updated last minute changes (#2103)

Co-authored-by: zarev <60230221+zarevskaya@users.noreply.github.com>

.dockerignore

@@ -1,6 +1,10 @@
 backend/**.db
 backend/tmp
+backend/dist
 backend/backend*
+backend/http/dist/**
 backend/vendor/**
+
 frontend/dist/**
-frontend/node_modules/**
+frontend/node_modules/**
+frontend/pkg/**

.github/workflows/pr.yaml

@@ -7,6 +7,7 @@ on:
       - "dev/v*.*.*"
       - "beta/v*.*.*"
       - "stable/v*.*.*"
+      - "staging/v*.*.*"
 jobs:
   prime_docker_cache:
     name: Prime docker cache
@@ -39,7 +40,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: dist
-          path: frontend/dist
+          path: backend/http/dist
   build_backend:
     name: Build backend
     runs-on: ubuntu-latest
@@ -75,6 +76,10 @@ jobs:
             dockerfile: ./_docker/Dockerfile.playwright-oidc
           - name: sharing
             dockerfile: ./_docker/Dockerfile.playwright-sharing
+          - name: no-config
+            dockerfile: ./_docker/Dockerfile.playwright-no-config
+          - name: settings
+            dockerfile: ./_docker/Dockerfile.playwright-settings
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -112,7 +117,6 @@ jobs:
           cache-to: |
             type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
   push_pr_to_registry:
-    if: github.event.pull_request.head.repo.fork == false
     name: Build docker image
     runs-on: ubuntu-latest
     steps:
@@ -122,16 +126,9 @@ jobs:
         uses: docker/setup-qemu-action@v3.0.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
         uses: docker/metadata-action@v5
-        with:
-          images: gtstef/filebrowser
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
@@ -144,4 +141,4 @@ jobs:
             VERSION=${{ steps.meta.outputs.version }}
             REVISION=${{ steps.meta.outputs.revision }}
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max

.github/workflows/promote-beta-to-stable.yaml

@@ -86,25 +86,3 @@ jobs:
           git push origin "$STABLE_BRANCH"
 
           echo "✅ Successfully merged '$BETA_BRANCH' into '$STABLE_BRANCH'."
-
-#      - name: Delete beta branch after successful merge
-#        run: |
-#          VERSION="${{ github.event.inputs.version }}"
-#          BETA_BRANCH="beta/v$VERSION"
-#
-#          # Delete beta branch locally and remotely
-#          git branch -d "$BETA_BRANCH"
-#          git push origin --delete "$BETA_BRANCH"
-#
-#          echo "✅ Successfully deleted '$BETA_BRANCH'."
-
-      - name: Create Pull Request to Main
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.PAT }}
-          commit-message: "Promote stable/v${{ github.event.inputs.version }} to main"
-          title: "Promote stable/v${{ github.event.inputs.version }} to main"
-          body: "This PR promotes stable/v${{ github.event.inputs.version }} to the main branch."
-          base: main
-          branch: stable/v${{ github.event.inputs.version }}
-          delete-branch: false

.github/workflows/promote-dev-to-beta.yaml

@@ -86,14 +86,3 @@ jobs:
           git push origin "$BETA_BRANCH"
 
           echo "✅ Successfully merged '$DEV_BRANCH' into '$BETA_BRANCH'."
-
-#      - name: Delete dev branch after successful merge
-#        run: |
-#          VERSION="${{ github.event.inputs.version }}"
-#          DEV_BRANCH="dev/v$VERSION"
-#
-#          # Delete dev branch locally and remotely
-#          git branch -d "$DEV_BRANCH"
-#          git push origin --delete "$DEV_BRANCH"
-#
-#          echo "✅ Successfully deleted '$DEV_BRANCH'."

.github/workflows/regular-tests.yaml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-            go-version: 'stable'
+          go-version: 'stable'
       - uses: golangci/golangci-lint-action@v7
         with:
           version: 'v2.1.6'
@@ -50,3 +50,10 @@ jobs:
       - uses: actions/setup-node@v4
       - working-directory: frontend
         run: npm i && npm run test
+  check-translations:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run i18n:check

.github/workflows/release_beta.yaml

@@ -59,8 +59,8 @@ jobs:
           target_commitish: ${{ github.sha }}
           token: ${{ secrets.PAT }}
           tag_name: ${{ steps.extract_branch.outputs.tag_name }}
-          prerelease: false # change this to false when stable gets released
-          make_latest: true # change this to false when stable gets released
+          prerelease: true
+          make_latest: false
           draft: false
           generate_release_notes: true
           name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/release_dev.yaml

@@ -1,62 +0,0 @@
-name: dev release
-
-on:
-  push:
-    branches:
-      - "dev/v[0-9]+.[0-9]+.[0-9]+"
-
-permissions:
-  contents: write
-
-jobs:
-  push_release_to_registry:
-    name: Push release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{ secrets.PAT }}
-      - name: Extract metadata (tags, labels) for Docker and GHCR
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            gtstef/filebrowser
-            ghcr.io/gtsteffaniak/filebrowser
-      - name: Modify version names
-        id: modify-json
-        run: |
-          TAGS="${{ steps.meta.outputs.tags }}"
-          # Apply modifications to both docker.io and ghcr.io tags
-          CLEANED_TAGS=$(echo "$TAGS" | sed 's/filebrowser:dev-v/filebrowser:/g' | sed -E 's/(filebrowser:[0-9]+\.[0-9]+\.[0-9]+)/\1-dev/g')
-          # Add dev tag to both registries
-          CLEANED_TAGS="$CLEANED_TAGS,gtstef/filebrowser:dev,ghcr.io/gtsteffaniak/filebrowser:dev"
-          echo "cleaned_tag<<EOF" >> $GITHUB_OUTPUT
-          echo "$CLEANED_TAGS" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64
-          file: ./_docker/Dockerfile
-          push: true
-          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_stable.yaml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   test_playwright:
-    name: Test Playwright
+    name: Test Playwright - regular
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -60,6 +60,7 @@ jobs:
           token: ${{ secrets.PAT }}
           tag_name: ${{ steps.extract_branch.outputs.tag_name }}
           prerelease: false
+          make_latest: true
           draft: false
           generate_release_notes: true
           name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/tag.yaml

@@ -59,7 +59,7 @@ jobs:
           images: |
             gtstef/filebrowser
             ghcr.io/gtsteffaniak/filebrowser
-      - name: Modify tags (strip 'v' and add 'beta'/'stable' if needed)
+      - name: Modify tags (strip 'v' and add version tags)
         id: modify-json
         run: |
           JSON='${{ steps.meta.outputs.json }}'
@@ -68,15 +68,31 @@ jobs:
               sub(":v"; ":")      # Strip the 'v'
               | select(test(":latest") | not)
             ) |
-            if any(.tags[]; test("beta")) then
+            # Find all version tags with suffix (X.Y.Z-suffix) and add major.minor and major tags
+            .tags += [
+              .tags[] 
+              | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
+              | split(":")
+              | .[-1] as $version
+              | ($version | split("-")) as $version_split
+              | ($version_split[0] | split(".")) as $version_parts
+              | ($version_split[1:] | join("-")) as $suffix
+              | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
+              | ($version_parts[0]) as $major
+              | "gtstef/filebrowser:\($major_minor)-\($suffix)",
+                "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
+                "gtstef/filebrowser:\($major)-\($suffix)",
+                "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
+            ] |
+            # Add suffix-only tags for beta (only if tag ends with -beta)
+            if any(.tags[]; split(":")[-1] | endswith("-beta")) then
               .tags += [
                 "gtstef/filebrowser:beta",
-                "ghcr.io/gtsteffaniak/filebrowser:beta",
-                "gtstef/filebrowser:latest",
-                "ghcr.io/gtsteffaniak/filebrowser:latest"
+                "ghcr.io/gtsteffaniak/filebrowser:beta"
               ]
             else . end |
-            if any(.tags[]; test("stable")) then
+            # Add suffix-only tags for stable (and latest) (only if tag ends with -stable)
+            if any(.tags[]; split(":")[-1] | endswith("-stable")) then
               .tags += [
                 "gtstef/filebrowser:stable",
                 "ghcr.io/gtsteffaniak/filebrowser:stable",
@@ -138,13 +154,31 @@ jobs:
               | select(test(":latest") | not) # Remove the "latest" tag
               | . + "-slim"                   # Append "-slim" to the versioned tag
             ) |
-            if any(.tags[]; test("beta")) then
+            # Find all version tags with suffix (X.Y.Z-suffix-slim) and add major.minor and major tags
+            .tags += [
+              .tags[] 
+              | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
+              | split(":")
+              | .[-1] as $version
+              | ($version | split("-")) as $version_split
+              | ($version_split[0] | split(".")) as $version_parts
+              | ($version_split[1:] | join("-")) as $suffix
+              | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
+              | ($version_parts[0]) as $major
+              | "gtstef/filebrowser:\($major_minor)-\($suffix)",
+                "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
+                "gtstef/filebrowser:\($major)-\($suffix)",
+                "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
+            ] |
+            # Add suffix-only tags for beta-slim (only if tag ends with -beta-slim)
+            if any(.tags[]; split(":")[-1] | endswith("-beta-slim")) then
               .tags += [
                 "gtstef/filebrowser:beta-slim",
                 "ghcr.io/gtsteffaniak/filebrowser:beta-slim"
               ]
             else . end |
-            if any(.tags[]; test("stable")) then
+            # Add suffix-only tags for stable-slim (only if tag ends with -stable-slim)
+            if any(.tags[]; split(":")[-1] | endswith("-stable-slim")) then
               .tags += [
                 "gtstef/filebrowser:stable-slim",
                 "ghcr.io/gtsteffaniak/filebrowser:stable-slim"

.github/workflows/update-build-images.yaml

@@ -0,0 +1,41 @@
+
+name: Update Build Images
+
+on:
+  workflow_dispatch:
+
+jobs:
+  publish_playwright_base:
+    name: Publish playwright-base to GHCR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/gtsteffaniak/playwright-base
+          tags: latest
+      - name: Build and push playwright-base
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          file: _docker/Dockerfile.playwright-base
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=playwright-base
+          cache-to: type=gha,mode=max,scope=playwright-base

.gitignore

@@ -8,22 +8,26 @@ rice-box.go
 /backend/backend
 /backend/filebrowser
 /backend/filebrowser.exe
+frontend/tsconfig.tsbuildinfo
 /backend/backend.exe
+/backend/playwright-files.db
 /backend/tmp
 /backend/dist
 /frontend/dist
 /frontend/pkg
 /frontend/test-results
+/frontend/playwright-files
+/frontend/screenshots
 /frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
-/frontend/package-lock.json
 /backend/vendor
 /backend/*.cov
-/backend/test_config.yaml
+/backend/*test_config.yaml
 /backend/generated.yaml
 /backend/srv
 /backend/http/dist
-/backend/http/embed/*
+/backend/http/embed
+/backend/debug
 
 .DS_Store
 node_modules
@@ -49,3 +53,7 @@ bin/
 build/
 *__debug*
 backend/custom.css
+
+# Runtime cache directories created by tests/application
+backend/preview/heic/
+backend/preview/thumbnails/

