+import (
+	"net/http"
+	"sync"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+var (
+	revokedApiKeyList map[string]struct{}
+	revokeMu          sync.Mutex
+)
+
+func init() {
+	revokedApiKeyList = make(map[string]struct{})
+}
+
+// Auther is the authentication interface.
+type Auther interface {
+	// Auth is called to authenticate a request.
+	Auth(r *http.Request, userStore *users.Storage) (*users.User, error)
+}
+
+func IsRevokedApiKey(key string) bool {
+	_, exists := revokedApiKeyList[key]
+	return exists
+}
+
+func RevokeAPIKey(key string) {
+	revokeMu.Lock()
+	defer revokeMu.Unlock()
+	revokedApiKeyList[key] = struct{}{}
+}