CHANGELOG.md

@@ -2,6 +2,658 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
+## v1.2.2-stable
+
+ **Security**:
+ - Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse)
+ - Patched Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info GHSA-525j-95gf-766f
+
+ **New Features**:
+ - "Divider" option in sidebar links to add a text or divider between links (#1875)
+ - shares offer a "go to source Location" sidebar link and button when editing a share.
+
+ **Notes**:
+ - Share edit/delete permissions are scoped to the user's shares rather than global (#2050)
+ - OIDC group claims accepted as map (#2084)
+
+ **BugFixes**:
+ - fixed the requirement that the database path needed to be set in the config file, now it loads `FILEBROWSER_DATABASE` value by default, fallback to config file property.
+ - Error downloading zipped directory: no such file or directory (users with scope) #2015
+
+## v1.2.1-stable
+
+ **BugFixes**:
+ - startup icon generation order issue (#2019)
+ - login button on shares not showing (#2028)
+ - removed file watcher link in context menu for shares (#2025)
+ - Direct download link for single-file shares generates incorrect URL (#2026)
+ - Deleting files causes error V1.2.0 #2039
+
+## v1.2.7-beta
+
+ **BugFixes**:
+ - head > title > infinitely duplicating titles (#2016)
+ - Proxy auth not working with Nginx, stuck at logo (#2013)
+
+## v1.2.6-beta
+
+ **Security**:
+ - resolves https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6
+
+## v1.2.5-beta
+
+ **Notes**:
+ - Dependency Updates for frontend and backend packages
+ - Upgrade to go 1.26
+ - file list prompt interaction behavior, single-click always selects, double-click navigates. (#1911)
+
+ **BugFixes**:
+ - .ssa and .ass subtitle files get their styling removed during conversion (#1933)
+ - custom icons issue
+ - new database message for noauth (#1935)
+
+## v1.2.4-beta
+
+ **Notes**:
+ - Changed `/api/media/subtitles` api endpoint to better support subtitles.
+ - Correcting some errors in French language (#1947)
+ - add Dutch `nl.json` for frontend i18n -- thanks @Stephan-P (#1957)
+ - share banner and icon images automatically serve a scaled down 1024x1024
+
+ **BugFixes**:
+ - Can't access directories with space (and possibly other special characters) when browsing a public link share (#1956)
+ - External ASS subtitles are not usable in web preview (#1933)
+ - Filename blocking rename/move (#1950)
+ - enforcedOtp: true blocks all user settings updates with HTTP 400 (#1962)
+ - Share favicon URL not showing up and Share description causing endless loading (#1911)
+ - folder sizes not updated for changes to filesystem outside of filebrowser (#1974)
+
+## v1.2.3-beta
+
+ **Notes**:
+ - Removed upload api behavior to assume paths ending in "/" are folders, strictly uses isDir query param
+ - renamed public upload api query param from `targetPath` to `path`. see swagger docs.
+
+ **BugFixes**:
+ - fix stuck motion preview popup window issue
+ - Chunked uploads ignore User Scope and are saved to Source Root (#1894)
+ - share delete with user scope issue
+ - fix favicon pwa icon, having the PWA respect the favicon/loginIcon (#1899)
+ - delete prompt icons show image previews
+
+## v1.2.2-beta
+
+ **New Features**:
+ - Resizable sidebar (#1896)
+ - OIDC Authentication: Change Button Text via `frontend.oidcLoginButtonText` (#1708)
+ - improved favicon processing (#1899)
+   - supports more formats
+   - supports larger images
+   - automatcially generates multiple favicon sizes on startup for non-svg images. Custom svg favicons need a companion *.png to exist broad compatibilty
+   - Enhanced media playback: Ability to control the queue from your device's lock screen and notification panel - Will also show
+   metadata of the current playing media if available (#1917)
+
+ **Notes**:
+ - Better text file content detection (#1726)
+ - More url encoding changes for API which should make things more consistent. Open issues if you see path/source not found errors.
+ - adjustments to the startup behavior for sqlite index for reusing the previous database on startup
+ - CTRL + B disables sticky sidebar forever (#1869)
+ - added context menu back to duplicate finder
+ - Sharing a link for uploads - folder/file access and UX polishing (#1902)
+ - improved listing view and scrolling performance
+ - improved image viewer which will utilize recent thumbnails as a placeholder when loading the full image.
+ - Small reorganization of "Share" settings to make the popup clear (#1826)
+
+ **BugFixes**:
+ - Added docker default `FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"` back -- mistakenly removed. see https://filebrowserquantum.com/en/docs/getting-started/config/#3-default-locations. (#1891)
+ - Fix brand text in login screen (#1898)
+ - Sidebar links cointains urls with 2x repeated source name (#1847)
+ - 2 factor auth getting overwritten if you edit the auth from admin (#1819)
+ - New created user's files are listing error, Probably related with language setting. (#1565)
+ - thumbnail generation cpu/memory and concurrency bug.
+   - added 75MB filesize limit for image previews
+   - optimized concurrency for large vs small images
+
+
+## v1.2.1-beta
+
+ **New Features**:
+ - Global disable onlyoffice editor via "*" file option to disable all files for a specific user. (#1533) 
+
+ **Notes**:
+ - upgraded imaging package and improved thumbnail generation performance. (#1797) (#1850)
+ - updated download api to use repeated `file` query param for path instead of `files` with comma. See swagger for details (#1881)
+
+ **BugFixes**:
+ - OnlyOffice stopped working after 1.2.0 upgrade due to download api changes
+ - Search result link to wrong path when search context other than / (#1863)
+ - File actions doesn't work if using user scopes (#1879)
+ - Drop items into folders doesn't work (#1860)
+ - duplicate finder context menu (#1862)
+ - File list in previews doesn't show the parent items (#1861)
+
+## v1.2.0-beta
+
+This is a major version update with many code changes which could cause unexpected behavior. Upgrades should proceed with caution and report any undesriable behavior by opening an issue on github. The index is now fully in sqlite database - see [Indexing Overview](https://filebrowserquantum.com/en/docs/features/indexing/) for more information.
+
+Sorry for the delay -- a lot of effort went into this release, specifically about fine-tuning sqlite indexing. It took me a long time to iron out the behavior, but it should be mostly there now. Enjoy and report any issues as always :)
+
+ **New Features**:
+ - SQLite-based indexing
+   - reduced memory usage, higher CPU and IO usage.
+   - index persistence between restarts (requires [persistent cacheDir](https://filebrowserquantum.com/en/docs/configuration/server/#cachedir))
+ - new tool - "realtime file watcher" low latency if user has realtime permissions (#917)
+ - Access control works with individual files too
+ - conditionally hide symbolic links as indexing rule config (#1540)
+ - External applications can connect to filebrowser over webDAV (#209) (#1764)
+ - make breadcrumbs act as a drop area (#1785)
+ - search multiple sources at once (#848)
+ - file uploads resume from bad internet connection #1599
+ - chunked downloads - fix for 524 errors on cloudflare #1502
+ - made size calculation consistent: defaults to "size on disk" style to mimic "du -sh", and allows config `source.config.useLogicalSize: true` for 0 size folders and actual size file sizes. (#1266)
+ - Feature: allow deleting selected duplicates from duplicate finder (#1659)
+ - share changes:
+  - opengraph support for shared links
+  - Allow adding "share settings" option to customizable sidebar links (#1825)
+  - file picker for share favicon and banner icon
+  - Allow disabling "Login button" for shares (#1673)
+
+ **Notes**:
+ - `server.cacheDirCleanup` defaults to `false` instead of `true`. For docker, you would still need to mount a cacheDir volume to persist cache between restarts.
+ - indexing rules have been streamlined, see [wiki]. The previous style is deprecated but still functional.
+ - improved listing load times for directories with metadata -- a two-pass approach. First a fast load to get the listing items, then a second api request to include metadata.
+ - Enhanced delete prompt
+ - bulkDelete API added and replaces the delete API for all UI actions. See swagger docs for usage.
+ - raw download and patch resource api simplified to a single source per request. See swagger docs for usage.
+ - UserScope function re-organization, if you notice any user scope issues, please open a GitHub issue.
+ - file upload resume from bad internet connection #1599
+
+ **BugFixes**:
+ - Source info not properly read from external storage NAS (#1727)
+ - ensure user requests scopes are strongly enforced (#1789)
+
+## New Contributors
+* @reddec made their first contribution in https://github.com/gtsteffaniak/filebrowser/pull/1764
+* @maximeborges made their first contribution in https://github.com/gtsteffaniak/filebrowser/pull/1849
+
+**Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v1.1.6-beta...v1.2.0-beta
+
+## v1.1.6-beta
+
+ **Notes**:
+ - "showHidden" is now a backend attribute. Shares will NOT show hidden files by default unless configured to.
+ - improved listing view UI performance, especially for folders with many items. (#1773)
+
+ **BugFixes**:
+ - SortBy config is not respected when navigating next/previous (#1786)
+ - unauthenticated users unable to preview files (#1792)
+ - File permission not correctly applied( #1790)
+ - API Key loses "download" permission after creation despite being enabled (#1799)
+ - never exclude root folder (#1749)
+ - sources with "files" name not showing after 1.1.x update (#1772)
+ - Symbolic links can't be deleted from webui. (#1566)
+ - panic: close of closed channel during indexing (#1771)
+ - Public sharing returns 404 errors for album art (#1792)
+ - Directories with some symbols in their name "fail to open" (#1808)
+
+## v1.1.5-beta
+
+ **Notes**:
+ - Major git container tag request #1756
+
+ **BugFixes**:
+ - Sharing broken if source `disableIndexing: true` (#1742)
+ - Password protected share permission issues (#1729) (#1606) (#1593)
+ - Sidebar Sliding left (#1737)
+ - file permissions not working (#1762)
+ - handle Close() errors in archive creation (#1745)
+ - Move custom CSS and user-selected theme styles to the end of the body (#1744)
+
+## v1.1.4-beta
+
+ **New Features**:
+ - toggle to show searching results with thumbnails #1545
+
+ **Notes**:
+ - file list has loading spinner to help prevent double click issues and give better feedback
+ - improved cacheDir startup checks
+   - warning for slow read/write speeds below 50MB/s
+   - warning for low free space below 20GB
+   - warning if read/write latency is slow
+   - fatal for any errors reading or writing to the directory
+   - links to official docs for more info 
+ - access rule changes:
+   - denied folders won't show up in parent directory listing view (#1684)
+   - tools will respect access rules
+   - shares will check access rules based on user that created the share
+
+ **BugFixes**:
+ - passwords with special characters not working properly (#1648)
+ - encoded filename navigation issue (#1711)
+ - Fix/Improve some behaviors in nextPrevious (#1707)
+ - Files recognized as folder if they have the same name as previously deleted folders #1697
+ - multi logger support issue #1701
+
+## v1.1.3-beta
+
+ **Notes**:
+ - continue create user dir scope even if filesystem path creation fails #1509
+ - access control cache is cleared more aggresively to ensure no delay
+ - removed default .ico favicon in favor of .svg
+
+ **BugFixes**:
+ - indexing used size increases over time #1685
+ - download progress is not shown #1687
+
+## v1.1.2-beta
+
+ **Notes**:
+ - changes to duplicate detector
+   - temp SQLite database each query to reduce memory pressure
+   - max limit is 500 groups total
+ - Downloads from UI requests utf-8 formatted names to support chinese and other characters. Updated swagger docs.
+ - beta releases no longer publish to `latest` docker tag #1675
+
+ **BugFixes**:
+ - better index status updates, fixing delays #1649
+ - fixed long load times for listings with media info due sequential processing of files. 
+ - downloaded files always included `utf-8` in filename #1671
+ - custom sidebar links allow external links like `https://google.com`
+ - html title not populated correctly for links #1676
+
+## v1.1.1-beta
+
+ **Notes**:
+ - [docker] upgraded ffmpeg 8.0 to 8.0.1
+ - stricter access control checks on file downloads.
+ - Wrong translation on Chinese "save" button #1650
+ - Incorrect Spanish Translations in Folder Creation and Rename Actions #1626
+ - duplicate file detector has stricter partial checksum match #1617
+
+ **BugFixes**:
+ - added missing exiftool to docker image for heic conversion orientation support
+ - v1.1.0-beta - Incorrect naming of 1 file in directory-info #1621
+ - disable only office viewing settings not applying
+ - OnlyOffice integration does not work behind proxy authentication #1422
+ - Newly created users "add on" to defined scope of previous user #1628 #1518
+ - disable chown on upload / file saving #1469 #1546
+ - Uploading a file will silently overwrite any existing file with the same name #1564
+ - share file url issue
+ - Fix drag and drop and rows in normal view #1651
+ - Some text based files are not able to edit. #1567
+
+## v1.1.0-beta
+
+ **New Features**:
+ - Added tools
+   - size analyzer -- quickly show largest files in interactive graphical chart
+   - duplicate finder -- find duplicate files larger than 1MB
+   - material icon picker and previewer
+ - Listing View Style updates
+   - Status bar for listing view #1459
+   - Duration field shows up if media is shown with duration
+   - More dynamic view modes with additional styling changes
+   - Total display modes consolidated into 3 main groups: list, gallery, normal. "icon" and "compact" mode exist as views based on display size setting.
+ - Customizable sidebar links
+   - Logged in users can have their preferences saved and synced
+   - Can rearrange, add custom links, and save your preferences.
+   - Can customize shares with their own custom sidebar links.
+ - Dynamic scopes for OIDC #1414 #1363
+ - Share and Access Rules validation
+   - If a file/path is moved/renamed in UI its rules and shares will always follow.
+   - If a file/path is moved/renamed outside UI, a warning message will show and ability to associate to new path
+ - Cascade delete access in Access Management when deleting a User #1347
+ - Enhanced notifications #1331
+   - Added "toast" notification type support -- most success messages show as toast now.
+   - multiple stacked notifications possible
+   - notification button support, such as click to open folder after moving file.
+   - notification history (not including toasts)
+   - Add swipe and visual timeout to notifications #1600
+ - Choose different bind ip via `server.listen` #1573
+ - Allow disabling clearing cache each startup via `server.cacheDirCleanup: false` in config #1576
+
+ **Notes**:
+ - more efficient user update actions. Successful PUT actions return only 204 if successful.
+ - Do not enter directory on "New Folder" action #1343
+ - Improved indexing performance - individual scanners per directory at root.
+ - Improved search memory efficiency
+ - Improved scrolling performance
+ - Static file handling has been streamlined, could potentially see some changes from this.
+ - No longer automatically publishing any dev builds to docker
+ - deprecated "DefaultLandingPage" option -- now determined by first source link in sidebar.
+ - Improve rename prompt #1608 #1556
+
+ **BugFixes**:
+ - uploading/editing/saving to password protected shares error
+ - updating a share with password protection without a password removed the password.
+ - per-user download counts were not persistant accross restarts
+ - "Update" button in Chinese wraps incorrectely #1542
+
+## v1.0.1-stable
+
+ **BugFixes**:
+ - UserDefault always applies to newly created users #1518
+ - Updating user's own password sometimes doesn't work
+ - Anonymous Share link with optional password does not allow downloads #1553
+ - Share options should go in the meta tags #1511
+ - Unable to select compression format when downloading multiple files/dir via Share link (v1.0.0) #1557
+ - fixed sidebar clipping on some browsers like safari
+ - Files show as Download is not available even though it is #1537
+
+## v1.0.1-beta & v1.0.0-stable
+
+ **New Features**:
+ - login icon support added via `frontend.loginIcon` config path variable
+
+ **Notes**:
+ - updated default login icon
+ - stopped publishing rolling `dev` docker tag.
+ - build requirement change -- from node 18 > node 20 with npm 9.0.0+
+ - version is not shown for unauthenticated users #1444
+ - adjusted how static assets are served to better handle icon standards
+ - fixed signup login #1444
+ - update makefile linker flags to properly set version and sha #1474
+ - better windows build support -- `make setup` and `make dev` work as long as git is installed on windows
+ - added better first initilization detection
+   - If filebrowser initialized and does not detect a database, a new warning message in server logs appears.
+   - If theres no database on start, any admin user's first login will see a welcome message in the ui.
+   - For docker, it defaults to ./data/database.db, but will also fallback to ./database.db without any additional configuration.
+
+ **BugFixes**:
+ - Generating multiple HEIC previews in parallel fails #1470
+ - ? in path not always encoded right #1447
+ - fixed some condition that the halloween background doesn't load properly
+ - some comments not showing up on config viewer in settings
+
+## v1.0.0-beta
+
+ **Notes**:
+ - Enhanced onlyoffice debugger with more wholistic backend logs
+ - Updated info prompt styling
+ - share qr code links to externalUrl for entire share if exists #1329
+
+ **BugFixes**:
+ - cookie host is set using x-Forwarded-Host to better support reverse proxies.
+ - HEIC conversion not working #1460
+ - 'Prevent user changing their password' also prevents admins changing the users password. #1365
+ - OnlyOffice write problem #1397 #1068
+ - Conditionals starting with a . seem to not work. #1455
+ - Last modified in file info is empty #1443
+ - Share links: 'Default View Mode' does not apply to subfolders. #1463
+
+## v0.8.11-beta
+
+ **New Features**:
+ - OnlyOffice debugger now shows backend logs as well for admin users.
+ - If proxy auth based `username` equals `auth.adminUsername`, the user will be promoted to admin.
+ - Guard against accidently cancelling uploads #1419
+ - Added a quirky halloween theme that automatically applies on october 31st -- you can disable this from happening by setting `frontend.styling.disableEventThemes`
+
+ **Notes**:
+ - Removed share setting `enableOnlyOfficeEditing` -- uses value from `allowEditing`
+ - Anonymous users can now edit if a share has edit permissions enabled.
+ - No "Incompatible user settings detected" message if its first setup
+ - cookie handling revamped
+   - fully backend managed
+   - `auth` cookie name changed to `filebrowser_quantum_jwt`
+   - auth cookie for password users no longer session based #1439
+   - removed state jwt state variable -- 100% cookie based.
+
+ **BugFixes**:
+ - Fixed issue editing onlyoffice on shares #1397
+ - Added proper and robust logging / error handling for the onlyoffice callback. #1422 #1068
+ - If a file was moved/renamed/deleted onlyoffice would re-save the original file without error, now it gives error the file doesn't exist anymore.
+ - OnlyOffice integration does not work behind proxy authentication #1422
+ - proxy-based authentication with docker does not work unless set up with password-based login first #1226
+ - Select all bug on safari mobile #1421
+ - Dragging a item into itself #1446
+
+## v0.8.10-beta
+
+ **New Features**:
+ - Add marquee selection to listing view -- thanks @Kurami32 #1388
+
+ **Notes**:
+ - More changes to login auth flow
+ - respects `FILEBROWSER_DISABLE_AUTOMATIC_BACKUP='true'` env var #1398
+ - Deprecating `conditionals.hidden` instead use `conditionals.ignoreHidden`
+
+ **BugFixes**:
+ - Fix material outline styling
+ - "feels lonely here" when clicking at source tab #1387
+ - Anonymous upload bug 0.8.9 #1383
+ - changing previews between documents in onlyoffice #1410
+ - onlyoffice should display user language #1061
+ - Filebrowser will hard fail when OIDC provider is not found #733
+ - some API endpoints always return 404 #849
+
+## v0.8.9-beta
+
+> [!CAUTION]
+> If you have indexing rules -- such as [maxWatchers](https://github.com/gtsteffaniak/filebrowser/blob/39514169f17ed9586d587dd496257588ded6e532/frontend/public/config.generated.yaml#L30), [neverWatchPaths](https://github.com/gtsteffaniak/filebrowser/blob/39514169f17ed9586d587dd496257588ded6e532/frontend/public/config.generated.yaml#L31C9-L31C24), [exclude](https://github.com/gtsteffaniak/filebrowser/blob/39514169f17ed9586d587dd496257588ded6e532/frontend/public/config.generated.yaml#L32C9-L32C16) rules, [include](https://github.com/gtsteffaniak/filebrowser/blob/39514169f17ed9586d587dd496257588ded6e532/frontend/public/config.generated.yaml#L43) rules, see [the migration guide](https://filebrowserquantum.com/en/docs/user-guides/general-configuration/exclusion-rules/) for help.
+
+ **New Features**:
+ - Playback Queue for media -- thanks @Kurami32 #1339
+ - Ctrl+b Shortcut to toggle sidebar, open settings, search #1172
+ - Add a "select all" toggle in the menu #974
+ - Save on exit text editor -- thanks @srini-abhiram #1334 #1241
+ - Disabled indexing for subfolders but allow browsing #783
+ - Added more granular create/upload, delete, and download (includes viewing content) permission #1200 #1199
+ - Upload settings can be adjusted directly in the upload prompt
+ - Added paste confirmation prompt when using copy/paste keyboard shortcuts.
+ - Updated shares
+   - `disableDownload` to disable download and (content viewing).
+   - `allowReplacements` to share permission -- prohibits replacing files on conflict #661
+   - normal shares can create/upload files if given permission
+
+ **Notes**:
+ - Optimized font and icon loading.
+ - the next/previous buttons will follow media queue order if playback mode has a queue.
+ - All new exclude rules -- see [full config example](https://github.com/gtsteffaniak/filebrowser/wiki/Full-Config-Example)
+ - The order of sources will strictly match order in config.yaml. Default landing page is root first source unless otherwise configured in profile settings.
+ - Uploading changes #1371
+   - Chunked uploading can no longer be explicitly disabled, defaults to 5MB chunks
+   - Automatic chunked/non-chunked uploads based on size. If an item exceeds the chunk size, chunked uploading will occur. If its less than chunk size, no chunked upload.
+   - To "disable" chunked upload, you an set your chunk size very large -- 0 chunk size will be reset to 5MB.
+
+ **BugFixes**:
+ - Remember the previous location after closing a preview #1336
+ - fixed issue related to multi-config parsing #1267
+ - Cannot save text files, missing button #1326 #1367
+ - Files are being overwritten and/or content disappears #1312
+ - moving between items using next/previous will reset the req and show a responsive loading spinner -- fixing several state related issues.
+ - access management: child folders accessible stopped showing up #1332
+ - Make source inaccessible if directory does not exist rather than exiting on start #1264
+ - HTTP Proxy environment gets ignored since version v0.8.6-beta #1324
+ - album artwork preview not showing on shares
+ - fixed OIDC logout causing a loop #995 #1361
+ - fixed checksum failure #1372
+ - Copy, paste, cut shortcuts don't work and make the UI unusable #1375
+
+## v0.8.8-beta
+
+ **New Features**:
+ - Ability to split configuration files via yaml anchoring #1267
+   - see [How to: Use multiple config files](https://github.com/gtsteffaniak/filebrowser/wiki/How-to:-Use-multiple-config-files)
+ - added [Init Script Help wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Init-Script-Help) to examples how you can bootstrap filebrowser quantum programatically
+ - Add capability to edit files permissions #813
+   - see updated full config for help using `server.filesystem`
+ - better copy/move prompt "in progress" indicator
+ - better login error message feedback
+ - Add capability to disable certain video previews at server level. See full config for help.
+ - Added ability to play media in same folder sequentially or shuffled.
+ - upload/upload only share links. #661
+ - Default landing directory if no other redirect is found (set profile settings) #781
+ - share download limit feature can apply per user -- and disables anonymous download when enabled.
+ - Docker health check #1292
+ - embedded subtitle support is now **disabled** by default, can be enabled via `integrations.media.extractEmbeddedSubtitles`. Per share configuration is also possible via `extractEmbeddedSubtitles` toggle. This change is because reading subtitles requires processing the entire file, and multi GB video files can take 10-20 seconds.
+
+ **Notes**:
+ - Some standardized path format changes for access rules to ensure the rules apply. A migration check happens on startup, all rules should still be in effect without any issues, but double check.
+ - moved `server.debugMedia` to `integrations.media.debug`
+ - optimized thumbnail generation workflow
+   - more concurrency changes for video thumbnails (now half of the numImageProcessors config)
+   - 15s timeout added to preview api
+   - preview operations are cancelled if api request is terminated.
+   - reduced io overhead for video previews
+   - you can now disable individual video file previews system wide at server config level (all enabled by default)
+
+ **BugFixes**:
+ - video plyr dark mode style issue where buttons are black instead of white
+ - error when running without a config file #1280
+ - Issue persist in 0.8.7 with Access Management #1282
+ - all static resources go through /public/static url to fix logout loop #995
+ - "realtime" Permission of API keys is not working #1141
+ - "Path not found" when trying to share a file or folder inside a sub-directory #1139
+ - logout path redirect not working
+ - 2FA secret error #1305
+ - console errors during login/logout
+ - fix scoped user share creation issue #1309
+ - share close button and navigation issues.
+ - OnlyOffice source not found when opening shared file #1285
+ - user scoped onlyoffice error saving files with Onlyoffice #1068
+
+## v0.8.7-beta
+
+ **New Features**:
+ - json logging format support
+
+ **Notes**:
+ - increased overall file size limit to retrieve metadata from 50MB to 300MB #1234
+ - document previews don't show up as folder previews.
+
+ **BugFixes**:
+ - Fix directories empty issue when disableIndexing is true #1249
+ - OIDC to Authentik behind CloudFlare with Bot Fight turned on triggers a JS challenge #1165
+ - OIDC Auth - loop with expired token #995
+ - We lost the ability for download all? #1250
+ - Directories are all empty when disableIndexing is true #1248
+ - Access Management: issues on the shared folder when there's a sub folder #1208
+ - user preferences for individual preview file types not getting respected (disable/enable office,image,video)
+ - High server load when browsing folders with .mkv files #1259
+ - 2FA can not be disabled with non-admin user #1244
+ - 2FA not working on login #1243
+ - Thumbnails of .m4a, .flac, and .opus are not displaying #1234
+ - creating files/folders with same name overwrite each other #1242
+
+## v0.8.6-beta
+
+ **Notes**:
+ - Please remove `indexAbumArt` config option from your config: it has been deprecated... I found a way to detect album art without impacting indexing performance -- so its default behavior.
+ - Download button should be invisible before password input #1162
+ - opus files / opus files detected wrongly #1164
+ - changed autoplay behavior on plyr to not start playing if blocked instead of playing muted.
+ - QR-Code disappearing / sliding out from shared link #1155
+ - audio player matches dark/light mode better
+
+ **BugFixes**:
+ - Copy/Move index update changes to be more thorough and update album artwork #1220 #1219
+ - fix preview related issues #1225 #1223
+ - Scrollbar missing on user-edit-prompt in v0.8.5-beta #1221
+ - copy share download link inconsistency #1207
+ - fixed some onlyoffice related issues #1192 #1068
+ - Creating a file, then a folder with the same name makes the folder unusable #1167
+ - fix plyr issue switching from video to audio via next/previous button.
+
+## v0.8.5-beta
+
+ **New Features**:
+ - backend media metadata processing
+   - significantly improved performance
+   - album artwork shows in listing view as preview thumbnail Album art thumbnail: display embedded covers of mp3/flac files #925
+   - folders can show album art if enabled with indexing `server.sources.config.indexAlbumArt:true`
+   - removed need for frontend dependancies.
+ - optional thumbnail support for folders -- uses first child item with thumbnail as cover. Useful in combination with album metadata support to show album covers for folders with music.
+ - Remember folder view type (and sorting) for each folder #966
+ - heic is supported in viewer (via ffmpeg conversion) when on non-safari browser. This can be enabled via `integrations.ffmpeg.convert.impagePreview.heic: true` #1191
+ - OnlyOffice: Add option to open documents in viewer mode (`integrations.office.viewOnly`) #1193
+ - Exclude folders and file names 'starting with' or wildcard option #1054
+ - added better info for failed uploads #1050
+ - upload prompt "clear completed" can be changed to "clear all" in uploads & downloads settings to clear error and conflict states as well. #1128
+ - share 'default view mode' option #1212
+ - Universal Next/Previous buttons
+   - available for all listing items (including office/markdown etc)
+   - remembers sort order from parent directory
+   - new "Quick Jump" prompt if you drag the next/previous icons. This shows other files available to "jump" directly to quickly.
+
+ **Notes**:
+ - Added more tests to ensure new features work in future.
+ - caching for preview images is md5 based. Moved, renamed, or duplicate images don't get re-generated. Same album artwork shares cache.
+ - Hide @eaDir folder by default #1212
+ - defaults to hide "@eadir" folders (common for synology) #1212
+ - After move/copy, ability to move to the destination folder #999
+
+ **BugFixes**:
+ - Access Management: issue with access settings #1195
+ - fix shutdown panic related to sse connection
+ - Custom theming not working in 0.8.4 beta #1204
+ - Config Viewer not working #1189
+ - "Path not found" when trying to share a file or folder inside a sub-directory #1139
+ - files containing "+" in share issue #1089
+
+## v0.8.4-beta
+
+ **New Features**:
+ - New media player styles and features
+   - Custom Media Player: enhanced media player using plyr thanks @Kurami32 (see #1160)
+   - Custom Media Player: also adds support for metadata
+   - added embeded video subtitle support (for both native and custom player). @maxbin123 #1072 #1157
+   - Users can disable the customer player and opt of native in profile settings.
+ - Option to disable backend update check via `server.disableUpdateCheck` #1134
+ - added `frontend.favicon` and `frontend.description` for html overrides
+ - onlyoffice is now supported in shares. Both viewing and editing can be configured per-share.
+ - Added only office debug view and wiki to assist with debugging issues #1068 #911 #1074
+ - Dark mode enforcement possible for shared links #1029
+ - added `System & Admin` section to settings
+   - includes a new config viewer to see current running config (hides secrets) #838
+ - added `server.minSearchLength` to allow adjusting the length requirement for search #1174
+
+ **Notes**:
+ - access management: specific folders/files with access are shown instead permission denied for parent folder
+ - navigation no longer appends last location hash which should fix some unwanted navation behavior #1070
+ - altered the context menu style and behavior.
+ - documentation update: comma or Space separated extensions #1138
+ - Files and folders can be created with "/" or "\" on the name #1126
+ - Share management should not be allowed without authentication #1163
+ - Question about customizing session timeout #1184
+
+ **BugFixes**:
+ - access management: delay showing rule changes in the list fixed. #1131
+ - Color names are not localized #1159
+ - rename issues #1170 #1171
+ - some shortcuts not working #1056
+ - Can't copy/paste text on mobile #1168
+ - Can't change between images inside of the share image viewer. #1144
+ - fixed and updated translations with variables always showing english.
+
+## v0.8.3-beta
+
+ **BugFixes**:
+ - fixed search bar style bug in mobile #1147
+
+## v0.8.2-beta
+
+ **New Features**:
+ - added `source.config.denyByDefault` configuration to enable a deny-by-default access rule. A source enabled with this will deny access unless an "allow" rule was specifically created. (Similar to creating a root-level denyAll rule)
+ - allow oidc user source access and permission based on username and groups is fulfilled by denyByDefault source with access rules https://github.com/gtsteffaniak/filebrowser/issues/824
+ - "open parent folder" in context menu and search results https://github.com/gtsteffaniak/filebrowser/issues/1121
+ - added friendly "share not found" page.
+
+ **Notes**:
+ - 8.0 ffmpeg version bundled with docker
+ - go 1.25 upgrade with green tea GC enabled
+ - totp secrets accept non-secure strings, only throwing warning
+ - adjusted download limit so it also counts viewing text "content" of files (like in editor). You can also "disable file viewing" to stop the editor from showing. lower quality file image previews are not counted as downloads.
+ - updated invalid share message to be more clear https://github.com/gtsteffaniak/filebrowser/issues/1120
+
+ **BugFixes**:
+ - fixed /public/static routes issue
+ - shares redirect to login - https://github.com/gtsteffaniak/filebrowser/issues/1109
+ - some static assets not available to anonymous user - https://github.com/gtsteffaniak/filebrowser/issues/1102
+ - more safari style issues https://github.com/gtsteffaniak/filebrowser/issues/1110
+ - fix public share download issues https://github.com/gtsteffaniak/filebrowser/issues/1118 https://github.com/gtsteffaniak/filebrowser/issues/1089
+ - fixed disable file viewer setting and enforced on backend
+
 ## v0.8.1-beta
 
  **New Features**:

CONTRIBUTING.md

@@ -4,19 +4,19 @@ Thank you for your interest in contributing to FileBrowser Quantum! This guide w
 
 ## Prerequisites
 
-- **Go 1.24+** (see `backend/go.mod`)
-- **Node.js 18.0.0+** with npm 7.0.0+ (see `frontend/package.json`)
+- **Go 1.25+** (see `backend/go.mod`)
+- **Node.js 20.0.0+** with npm 9.0.0+ (see `frontend/package.json`)
 - **Docker** (optional, for containerized development)
-- **Git**
+- **Git** especially improtant on windows -- needed for bash support.
 
-### Required Tools
+### Optional Tools
 
-- **ffmpeg**: Required for video thumbnail generation
+- **ffmpeg**: For media features (subtitles, thumbnails, heic)
   - Ubuntu/Debian: `sudo apt-get install ffmpeg`
   - macOS: `brew install ffmpeg`
   - Windows: Download from [ffmpeg.org](https://ffmpeg.org/download.html)
 
-- **mupdf-tools**: Required for PDF preview generation
+- **mupdf-tools**: For PDF preview generation
   - Ubuntu/Debian: `sudo apt-get install mupdf-tools`
   - macOS: `brew install mupdf-tools`
   - Windows: Download from [mupdf.com](https://mupdf.com/downloads/)
@@ -31,8 +31,8 @@ cd filebrowser
 # 2. Initial setup - installs dependencies and creates test config
 make setup
 
-# 3. Run in development mode
-make run
+# 3. Run in development mode with hot-reloading
+make dev
 ```
 
 `make setup` installs all dependencies and creates a test configuration file.
@@ -52,14 +52,14 @@ make run
 - **Framework**: Vue 3 + Vite + TypeScript
 - **State**: Custom store in `frontend/src/store/`
 - **API Client**: Axios-based in `frontend/src/api/`
-- **i18n**: 25+ languages with English as master
+- **i18n**: 25+ languages with English as main
 - **Components**: Feature-based organization
 
 ## Development Commands
 
 ### Essential Commands
 ```bash
-make run          # Start development server
+make dev          # Start development server with hot-reloading
 make test         # Run all tests
 make lint         # Check code quality
 make check-all    # Lint + tests
@@ -70,12 +70,12 @@ make build          # Build Docker image
 ```
 
 ### Frontend Development
+
+Note: consider using make commands above instead.
 ```bash
 cd frontend
-npm run dev       # Dev server with hot reload
 npm run lint:fix  # Auto-fix linting issues
-npm run typecheck # TypeScript validation
-npm run i18n:sync # Sync translations
+npm run i18n:sync # Sync translations changes
 ```
 
 ## Testing
@@ -128,12 +128,11 @@ make build-backend   # Build Go binary with embedded assets
 
 ### Docker
 ```bash
-make build       # Full image with ffmpeg (~200MB)
-make run-proxy   # Docker Compose with nginx proxy
+make build       # Full image with ffmpeg and muPDF
 ```
 
 ### Configuration
-- **Test Config**: `backend/test_config.yaml` Auto-generated after running `make setup` 
+- **Test Config**: `backend/test_config.yaml` Auto-generated after running `make setup`
 
 ## Contributing
 
@@ -141,7 +140,7 @@ make run-proxy   # Docker Compose with nginx proxy
 
 1. Fork and create a feature branch
 2. Make your changes following the code standards
-3. Run `make run` to build and run with your changes
+3. Run `make dev` to build and run with your changes. Supports hot-reloading frontend and backend changes.
 4. When ready, run `make check-all` to verify tests and linting
 5. Submit PR with a clear description
 
@@ -175,16 +174,6 @@ cd frontend && rm -rf node_modules && npm install
 cd backend && go mod tidy && go clean -modcache
 ```
 
-**Debugging:**
-```bash
-# Backend with debug logs
-cd backend
-FILEBROWSER_NO_EMBEDDED=true go run -tags mupdf . -c test_config.yaml --log-level debug
-
-# API documentation
-# Visit /swagger endpoint when running
-```
-
 **Authentication Issues:**
 
 Always first enable debug logging in your config file if you have issues.

README.md

@@ -2,58 +2,59 @@
 
   [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
   [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
-  [![latest version](https://img.shields.io/github/release/gtsteffaniak/filebrowser/all.svg)](https://github.com/gtsteffaniak/filebrowser/releases)
+  [![latest version](https://img.shields.io/github/v/release/gtsteffaniak/filebrowser)](https://github.com/gtsteffaniak/filebrowser/releases)
   [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
   [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
 
   [![Donate](https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif)](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A#is-there-a-way-to-donate-or-support-this-project)
 
-  <img width="150" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" title="Logo">
+  <img width="150" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" title="Logo">
   <h3>FileBrowser Quantum</h3>
   The best free self-hosted web-based file manager.
   <br/><br/>
-  <img width="800" src="https://github.com/user-attachments/assets/95af22fa-7760-4f7b-9c20-51fdcfe8f4ea" title="Main Screenshot">
+  <img width="800" src="https://github.com/user-attachments/assets/162d7a95-33b7-49bd-976c-dd6822c0d22b">
 </div>
 
-> [!WARNING]
-> There is no stable version -- :construction: planned for 2025. ([Read more](https://github.com/gtsteffaniak/filebrowser/discussions/628))
+## Pinned
 
-[FYI: how much RAM does it require?](https://github.com/gtsteffaniak/filebrowser/discussions/787)
+:loudspeaker: [What's Coming Soon](https://github.com/gtsteffaniak/filebrowser/discussions/1622)
+
+:pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)
 
 ## About
 
-FileBrowser Quantum provides an easy way to access and manage your files from the web. It has has a modern responsive interface that has many advanced features to manage users, access, sharing, and file preview and editing.
+FileBrowser Quantum provides an easy way to access and manage your files from the web. It has a modern responsive interface that has many advanced features to manage users, access, sharing, and file preview and editing.
 
 This version is called "Quantum" because it packs tons of advanced features into a tiny easy to run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
 
 The goal for this repo is to become the best open-source self-hosted file browsing application that exists -- **all for free**. This repo will always be free and open-source.
 
-Ready to try it out? See [Getting Started Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Getting-Started).
+Ready to try it out? See [Getting Started Docs](https://filebrowserquantum.com/en/docs/getting-started/).
 
 ## How its different
 
 FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:
 
-  1. ✅ Multiple sources support
+  1. ✅ Add and configure multiple sources
   2. ✅ Login support for OIDC, password + 2FA, and proxy.
   3. ✅ Beautiful, Responsive, and Customizable user interface.
-  4. ✅ Simplified configuration via `config.yaml` config file.
+  4. ✅ Streamlined configuration via `config.yaml` config file.
   5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
      - Real-time search results as you type.
      - Real-time monitoring and updates in the UI.
      - Search supports file and folder sizes, along with various filters.
   6. ✅ Better listing browsing
-     - More file type previews, such as **office** and **video** file previews
-     - Instantly switches view modes and sort order without reloading data.
-     - Folder sizes are displayed.
+     - Better thumbnail support including **office**, **video**, and **album artwork**
+     - Faster and more responsive views with animations.
+     - Folder sizes are displayed and support for thumbnails
      - Navigating remembers the last scroll position.
-  7. ✅ Highly configurable and customizable sharing options, incuding:
+  7. ✅ Highly configurable and customizable sharing options
      - share expiration time
      - users who can access share (including anonymous)
      - styling and themes
      - file viewing, editing, and uploading permissions
   8. ✅ Directory-level access control that can be scoped to user or group.
-  8. ✅ Developer API support
+  9. ✅ Developer API support
      - Ability to create long-lived API Tokens.
      - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.
 
@@ -62,10 +63,15 @@ Notable features that this fork *does not* have (removed):
  - :construction: jobs are not supported yet.
  - ❌ shell commands are completely removed and will not be returned.
 
+FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.
+
+## System Requirements
+
 > [!WARNING]
 > Every file and directory in the source gets indexed (by default). This enables powerful features such as instant search, but large source filesystems can increase your system requirements. [See indexing wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) for more info.
 
-FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.
+ - **Memory**: depends on configured source complexity. See [how much RAM does it require?](https://github.com/gtsteffaniak/filebrowser/discussions/787)
+ - **GPU**: Not currently used (planned)
 
 ## The UI
 
@@ -84,49 +90,26 @@ a pop-up menu.
   <img width="1000" src="https://github.com/user-attachments/assets/aa32b05c-f917-47bb-b07f-857edc5e47f7" title="Search GIF">
 </p>
 
-## Install and Configuration
+## Official Docs
 
-Check out the [Getting Started Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Getting-Started)
-
-For help configuring your filebrowser see [Configuration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration-And-Examples)
-
-## Command Line Usage
-
-See the [CLI Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/CLI)
-
-## API Usage
-
-See the [API Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/API)
-
-## Office File Support
-
-See [Office Support Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Office-Support#adding-open-office-integration-for-docker) on how to enable office file editing and office-related features.
-
-## Migration from the original filebrowser
-
-See the [Migration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Migration)
-
-## Other Questions
-
-For more, see the [Q&A Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A)
+See the [Official Docs](https://filebrowserquantum.com/). Contributions are welcome and encouraged! See [FilebrowserDocs Github](https://github.com/quantumx-apps/filebrowserDocs).
 
 ## Comparison Chart
-
- Application Name | <img width="48" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
+Application Name | <img width="48" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
 --- | --- | --- | --- | --- | --- | --- |
 Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Windows                       | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Self hostable                 | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Has Stable Release?           | :construction: | ✅ | ✅ | ✅ | ✅ | ✅ |
+Has Stable Release?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
-webdav support                | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
+webdav support                | :warning:* | ❌ | ✅ | ✅ | ❌ | ✅ |
 FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Dedicated docs site?          | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
+Dedicated docs site?          | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Docker image size             | 180 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
-Min. Memory Requirements      | 256 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
+Min. Memory Requirements      | 512 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
 has standalone binary         | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
 price                         | free | free | free | free tier | free tier | $99+ |
 rich media preview            | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
@@ -163,3 +146,5 @@ Can browse archive files      | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
 Can convert documents         | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
 Can convert videos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
 Can convert photos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
+
+*Accessing files from FileBrowser via WebDav is a newly introduced and experimental feature.

_docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM gtstef/ffmpeg:7.1.1-decode AS ffmpeg
+FROM gtstef/ffmpeg:8.0.1-decode AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION
@@ -12,33 +12,40 @@ RUN go build -tags mupdf,musl -ldflags="-w -s \
   -o filebrowser .
 RUN upx filebrowser
 
-FROM node:lts-slim AS nbuild
+FROM node:jod-slim AS nbuild
 WORKDIR /app
 COPY ./frontend/package.json ./
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
+    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
 RUN npm i --maxsockets 1
 COPY  ./frontend/ ./
-RUN npm run build-docker
+RUN npm run build:docker
 
 FROM alpine:latest
 COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
 ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
 ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
-ENV FILEBROWSER_NO_EMBEDED="true"
+ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
 ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata
+RUN apk --no-cache add ca-certificates mailcap tzdata curl exiftool
 RUN adduser -D -s /bin/true -u 1000 filebrowser
 USER filebrowser
 WORKDIR /home/filebrowser
 # copy config to two locations for compatibility
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "/app/config.yaml", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
 COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 RUN [ "ffmpeg", "-version" ]
 RUN [ "ffprobe", "-version" ]
+RUN [ "exiftool", "-ver" ]
 USER root
 # exposing default port for auto discovery.
 EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:80/health || exit 1
 ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-general

@@ -1,4 +1,4 @@
-FROM gtstef/playwright-base
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
 WORKDIR /app
 
 # Copy setup scripts first to leverage caching
@@ -10,9 +10,11 @@ COPY [ "./frontend/tests/", "./tests" ]
 
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser*", "./"]
+COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
 RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]
 
 # Run tests
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser set -u testuser1,testuser1
-RUN FILEBROWSER_NO_EMBEDED=true ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-no-config

@@ -0,0 +1,18 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/no-config/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./_docker/src/no-config/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-noauth

@@ -1,4 +1,4 @@
-FROM gtstef/playwright-base
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
 WORKDIR /app
 
 # Copy setup scripts first to leverage caching
@@ -6,6 +6,7 @@ COPY [ "./_docker/src/noauth/", "./" ]
 
 WORKDIR /app/frontend
 COPY [ "./frontend/tests", "./tests" ]
+COPY [ "./frontend/tests/playwright-files", "./tests/playwright-files2" ]
 
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
@@ -13,4 +14,5 @@ RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]
 
 # Run tests
-RUN  FILEBROWSER_NO_EMBEDED=true ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-oidc

@@ -1,4 +1,4 @@
-FROM gtstef/playwright-base
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
 
 COPY [ "./_docker/src/oidc/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]
@@ -8,6 +8,8 @@ RUN mkdir -p ./http/dist
 COPY [ "./_docker/src/oidc/backend/", "./"]
 COPY ["./backend/filebrowser", "./"]
 COPY [ "./backend/http/embed/", "./http/dist/"]
+
 # Run tests
 WORKDIR /app/frontend
-RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && FILEBROWSER_NO_EMBEDED=true ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-proxy

@@ -1,4 +1,4 @@
-FROM gtstef/playwright-base
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
 WORKDIR /app
 COPY [ "./_docker/src/proxy/", "./" ]
 WORKDIR /app/frontend
@@ -9,5 +9,7 @@ RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
+RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
 RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
-RUN nginx & FILEBROWSER_NO_EMBEDED=true ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-settings

@@ -0,0 +1,22 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/settings/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./_docker/src/settings/frontend/", "./" ]
+COPY [ "./frontend/tests/", "./tests" ]
+COPY [ "./frontend/tests/playwright-files", "/tests/playwright-files" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN ./filebrowser set -u testuser1,testuser1
+RUN ./filebrowser set rule -f /tests/playwright-files -p / -r user -v admin -allow -c config.yaml
+RUN ./filebrowser set rule -f /tests/playwright-files -p /excluded -r user -v admin -c config.yaml

_docker/Dockerfile.playwright-sharing

@@ -1,4 +1,4 @@
-FROM gtstef/playwright-base
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
 WORKDIR /app
 
 # Copy setup scripts first to leverage caching
@@ -14,4 +14,5 @@ RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]
 
 # Run tests
-RUN FILEBROWSER_NO_EMBEDED=true ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.primecache

@@ -1 +1 @@
-FROM gtstef/playwright-base
+FROM ghcr.io/gtsteffaniak/playwright-base:latest

_docker/Dockerfile.slim

@@ -10,23 +10,27 @@ RUN go build -ldflags="-w -s \
   -o filebrowser .
 RUN upx filebrowser
 
-FROM node:lts-slim AS nbuild
+FROM node:jod-slim AS nbuild
 WORKDIR /app
 COPY ./frontend/package.json ./
-RUN npm i --maxsockets 1
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
+    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
+RUN npm i
 COPY  ./frontend/ ./
-RUN npm run build-docker
+RUN npm run build:docker
 
 FROM alpine:latest
-ENV FILEBROWSER_NO_EMBEDED="true"
 ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
+ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
 ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata
+RUN apk --no-cache add ca-certificates mailcap tzdata curl
 RUN adduser -D -s /bin/true -u 1000 filebrowser
 USER filebrowser
 WORKDIR /home/filebrowser
 COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
 COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
@@ -34,4 +38,6 @@ RUN [ "filebrowser", "version" ]
 USER root
 # exposing default port for auto discovery.
 EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:80/health || exit 1
 ENTRYPOINT [ "./filebrowser" ]

_docker/docker-compose.yaml

@@ -6,6 +6,7 @@ services:
       - "80:80"
     volumes:
       - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
+      - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
   filebrowser:
     hostname: filebrowser
     volumes:

_docker/src/general/backend/config.yaml

@@ -1,21 +1,15 @@
 server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        defaultEnabled: true
+  <<: *server-main
 frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
+  <<: *frontend-main
+
+userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
+  permissions:
+    download: true
+    create: true

_docker/src/general/backend/frontend-config.yaml

@@ -0,0 +1,13 @@
+frontend-main: &frontend-main
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  styling:
+    disableEventThemes: true
+    customThemes:
+      no-rounded:
+        description: "No rounded corners" # The description of the theme to display in the UI.
+        css: "no-rounded.css" # The css file path and filename to use for the theme.
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"

_docker/src/general/backend/server-config.yaml

@@ -0,0 +1,15 @@
+server-main: &server-main
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      name: "playwright + files"
+      config:
+        defaultEnabled: true
+    - path: "."
+      name: "docker"
+      config:
+        disableIndexing: true
+        defaultEnabled: true

_docker/src/no-config/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/no-config-setup",
+  timeout: 5000,
+  testDir: "./tests/playwright/no-config",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1,
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1/",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

_docker/src/noauth/backend/config.yaml

@@ -5,15 +5,43 @@ server:
     - levels: "info|error|debug"
   sources:
     - path: "../frontend/tests/playwright-files"
+      name: "exclude"
       config:
         defaultEnabled: true
-        exclude:
-          folderPaths:
-            - "excluded"
+        rules:
+          - folderPath: "excluded"
+          - folderPath: "excludedButVisible"
+            viewable: true
+          - fileStartsWith: "startsWith"
+          - fileName: "dontshow.txt"
+    - path: "../frontend/tests/playwright-files2"
+      name: "include"
+      config:
+        defaultEnabled: true
+        useLogicalSize: true
+        rules:
+          - includeRootItem: "myfolder"
+          - includeRootItem: "subfolderExclusions"
+          - includeRootItem: "folder#hash"
+          - includeRootItem: "files"
+          - filePath: "/subfolderExclusions/exclusionlist.sh"
+          - folderPath: "/subfolderExclusions/folderItem"
+            viewable: true
+        conditionals:
+          rules:
+            - fileStartsWith: "startsWith"
+            - folderEndsWith: "Folder"
+            - folderNames: 'folderNames'
+            - fileNames: 'fileNames'
+            - folderName: 'folderName'
+            - fileName: 'fileName'
+            - folderName: '.hiddenDir'
+            - fileName: '.hidden'
 
 auth:
   methods:
     noauth: true
+
 frontend:
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
@@ -21,6 +49,17 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
+  styling:
+    disableEventThemes: true
+
 userDefaults:
+  showHidden: true
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
   permissions:
-   realtime: true
+    download: true
+    create: true

_docker/src/oidc/backend/config.yaml

@@ -14,7 +14,8 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
-
+  styling:
+    disableEventThemes: true
 auth:
   methods:
     password:
@@ -28,6 +29,12 @@ auth:
       adminGroup: "Admins"
 
 userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
   darkMode: true
   disableSettings: false
   singleClick: false
@@ -35,4 +42,6 @@ userDefaults:
     admin: false
     modify: true
     share: false
-    api: false
+    api: false
+    download: true
+    create: true

_docker/src/proxy/backend/.htpasswd

@@ -0,0 +1 @@
+demo-127.0.0.1:$apr1$j5FRA4Bc$RYdNFuM7YAAo9Qtie8w4b/

_docker/src/proxy/backend/config.yaml

@@ -1,6 +1,6 @@
 server:
   port: 8080
-  baseURL:  "/"
+  baseURL:  "/subpath"
   logging:
     - levels: "info|error|debug"
   sources:
@@ -16,9 +16,12 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
-
+  styling:
+    disableEventThemes: true
 auth:
   methods:
+    password:
+      enabled: false
     proxy:
       enabled: true
       header: "X-Username"
@@ -26,11 +29,19 @@ auth:
       logoutRedirectUrl: "https://localhost/api/auth/logout2"
 
 userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
   darkMode: true
   disableSettings: false
   singleClick: false
   permissions:
     admin: false
     modify: true
-    share: false
-    api: false
+    share: true
+    api: false
+    download: true
+    create: true

_docker/src/proxy/backend/default.conf

@@ -7,13 +7,26 @@ server {
     listen 80;
     server_name localhost 127.0.0.1;
 
-    location / {
+    location /subpath/public/ {
+        proxy_pass http://filebrowser:8080/subpath/public/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Username $uuid;
+    }
+
+    # requires basic auth demo-127.0.0.1:SecurePass123!
+    location /subpath {
+        auth_basic "Restricted Access";
+        auth_basic_user_file /etc/nginx/conf.d/.htpasswd;
         proxy_set_header X-Username $uuid;
         add_header X-Username $uuid;
-        proxy_pass http://filebrowser:8080;
+        proxy_pass http://filebrowser:8080/subpath;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
 }

_docker/src/proxy/frontend/playwright.config.ts

@@ -10,8 +10,8 @@ import { defineConfig, devices } from "@playwright/test";
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-  //globalSetup: "./global-setup",
-  timeout: 3000,
+  globalSetup: "./tests/playwright/proxy-setup.ts",
+  timeout: 5000,
   testDir: "./tests/playwright/proxy",
   /* Run tests in files in parallel */
   fullyParallel: false,
@@ -25,8 +25,8 @@ export default defineConfig({
   reporter: "line",
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
-    actionTimeout: 3000,
-    //storageState: "loginAuth.json",
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
     /* Base URL to use in actions like `await page.goto('/')`. */
     baseURL: "http://127.0.0.1",
 

_docker/src/settings/backend/config.yaml

@@ -0,0 +1,38 @@
+server:
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      name: "playwright + files"
+      config:
+        defaultEnabled: true
+    - path: "."
+      name: "docker"
+      config:
+        disableIndexing: true
+        defaultEnabled: true
+    - path: "/tests/playwright-files"
+      name: "access"
+      config:
+        defaultEnabled: true
+        denyByDefault: true
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  styling:
+    disableEventThemes: true
+    customThemes:
+      no-rounded:
+        description: "No rounded corners" # The description of the theme to display in the UI.
+        css: "no-rounded.css" # The css file path and filename to use for the theme.
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+
+auth:
+  methods:
+    password:
+      signup: true

_docker/src/settings/frontend/playwright.config.ts

@@ -0,0 +1,47 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/global-setup",
+  timeout: 3000,
+  testDir: "./tests/playwright/settings",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 1,
+  /* Opt out of parallel tests on CI. */
+  workers: 1,
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1/",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+    },
+  ],
+});

_docker/src/sharing/backend/config.yaml

@@ -13,10 +13,13 @@ server:
       config:
         private: true
         defaultEnabled: true
+
 frontend:
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
   externalLinks:
     - text: "A playwright test"
       url: "https://playwright.dev/"
-      title: "Playwright"
+      title: "Playwright"
+  styling:
+    disableEventThemes: true

backend/.air.toml

@@ -0,0 +1,17 @@
+root = "."
+tmp_dir = "tmp"
+
+[build]
+  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=version'\" ."
+  bin = "tmp/filebrowser"
+  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser -c test_config.yaml"
+  include_ext = ["go", "tpl", "tmpl", "html"]
+  exclude_dir = ["tmp", "vendor", "http/dist", "http/embed", "swagger/docs", "preview/thumbnails", "preview/heic"]
+  log = "air.log"
+  delay = 1000 # ms
+
+[log]
+  time = true
+
+[misc]
+  clean_on_exit = false

backend/.air.windows.toml

@@ -0,0 +1,21 @@
+root = "."
+tmp_dir = "tmp"
+
+[build]
+  cmd = "go build -o ./tmp/filebrowser.exe --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=version'\" ."
+  bin = "tmp/filebrowser.exe"
+  args_bin = ["-c", "test_config.yaml"]
+  include_ext = ["go", "tpl", "tmpl", "html"]
+  exclude_dir = ["tmp", "vendor", "http\\dist", "http\\embed", "swagger\\docs"]
+  exclude_unchanged = true
+  follow_symlink = false
+  poll = true
+  poll_interval = 1000
+  log = "air.log"
+  delay = 1000 # ms
+
+[log]
+  time = true
+
+[misc]
+  clean_on_exit = false

backend/.gitignore

@@ -0,0 +1,6 @@
+tmp/
+air.log
+filebrowser
+generated.yaml
+test_config.yaml
+/data

backend/.goreleaser.yaml

@@ -104,7 +104,7 @@ archives:
       {{- else -}}
       {{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{.ProjectName}}
       {{- end -}}
-    format: binary
+    formats: [ 'binary' ]
 
 checksum:
   disable: true

backend/adapters/fs/diskcache/file_cache.go

@@ -2,7 +2,7 @@ package diskcache
 
 import (
 	"context"
-	"crypto/sha1" //nolint:gosec
+	"crypto/sha1"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -10,6 +10,9 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/go-logger/logger"
 )
 
 // Cache interface for caching operations
@@ -29,9 +32,61 @@ type FileCache struct {
 	}
 }
 
-// NewFileCache creates a new FileCache
 func NewFileCache(dir string) (*FileCache, error) {
-	return &FileCache{dir: dir}, nil
+	cacheDir := filepath.Join(dir, "diskcache")
+
+	// Migrate existing cache files from old structure (if any)
+	if err := migrateOldCacheStructure(dir, cacheDir); err != nil {
+		logger.Warningf("failed to migrate old cache structure: %v\n", err)
+	}
+
+	// Create the cache directory immediately with proper permissions
+	if err := os.MkdirAll(cacheDir, fileutils.PermDir); err != nil {
+		return nil, fmt.Errorf("failed to create cache directory: %w", err)
+	}
+	return &FileCache{dir: cacheDir}, nil
+}
+
+// migrateOldCacheStructure moves cache files from old structure (dir/a/...) to new structure (dir/diskcache/a/...)
+func migrateOldCacheStructure(oldDir, newDir string) error {
+	// Read the old cache directory
+	entries, err := os.ReadDir(oldDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil // Directory doesn't exist yet, nothing to migrate
+		}
+		return err
+	}
+
+	migrated := 0
+	for _, entry := range entries {
+		// Only migrate single-character directories (cache hash directories like a, b, c, etc.)
+		if !entry.IsDir() || len(entry.Name()) != 1 {
+			continue
+		}
+
+		// Skip if it's already the diskcache directory
+		if entry.Name() == "d" && filepath.Join(oldDir, entry.Name()) == newDir {
+			continue
+		}
+
+		oldPath := filepath.Join(oldDir, entry.Name())
+		newPath := filepath.Join(newDir, entry.Name())
+
+		// Create parent directory in new location
+		if err := os.MkdirAll(newDir, fileutils.PermDir); err != nil {
+			return err
+		}
+
+		// Move the directory
+		if err := os.Rename(oldPath, newPath); err != nil {
+			// If rename fails (e.g., cross-device), skip this one
+			continue
+		}
+		migrated++
+	}
+
+	return nil
 }
 
 func (f *FileCache) Store(ctx context.Context, key string, value []byte) error {
@@ -40,11 +95,11 @@ func (f *FileCache) Store(ctx context.Context, key string, value []byte) error {
 	defer mu.Unlock()
 
 	fileName := f.getFileName(key)
-	if err := os.MkdirAll(filepath.Dir(fileName), 0700); err != nil {
+	if err := os.MkdirAll(filepath.Dir(fileName), fileutils.PermDir); err != nil {
 		return err
 	}
 
-	if err := os.WriteFile(fileName, value, 0600); err != nil {
+	if err := os.WriteFile(fileName, value, fileutils.PermFile); err != nil {
 		return err
 	}
 
@@ -106,7 +161,7 @@ func (f *FileCache) getScopedLocks(key string) (lock sync.Locker) {
 }
 
 func (f *FileCache) getFileName(key string) string {
-	hasher := sha1.New() //nolint:gosec
+	hasher := sha1.New()
 	_, _ = hasher.Write([]byte(key))
 	hash := hex.EncodeToString(hasher.Sum(nil))
 	return filepath.Join(f.dir, fmt.Sprintf("%s/%s/%s", hash[:1], hash[1:3], hash))

backend/adapters/fs/diskcache/file_cache_test.go

@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/stretchr/testify/require"
 )
 
@@ -19,6 +20,9 @@ func TestFileCache(t *testing.T) {
 		cachedFilePath = "a/62/a62f2225bf70bfaccbc7f1ef2a397836717377de"
 	)
 
+	// Set up file permissions before creating cache
+	fileutils.SetFsPermissions(0644, 0755)
+
 	// Create temporary directory for the cache
 	cacheDir, err := os.MkdirTemp("", cacheRoot)
 	require.NoError(t, err)
@@ -28,19 +32,20 @@ func TestFileCache(t *testing.T) {
 	require.NoError(t, err)
 
 	// store new key
+	// Note: NewFileCache creates a "diskcache" subdirectory, so the actual path includes it
 	err = cache.Store(ctx, key, []byte(value))
 	require.NoError(t, err)
-	checkValue(t, ctx, cache, filepath.Join(cacheDir, cachedFilePath), key, value)
+	checkValue(t, ctx, cache, filepath.Join(cacheDir, "diskcache", cachedFilePath), key, value)
 
 	// update existing key
 	err = cache.Store(ctx, key, []byte(newValue))
 	require.NoError(t, err)
-	checkValue(t, ctx, cache, filepath.Join(cacheDir, cachedFilePath), key, newValue)
+	checkValue(t, ctx, cache, filepath.Join(cacheDir, "diskcache", cachedFilePath), key, newValue)
 
 	// delete key
 	err = cache.Delete(ctx, key)
 	require.NoError(t, err)
-	exists := fileExists(filepath.Join(cacheDir, cachedFilePath))
+	exists := fileExists(filepath.Join(cacheDir, "diskcache", cachedFilePath))
 	require.False(t, exists)
 }
 

backend/adapters/fs/files/content_test.go

@@ -0,0 +1,138 @@
+package files
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"unicode/utf8"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetContent_UTF8Truncation(t *testing.T) {
+	// Get the path to the test file
+	// The test file is in frontend/tests/playwright-files/utf8-truncated.txt
+	// We need to find it relative to the test execution directory
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	// Navigate from backend/adapters/fs/files to the project root
+	// backend/adapters/fs/files -> backend/adapters/fs -> backend/adapters -> backend -> root
+	testFilePath := filepath.Join(cwd, "..", "..", "..", "..", "frontend", "tests", "playwright-files", "utf8-truncated.txt")
+
+	// Check if file exists, if not try alternative path
+	if _, err = os.Stat(testFilePath); os.IsNotExist(err) {
+		// Try from project root
+		testFilePath = filepath.Join("frontend", "tests", "playwright-files", "utf8-truncated.txt")
+		if _, err = os.Stat(testFilePath); os.IsNotExist(err) {
+			t.Skipf("Test file not found at %s, skipping test", testFilePath)
+			return
+		}
+	}
+
+	// Get absolute path
+	var absPath string
+	absPath, err = filepath.Abs(testFilePath)
+	require.NoError(t, err)
+
+	t.Run("file with UTF-8 truncation at 4096 byte boundary", func(t *testing.T) {
+		// The test file is longer than 4096 bytes, with valid UTF-8 throughout.
+		// However, when reading exactly 4096 bytes as a header, it cuts off in the
+		// middle of a multi-byte UTF-8 sequence (e6 9c, missing the last byte 88 of '月').
+		// This should trigger the truncation handling in getContent's header validation.
+		// The fix should trim the incomplete sequence from the header, allowing the
+		// header check to pass, and then the full file (which is valid UTF-8) should
+		// pass the full file validation.
+		content, err := getContent(absPath)
+
+		// Should not return an error - the header truncation is handled, and the full file is valid
+		require.NoError(t, err)
+
+		// The content should be the full valid UTF-8 file
+		require.NotEmpty(t, content, "Content should not be empty - full file is valid UTF-8")
+
+		// Verify it contains the expected text
+		require.Contains(t, content, "文件已备份", "Content should contain Chinese characters")
+		require.Contains(t, content, "2024年", "Content should contain date information")
+	})
+
+	t.Run("regular UTF-8 text file", func(t *testing.T) {
+		// Test with a simple text file to ensure normal files still work
+		tmpFile, err := os.CreateTemp("", "test-utf8-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tmpFile.Name())
+		defer tmpFile.Close()
+
+		testText := "Hello, 世界! This is a test file with UTF-8 characters.\n"
+		_, err = tmpFile.WriteString(testText)
+		require.NoError(t, err)
+		tmpFile.Close()
+
+		content, err := getContent(tmpFile.Name())
+		require.NoError(t, err)
+		require.Equal(t, testText, content)
+	})
+
+	t.Run("file smaller than header size", func(t *testing.T) {
+		// Test with a file smaller than 4096 bytes
+		tmpFile, err := os.CreateTemp("", "test-small-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tmpFile.Name())
+		defer tmpFile.Close()
+
+		testText := "Small file content"
+		_, err = tmpFile.WriteString(testText)
+		require.NoError(t, err)
+		tmpFile.Close()
+
+		content, err := getContent(tmpFile.Name())
+		require.NoError(t, err)
+		require.Equal(t, testText, content)
+	})
+
+	t.Run("file with Chinese characters at boundary", func(t *testing.T) {
+		// Create a file that's exactly 4094 bytes, ending with a complete Chinese character
+		tmpFile, err := os.CreateTemp("", "test-chinese-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tmpFile.Name())
+		defer tmpFile.Close()
+
+		// Create content that's exactly 4094 bytes, ending with complete UTF-8
+		baseText := "2024年 06月 17日 星期一 04:05:58 CST 文件已备份\n"
+		content := ""
+		for len([]byte(content)) < 4094 {
+			content += baseText
+		}
+		// Trim to exactly 4094 bytes
+		encoded := []byte(content)
+		if len(encoded) > 4094 {
+			encoded = encoded[:4094]
+		}
+		// Ensure it ends with a complete character by finding the last complete rune
+		for len(encoded) > 0 {
+			lastRune, _ := decodeLastRune(encoded)
+			if lastRune != 0xFFFD { // RuneError
+				break
+			}
+			encoded = encoded[:len(encoded)-1]
+		}
+
+		_, err = tmpFile.Write(encoded)
+		require.NoError(t, err)
+		tmpFile.Close()
+
+		result, err := getContent(tmpFile.Name())
+		require.NoError(t, err)
+		require.NotEmpty(t, result)
+		require.Equal(t, string(encoded), result)
+	})
+}
+
+// Helper function to check if last rune is valid
+func decodeLastRune(p []byte) (rune, int) {
+	if len(p) == 0 {
+		return 0, 0
+	}
+	r, size := utf8.DecodeLastRune(p)
+	return r, size
+}

backend/adapters/fs/files/file_test.go

@@ -6,8 +6,11 @@ import (
 	"reflect"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	dbsql "github.com/gtsteffaniak/filebrowser/backend/database/sql"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )
@@ -98,11 +101,11 @@ func TestSortItems(t *testing.T) {
 					{Name: "apple"},
 					{Name: "Banana"},
 				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "File2.txt"},
-					{Name: "File10.txt"},
-					{Name: "File1"},
-					{Name: "banana"},
+				Files: []iteminfo.ExtendedItemInfo{
+					{ItemInfo: iteminfo.ItemInfo{Name: "File2.txt"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File10.txt"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File1"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "banana"}},
 				},
 			},
 			expected: iteminfo.FileInfo{
@@ -112,11 +115,11 @@ func TestSortItems(t *testing.T) {
 					{Name: "apple"},
 					{Name: "Banana"},
 				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "banana"},
-					{Name: "File1"},
-					{Name: "File10.txt"},
-					{Name: "File2.txt"},
+				Files: []iteminfo.ExtendedItemInfo{
+					{ItemInfo: iteminfo.ItemInfo{Name: "banana"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File1"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File10.txt"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "File2.txt"}},
 				},
 			},
 		},
@@ -128,10 +131,10 @@ func TestSortItems(t *testing.T) {
 					{Name: "Cat.txt"},
 					{Name: "apple"},
 				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "Zebra"},
-					{Name: "apple"},
-					{Name: "cat"},
+				Files: []iteminfo.ExtendedItemInfo{
+					{ItemInfo: iteminfo.ItemInfo{Name: "Zebra"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "apple"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "cat"}},
 				},
 			},
 			expected: iteminfo.FileInfo{
@@ -140,10 +143,10 @@ func TestSortItems(t *testing.T) {
 					{Name: "Cat.txt"},
 					{Name: "dog.txt"},
 				},
-				Files: []iteminfo.ItemInfo{
-					{Name: "apple"},
-					{Name: "cat"},
-					{Name: "Zebra"},
+				Files: []iteminfo.ExtendedItemInfo{
+					{ItemInfo: iteminfo.ItemInfo{Name: "apple"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "cat"}},
+					{ItemInfo: iteminfo.ItemInfo{Name: "Zebra"}},
 				},
 			},
 		},
@@ -153,7 +156,7 @@ func TestSortItems(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			test.input.SortItems()
 
-			getNames := func(items []iteminfo.ItemInfo) []string {
+			getFolderNames := func(items []iteminfo.ItemInfo) []string {
 				names := []string{}
 				for _, folder := range items {
 					names = append(names, folder.Name)
@@ -161,15 +164,23 @@ func TestSortItems(t *testing.T) {
 				return names
 			}
 
-			actualFolderNames := getNames(test.input.Folders)
-			expectedFolderNames := getNames(test.expected.Folders)
+			getFileNames := func(items []iteminfo.ExtendedItemInfo) []string {
+				names := []string{}
+				for _, file := range items {
+					names = append(names, file.Name)
+				}
+				return names
+			}
+
+			actualFolderNames := getFolderNames(test.input.Folders)
+			expectedFolderNames := getFolderNames(test.expected.Folders)
 
 			if !reflect.DeepEqual(actualFolderNames, expectedFolderNames) {
 				t.Errorf("Folders not sorted correctly.\nGot: %v\nExpected: %v", actualFolderNames, expectedFolderNames)
 			}
 
-			actualFileNames := getNames(test.input.Files)
-			expectedFileNames := getNames(test.expected.Files)
+			actualFileNames := getFileNames(test.input.Files)
+			expectedFileNames := getFileNames(test.expected.Files)
 
 			if !reflect.DeepEqual(actualFileNames, expectedFileNames) {
 				t.Errorf("Files not sorted correctly.\nGot: %v\nExpected: %v", actualFileNames, expectedFileNames)
@@ -177,3 +188,224 @@ func TestSortItems(t *testing.T) {
 		})
 	}
 }
+
+// TestDeleteFilesCacheClearing was removed because cache clearing is not performed
+// per design decision - RealPathCache is auxiliary and doesn't need clearing
+
+func TestOverrideDirectoryToFile(t *testing.T) {
+	// Use a temporary directory for cache to avoid creating directories in the source tree
+	tmpDir := t.TempDir()
+	originalCacheDir := settings.Config.Server.CacheDir
+	settings.Config.Server.CacheDir = tmpDir
+	defer func() {
+		settings.Config.Server.CacheDir = originalCacheDir
+	}()
+
+	// Ensure fileutils permissions are set (needed by NewTempDB)
+	if fileutils.PermDir == 0 {
+		fileutils.SetFsPermissions(0644, 0755)
+	}
+
+	// Initialize the database first (use test helper to avoid permission issues)
+	if indexing.GetIndexDB() == nil {
+		db, _, err := dbsql.NewIndexDB("test_file", "OFF", 1000, 32, false)
+		if err != nil {
+			t.Fatalf("Failed to create test database: %v", err)
+		}
+		indexing.SetIndexDBForTesting(db)
+	}
+
+	// Initialize the index with scanning disabled to prevent background scanner interference
+	indexing.Initialize(&settings.Source{
+		Name: "test",
+		Path: "/mock/path",
+	}, true, false) // true for mock mode, false for isNewDb
+
+	// Get the index and set up mock data
+	idx := indexing.GetIndex("test")
+	if idx == nil { //nolint:staticcheck // t.Fatal terminates execution
+		t.Fatal("Failed to get test index")
+	}
+
+	// Wait for initial scanner to complete (it will fail on /mock/path but needs to finish cleanup)
+	// This ensures batchItems is nil before we start testing
+	for i := 0; i < 50; i++ { // Wait up to 500ms
+		time.Sleep(10 * time.Millisecond)
+		status := idx.GetScannerStatus()
+		if status["status"] == "ready" || status["status"] == "unavailable" {
+			break
+		}
+	}
+
+	// Create mock directory structure using UpdateMetadata
+	rootInfo := &iteminfo.FileInfo{
+		Path: "/",
+		ItemInfo: iteminfo.ItemInfo{
+			Name: "/",
+			Type: "directory",
+		},
+		Folders: []iteminfo.ItemInfo{
+			{Name: "Test Object", Type: "directory"},
+		},
+	}
+	idx.UpdateMetadata(rootInfo, nil) // nil scanner for test
+
+	// Delete the old directory item from the database before replacing it with a file
+	idx.DeleteMetadata("/Test Object", true, false)
+
+	// Simulate the directory-to-file override by updating the mock data
+	// Remove the directory from the parent's Folders slice
+	rootInfo.Folders = []iteminfo.ItemInfo{} // Clear folders
+
+	// Add the file to the parent's Files slice
+	rootInfo.Files = []iteminfo.ExtendedItemInfo{
+		{
+			ItemInfo: iteminfo.ItemInfo{
+				Name: "Test Object",
+				Size: 25, // Length of "This is test file content"
+			},
+		},
+	}
+	idx.UpdateMetadata(rootInfo, nil) // nil scanner for test
+
+	// Verify the directory was replaced with a file in the mock data
+	rootInfo, exists := idx.GetMetadataInfo("/", true, false)
+	if !exists {
+		t.Fatal("Root metadata not found")
+	}
+
+	// Check that the directory was removed from Folders
+	foundDir := false
+	for _, folder := range rootInfo.Folders {
+		if folder.Name == "Test Object" {
+			foundDir = true
+			break
+		}
+	}
+	if foundDir {
+		t.Error("Directory 'Test Object' should have been removed from Folders")
+	}
+
+	// Check that the file was added to Files
+	foundFile := false
+	for _, file := range rootInfo.Files {
+		if file.Name == "Test Object" {
+			foundFile = true
+			if file.Size != 25 {
+				t.Errorf("Expected file size 25, got %d", file.Size)
+			}
+			break
+		}
+	}
+	if !foundFile {
+		t.Error("File 'Test Object' should have been added to Files")
+	}
+}
+
+func TestOverrideFileToDirectory(t *testing.T) {
+	// Use a temporary directory for cache to avoid creating directories in the source tree
+	tmpDir := t.TempDir()
+	originalCacheDir := settings.Config.Server.CacheDir
+	settings.Config.Server.CacheDir = tmpDir
+	defer func() {
+		settings.Config.Server.CacheDir = originalCacheDir
+	}()
+
+	// Ensure fileutils permissions are set (needed by NewTempDB)
+	if fileutils.PermDir == 0 {
+		fileutils.SetFsPermissions(0644, 0755)
+	}
+
+	// Initialize the database first (use test helper to avoid permission issues)
+	if indexing.GetIndexDB() == nil {
+		db, _, err := dbsql.NewIndexDB("test_file", "OFF", 1000, 32, false)
+		if err != nil {
+			t.Fatalf("Failed to create test database: %v", err)
+		}
+		indexing.SetIndexDBForTesting(db)
+	}
+
+	// Initialize the index in mock mode (no filesystem operations)
+	indexing.Initialize(&settings.Source{
+		Name: "test",
+		Path: "/mock/path",
+	}, true, false) // true for mock mode, false for isNewDb
+
+	// Get the index and set up mock data
+	idx := indexing.GetIndex("test")
+	if idx == nil { //nolint:staticcheck // t.Fatal terminates execution
+		t.Fatal("Failed to get test index")
+	}
+
+	// Wait for initial scanner to complete (it will fail on /mock/path but needs to finish cleanup)
+	// This ensures batchItems is nil before we start testing
+	for i := 0; i < 50; i++ { // Wait up to 500ms
+		time.Sleep(10 * time.Millisecond)
+		status := idx.GetScannerStatus()
+		if status["status"] == "ready" || status["status"] == "unavailable" {
+			break
+		}
+	}
+
+	// Create mock directory structure with a file using UpdateMetadata
+	rootInfo := &iteminfo.FileInfo{
+		Path: "/",
+		ItemInfo: iteminfo.ItemInfo{
+			Name: "/",
+			Type: "directory",
+		},
+		Files: []iteminfo.ExtendedItemInfo{
+			{ItemInfo: iteminfo.ItemInfo{Name: "Test Object", Size: 12}}, // Length of "test content"
+		},
+	}
+	idx.UpdateMetadata(rootInfo, nil) // nil scanner for test
+
+	// Delete the old file item from the database before replacing it with a directory
+	idx.DeleteMetadata("/Test Object", false, false)
+
+	// Simulate the file-to-directory override by updating the mock data
+	// Remove the file from the parent's Files slice
+	rootInfo.Files = []iteminfo.ExtendedItemInfo{} // Clear files
+
+	// Add the directory to the parent's Folders slice
+	rootInfo.Folders = []iteminfo.ItemInfo{
+		{
+			Name: "Test Object",
+			Type: "directory",
+		},
+	}
+	idx.UpdateMetadata(rootInfo, nil) // nil scanner for test
+
+	// Verify the file was replaced with a directory in the mock data
+	rootInfo, exists := idx.GetMetadataInfo("/", true, false)
+	if !exists {
+		t.Fatal("Root metadata not found")
+	}
+
+	// Check that the file was removed from Files
+	foundFile := false
+	for _, file := range rootInfo.Files {
+		if file.Name == "Test Object" {
+			foundFile = true
+			break
+		}
+	}
+	if foundFile {
+		t.Error("File 'Test Object' should have been removed from Files")
+	}
+
+	// Check that the directory was added to Folders
+	foundDir := false
+	for _, folder := range rootInfo.Folders {
+		if folder.Name == "Test Object" {
+			foundDir = true
+			if folder.Type != "directory" {
+				t.Errorf("Expected directory type, got %s", folder.Type)
+			}
+			break
+		}
+	}
+	if !foundDir {
+		t.Error("Directory 'Test Object' should have been added to Folders")
+	}
+}

backend/adapters/fs/files/files.go

@@ -1,94 +1,269 @@
 package files
 
 import (
-	"crypto/md5"
-	"crypto/sha1"
-	"crypto/sha256"
-	"crypto/sha512"
-	"encoding/hex"
+	"context"
 	"fmt"
-	"hash"
 	"io"
-	"unicode"
-	"unicode/utf8"
-
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
+	"github.com/dhowden/tag"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
-func FileInfoFaster(opts iteminfo.FileOptions) (iteminfo.ExtendedFileInfo, error) {
-	response := iteminfo.ExtendedFileInfo{}
-	index := indexing.GetIndex(opts.Source)
-	if index == nil {
-		return response, fmt.Errorf("could not get index: %v ", opts.Source)
+// processDirectoryMetadata extracts metadata for audio/video files in directories
+func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts utils.FileOptions) {
+	metadataCount := 0
+	for i := range response.Files {
+		fileItem := &response.Files[i]
+		isItemAudio := strings.HasPrefix(fileItem.Type, "audio")
+		isItemVideo := strings.HasPrefix(fileItem.Type, "video")
+		if isItemAudio || isItemVideo {
+			metadataCount++
+		}
 	}
-	if opts.Access != nil && !opts.Access.Permitted(index.Path, opts.Path, opts.Username) {
-		return response, errors.ErrPermissionDenied
+	// Process files concurrently using goroutines
+	var wg sync.WaitGroup
+	var mu sync.Mutex // Protects processedCount
+
+	// Refresh directory to update folder sizes
+	wg.Go(func() {
+		indexPath := idx.MakeIndexPath(response.Path, true)
+		err := idx.RefreshDirectory(indexPath, false)
+		if err != nil {
+			logger.Debugf("Failed to refresh directory for folder size update: %v", err)
+		}
+	})
+
+	// Set hasMetadata flag if there are files with potential metadata
+	if metadataCount > 0 {
+		response.HasMetadata = true
 	}
-	realPath, isDir, err := index.GetRealPath(opts.Path)
-	if err != nil {
-		return response, err
-	}
-	opts.IsDir = isDir
-	var info *iteminfo.FileInfo
-	var exists bool
-	err = index.RefreshFileInfo(opts)
-	if err != nil {
-		if err == errors.ErrNotIndexed && index.Config.DisableIndexing {
-			info, err = index.GetFsDirInfo(opts.Path)
-			if err != nil {
-				return response, err
+
+	// Only process metadata if explicitly requested
+	if opts.Metadata && metadataCount > 0 {
+		processedCount := 0
+
+		// Create a single shared FFmpegService instance for all files to coordinate concurrency
+		sharedFFmpegService := ffmpeg.NewFFmpegService(10, false, "")
+		if sharedFFmpegService != nil {
+
+			for i := range response.Files {
+				fileItem := &response.Files[i]
+				isItemAudio := strings.HasPrefix(fileItem.Type, "audio")
+				isItemVideo := strings.HasPrefix(fileItem.Type, "video")
+
+				if isItemAudio || isItemVideo {
+					wg.Go(func() {
+						// Extract metadata for audio files (without album art for performance)
+						if isItemAudio {
+							err := extractAudioMetadata(context.Background(), fileItem, response.RealPath+"/"+fileItem.Name, opts.AlbumArt, opts.Metadata, sharedFFmpegService)
+							if err != nil {
+								logger.Debugf("failed to extract metadata for file: %s, error: %v", fileItem.Name, err)
+							} else {
+								mu.Lock()
+								processedCount++
+								mu.Unlock()
+							}
+						} else {
+							// Extract duration for video files
+							err := extractVideoMetadata(context.Background(), fileItem, response.RealPath+"/"+fileItem.Name, sharedFFmpegService)
+							if err != nil {
+								logger.Debugf("failed to extract video metadata for file: %s, error: %v", fileItem.Name, err)
+							} else {
+								mu.Lock()
+								processedCount++
+								mu.Unlock()
+							}
+						}
+					})
+				}
 			}
-		} else if err == errors.ErrNotIndexed {
-			return response, fmt.Errorf("could not refresh file info: %v", err)
-		}
-	} else {
-		info, exists = index.GetReducedMetadata(opts.Path, opts.IsDir)
-		if !exists {
-			return response, fmt.Errorf("could not get metadata for path: %v", opts.Path)
+
 		}
 	}
-	if opts.Content {
-		if info.Size < 20*1024*1024 { // 20 megabytes in bytes
-			content, err := getContent(realPath)
-			if err != nil {
-				logger.Debugf("could not get content for file: "+info.Path, info.Name, err)
-				return response, err
-			}
-			response.Content = content
-		} else {
-			logger.Debug("skipping large text file contents (20MB limit): "+info.Path, info.Name)
-		}
-	}
-	response.FileInfo = *info
-	response.RealPath = realPath
-	response.Source = index.Name
+	// Wait for all goroutines to complete
+	wg.Wait()
+}
+
+// finalizeResponse handles final response adjustments (OnlyOffice ID, scope stripping)
+func finalizeResponse(response *iteminfo.ExtendedFileInfo, info *iteminfo.FileInfo, realPath string, user *users.User, userScope string) {
+	// Add OnlyOffice ID if applicable
 	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
 		response.OnlyOfficeId = generateOfficeId(realPath)
 	}
-	if strings.HasPrefix(info.Type, "video") {
-		parentInfo, exists := index.GetReducedMetadata(filepath.Dir(info.Path), true)
-		if exists {
-			response.DetectSubtitles(parentInfo)
+
+	// Strip user scope from response path to return path relative to user's context
+	if user != nil && userScope != "" && userScope != "/" {
+		response.Path = strings.TrimPrefix(response.Path, userScope)
+		if response.Path == "" {
+			response.Path = "/"
 		}
 	}
+}
+
+func FileInfoFaster(opts utils.FileOptions, access *access.Storage, user *users.User) (*iteminfo.ExtendedFileInfo, error) {
+	response := &iteminfo.ExtendedFileInfo{}
+	if access == nil {
+		return response, fmt.Errorf("access not provided")
+	}
+	if user == nil {
+		return response, fmt.Errorf("user not provided")
+	}
+	if opts.Path == "" {
+		return response, fmt.Errorf("path not provided")
+	}
+	if opts.Source == "" {
+		return response, fmt.Errorf("source not provided")
+	}
+	// Get index
+	idx := indexing.GetIndex(opts.Source)
+	if idx == nil {
+		return response, fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+
+	// Resolve user scope
+	userScope, scopeErr := user.GetScopeForSourcePath(idx.Path)
+	if scopeErr != nil || userScope == "" {
+		return response, fmt.Errorf("user has no access to source: %v", opts.Source)
+	}
+
+	safePath, err := utils.SanitizeUserPath(opts.Path)
+	if err != nil {
+		return response, errors.ErrAccessDenied
+	}
+
+	// Combine scope + sanitized path
+	indexPath := utils.JoinPathAsUnix(userScope, safePath)
+	// Layer 1: USER ACCESS CONTROL
+	// Quick check: Does THIS user have permission?
+	if !access.Permitted(idx.Path, indexPath, user.Username) {
+		return response, errors.ErrAccessDenied
+	}
+
+	// Layer 2: INDEX RULES (global)
+	// Get file info using unified entry point (applies IsViewable/ShouldSkip)
+	info, err := idx.GetFileInfo(indexing.FileInfoRequest{
+		IndexPath:      indexPath,
+		FollowSymlinks: opts.FollowSymlinks,
+		ShowHidden:     opts.ShowHidden,
+		Expand:         opts.Expand,
+		IsRoutineScan:  false, // API call
+	})
+	if err != nil {
+		return response, err // Path excluded by index rules OR doesn't exist
+	}
+
+	// Build response
+	response.FileInfo = *info
+	response.RealPath = filepath.Join(idx.Path, indexPath)
+	response.Source = opts.Source
+
+	// Layer 3: FILTER CHILDREN (user access)
+	// Remove child items THIS user can't access
+	if info.Type == "directory" {
+		if err := access.CheckChildItemAccess(response, idx, user.Username); err != nil {
+			return response, err
+		}
+	}
+
+	// Process directory metadata if requested
+	if info.Type == "directory" {
+		processDirectoryMetadata(response, idx, opts)
+	}
+
+	// Process single file content/metadata
+	isAudioVideo := strings.HasPrefix(info.Type, "audio") || strings.HasPrefix(info.Type, "video")
+	if opts.Content || opts.Metadata || isAudioVideo {
+		processContent(response, idx, opts)
+	}
+
+	// Finalize response (OnlyOffice ID, scope stripping)
+	finalizeResponse(response, info, response.RealPath, user, userScope)
+
 	return response, nil
 }
 
+func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts utils.FileOptions) {
+	isVideo := strings.HasPrefix(info.Type, "video")
+	isAudio := strings.HasPrefix(info.Type, "audio")
+	isFolder := info.Type == "directory"
+	if isFolder {
+		return
+	}
+
+	if isVideo {
+		// Extract duration for video
+		extItem := &iteminfo.ExtendedItemInfo{
+			ItemInfo: info.ItemInfo,
+		}
+		err := extractVideoMetadata(context.Background(), extItem, info.RealPath, nil)
+		if err != nil {
+			logger.Debugf("failed to extract video metadata for file: "+info.RealPath, info.Name, err)
+		} else {
+			info.Metadata = extItem.Metadata
+		}
+
+		// Handle subtitles if requested
+		parentPath := filepath.Dir(info.Path)
+		parentInfo, exists := idx.GetMetadataInfo(parentPath, true, false)
+		if exists {
+			info.GetSubtitles(parentInfo)
+		}
+		if opts.ExtractEmbeddedSubtitles {
+			subtitles := ffmpeg.DetectEmbeddedSubtitles(info.RealPath, info.ModTime)
+			info.Subtitles = append(info.Subtitles, subtitles...)
+		}
+
+		return
+	}
+
+	if isAudio {
+		// Create an ExtendedItemInfo to hold the metadata
+		extItem := &iteminfo.ExtendedItemInfo{
+			ItemInfo: info.ItemInfo,
+		}
+		err := extractAudioMetadata(context.Background(), extItem, info.RealPath, opts.AlbumArt || opts.Content, opts.Metadata || opts.Content, nil)
+		if err != nil {
+			logger.Debugf("failed to extract audio metadata for file: "+info.RealPath, info.Name, err)
+		} else {
+			// Copy metadata to ExtendedFileInfo
+			info.Metadata = extItem.Metadata
+			info.HasMetadata = true
+			info.HasPreview = extItem.Metadata != nil && len(extItem.Metadata.AlbumArt) > 0
+		}
+		return
+	}
+
+	// Process text content for non-video, non-audio files
+	if info.Size < 20*1024*1024 { // 20 megabytes in bytes
+		content, err := getContent(info.RealPath)
+		if err != nil {
+			logger.Debugf("could not get content for file: "+info.RealPath, info.Name, err)
+			return
+		}
+		info.Content = content
+	} else {
+		logger.Debug("skipping large text file contents (20MB limit): "+info.Path, info.Name, info.Type)
+	}
+}
+
 func generateOfficeId(realPath string) string {
-	key, ok := utils.OnlyOfficeCache.Get(realPath).(string)
+	key, ok := utils.OnlyOfficeCache.Get(realPath)
 	if !ok {
 		timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)
 		documentKey := utils.HashSHA256(realPath + timestamp)
@@ -98,57 +273,139 @@ func generateOfficeId(realPath string) string {
 	return key
 }
 
-// Checksum checksums a given File for a given User, using a specific
-// algorithm. The checksums data is saved on File object.
-func GetChecksum(fullPath, algo string) (map[string]string, error) {
-	subs := map[string]string{}
-	reader, err := os.Open(fullPath)
-	if err != nil {
-		return subs, err
-	}
-	defer reader.Close()
-
-	hashFuncs := map[string]hash.Hash{
-		"md5":    md5.New(),
-		"sha1":   sha1.New(),
-		"sha256": sha256.New(),
-		"sha512": sha512.New(),
-	}
-
-	h, ok := hashFuncs[algo]
-	if !ok {
-		return subs, errors.ErrInvalidOption
-	}
-
-	_, err = io.Copy(h, reader)
-	if err != nil {
-		return subs, err
-	}
-	subs[algo] = hex.EncodeToString(h.Sum(nil))
-	return subs, nil
-}
-
-func DeleteFiles(source, absPath string, absDirPath string) error {
-	err := os.RemoveAll(absPath)
+// extractAudioMetadata extracts metadata from an audio file using dhowden/tag
+// and optionally extracts duration using the ffmpeg service with concurrency control
+// If ffmpegService is nil, a new service will be created (for backward compatibility)
+func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, getArt bool, getDuration bool, ffmpegService *ffmpeg.FFmpegService) error {
+	file, err := os.Open(realPath)
 	if err != nil {
 		return err
 	}
-	index := indexing.GetIndex(source)
-	if index == nil {
-		return fmt.Errorf("could not get index: %v ", source)
+	defer file.Close()
+
+	// Check file size first to prevent reading extremely large files
+	fileInfo, err := file.Stat()
+	if err != nil {
+		return err
 	}
-	if index.Config.DisableIndexing {
+
+	// Skip files larger than 300MB to prevent memory issues
+	maxSize := int64(300)
+	if fileInfo.Size() > maxSize*1024*1024 {
+		return fmt.Errorf("file with size %d MB exceeds metadata check limit: %d MB", fileInfo.Size()/1024/1024, maxSize)
+	}
+
+	m, err := tag.ReadFrom(file)
+	if err != nil {
+		return err
+	}
+
+	item.Metadata = &iteminfo.MediaMetadata{
+		Title:  m.Title(),
+		Artist: m.Artist(),
+		Album:  m.Album(),
+		Year:   m.Year(),
+		Genre:  m.Genre(),
+	}
+
+	// Extract track number
+	track, _ := m.Track()
+	item.Metadata.Track = track
+
+	// Extract duration ONLY if explicitly requested using the ffmpeg VideoService
+	// This respects concurrency limits and gracefully handles missing ffmpeg
+	if getDuration {
+		// Use provided service or create a new one for backward compatibility
+		service := ffmpegService
+		if service == nil {
+			service = ffmpeg.NewFFmpegService(5, false, "")
+		}
+		if service != nil {
+			if duration, err := service.GetMediaDuration(ctx, realPath); err == nil {
+				item.Metadata.Duration = int(duration)
+			}
+		}
+	}
+
+	if !getArt {
 		return nil
 	}
-	refreshConfig := iteminfo.FileOptions{Path: index.MakeIndexPath(absDirPath), IsDir: true}
-	err = index.RefreshFileInfo(refreshConfig)
-	if err != nil {
-		return err
+
+	// Extract album art if available (stored as raw bytes, auto-encoded to base64 in JSON)
+	if picture := m.Picture(); picture != nil && picture.Data != nil {
+		// Size limit to prevent memory issues (max 5MB)
+		if len(picture.Data) <= 5*1024*1024 {
+			item.Metadata.AlbumArt = picture.Data
+		} else {
+			logger.Debugf("Skipping album art for %s: too large (%d bytes)", realPath, len(picture.Data))
+		}
+	}
+
+	return nil
+}
+
+// extractVideoMetadata extracts duration from video files using ffprobe
+// If ffmpegService is nil, a new service will be created (for backward compatibility)
+func extractVideoMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, ffmpegService *ffmpeg.FFmpegService) error {
+	// Use provided service or create a new one for backward compatibility
+	service := ffmpegService
+	if service == nil {
+		service = ffmpeg.NewFFmpegService(10, false, "")
+	}
+	if service != nil {
+		duration, err := service.GetMediaDuration(ctx, realPath)
+		if err != nil {
+			return err
+		}
+		if duration > 0 {
+			item.Metadata = &iteminfo.MediaMetadata{
+				Duration: int(duration),
+			}
+		}
+		return nil
 	}
 	return nil
 }
 
-func RefreshIndex(source string, path string, isDir bool) error {
+func DeleteFiles(source, absPath string, isDir bool) error {
+	index := indexing.GetIndex(source)
+	if index == nil {
+		return fmt.Errorf("could not get index: %v ", source)
+	}
+
+	if !index.Config.DisableIndexing {
+		indexPath := index.MakeIndexPath(absPath, isDir)
+
+		// Perform the physical deletion
+		err := os.RemoveAll(absPath)
+		if err != nil {
+			return err
+		}
+
+		// Clear cache entries
+		indexing.RealPathCache.Delete(absPath)
+		indexing.IsDirCache.Delete(absPath + ":isdir")
+
+		// Remove metadata from index
+		deleteSuccess := index.DeleteMetadata(indexPath, isDir, isDir)
+		if !deleteSuccess {
+			logger.Errorf("Failed to delete metadata from index for %s, but filesystem deletion succeeded", indexPath)
+		}
+
+		// Refresh the parent directory to recalculate sizes and update counts
+		refreshConfig := utils.FileOptions{
+			Path:  index.MakeIndexPath(filepath.Dir(absPath), true),
+			IsDir: true,
+		}
+		err = index.RefreshFileInfo(refreshConfig)
+		return err
+	}
+
+	// Indexing disabled, just delete the file
+	return os.RemoveAll(absPath)
+}
+
+func RefreshIndex(source string, path string, isDir bool, recursive bool) error {
 	idx := indexing.GetIndex(source)
 	if idx == nil {
 		return fmt.Errorf("could not get index: %v ", source)
@@ -156,8 +413,47 @@ func RefreshIndex(source string, path string, isDir bool) error {
 	if idx.Config.DisableIndexing {
 		return nil
 	}
-	path = idx.MakeIndexPath(path)
-	return idx.RefreshFileInfo(iteminfo.FileOptions{Path: path, IsDir: isDir})
+	// Always normalize path using MakeIndexPath
+	path = idx.MakeIndexPath(path, isDir)
+
+	// Check if path is a symlink
+	realPath, _, _ := idx.GetRealPath(path)
+	isSymlink := false
+	if realPath != "" {
+		if fileInfo, err := os.Lstat(realPath); err == nil {
+			isSymlink = fileInfo.Mode()&os.ModeSymlink != 0
+		}
+	}
+
+	// Skip indexing only for paths that are explicitly excluded (not viewable and should be skipped)
+	hidden := indexing.IsHidden(filepath.Join(idx.Path, path))
+	if idx.ShouldSkip(isDir, path, hidden, isSymlink, false) {
+		return nil
+	}
+
+	// For directories, check if the path exists on disk
+	// If it doesn't exist, remove it from the index
+	if isDir {
+		realPath, _, err := idx.GetRealPath(path)
+		if err == nil {
+			// Check if the directory exists on disk
+			if !Exists(realPath) {
+				// Directory no longer exists, remove it from the index
+				// This clears both Directories and DirectoriesLedger maps
+				indexing.RealPathCache.Delete(realPath)
+				indexing.IsDirCache.Delete(realPath + ":isdir")
+				idx.DeleteMetadata(path, true, false)
+				return nil
+			}
+		}
+	}
+
+	err := idx.RefreshFileInfo(utils.FileOptions{Path: path, IsDir: isDir, Recursive: recursive})
+	if err != nil {
+		logger.Errorf("RefreshFileInfo failed: %v", err)
+		return err
+	}
+	return err
 }
 
 // validateMoveDestination checks if a move/rename operation is valid
@@ -189,77 +485,227 @@ func validateMoveDestination(src, dst string, isSrcDir bool) error {
 	return nil
 }
 
-func MoveResource(isSrcDir, isDestDir bool, sourceIndex, destIndex, realsrc, realdst string, s *share.Storage) error {
+func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string, s *share.Storage, a *access.Storage) error {
+	// Check if source and destination are the same file
+	if realsrc == realdst {
+		return fmt.Errorf("cannot move a file to itself: %s", realsrc)
+	}
+
 	// Validate the move operation before executing
 	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
 		return err
 	}
 
+	// Get indexes for deletion and refresh operations
+	srcIdx := indexing.GetIndex(sourceIndex)
+	if srcIdx == nil {
+		return fmt.Errorf("could not get source index: %v", sourceIndex)
+	}
+	dstIdx := indexing.GetIndex(destIndex)
+	if dstIdx == nil {
+		return fmt.Errorf("could not get destination index: %v", destIndex)
+	}
+
+	// Prepare paths for index operations
+	srcIndexPath := srcIdx.MakeIndexPath(realsrc, isSrcDir)
+	srcParentPath := filepath.Dir(realsrc)
+
+	// Perform the physical move
 	err := fileutils.MoveFile(realsrc, realdst)
 	if err != nil {
 		return err
 	}
-	go RefreshIndex(sourceIndex, realsrc, isSrcDir) //nolint:errcheck
-	go RefreshIndex(destIndex, realdst, isDestDir)  //nolint:errcheck
 
-	// update shares
-	idx := indexing.GetIndex(sourceIndex)
-	if idx == nil {
-		return fmt.Errorf("could not get index: %v ", sourceIndex)
+	// Handle SOURCE cleanup (treat as deletion)
+	// Run async to avoid blocking the HTTP response
+	if !srcIdx.Config.DisableIndexing {
+		go func() {
+			if isSrcDir {
+				srcIdx.DeleteMetadata(srcIndexPath, true, true)
+			} else {
+				srcIdx.DeleteMetadata(srcIndexPath, false, false)
+			}
+			if err := RefreshIndex(sourceIndex, srcParentPath, true, false); err != nil {
+				logger.Errorf("Failed to refresh source parent directory %s after move: %v", srcParentPath, err)
+			}
+		}()
 	}
-	idx2 := indexing.GetIndex(destIndex)
-	if idx2 == nil {
-		return fmt.Errorf("could not get index: %v ", destIndex)
+
+	// Handle DESTINATION indexing
+	// Run async to avoid blocking the HTTP response
+	if !dstIdx.Config.DisableIndexing {
+		if isSrcDir {
+			go func() {
+				// Recursively index the moved directory tree
+				if err := RefreshIndex(destIndex, realdst, true, true); err != nil {
+					logger.Errorf("Failed to index moved directory %s: %v", realdst, err)
+					return
+				}
+
+				// Refresh parent to update its size
+				parentDir := filepath.Dir(realdst)
+				if err := RefreshIndex(destIndex, parentDir, true, false); err != nil {
+					logger.Errorf("Failed to refresh destination parent %s: %v", parentDir, err)
+				}
+			}()
+		} else {
+			// For files, refresh parent directory
+			parentDir := filepath.Dir(realdst)
+			go RefreshIndex(destIndex, parentDir, true, false) //nolint:errcheck
+		}
 	}
 
 	// Use backend source paths to match how shares are stored
-	go s.UpdateShares(idx.Path, idx.MakeIndexPath(realsrc), idx2.Path, idx2.MakeIndexPath(realdst)) //nolint:errcheck
+	go s.UpdateShares(srcIdx.Path, srcIdx.MakeIndexPath(realsrc, isSrcDir), dstIdx.Path, dstIdx.MakeIndexPath(realdst, isSrcDir)) //nolint:errcheck
+
+	// Update access rules for the moved path
+	if a != nil {
+		// If moving within the same source, update the rules
+		if srcIdx.Path == dstIdx.Path {
+			go a.UpdateRules(srcIdx.Path, srcIdx.MakeIndexPath(realsrc, isSrcDir), dstIdx.MakeIndexPath(realdst, isSrcDir)) //nolint:errcheck
+		}
+		// Cross-source moves don't preserve access rules (they're source-specific)
+	}
+
 	return nil
 }
 
-func CopyResource(isSrcDir, isDestDir bool, sourceIndex, destIndex, realsrc, realdst string) error {
+func CopyResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string) error {
+	// Check if source and destination are the same file
+	if realsrc == realdst {
+		return fmt.Errorf("cannot copy a file to itself: %s", realsrc)
+	}
+
 	// Validate the copy operation before executing
 	if err := validateMoveDestination(realsrc, realdst, isSrcDir); err != nil {
+		logger.Errorf("[COPY] Copy validation failed: %v", err)
 		return err
 	}
 
+	// Perform the physical copy
 	err := fileutils.CopyFile(realsrc, realdst)
 	if err != nil {
+		logger.Errorf("[COPY] Physical copy failed: %v", err)
 		return err
 	}
-	go RefreshIndex(sourceIndex, realsrc, isSrcDir) //nolint:errcheck
-	go RefreshIndex(destIndex, realdst, isDestDir)  //nolint:errcheck
-	// update shares
+
+	// Refresh source (non-recursive, just metadata)
+	srcIdx := indexing.GetIndex(sourceIndex)
+	if srcIdx != nil && !srcIdx.Config.DisableIndexing {
+		srcRefreshPath := realsrc
+		if !isSrcDir {
+			srcRefreshPath = filepath.Dir(realsrc)
+		}
+		go RefreshIndex(sourceIndex, srcRefreshPath, true, false) //nolint:errcheck
+	}
+
+	// Refresh destination (RECURSIVE for directories to capture full tree)
+	// Run async to avoid blocking the HTTP response
+	dstIdx := indexing.GetIndex(destIndex)
+	if dstIdx != nil && !dstIdx.Config.DisableIndexing {
+		if isSrcDir {
+			go func() {
+				// Recursively index the copied directory tree
+				if err := RefreshIndex(destIndex, realdst, true, true); err != nil {
+					logger.Errorf("[COPY] Failed to index copied directory %s: %v", realdst, err)
+					return
+				}
+
+				// Refresh parent to update its size
+				parentDir := filepath.Dir(realdst)
+				if err := RefreshIndex(destIndex, parentDir, true, false); err != nil {
+					logger.Errorf("[COPY] Failed to refresh parent %s: %v", parentDir, err)
+				}
+			}()
+		} else {
+			// For files, refresh parent directory
+			dstParent := filepath.Dir(realdst)
+			go RefreshIndex(destIndex, dstParent, true, false) //nolint:errcheck
+		}
+	}
 	return nil
 }
 
-func WriteDirectory(opts iteminfo.FileOptions) error {
+func WriteDirectory(opts utils.FileOptions) error {
 	idx := indexing.GetIndex(opts.Source)
 	if idx == nil {
 		return fmt.Errorf("could not get index: %v ", opts.Source)
 	}
 	realPath, _, _ := idx.GetRealPath(opts.Path)
+
+	var stat os.FileInfo
+	var err error
+	// Check if the destination exists and is a file
+	if stat, err = os.Stat(realPath); err == nil && !stat.IsDir() {
+		// If it's a file and we're trying to create a directory, remove the file first
+		err = os.Remove(realPath)
+		if err != nil {
+			return fmt.Errorf("could not remove existing file to create directory: %v", err)
+		}
+	}
+
 	// Ensure the parent directories exist
-	err := os.MkdirAll(realPath, fileutils.PermDir)
+	// Permissions are set by MkdirAll (subject to umask, which is usually acceptable)
+	err = os.MkdirAll(realPath, fileutils.PermDir)
 	if err != nil {
 		return err
 	}
-	return RefreshIndex(idx.Name, opts.Path, true)
+
+	// Explicitly set directory permissions to bypass umask
+	err = os.Chmod(realPath, fileutils.PermDir)
+	if err != nil {
+		// Handle chmod error gracefully
+		logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", realPath, err)
+	}
+
+	// Refresh the directory itself recursively
+	err = RefreshIndex(idx.Name, opts.Path, true, true)
+	if err != nil {
+		return err
+	}
+
+	// Refresh parent directory to update its size
+	parentPath := filepath.Dir(opts.Path)
+	if parentPath != "." && parentPath != "/" && parentPath != opts.Path {
+		if err := RefreshIndex(idx.Name, parentPath, true, false); err != nil {
+			logger.Debugf("Could not refresh parent directory %s: %v", parentPath, err)
+		}
+	}
+
+	return nil
 }
 
-func WriteFile(opts iteminfo.FileOptions, in io.Reader) error {
-	idx := indexing.GetIndex(opts.Source)
+func WriteFile(source, path string, in io.Reader) error {
+	idx := indexing.GetIndex(source)
 	if idx == nil {
-		return fmt.Errorf("could not get index: %v ", opts.Source)
+		return fmt.Errorf("could not get index: %v ", source)
 	}
-	dst, _, _ := idx.GetRealPath(opts.Path)
+	realPath, _, _ := idx.GetRealPath(path)
+	// Strip trailing slash from realPath if it's meant to be a file
+	realPath = strings.TrimRight(realPath, "/")
 	// Ensure the parent directories exist
-	err := os.MkdirAll(filepath.Dir(dst), fileutils.PermDir)
+	parentDir := filepath.Dir(realPath)
+	err := os.MkdirAll(parentDir, fileutils.PermDir)
 	if err != nil {
 		return err
 	}
+	var stat os.FileInfo
+	// Check if the destination exists and is a directory
+	if stat, err = os.Stat(realPath); err == nil {
+		if stat.IsDir() {
+			// If it's a directory and we're trying to create a file, remove the directory first
+			err = os.RemoveAll(realPath)
+			if err != nil {
+				return fmt.Errorf("could not remove existing directory to create file: %v", err)
+			}
+		}
+		// If file exists, its permissions will be preserved (O_TRUNC doesn't change permissions)
+	}
+
 	// Open the file for writing (create if it doesn't exist, truncate if it does)
-	file, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileutils.PermFile)
+	// For new files: permissions are set to fileutils.PermFile (subject to umask, which is usually acceptable)
+	// For existing files: permissions are preserved automatically (O_TRUNC doesn't change them)
+	file, err := os.OpenFile(realPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileutils.PermFile)
 	if err != nil {
 		return err
 	}
@@ -270,131 +716,56 @@ func WriteFile(opts iteminfo.FileOptions, in io.Reader) error {
 	if err != nil {
 		return err
 	}
-	return RefreshIndex(opts.Source, opts.Path, false)
+
+	// Explicitly set file permissions to bypass umask
+	err = os.Chmod(realPath, fileutils.PermFile)
+	if err != nil {
+		// Handle chmod error gracefully
+		logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", realPath, err)
+	}
+
+	// Refresh the file itself
+	err = RefreshIndex(source, path, false, false)
+	if err != nil {
+		return err
+	}
+
+	// Refresh parent directory to update its size
+	parentPath := filepath.Dir(path)
+	if parentPath != "." && parentPath != "/" && parentPath != path {
+		if err := RefreshIndex(source, parentPath, true, false); err != nil {
+			logger.Debugf("Could not refresh parent directory %s: %v", parentPath, err)
+		}
+	}
+
+	return nil
 }
 
 // getContent reads and returns the file content if it's considered an editable text file.
+// This is a wrapper around utils.IsTextFile that also returns the file content.
 func getContent(realPath string) (string, error) {
-	const headerSize = 4096
-	// Thresholds for detecting binary-like content (these can be tuned)
-	const maxNullBytesInHeaderAbs = 10    // Max absolute null bytes in header
-	const maxNullByteRatioInHeader = 0.1  // Max 10% null bytes in header
-	const maxNullByteRatioInFile = 0.05   // Max 5% null bytes in the entire file
-	const maxNonPrintableRuneRatio = 0.05 // Max 5% non-printable runes in the entire file
-
-	// Open file
-	f, err := os.Open(realPath)
+	// First check if it's a text file using the consolidated validation logic
+	isText, err := utils.IsTextFile(realPath)
 	if err != nil {
 		return "", err
 	}
-	defer f.Close()
-
-	// Read header
-	headerBytes := make([]byte, headerSize)
-	n, err := f.Read(headerBytes)
-	if err != nil && err != io.EOF {
-		return "", err
+	if !isText {
+		// Not a text file, return empty string (no error, just not text)
+		return "", nil
 	}
-	actualHeader := headerBytes[:n]
 
-	// --- Start of new heuristic checks ---
-
-	if n > 0 {
-		// 1. Basic Check: Is the header valid UTF-8?
-		// If not, it's unlikely an editable UTF-8 text file.
-		if !utf8.Valid(actualHeader) {
-			return "", nil // Not an error, just not the text file we want
-		}
-
-		// 2. Check for excessive null bytes in the header
-		nullCountInHeader := 0
-		for _, b := range actualHeader {
-			if b == 0x00 {
-				nullCountInHeader++
-			}
-		}
-		// Reject if too many nulls absolutely or relatively in the header
-		if nullCountInHeader > 0 { // Only perform check if there are any nulls
-			if nullCountInHeader > maxNullBytesInHeaderAbs ||
-				(float64(nullCountInHeader)/float64(n) > maxNullByteRatioInHeader) {
-				return "", nil // Too many nulls in header
-			}
-		}
-
-		// 3. Check for other non-text ASCII control characters in the header
-		// (C0 controls excluding \t, \n, \r)
-		for _, b := range actualHeader {
-			if b < 0x20 && b != '\t' && b != '\n' && b != '\r' {
-				return "", nil // Found problematic control character
-			}
-			// C1 control characters (0x80-0x9F) would be caught by utf8.Valid if part of invalid sequences,
-			// or by the non-printable rune check later if they form valid (but undesirable) codepoints.
-		}
-
-		// Optional: Use http.DetectContentType for an additional check on the header
-		// contentType := http.DetectContentType(actualHeader)
-		// if !strings.HasPrefix(contentType, "text/") && contentType != "application/octet-stream" {
-		//     // If it's clearly a non-text MIME type (e.g., "image/jpeg"), reject it.
-		//     // "application/octet-stream" is ambiguous, so we rely on other heuristics.
-		//     return "", nil
-		// }
-	}
-	// --- End of new heuristic checks for header ---
-
-	// Now read the full file (original logic)
+	// It's a text file, read and return the content
 	content, err := os.ReadFile(realPath)
 	if err != nil {
 		return "", err
 	}
-	// Handle empty file (original logic - returns specific string)
+
+	// Handle empty file (return specific marker string)
 	if len(content) == 0 {
 		return "empty-file-x6OlSil", nil
 	}
 
-	stringContent := string(content)
-
-	// 4. Final UTF-8 validation for the entire file
-	// (This is crucial as the header might be fine, but the rest of the file isn't)
-	if !utf8.ValidString(stringContent) {
-		return "", nil
-	}
-
-	// 5. Check for excessive null bytes in the entire file content
-	if len(content) > 0 { // Check only for non-empty files
-		totalNullCount := 0
-		for _, b := range content {
-			if b == 0x00 {
-				totalNullCount++
-			}
-		}
-		if float64(totalNullCount)/float64(len(content)) > maxNullByteRatioInFile {
-			return "", nil // Too many nulls in the entire file
-		}
-	}
-
-	// 6. Check for excessive non-printable runes in the entire file content
-	// (Excluding tab, newline, carriage return, which are common in text files)
-	if len(stringContent) > 0 { // Check only for non-empty strings
-		nonPrintableRuneCount := 0
-		totalRuneCount := 0
-		for _, r := range stringContent {
-			totalRuneCount++
-			// unicode.IsPrint includes letters, numbers, punctuation, symbols, and spaces.
-			// It excludes control characters. We explicitly allow \t, \n, \r.
-			if !unicode.IsPrint(r) && r != '\t' && r != '\n' && r != '\r' {
-				nonPrintableRuneCount++
-			}
-		}
-
-		if totalRuneCount > 0 { // Avoid division by zero
-			if float64(nonPrintableRuneCount)/float64(totalRuneCount) > maxNonPrintableRuneRatio {
-				return "", nil // Too many non-printable runes
-			}
-		}
-	}
-
-	// The file has passed all checks and is considered editable text.
-	return stringContent, nil
+	return string(content), nil
 }
 
 func IsNamedPipe(mode os.FileMode) bool {

backend/adapters/fs/files/mime.go

@@ -590,10 +590,11 @@ var types = map[string]string{
 	".xpi":       "application/x-xpinstall",
 	".wasm":      "application/wasm",
 	".m4a":       "audio/mp4",
-	".flac":      "audio/x-flac",
+	".flac":      "audio/flac",
 	".amr":       "audio/amr",
 	".aac":       "audio/aac",
-	".opus":      "video/ogg",
+	".opus":      "audio/ogg", // https://wiki.xiph.org/MIME_Types_and_File_Extensions
+	".ogx":       "application/ogg",
 	".m4v":       "video/mp4",
 	".mkv":       "video/x-matroska",
 	".caf":       "audio/x-caf",

backend/adapters/fs/files/user.go

@@ -6,7 +6,9 @@ import (
 	"path/filepath"
 
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
 )
 
 // MakeUserDir makes the user directory according to settings.
@@ -25,37 +27,46 @@ func MakeUserDirs(u *users.User, disableScopeChange bool) error {
 	for i, scope := range u.Scopes {
 		source, ok := settings.Config.Server.SourceMap[scope.Name]
 		if !ok {
-			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
+			logger.Errorf("MakeUserDirs: source not found: %s", scope.Name)
+			continue
 		}
 		// create directory and append user name
 		if filepath.Base(scope.Scope) != cleanedUserName && source.Config.CreateUserDir && !disableScopeChange {
 			fullPath := filepath.Join(source.Path, scope.Scope, cleanedUserName)
 			parentDir := filepath.Join(source.Path, scope.Scope)
-			// validate that scope path exists
+			// If parent directory doesn't exist and createUserDir is enabled, create it
 			if !Exists(parentDir) {
-				return fmt.Errorf("MakeUserDirs: scope path does not exist: %s", scope.Scope)
+				if err := MakeUserDir(parentDir); err != nil {
+					logger.Errorf("MakeUserDirs: failed to create parent scope directory: %s - %v", scope.Scope, err)
+					continue
+				}
 			}
-			scope.Scope = filepath.Join(scope.Scope, cleanedUserName)
+			// Use JoinPathAsUnix to ensure scope remains in Unix format (forward slashes)
+			scope.Scope = utils.JoinPathAsUnix(scope.Scope, cleanedUserName)
 			err := MakeUserDir(fullPath)
 			if err != nil {
-				return fmt.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
+				logger.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
+				// Continue to next scope even if this one failed
 			}
 		} else if filepath.Base(scope.Scope) == cleanedUserName && source.Config.CreateUserDir {
 			// create directory exactly as specified
 			fullPath := filepath.Join(source.Path, scope.Scope)
 			parentDir := filepath.Dir(fullPath)
 			if !Exists(parentDir) {
-				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", parentDir)
+				logger.Errorf("MakeUserDirs: scope folder does not exist: %s", parentDir)
+				continue
 			}
 			err := MakeUserDir(fullPath)
 			if err != nil {
-				return fmt.Errorf("create user: failed to create user home dir: %s", err)
+				logger.Errorf("create user: failed to create user home dir: %s", err)
+				// Continue to next scope even if this one failed
 			}
 		} else {
 			// just assigning scope to path provided, so just check that it exists
 			path := filepath.Join(source.Path, scope.Scope)
 			if !Exists(path) {
-				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", path)
+				logger.Errorf("MakeUserDirs: scope folder does not exist: %s", path)
+				continue
 			}
 		}
 		u.Scopes[i] = scope

backend/adapters/fs/fileutils/assets.go

@@ -0,0 +1,36 @@
+package fileutils
+
+import (
+	"io/fs"
+	"net/http"
+)
+
+var (
+	assetFs fs.FS
+)
+
+// Custom dirFS to handle both embedded and non-embedded file systems
+type dirFS struct {
+	http.Dir
+}
+
+// Implement the Open method for dirFS, which wraps http.Dir
+func (d dirFS) Open(name string) (fs.File, error) {
+	return d.Dir.Open(name)
+}
+
+// InitAssetFS initializes the asset filesystem for the application
+// This should be called once during startup before http or preview services start
+func InitAssetFS(embeddedAssets fs.FS, useEmbedded bool) {
+	if useEmbedded {
+		assetFs = embeddedAssets
+	} else {
+		// Dev mode: Serve files from http/dist directory
+		assetFs = dirFS{Dir: http.Dir("http/dist")}
+	}
+}
+
+// GetAssetFS returns the initialized asset filesystem
+func GetAssetFS() fs.FS {
+	return assetFs
+}

backend/adapters/fs/fileutils/file.go

@@ -6,12 +6,16 @@ import (
 	"path"
 	"path/filepath"
 
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
-const PermFile = 0644
-const PermDir = 0755
+var PermFile os.FileMode
+var PermDir os.FileMode
+
+func SetFsPermissions(PermFileOctal os.FileMode, PermDirOctal os.FileMode) {
+	PermFile = PermFileOctal
+	PermDir = PermDirOctal
+}
 
 // MoveFile moves a file from src to dst.
 // By default, the rename system call is used. If src and dst point to different volumes,
@@ -25,14 +29,14 @@ func MoveFile(src, dst string) error {
 	// fallback
 	err = CopyFile(src, dst)
 	if err != nil {
-		logger.Errorf("CopyFile failed %v %v %v ", src, dst, err)
+		logger.Errorf("CopyFile failed %v", err)
 		return err
 	}
 
 	go func() {
 		err = os.RemoveAll(src)
 		if err != nil {
-			logger.Errorf("os.Remove failed %v %v ", src, err)
+			logger.Errorf("os.Remove failed %v", err)
 		}
 	}()
 
@@ -58,6 +62,13 @@ func CopyFile(source, dest string) error {
 
 // copySingleFile handles copying a single file.
 func copySingleFile(source, dest string) error {
+	// Get source file info to preserve permissions
+	srcInfo, err := os.Stat(source)
+	if err != nil {
+		return err
+	}
+	sourcePerms := srcInfo.Mode().Perm()
+
 	// Open the source file.
 	src, err := os.Open(source)
 	if err != nil {
@@ -71,8 +82,8 @@ func copySingleFile(source, dest string) error {
 		return err
 	}
 
-	// Create the destination file.
-	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, PermFile)
+	// Create the destination file with source permissions
+	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, sourcePerms)
 	if err != nil {
 		return err
 	}
@@ -84,14 +95,13 @@ func copySingleFile(source, dest string) error {
 		return err
 	}
 
-	// Copy the mode.
-	info, err := os.Stat(source)
+	// Preserve source file permissions
+	// Handle chmod errors gracefully (e.g., in rootless containers where chmod may be restricted)
+	err = os.Chmod(dest, sourcePerms)
 	if err != nil {
-		return err
-	}
-	err = os.Chmod(dest, info.Mode())
-	if err != nil {
-		return err
+		// Log but don't fail - chmod may be restricted in some environments
+		// The file was copied successfully, so we continue
+		logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", dest, err)
 	}
 
 	return nil
@@ -179,8 +189,7 @@ func CommonPrefix(sep byte, paths ...string) string {
 	return string(c)
 }
 
-func ClearCacheDir() {
-	cacheDir := settings.Config.Server.CacheDir
+func ClearCacheDir(cacheDir string) {
 	entries, err := os.ReadDir(cacheDir)
 	if err != nil {
 		logger.Errorf("failed clear cache dir: %v", err)

backend/adapters/fs/fileutils/partition_unix.go

@@ -0,0 +1,31 @@
+//go:build !windows
+
+package fileutils
+
+import (
+	"syscall"
+)
+
+// GetPartitionSize returns the filesystem size for Unix systems
+func GetPartitionSize(path string) (uint64, error) {
+	var stat syscall.Statfs_t
+	err := syscall.Statfs(path, &stat)
+	if err != nil {
+		return 0, err
+	}
+	// Total size in bytes: Blocks * Block size
+	total := uint64(stat.Blocks) * uint64(stat.Bsize)
+	return total, nil
+}
+
+// GetFreeSpace returns the available free space for Unix systems
+func GetFreeSpace(path string) (uint64, error) {
+	var stat syscall.Statfs_t
+	err := syscall.Statfs(path, &stat)
+	if err != nil {
+		return 0, err
+	}
+	// Available free space in bytes: Available blocks * Block size
+	free := uint64(stat.Bavail) * uint64(stat.Bsize)
+	return free, nil
+}

backend/adapters/fs/fileutils/partition_windows.go

@@ -0,0 +1,35 @@
+//go:build windows
+
+package fileutils
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+// GetPartitionSize returns the filesystem size for Windows systems
+func GetPartitionSize(path string) (uint64, error) {
+	pathPtr, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+	var freeBytes, totalBytes, totalFreeBytes uint64
+	err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytes, &totalBytes, &totalFreeBytes)
+	if err != nil {
+		return 0, err
+	}
+	return totalBytes, nil
+}
+
+// GetFreeSpace returns the available free space for Windows systems
+func GetFreeSpace(path string) (uint64, error) {
+	pathPtr, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+	var freeBytes, totalBytes, totalFreeBytes uint64
+	err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytes, &totalBytes, &totalFreeBytes)
+	if err != nil {
+		return 0, err
+	}
+	return freeBytes, nil
+}

backend/auth/auth.go

@@ -20,8 +20,6 @@ func init() {
 type Auther interface {
 	// Auth is called to authenticate a request.
 	Auth(r *http.Request, userStore *users.Storage) (*users.User, error)
-	// LoginPage indicates if this auther needs a login page.
-	LoginPage() bool
 }
 
 func IsRevokedApiKey(key string) bool {

backend/auth/json.go

@@ -22,6 +22,11 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 	username := r.URL.Query().Get("username")
 	recaptcha := r.URL.Query().Get("recaptcha")
 	password := r.Header.Get("X-Password")
+	// URL-decode password to support special characters in headers
+	password, err := url.QueryUnescape(password)
+	if err != nil {
+		return nil, fmt.Errorf("invalid password encoding: %v", err)
+	}
 	totpCode := r.Header.Get("X-Secret")
 
 	// If ReCaptcha is enabled, check the code.
@@ -65,11 +70,6 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 
 }
 
-// LoginPage tells that json auth doesn't require a login page.
-func (a JSONAuth) LoginPage() bool {
-	return true
-}
-
 const reCaptchaAPI = "/recaptcha/api/siteverify"
 
 // ReCaptcha identifies a recaptcha connection.

backend/auth/none.go

@@ -16,8 +16,3 @@ type NoAuth struct{}
 func (a NoAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
 	return usr.Get(uint(1))
 }
-
-// LoginPage tells that no auth doesn't require a login page.
-func (a NoAuth) LoginPage() bool {
-	return false
-}

backend/auth/proxy.go

@@ -26,8 +26,3 @@ func (a ProxyAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error
 
 	return user, err
 }
-
-// LoginPage tells that proxy auth doesn't require a login page.
-func (a ProxyAuth) LoginPage() bool {
-	return false
-}

backend/auth/storage.go

@@ -3,9 +3,12 @@ package auth
 import (
 	"encoding/base64"
 
+	"crypto/sha256"
+
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
+	"golang.org/x/crypto/pbkdf2"
 )
 
 // StorageBackend is a storage backend for auth storage.
@@ -35,9 +38,19 @@ func NewStorage(back StorageBackend, userStore *users.Storage) (*Storage, error)
 	if err != nil {
 		return nil, err
 	}
-	encryptionKey, err = base64.StdEncoding.DecodeString(settings.Config.Auth.TotpSecret)
-	if err != nil {
-		logger.Warning("failed to decode TOTP secret, using default key. This is insecure and should be fixed.")
+	if settings.Config.Auth.TotpSecret != "" {
+		key, err := base64.StdEncoding.DecodeString(settings.Config.Auth.TotpSecret)
+		keyLen := len(key)
+
+		if err == nil && (keyLen == 16 || keyLen == 24 || keyLen == 32) {
+			// Use the user-provided key if it's valid
+			encryptionKey = key
+		} else {
+			// Otherwise, derive the key from the provided secret string
+			logger.Warningf("totpSecret is not a valid Base64 encoded key. Deriving a key from it. For better security, generate a secret with 'openssl rand -base64 32'.")
+			salt := []byte{0xda, 0x90, 0x45, 0xc3, 0x06, 0xb5, 0x99, 0x9f, 0xb6, 0xae, 0xfc, 0x14, 0xef, 0x27, 0x6e, 0x6a}
+			encryptionKey = pbkdf2.Key([]byte(settings.Config.Auth.TotpSecret), salt, 4096, 32, sha256.New)
+		}
 	}
 	return store, nil
 }

backend/auth/totp.go

@@ -48,7 +48,7 @@ var (
 	// (2*2 + 1) * 30s = 150s (2.5 minutes). This is the closest we can get.
 	TOTPSkew      uint = uint(TokenValidTime.Seconds()) / (2 * uint(TOTPPeriod))
 	encryptionKey []byte
-	TotpCache     = cache.NewCache(5 * time.Minute)
+	TotpCache     = cache.NewCache[string](5 * time.Minute)
 )
 
 func GenerateOtpForUser(user *users.User, userStore *users.Storage) (string, error) {
@@ -67,15 +67,17 @@ func GenerateOtpForUser(user *users.User, userStore *users.Storage) (string, err
 
 	secretText := key.Secret()
 	nonce := ""
+	secretToStore := secretText
 	if settings.Config.Auth.TotpSecret != "" {
 		// If an encryption key is provided, encrypt the secret.
-		secretText, nonce, err = encryptSecret(secretText, encryptionKey)
+		secretToStore, nonce, err = encryptSecret(secretText, encryptionKey)
 		if err != nil {
 			return "", fmt.Errorf("failed to encrypt TOTP secret: %w", err)
 		}
 	}
 	// set cache so verify can attempt to use it but not require it for user yet.
-	TotpCache.Set(user.Username, secretText+"||"+nonce)
+	TotpCache.Set(user.Username, secretToStore+"||"+nonce)
+	// Use the original base32 secret in the OTP URL, not the encrypted version
 	url := fmt.Sprintf("otpauth://totp/%v?secret=%v", "FileBrowser Quantum: "+user.Username, secretText)
 	return url, nil
 }
@@ -145,7 +147,7 @@ func decryptSecret(b64Ciphertext, b64Nonce string) (string, error) {
 
 func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) error {
 	// get data from cache
-	cachedSecret, found := TotpCache.Get(user.Username).(string)
+	cachedSecret, found := TotpCache.Get(user.Username)
 	if !found && user.TOTPSecret == "" {
 		return fmt.Errorf("OTP token not found in cache, please generate a new one")
 	}
@@ -181,17 +183,18 @@ func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) err
 		Algorithm: TOTPAlgorithm,
 	})
 	if err != nil {
-		logger.Errorf("error during TOTP validation: %v", err)
+		logger.Errorf("error during TOTP validation for user %s: %v", user.Username, err)
 	}
 	if !valid {
+		logger.Warningf("Invalid TOTP code for user %s", user.Username)
 		return fmt.Errorf("invalid OTP token")
 	}
-	if totpSecret != "" {
+	if totpSecret != "" || !user.OtpEnabled {
 		user.TOTPSecret = totpSecret // The encrypted or plaintext secret
 		user.TOTPNonce = totpNonce   // The nonce if encrypted, or empty if plaintext
 		user.OtpEnabled = true       // Enable OTP for the user
 		// save user
-		if err := userStore.Update(user, true, "TOTPSecret", "TOTPNonce"); err != nil {
+		if err := userStore.Update(user, true, "TOTPSecret", "TOTPNonce", "OtpEnabled"); err != nil {
 			logger.Error("error updating user with OTP token:", err)
 			return fmt.Errorf("error updating user with OTP token: %w", err)
 		}

backend/benchmark_results.txt

@@ -1,83 +0,0 @@
-
- == Running benchmark == 
-/usr/local/go/bin/go
-?   	github.com/gtsteffaniak/filebrowser/backend	[no test files]
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/diskcache	0.004s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files	0.006s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils	0.003s
-?   	github.com/gtsteffaniak/filebrowser/backend/auth	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/cmd	[no test files]
-?   	github.com/gtsteffaniak/go-cache/cache	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/common/errors	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/common/logger	[no test files]
-2025/05/11 20:42:56 Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable
-2025/05/11 20:42:56 Using OnlyOffice secret from FILEBROWSER_ONLYOFFICE_SECRET environment variable
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/common/settings	0.006s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/common/utils	0.003s
-?   	github.com/gtsteffaniak/filebrowser/backend/common/version	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/database/share	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/database/storage	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt	[no test files]
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/database/users	0.002s
-?   	github.com/gtsteffaniak/filebrowser/backend/events	[no test files]
-2025/05/11 20:42:56 [DEBUG]  Saving user [admin] changepass: true
-2025/05/11 20:42:56 [DEBUG]  Saving user [non-admin] changepass: true
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/http	0.197s
-2025/05/11 20:42:57 initializing index: [test]
-2025/05/11 20:42:57 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:57 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:57 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:57 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:57 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:57 [DEBUG]  Next scan in 1m0s
-2025/05/11 20:42:58 initializing index: [test]
-2025/05/11 20:42:58 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:58 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:58 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:58 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:58 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:58 [DEBUG]  Next scan in 1m0s
-goos: linux
-goarch: amd64
-pkg: github.com/gtsteffaniak/filebrowser/backend/indexing
-cpu: 11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz
-BenchmarkFillIndex-8                     	2025/05/11 20:42:59 initializing index: [test]
-2025/05/11 20:42:59 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:59 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:42:59 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:42:59 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:42:59 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:42:59 [DEBUG]  Next scan in 1m0s
-      10	   3548759 ns/op	   38032 B/op	     452 allocs/op
-BenchmarkCheckIndexExclude-8             	      10	       172.6 ns/op	       0 B/op	       0 allocs/op
-BenchmarkCheckIndexConditionsInclude-8   	      10	       118.2 ns/op	       0 B/op	       0 allocs/op
-2025/05/11 20:43:01 initializing index: [test]
-2025/05/11 20:43:01 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:01 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:43:01 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:43:01 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:43:01 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:01 [DEBUG]  Next scan in 1m0s
-BenchmarkSearchAllIndexes-8              	2025/05/11 20:43:02 initializing index: [test]
-2025/05/11 20:43:02 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:02 [DEBUG]  Starting full scan for [test]
-2025/05/11 20:43:02 Index assessment         : [test] complexity=simple directories=0 files=0
-2025/05/11 20:43:02 [DEBUG]  Time spent indexing [test]: 0 seconds
-2025/05/11 20:43:02 [DEBUG]  Skipping source update event for mock index.
-2025/05/11 20:43:02 [DEBUG]  Next scan in 1m0s
-      10	    781119 ns/op	   38515 B/op	     900 allocs/op
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/indexing	5.097s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo	0.005s
-PASS
-ok  	github.com/gtsteffaniak/filebrowser/backend/preview	0.128s
-?   	github.com/gtsteffaniak/filebrowser/backend/swagger/docs	[no test files]
-?   	github.com/gtsteffaniak/filebrowser/backend/tools	[no test files]

backend/cmd/access.go

@@ -0,0 +1,116 @@
+package cmd
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// validateAccessRules migrates old-style access rules (without trailing slashes) to new format
+func validateAccessRules() {
+	if store.Access == nil {
+		return
+	}
+	// Get all sources
+	for sourcePath := range settings.Config.Server.SourceMap {
+		// Get all rules for this source
+		rules, err := store.Access.GetAllRules(sourcePath)
+		if err != nil {
+			logger.Errorf("Failed to get access rules for source %s: %v", sourcePath, err)
+			continue
+		}
+
+		// Check if there are any rules that need migration
+		needsMigration := false
+		for oldPath := range rules {
+			if oldPath != "/" && !strings.HasSuffix(oldPath, "/") {
+				needsMigration = true
+				break
+			}
+		}
+
+		if !needsMigration {
+			continue
+		}
+
+		migratedCount := 0
+		for oldPath, rule := range rules {
+			// Check if this path needs migration (doesn't have trailing slash and isn't root)
+			if oldPath != "/" && !strings.HasSuffix(oldPath, "/") {
+				// Create the new path with trailing slash
+				newPath := oldPath + "/"
+
+				// Migrate the rule to the new path
+				if err := migrateAccessRule(sourcePath, oldPath, newPath, rule); err != nil {
+					logger.Errorf("Failed to migrate rule from %s to %s: %v", oldPath, newPath, err)
+					continue
+				}
+
+				// Remove the old rule
+				if err := removeOldAccessRule(sourcePath, oldPath); err != nil {
+					logger.Errorf("Failed to remove old rule %s: %v", oldPath, err)
+					continue
+				}
+
+				migratedCount++
+			}
+		}
+
+		// After migration, clear cache
+		if migratedCount > 0 {
+			logger.Infof("Migrated %d access rules for source %s", migratedCount, sourcePath)
+		}
+	}
+}
+
+// migrateAccessRule creates a new access rule with the new path format
+func migrateAccessRule(sourcePath, oldPath, newPath string, rule access.FrontendAccessRule) error {
+	// Add deny users
+	for _, user := range rule.Deny.Users {
+		if err := store.Access.DenyUser(sourcePath, newPath, user); err != nil && err != errors.ErrExist {
+			return fmt.Errorf("failed to add deny user %s: %w", user, err)
+		}
+	}
+
+	// Add deny groups
+	for _, group := range rule.Deny.Groups {
+		if err := store.Access.DenyGroup(sourcePath, newPath, group); err != nil && err != errors.ErrExist {
+			return fmt.Errorf("failed to add deny group %s: %w", group, err)
+		}
+	}
+
+	// Add allow users
+	for _, user := range rule.Allow.Users {
+		if err := store.Access.AllowUser(sourcePath, newPath, user); err != nil && err != errors.ErrExist {
+			return fmt.Errorf("failed to add allow user %s: %w", user, err)
+		}
+	}
+
+	// Add allow groups
+	for _, group := range rule.Allow.Groups {
+		if err := store.Access.AllowGroup(sourcePath, newPath, group); err != nil && err != errors.ErrExist {
+			return fmt.Errorf("failed to add allow group %s: %w", group, err)
+		}
+	}
+
+	// Add deny all rule if needed
+	if rule.DenyAll {
+		if err := store.Access.DenyAll(sourcePath, newPath); err != nil && err != errors.ErrExist {
+			return fmt.Errorf("failed to add deny all rule: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// removeOldAccessRule removes the old access rule by directly accessing the internal storage
+func removeOldAccessRule(sourcePath, oldPath string) error {
+	// Access the internal storage directly to remove the old rule
+	// We need to use the unnormalized path since that's how it was stored originally
+	store.Access.RemoveRuleByPath(sourcePath, oldPath)
+	return nil
+}

backend/cmd/cli.go

@@ -60,10 +60,17 @@ func runCLI() bool {
 	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
 	var user, dbConfig string
 	var asAdmin bool
+	var fsPath, indexPath, ruleCategory, value string
+	var allow bool
 
 	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
 	setCmd.BoolVar(&asAdmin, "a", false, "Create a user as admin user, used in combination with -u")
 	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
+	setCmd.StringVar(&fsPath, "f", "", "Real filesystem path (e.g. /mnt/storage) for rule command")
+	setCmd.StringVar(&indexPath, "p", "", "Index path (e.g. /secret) for rule command")
+	setCmd.StringVar(&ruleCategory, "r", "", "Rule category: 'user', 'group', or 'all' (for deny only)")
+	setCmd.StringVar(&value, "v", "", "Value: username or groupname (not required if ruleCategory is 'all')")
+	setCmd.BoolVar(&allow, "allow", false, "Allow access (default: false, which means deny)")
 
 	// Parse subcommand flags only if a subcommand is specified
 	if len(os.Args) > 1 {
@@ -72,68 +79,48 @@ func runCLI() bool {
 			createConfig(configPath)
 			return false
 		case "set":
-			err := setCmd.Parse(os.Args[2:])
-			if err != nil {
-				setCmd.PrintDefaults()
+			if len(os.Args) < 3 {
+				fmt.Printf("error: missing subcommand for 'set'. Use 'set user' or 'set rule'\n")
 				os.Exit(1)
 			}
-			userInfo := strings.Split(user, ",")
-			if len(userInfo) < 2 {
-				fmt.Printf("not enough info to create user: \"set -u username,password\", only provided %v\n", userInfo)
-				setCmd.PrintDefaults()
-				os.Exit(1)
-			}
-			username := userInfo[0]
-			password := userInfo[1]
-			_ = getStore(dbConfig) // ignore bool check
-			user, err := store.Users.Get(username)
-			if err != nil {
-				newUser := users.User{
-					Username:    username,
-					LoginMethod: users.LoginMethodPassword,
-					NonAdminEditable: users.NonAdminEditable{
-						Password: password,
-					},
-				}
-				for _, source := range settings.Config.Server.SourceMap {
-					if source.Config.DefaultEnabled {
-						newUser.Scopes = append(newUser.Scopes, users.SourceScope{
-							Name:  source.Name,
-							Scope: source.Config.DefaultUserScope,
-						})
-					}
-				}
+			subcommand := os.Args[2]
 
-				// Create the user logic
-				if asAdmin {
-					logger.Infof("Creating user as admin: %s\n", username)
-				} else {
-					logger.Infof("Creating non-admin user: %s\n", username)
-				}
-				newUser.Permissions = settings.Config.UserDefaults.Permissions
-				newUser.Permissions.Admin = asAdmin
-				err = storage.CreateUser(newUser)
+			// Handle old syntax: "set -u user,pass -c config.yaml"
+			if subcommand == "-u" {
+				// Parse flags starting from os.Args[2:] to include the -u flag
+				err := setCmd.Parse(os.Args[2:])
 				if err != nil {
-					logger.Errorf("could not create user: %v", err)
+					setCmd.PrintDefaults()
+					os.Exit(1)
+				}
+				logger.Debugf("setUser called with args: %v, config: %v, admin: %v", os.Args, dbConfig, asAdmin)
+				err = setUser(dbConfig, asAdmin)
+				if err != nil {
+					fmt.Printf("error: %v\n", err)
+					os.Exit(1)
 				}
 				return false
 			}
-			if user.LoginMethod != users.LoginMethodPassword {
-				logger.Fatalf("user %s is not allowed to login with password authentication, cannot set password", username)
-			}
-			user.Password = password
-			user.TOTPSecret = "" // reset TOTP secret if it exists
-			user.TOTPNonce = ""  // reset TOTP nonce if it exists
-			user.LoginMethod = users.LoginMethodPassword
-			if asAdmin {
-				user.Permissions.Admin = true
-			}
-			err = store.Users.Save(user, true, false)
+
+			// New pattern: subcommand-based (e.g., "set user" or "set rule")
+			// Parse flags starting from os.Args[3:] to skip the subcommand
+			err := setCmd.Parse(os.Args[3:])
 			if err != nil {
-				logger.Errorf("could not update user: %v", err)
+				setCmd.PrintDefaults()
+				os.Exit(1)
+			}
+			switch subcommand {
+			case "rule":
+				err := setRule(dbConfig, fsPath, indexPath, ruleCategory, value, allow)
+				if err != nil {
+					fmt.Printf("error: %v\n", err)
+					os.Exit(1)
+				}
+				return false
+			default:
+				fmt.Printf("error: unknown subcommand '%s' for 'set'. Use 'set user' or 'set rule'\n", subcommand)
+				os.Exit(1)
 			}
-			fmt.Printf("successfully updated user: %s\n", username)
-			return false
 
 		case "version":
 			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
@@ -147,6 +134,130 @@ func runCLI() bool {
 	return true
 }
 
+func setRule(dbConfig, fsPath, indexPath, ruleCategory, value string, allow bool) error {
+	// Validate required parameters
+	if fsPath == "" {
+		return fmt.Errorf("real filesystem path is required: use -f <fsPath>")
+	}
+	if indexPath == "" {
+		return fmt.Errorf("index path is required: use -p <indexPath>")
+	}
+	if ruleCategory == "" {
+		return fmt.Errorf("ruleCategory is required: use -r <user|group|all>")
+	}
+	if ruleCategory != "all" && value == "" {
+		return fmt.Errorf("value is required when ruleCategory is 'user' or 'group': use -v <username|groupname>")
+	}
+
+	// Initialize store and settings
+	_ = getStore(dbConfig) // ignore bool check
+
+	// Apply the rule based on allow flag and ruleCategory
+	var err error
+	if allow {
+		switch ruleCategory {
+		case "user":
+			err = store.Access.AllowUser(fsPath, indexPath, value)
+		case "group":
+			err = store.Access.AllowGroup(fsPath, indexPath, value)
+		default:
+			return fmt.Errorf("invalid ruleCategory for allow: must be 'user' or 'group'")
+		}
+	} else {
+		switch ruleCategory {
+		case "user":
+			err = store.Access.DenyUser(fsPath, indexPath, value)
+		case "group":
+			err = store.Access.DenyGroup(fsPath, indexPath, value)
+		case "all":
+			err = store.Access.DenyAll(fsPath, indexPath)
+		default:
+			return fmt.Errorf("invalid ruleCategory: must be 'user', 'group', or 'all'")
+		}
+	}
+
+	if err != nil {
+		return fmt.Errorf("failed to add or update rule: %w", err)
+	}
+
+	action := "deny"
+	if allow {
+		action = "allow"
+	}
+	if ruleCategory == "all" {
+		fmt.Printf("successfully added %s rule for all users on index path '%s' in filesystem path '%s'\n", action, indexPath, fsPath)
+	} else {
+		fmt.Printf("successfully added %s rule for %s '%s' on index path '%s' in filesystem path '%s'\n", action, ruleCategory, value, indexPath, fsPath)
+	}
+	return nil
+}
+
+func setUser(dbConfig string, asAdmin bool) error {
+	if len(os.Args) < 4 {
+		return fmt.Errorf("missing username and password for 'set user'. Use 'set -u username,password'")
+	}
+	userInfo := strings.Split(os.Args[3], ",")
+	if len(userInfo) < 2 {
+		return fmt.Errorf("not enough info to create user: \"set -u username,password\", only provided %v", userInfo)
+	}
+	username := userInfo[0]
+	password := userInfo[1]
+	_ = getStore(dbConfig) // ignore bool check
+	user, err := store.Users.Get(username)
+	if err != nil {
+		newUser := users.User{
+			Username:    username,
+			LoginMethod: users.LoginMethodPassword,
+			NonAdminEditable: users.NonAdminEditable{
+				Password: password,
+			},
+		}
+		for _, source := range settings.Config.Server.SourceMap {
+			if source.Config.DefaultEnabled {
+				newUser.Scopes = append(newUser.Scopes, users.SourceScope{
+					Name:  source.Name,
+					Scope: source.Config.DefaultUserScope,
+				})
+			}
+		}
+
+		// Create the user logic
+		if asAdmin {
+			logger.Infof("Creating user as admin: %s\n", username)
+		} else {
+			logger.Infof("Creating non-admin user: %s\n", username)
+		}
+		newUser.Permissions = settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Permissions)
+		newUser.Permissions.Admin = asAdmin
+		err = storage.CreateUser(newUser, newUser.Permissions)
+		if err != nil {
+			return fmt.Errorf("could not create user: %v", err)
+		}
+		fmt.Printf("successfully created user")
+		return nil
+	}
+	if user.LoginMethod != users.LoginMethodPassword {
+		return fmt.Errorf("user %s is not allowed to login with password authentication, cannot set password", username)
+	}
+	user.Password = password
+	user.TOTPSecret = "" // reset TOTP secret if it exists
+	user.TOTPNonce = ""  // reset TOTP nonce if it exists
+	user.LoginMethod = users.LoginMethodPassword
+	if asAdmin {
+		user.Permissions.Admin = true
+	}
+	// Ensure version is set for existing users being updated
+	if user.Version == 0 {
+		user.Version = 1
+	}
+	err = store.Users.Save(user, true, false)
+	if err != nil {
+		return fmt.Errorf("could not update user: %v", err)
+	}
+	fmt.Printf("successfully updated user: %s\n", username)
+	return nil
+}
+
 // UserDefaults defines default settings for new users.
 type UserDefaults struct {
 	Permissions users.Permissions `yaml:"permissions"`
@@ -332,7 +443,7 @@ func createConfig(configpath string) {
 	}
 	// cleanup database if it exists
 	if _, err := os.Stat(config.Server.Database); err == nil {
-		response := askYesNoQuestion(reader, "Database specified already exists. Move databse file to backup to start fresh?", "no")
+		response := askYesNoQuestion(reader, "Database specified already exists. Move database file to backup to start fresh?", "no")
 		if !response {
 			return
 		}
@@ -349,11 +460,16 @@ func createConfig(configpath string) {
 }
 
 func generateYaml() {
-	if os.Getenv("FILEBROWSER_GENERATE_CONFIG") != "" {
+	generateConfig := os.Getenv("FILEBROWSER_GENERATE_CONFIG") == "true"
+	if generateConfig || settings.Env.IsDevMode {
 		logger.Info("Generating config.yaml")
 		settings.GenerateYaml()
+	}
+
+	if generateConfig {
 		os.Exit(0)
 	}
+
 }
 
 func SplitByMultiple(str string) []string {

backend/cmd/root.go

@@ -3,9 +3,11 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"io/fs"
 	"os"
 	"os/signal"
 	"syscall"
+	"time"
 
 	_ "net/http/pprof"
 
@@ -15,7 +17,9 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
+	"github.com/gtsteffaniak/filebrowser/backend/icons"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
 	"github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
@@ -54,12 +58,14 @@ func StartFilebrowser() {
 	if !keepGoing {
 		return
 	}
-	info, _ := utils.CheckForUpdates()
-	if info.LatestVersion != "" {
-		logger.Infof("A new version is available: %s (current: %s)", info.LatestVersion, info.CurrentVersion)
-		logger.Infof("Release notes: %s", info.ReleaseNotes)
+	if !settings.Config.Server.DisableUpdateCheck {
+		info, _ := utils.CheckForUpdates()
+		if info.LatestVersion != "" {
+			logger.Infof("A new version is available: %s (current: %s)", info.LatestVersion, info.CurrentVersion)
+			logger.Infof("Release notes: %s", info.ReleaseNotes)
+		}
+		go utils.StartCheckForUpdates()
 	}
-	go utils.StartCheckForUpdates()
 
 	// Create context and channels for graceful shutdown
 	ctx, cancel := context.WithCancel(context.Background())
@@ -75,6 +81,14 @@ func StartFilebrowser() {
 	if !dbExists {
 		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
 	}
+
+	// Dev mode enables development features like template hot-reloading
+	_, err := os.Stat("http/dist")
+	// In dev mode, always use filesystem assets. Otherwise, check if http/dist exists
+	if !settings.Env.IsDevMode {
+		settings.Env.EmbeddedFs = os.IsNotExist(err)
+	}
+
 	sourceList := []string{}
 	for path, source := range settings.Config.Server.SourceMap {
 		sourceList = append(sourceList, fmt.Sprintf("%v: %v", source.Name, path))
@@ -84,7 +98,16 @@ func StartFilebrowser() {
 	logger.Infof("Auth Methods             : %v", settings.Config.Auth.AuthMethods)
 	logger.Info(database)
 	logger.Infof("Sources                  : %v", sourceList)
-
+	logger.Debugf("Using Embedded FS        : %v", settings.Env.EmbeddedFs)
+	walModeStr := "OFF"
+	if settings.Config.Server.IndexSqlConfig.WalMode {
+		walModeStr = "WAL"
+	}
+	logger.Infof("SQL Journal Mode         : %v", walModeStr)
+	if settings.Config.Server.CacheDirCleanup {
+		logger.Debugf("clearing cache dir: %s", settings.Config.Server.CacheDir)
+		fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
+	}
 	serverConfig := settings.Config.Server
 	swagInfo := docs.SwaggerInfo
 	swagInfo.BasePath = serverConfig.BaseURL
@@ -93,11 +116,30 @@ func StartFilebrowser() {
 	if len(settings.Config.Server.SourceMap) == 0 {
 		logger.Fatal("No sources configured, exiting...")
 	}
-	for _, source := range settings.Config.Server.SourceMap {
-		go indexing.Initialize(source, false)
+
+	// Initialize shared index database before starting HTTP service
+	isNewDb, err := indexing.InitializeIndexDB()
+	if err != nil {
+		logger.Fatalf("Failed to initialize index database: %v", err)
 	}
-	validateUserInfo()
+
+	// Set indexing storage for persistence
+	if store != nil && store.Indexing != nil {
+		indexing.SetIndexingStorage(store.Indexing)
+		if isNewDb {
+			if err := store.Indexing.ResetAllComplexities(); err != nil {
+				logger.Errorf("Failed to reset index complexities: %v", err)
+			}
+		}
+	}
+
+	for _, source := range settings.Config.Server.SourceMap {
+		go indexing.Initialize(source, false, isNewDb)
+	}
+	validateUserInfo(!dbExists)
 	validateOfficeIntegration()
+	validateAccessRules()
+	validateShareInfo()
 	// Start the rootCMD in a goroutine
 	go func() {
 		if err := rootCMD(ctx, store, &serverConfig, shutdownComplete); err != nil {
@@ -113,10 +155,23 @@ func StartFilebrowser() {
 	case <-done:
 		logger.Info("Server stopped unexpectedly. Shutting down...")
 	}
-	fileutils.ClearCacheDir()
 
-	<-shutdownComplete // Ensure we don't exit prematurely
-	// Wait for the server to stop
+	// Stop all indexing scanners before closing the database
+	indexing.StopAllScanners()
+
+	// Give scanners a moment to finish their current scan operations
+	time.Sleep(100 * time.Millisecond)
+
+	// cleanup temp databases
+	indexDB := indexing.GetIndexDB()
+	if indexDB != nil {
+		indexDB.Close()
+	}
+	if settings.Config.Server.CacheDirCleanup {
+		logger.Debugf("clearing cache dir: %s", settings.Config.Server.CacheDir)
+		fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
+	}
+	<-shutdownComplete
 	logger.Info("Shutdown complete.")
 }
 
@@ -126,12 +181,33 @@ func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.
 	}
 	cacheDir := settings.Config.Server.CacheDir
 	numWorkers := settings.Config.Server.NumImageProcessors
-	ffpmpegPath := settings.Config.Integrations.Media.FfmpegPath
-	// setup disk cache
-	err := preview.StartPreviewGenerator(numWorkers, ffpmpegPath, cacheDir)
+	ffmpeg.SetFFmpegPaths()
+
+	// Initialize asset filesystem before starting services
+	if settings.Env.EmbeddedFs {
+		embeddedAssets := fbhttp.GetEmbeddedAssets()
+		subAssets, err := fs.Sub(embeddedAssets, "embed")
+		if err != nil {
+			logger.Fatalf("Failed to create sub filesystem: %v", err)
+		}
+		fileutils.InitAssetFS(subAssets, true)
+	} else {
+		fileutils.InitAssetFS(nil, false)
+	}
+
+	// Start preview service
+	err := preview.StartPreviewGenerator(numWorkers, cacheDir)
 	if err != nil {
 		logger.Fatalf("Error starting preview service: %v", err)
 	}
+	logger.Debugf("MuPDF Enabled            : %v", settings.Env.MuPdfAvailable)
+	logger.Debugf("Media Enabled            : %v", settings.MediaEnabled())
+
+	// Generate PWA icons after preview service is initialized
+	if err := icons.GeneratePWAIcons(); err != nil {
+		logger.Warningf("Failed to generate PWA icons: %v", err)
+	}
+
 	fbhttp.StartHttp(ctx, store, shutdownComplete)
 	return nil
 }

backend/cmd/share.go

@@ -0,0 +1,57 @@
+package cmd
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// validateShareInfo migrates share links to add default sidebar links
+func validateShareInfo() {
+	if store.Share == nil {
+		return
+	}
+
+	// Get all shares
+	shares, err := store.Share.All()
+	if err != nil {
+		logger.Debugf("No shares found or error getting shares: %v", err)
+		return
+	}
+
+	migratedCount := 0
+	for _, link := range shares {
+		// Check if this share needs migration (version not set or 0)
+		if link.Version == 0 {
+			// Add default sidebar links
+			link.SidebarLinks = []users.SidebarLink{
+				{
+					Name:     "Share QR Code and Info",
+					Category: "shareInfo",
+					Target:   "#",
+					Icon:     "qr_code",
+				},
+				{
+					Name:     "Download",
+					Category: "download",
+					Target:   "#",
+					Icon:     "download",
+				},
+			}
+
+			// Set version to 1 to indicate migration is complete
+			link.Version = 1
+
+			// Save the updated share
+			if err := store.Share.Save(link); err != nil {
+				logger.Errorf("Failed to migrate share %s: %v", link.Hash, err)
+				continue
+			}
+
+			migratedCount++
+		}
+	}
+
+	if migratedCount > 0 {
+		logger.Infof("Migrated %d share links with default sidebar links", migratedCount)
+	}
+}

backend/cmd/user.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"fmt"
+	"os"
 	"reflect"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
@@ -10,9 +11,9 @@ import (
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
-var createBackup = []bool{}
+var createBackup = false
 
-func validateUserInfo() {
+func validateUserInfo(newDB bool) {
 	// update source info for users if names/sources/paths might have changed
 	usersList, err := store.Users.Gets()
 	if err != nil {
@@ -33,6 +34,12 @@ func validateUserInfo() {
 		if updateLoginType(user) {
 			updateUser = true
 		}
+		if updateShowFirstLogin(user) {
+			updateUser = true
+		}
+		if updateSidebarLinks(user) {
+			updateUser = true
+		}
 		adminUser := settings.Config.Auth.AdminUsername
 		adminPass := settings.Config.Auth.AdminPassword
 		passwordEnabled := settings.Config.Auth.Methods.PasswordAuth.Enabled
@@ -44,7 +51,8 @@ func validateUserInfo() {
 			changePass = true
 		}
 		if updateUser {
-			if len(createBackup) == 1 {
+			skipCreateBackup := os.Getenv("FILEBROWSER_DISABLE_AUTOMATIC_BACKUP") == "true" || newDB
+			if createBackup && !skipCreateBackup {
 				logger.Warning("Incompatible user settings detected, creating backup of database before converting.")
 				err = fileutils.CopyFile(settings.Config.Server.Database, fmt.Sprintf("%s.bak", settings.Config.Server.Database))
 				if err != nil {
@@ -71,27 +79,23 @@ func updateUserScopes(user *users.User) bool {
 
 	// Preserve order by using Config.Server.Sources
 	for _, src := range settings.Config.Server.Sources {
-		realsource, ok := settings.Config.Server.NameToSource[src.Name]
-		if !ok {
-			continue
-		}
-		existingScope, ok := existing[realsource.Path]
+		existingScope, ok := existing[src.Path]
 		if ok {
 			// If scope is empty and there's a default, apply default
 			if existingScope.Scope == "" {
 				existingScope.Scope = src.Config.DefaultUserScope
 			}
-		} else if realsource.Config.DefaultEnabled {
-			existingScope.Scope = realsource.Config.DefaultUserScope
+		} else if src.Config.DefaultEnabled {
+			existingScope.Scope = src.Config.DefaultUserScope
 		} else {
 			continue
 		}
 
 		newScopes = append(newScopes, users.SourceScope{
-			Name:  realsource.Path,
+			Name:  src.Path,
 			Scope: existingScope.Scope,
 		})
-		seen[realsource.Path] = struct{}{}
+		seen[src.Path] = struct{}{}
 	}
 
 	// Preserve user-defined scopes not matching current sources, append to end
@@ -105,9 +109,21 @@ func updateUserScopes(user *users.User) bool {
 	return changed
 }
 
+func updateShowFirstLogin(user *users.User) bool {
+	if user.ShowFirstLogin && !settings.Env.IsFirstLoad {
+		user.ShowFirstLogin = false
+		return true
+	}
+	return false
+}
+
 // func to convert legacy user with perm key to permissions
 func updatePermissions(user *users.User) bool {
-	updateUser := false
+	if user.Version >= 1 {
+		return false
+	}
+	updateUser := true
+	user.Permissions.Download = true
 	// if any keys are true, set the permissions to true
 	if user.Perm.Api {
 		user.Permissions.Api = true
@@ -129,8 +145,29 @@ func updatePermissions(user *users.User) bool {
 		user.Perm.Share = false
 		updateUser = true
 	}
+	if user.Perm.Create {
+		user.Permissions.Create = true
+		user.Perm.Create = false
+		updateUser = true
+	}
+	if user.Perm.Create {
+		user.Permissions.Create = true
+		user.Perm.Create = false
+		updateUser = true
+	}
+	if user.Perm.Download {
+		user.Permissions.Download = true
+		user.Perm.Download = false
+		updateUser = true
+	}
+	if user.Permissions.Modify {
+		user.Permissions.Create = true
+		user.Permissions.Delete = true
+		updateUser = true
+	}
+	user.Version = 1
 	if updateUser {
-		createBackup = append(createBackup, true)
+		createBackup = true
 	}
 	return updateUser
 }
@@ -152,3 +189,60 @@ func updatePreviewSettings(user *users.User) bool {
 	}
 	return false
 }
+
+// updateSidebarLinks checks if user has stale source links and rebuilds them if needed
+func updateSidebarLinks(user *users.User) bool {
+	// Count source links and check if any are still valid
+	sourceLinksCount := 0
+	validSourceLinksCount := 0
+
+	for _, link := range user.SidebarLinks {
+		if link.Category == "source" {
+			sourceLinksCount++
+			// Check if this source still exists
+			if link.SourceName != "" {
+				if _, ok := settings.Config.Server.SourceMap[link.SourceName]; ok {
+					validSourceLinksCount++
+				}
+			}
+		}
+	}
+
+	// If user has no source links, don't update anything
+	if sourceLinksCount == 0 {
+		return false
+	}
+
+	// If user has source links but NONE are valid, rebuild from their scopes
+	if validSourceLinksCount == 0 {
+		logger.Infof("User %s has %d stale source links, rebuilding from scopes", user.Username, sourceLinksCount)
+
+		// Remove all existing source links
+		newLinks := []users.SidebarLink{}
+		for _, link := range user.SidebarLinks {
+			if link.Category != "source" {
+				newLinks = append(newLinks, link)
+			}
+		}
+
+		// Add new source links based on user's scopes
+		for _, scope := range user.Scopes {
+			if source, ok := settings.Config.Server.SourceMap[scope.Name]; ok {
+				// User has access to this source, add it to sidebar
+				newLinks = append(newLinks, users.SidebarLink{
+					Name:       source.Name,
+					Category:   "source",
+					Target:     "/",
+					Icon:       "",
+					SourceName: source.Path,
+				})
+			}
+		}
+
+		user.SidebarLinks = newLinks
+		return true
+	}
+
+	// User has at least one valid source link, no update needed
+	return false
+}

backend/cmd/user_test.go

@@ -16,14 +16,14 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 		DefaultUserScope: "/defaultA",
 	}}
 	sourceB := settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
-	settings.Config.Server.Sources = []settings.Source{sourceA, sourceB}
-	settings.Config.Server.SourceMap = map[string]settings.Source{
-		"/pathA": sourceA,
-		"/pathB": sourceB,
+	settings.Config.Server.Sources = []*settings.Source{&sourceA, &sourceB}
+	settings.Config.Server.SourceMap = map[string]*settings.Source{
+		"/pathA": &sourceA,
+		"/pathB": &sourceB,
 	}
-	settings.Config.Server.NameToSource = map[string]settings.Source{
-		"sourceA": sourceA,
-		"sourceB": sourceB,
+	settings.Config.Server.NameToSource = map[string]*settings.Source{
+		"sourceA": &sourceA,
+		"sourceB": &sourceB,
 	}
 
 	// ---------------------
@@ -159,14 +159,14 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 		CreateUserDir:    true,
 	}}
 	sourceB = settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
-	settings.Config.Server.Sources = []settings.Source{sourceA, sourceB}
-	settings.Config.Server.SourceMap = map[string]settings.Source{
-		"/pathA": sourceA,
-		"/pathB": sourceB,
+	settings.Config.Server.Sources = []*settings.Source{&sourceA, &sourceB}
+	settings.Config.Server.SourceMap = map[string]*settings.Source{
+		"/pathA": &sourceA,
+		"/pathB": &sourceB,
 	}
-	settings.Config.Server.NameToSource = map[string]settings.Source{
-		"sourceA": sourceA,
-		"sourceB": sourceB,
+	settings.Config.Server.NameToSource = map[string]*settings.Source{
+		"sourceA": &sourceA,
+		"sourceB": &sourceB,
 	}
 
 	// Run again without resetting user objects to test idempotency + renaming

backend/common/errors/errors.go

@@ -15,6 +15,7 @@ var (
 	ErrInvalidOption        = errors.New("invalid option")
 	ErrInvalidAuthMethod    = errors.New("invalid auth method")
 	ErrPermissionDenied     = errors.New("permission denied")
+	ErrAccessDenied         = errors.New("access denied")
 	ErrInvalidRequestParams = errors.New("invalid request params")
 	ErrSourceIsParent       = errors.New("source is parent")
 	ErrNoTotpProvided       = errors.New("OTP code is required for user")
@@ -22,4 +23,6 @@ var (
 	ErrUnauthorized         = errors.New("user unauthorized")
 	ErrNotIndexed           = errors.New("directory or item excluded from indexing")
 	ErrWrongLoginMethod     = errors.New("user attempted to login with wrong login method")
+	ErrDownloadNotAllowed   = errors.New("downloads are not allowed for this share")
+	ErrUploadNotAllowed     = errors.New("upload permission not allowed for this share")
 )

backend/common/settings/auth.go

@@ -8,16 +8,34 @@ import (
 	"net/http"
 
 	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
+// userAgentTransport wraps an http.RoundTripper to add a User-Agent header
+type userAgentTransport struct {
+	base      http.RoundTripper
+	userAgent string
+}
+
+// RoundTrip implements the http.RoundTripper interface
+func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Clone the request to avoid modifying the original
+	reqCopy := req.Clone(req.Context())
+	// Set User-Agent header if not already set
+	if reqCopy.Header.Get("User-Agent") == "" {
+		reqCopy.Header.Set("User-Agent", t.userAgent)
+	}
+	return t.base.RoundTrip(reqCopy)
+}
+
 type Auth struct {
-	TokenExpirationHours int          `json:"tokenExpirationHours"` // the number of hours until the token expires. Default is 2 hours.
+	TokenExpirationHours int          `json:"tokenExpirationHours"` // time in hours each web UI session token is valid for. Default is 2 hours.
 	Methods              LoginMethods `json:"methods"`
-	Key                  string       `json:"key"`           // the key used to sign the JWT tokens. If not set, a random key will be generated.
-	AdminUsername        string       `json:"adminUsername"` // the username of the admin user. If not set, the default is "admin".
-	AdminPassword        string       `json:"adminPassword"` // the password of the admin user. If not set, the default is "admin".
-	TotpSecret           string       `json:"totpSecret"`    // secret used to encrypt TOTP secrets
+	Key                  string       `json:"key"`           // secret: the key used to sign the JWT tokens. If not set, a random key will be generated.
+	AdminUsername        string       `json:"adminUsername"` // secret: the username of the admin user. If not set, the default is "admin".
+	AdminPassword        string       `json:"adminPassword"` // secret: the password of the admin user. If not set, the default is "admin".
+	TotpSecret           string       `json:"totpSecret"`    // secret: secret used to encrypt TOTP secrets
 	AuthMethods          []string     `json:"-"`
 }
 
@@ -52,8 +70,8 @@ type Recaptcha struct {
 // OpenID OAuth2.0
 type OidcConfig struct {
 	Enabled           bool                  `json:"enabled"`           // whether to enable OIDC authentication
-	ClientID          string                `json:"clientId"`          // client id of the OIDC application
-	ClientSecret      string                `json:"clientSecret"`      // client secret of the OIDC application
+	ClientID          string                `json:"clientId"`          // secret: client id of the OIDC application
+	ClientSecret      string                `json:"clientSecret"`      // secret: client secret of the OIDC application
 	IssuerUrl         string                `json:"issuerUrl"`         // authorization URL of the OIDC provider
 	Scopes            string                `json:"scopes"`            // scopes to request from the OIDC provider
 	UserIdentifier    string                `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username", can also be "email" or "username", or "phone"
@@ -84,22 +102,28 @@ func validateOidcAuth() error {
 	}
 	ctx := context.Background()
 
-	// If disableVerifyTLS is true, create a custom HTTP client
-	// and set it in the context for the OIDC provider.
+	// Create a custom HTTP client with proper User-Agent to avoid being blocked by bot protection
+	transport := &http.Transport{
+		Proxy: http.ProxyFromEnvironment, // Respect HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables
+	}
+
+	// If disableVerifyTLS is true, disable TLS verification
 	if oidcCfg.DisableVerifyTLS {
-		// Create a custom transport with InsecureSkipVerify set to true
-		transport := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		}
-		customClient := &http.Client{
-			Transport: transport,
-		}
-		// Use oidc.ClientContext to pass the custom client to the OIDC library
-		ctx = oidc.ClientContext(ctx, customClient)
-		// Log that TLS verification is disabled (important for security awareness)
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
 		logger.Warning("OIDC TLS verification is disabled.")
 	}
 
+	// Create custom client with User-Agent header to bypass bot protection (like Cloudflare Bot Fight Mode)
+	customClient := &http.Client{
+		Transport: &userAgentTransport{
+			base:      transport,
+			userAgent: fmt.Sprintf("FileBrowser Quantum - %s (OIDC Client)", version.Version),
+		},
+	}
+
+	// Use oidc.ClientContext to pass the custom client to the OIDC library
+	ctx = oidc.ClientContext(ctx, customClient)
+
 	provider, err := oidc.NewProvider(ctx, oidcCfg.IssuerUrl)
 	if err != nil {
 		return fmt.Errorf("url '%v' failed to create OIDC provider: %w", oidcCfg.IssuerUrl, err)

backend/common/settings/config.go

@@ -1,17 +1,22 @@
 package settings
 
 import (
+	"bytes"
 	"fmt"
+	"io"
 	"log"
 	"os"
 	"path/filepath"
 	"runtime"
 	"slices"
+	"strconv"
 	"strings"
 	"time"
 
 	"github.com/go-playground/validator/v10"
 	"github.com/goccy/go-yaml"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
@@ -30,6 +35,9 @@ func Initialize(configFile string) {
 		time.Sleep(5 * time.Second) // allow sleep time before exiting to give docker/kubernetes time before restarting
 		logger.Fatal(err.Error())
 	}
+	setupLogging()
+	// setup logging first to ensure we log any errors
+	setupEnv()
 	err = ValidateConfig(Config)
 	if err != nil {
 		errmsg := "The provided config file failed validation. "
@@ -40,14 +48,186 @@ func Initialize(configFile string) {
 		time.Sleep(5 * time.Second) // allow sleep time before exiting to give docker/kubernetes time before restarting
 		logger.Fatal(err.Error())
 	}
-	setupLogging()
+	setupFs()
+	setupServer()
 	setupAuth(false)
 	setupSources(false)
+	InitializeUserResolvers() // Initialize user package resolvers after sources are set up
 	setupUrls()
-	setupFrontend()
+	setupFrontend(false)
+	setupMedia()
 }
 
-func setupFrontend() {
+func setupServer() {
+	if Config.Server.ListenAddress == "" {
+		Config.Server.ListenAddress = "0.0.0.0"
+	}
+	// Check environment variable first (overrides config file)
+	if os.Getenv("FILEBROWSER_SQL_WAL") == "true" {
+		Config.Server.IndexSqlConfig.WalMode = true
+	}
+	// WalMode is false by default (OFF journaling)
+}
+
+func setupEnv() {
+	Env.IsPlaywright = os.Getenv("FILEBROWSER_PLAYWRIGHT_TEST") == "true"
+	if Env.IsPlaywright {
+		logger.Warning("Running in playwright test mode. This is not recommended for production.")
+	}
+	Env.IsDevMode = os.Getenv("FILEBROWSER_DEVMODE") == "true"
+	if Env.IsDevMode {
+		logger.Warning("Running in dev mode. This is not recommended for production.")
+	}
+}
+
+func setupFs() {
+	// Convert permission values (like 644, 755) to octal interpretation
+	filePermOctal, err := strconv.ParseUint(Config.Server.Filesystem.CreateFilePermission, 8, 32)
+	if err != nil {
+		Config.Server.Filesystem.CreateFilePermission = "644"
+		filePermOctal, _ = strconv.ParseUint("644", 8, 32)
+	}
+	dirPermOctal, err := strconv.ParseUint(Config.Server.Filesystem.CreateDirectoryPermission, 8, 32)
+	if err != nil {
+		Config.Server.Filesystem.CreateDirectoryPermission = "755"
+		dirPermOctal, _ = strconv.ParseUint("755", 8, 32)
+	}
+	fileutils.SetFsPermissions(os.FileMode(filePermOctal), os.FileMode(dirPermOctal))
+
+	// Perform mandatory cache directory speed test
+	testCacheDirSpeed()
+
+	logger.Infof("cache directory setup successfully: %v", Config.Server.CacheDir)
+
+}
+
+// testCacheDirSpeed performs a mandatory speed test on the cache directory by writing,
+// reading, and deleting a 10MB test file. Reports write and read performance in MB/s.
+func testCacheDirSpeed() {
+	msgPrfx := "cacheDir"
+	failSuffix := "Please review documentation to ensure a valid cache directory is configured https://filebrowserquantum.com/en/docs/configuration/server/#cachedir"
+	const testFileSize = 10 * 1024 * 1024 // 10MB
+
+	// Ensure cache directory exists
+	err := os.MkdirAll(Config.Server.CacheDir, fileutils.PermDir)
+	if err != nil {
+		logger.Fatalf("%s failed to create cache directory: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	testFileName := filepath.Join(Config.Server.CacheDir, "speed_test.tmp")
+
+	// Create test data (10MB of zeros)
+	testData := make([]byte, testFileSize)
+
+	// Test write performance
+	writeStart := time.Now()
+	file, err := os.Create(testFileName)
+	if err != nil {
+		logger.Fatalf("%s failed to create test file: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	written, err := file.Write(testData)
+	if err != nil {
+		file.Close()
+		os.Remove(testFileName)
+		logger.Fatalf("%s failed to write test file: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	err = file.Sync() // Ensure data is written to disk
+	if err != nil {
+		file.Close()
+		os.Remove(testFileName)
+		logger.Fatalf("%s failed to sync test file to disk: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	err = file.Close()
+	if err != nil {
+		os.Remove(testFileName)
+		logger.Fatalf("%s failed to close test file: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	writeDuration := time.Since(writeStart)
+	writeSpeedMBs := float64(written) / (1024 * 1024) / writeDuration.Seconds()
+
+	// Test read performance
+	readStart := time.Now()
+	file, err = os.Open(testFileName)
+	if err != nil {
+		os.Remove(testFileName)
+		logger.Fatalf("%s failed to open test file for reading: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	readData := make([]byte, testFileSize)
+	readBytes, err := io.ReadFull(file, readData)
+	if err != nil {
+		file.Close()
+		os.Remove(testFileName)
+		logger.Fatalf("%s failed to read test file: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	err = file.Close()
+	if err != nil {
+		os.Remove(testFileName)
+		logger.Fatalf("%s failed to close test file after reading: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	readDuration := time.Since(readStart)
+	readSpeedMBs := float64(readBytes) / (1024 * 1024) / readDuration.Seconds()
+
+	// Verify data integrity
+	if readBytes != written {
+		os.Remove(testFileName)
+		logger.Fatalf("%s data integrity check failed: wrote %d bytes but read %d bytes\n%s", msgPrfx, written, readBytes, failSuffix)
+	}
+
+	// Clean up test file
+	err = os.Remove(testFileName)
+	if err != nil {
+		logger.Fatalf("%s failed to remove test file: %v\n%s", msgPrfx, err, failSuffix)
+	}
+
+	// Log performance results
+	writeDurationMs := writeDuration.Seconds() * 1000
+	readDurationMs := readDuration.Seconds() * 1000
+	const highLatencyThresholdMs = 1000.0 // 1 second for 10MB file indicates high latency
+
+	if writeSpeedMBs < 50 {
+		slowSuffix := " Ensure you configure a faster cache directory via the `server.cacheDir` configuration option."
+		logger.Warningf("%s slow write speed detected: %.2f MB/s (%.2f ms)\n%s\n%s", msgPrfx, writeSpeedMBs, writeDurationMs, failSuffix, slowSuffix)
+	} else if writeDurationMs > highLatencyThresholdMs {
+		slowSuffix := " Ensure you configure a faster cache directory via the `server.cacheDir` configuration option."
+		logger.Warningf("%s high write latency detected: %.2f ms for 10MB file (speed: %.2f MB/s). This may indicate network storage or I/O issues.\n%s\n%s", msgPrfx, writeDurationMs, writeSpeedMBs, failSuffix, slowSuffix)
+	} else {
+		logger.Debugf("%s write speed: %.2f MB/s (%.2f ms)", msgPrfx, writeSpeedMBs, writeDurationMs)
+	}
+	if readSpeedMBs < 50 {
+		slowSuffix := " Ensure you configure a faster cache directory via the `server.cacheDir` configuration option."
+		logger.Warningf("%s slow read speed detected: %.2f MB/s (%.2f ms)\n%s\n%s", msgPrfx, readSpeedMBs, readDurationMs, failSuffix, slowSuffix)
+	} else if readDurationMs > highLatencyThresholdMs {
+		slowSuffix := " Ensure you configure a faster cache directory via the `server.cacheDir` configuration option."
+		logger.Warningf("%s high read latency detected: %.2f ms for 10MB file (speed: %.2f MB/s). This may indicate network storage or I/O issues.\n%s\n%s", msgPrfx, readDurationMs, readSpeedMBs, failSuffix, slowSuffix)
+	} else {
+		logger.Debugf("%s read speed : %.2f MB/s (%.2f ms)", msgPrfx, readSpeedMBs, readDurationMs)
+	}
+	// check cache directory disk free space
+	freeSpace, err := fileutils.GetFreeSpace(Config.Server.CacheDir)
+	if err != nil {
+		logger.Fatalf("%s failed to get free space for cache directory: %v\n%s", msgPrfx, err, failSuffix)
+	}
+	freeSpaceGB := float64(freeSpace) / (1024 * 1024 * 1024)
+	logger.Debugf("%s cache directory has %.2f GB of free space", msgPrfx, freeSpaceGB)
+	const minRecommendedGB = 20.0
+	if freeSpaceGB < minRecommendedGB {
+		logger.Warningf("%s only has %.2f GB of free space, this is less than the %.0f GB minimum recommended free space.\n%s", msgPrfx, freeSpaceGB, minRecommendedGB, failSuffix)
+	}
+}
+
+func setupFrontend(generate bool) {
+	// Load login icon configuration at startup
+	loadLoginIcon()
+	if Config.Server.MinSearchLength == 0 {
+		Config.Server.MinSearchLength = 3
+	}
 	if !Config.Frontend.DisableDefaultLinks {
 		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
 			Text:  fmt.Sprintf("(%v)", version.Version),
@@ -56,14 +236,25 @@ func setupFrontend() {
 		})
 		Config.Frontend.ExternalLinks = append(Config.Frontend.ExternalLinks, ExternalLink{
 			Text: "Help",
-			Url:  "https://github.com/gtsteffaniak/filebrowser/wiki",
+			Url:  "help prompt",
 		})
 	}
+	if Config.Frontend.Description == "" {
+		Config.Frontend.Description = "FileBrowser Quantum is a file manager for the web which can be used to manage files on your server"
+	}
 	Config.Frontend.Styling.LightBackground = FallbackColor(Config.Frontend.Styling.LightBackground, "#f5f5f5")
 	Config.Frontend.Styling.DarkBackground = FallbackColor(Config.Frontend.Styling.DarkBackground, "#141D24")
-	Config.Frontend.Styling.CustomCSS = readCustomCSS(Config.Frontend.Styling.CustomCSS)
+	var err error
+	if Config.Frontend.Styling.CustomCSS != "" {
+		Config.Frontend.Styling.CustomCSSRaw, err = readCustomCSS(Config.Frontend.Styling.CustomCSS)
+		if err != nil {
+			logger.Warning(err.Error())
+		}
+	}
 	Config.Frontend.Styling.CustomThemeOptions = map[string]CustomTheme{}
-	Config.Frontend.Styling.CustomThemes = map[string]CustomTheme{}
+	if Config.Frontend.Styling.CustomThemes == nil {
+		Config.Frontend.Styling.CustomThemes = map[string]CustomTheme{}
+	}
 	for name, theme := range Config.Frontend.Styling.CustomThemes {
 		addCustomTheme(name, theme.Description, theme.CSS)
 	}
@@ -73,24 +264,56 @@ func setupFrontend() {
 		// check if file exists
 		if _, err := os.Stat("reduce-rounded-corners.css"); err == nil {
 			addCustomTheme("alternative", "Reduce rounded corners", "reduce-rounded-corners.css")
+			if generate {
+				Config.Frontend.Styling.CustomThemes["alternative"] = CustomTheme{
+					Description: "Reduce rounded corners",
+					CSS:         "reduce-rounded-corners.css",
+				}
+			}
 		}
 	}
 	_, ok := Config.Frontend.Styling.CustomThemes["default"]
 	if !ok {
 		addCustomTheme("default", "The default theme", "")
 	}
+	// Load custom favicon if configured
+	loadCustomFavicon()
 }
 
-func getRealPath(path string) string {
-	realPath, err := filepath.Abs(path)
-	if err != nil {
-		logger.Fatalf("could not find configured source path: %v", err)
+func setupMedia() {
+	// Save user's explicit config before applying defaults
+	userImageConfig := make(map[ImagePreviewType]*bool)
+	for k, v := range Config.Integrations.Media.Convert.ImagePreview {
+		userImageConfig[k] = v
 	}
-	// check path exists
-	if _, err = os.Stat(realPath); os.IsNotExist(err) {
-		logger.Fatalf("configured source path does not exist: %v", realPath)
+
+	// Re-initialize with defaults (gets wiped out during YAML unmarshal)
+	Config.Integrations.Media.Convert.ImagePreview = make(map[ImagePreviewType]*bool)
+	Config.Integrations.Media.Convert.ImagePreview[HEICImagePreview] = boolPtr(false) // HEIC defaults to disabled
+	Config.Integrations.Media.Convert.ImagePreview[JPEGImagePreview] = boolPtr(true)  // JPEG fallback defaults to enabled
+
+	// Apply user overrides (only for keys explicitly set in YAML)
+	for k, v := range userImageConfig {
+		Config.Integrations.Media.Convert.ImagePreview[k] = v
+	}
+
+	// VideoPreview: Merge user config with defaults
+	// Save user's explicit config from YAML
+	userVideoConfig := make(map[VideoPreviewType]*bool)
+	for k, v := range Config.Integrations.Media.Convert.VideoPreview {
+		userVideoConfig[k] = v
+	}
+
+	// Re-initialize with defaults (all enabled)
+	Config.Integrations.Media.Convert.VideoPreview = make(map[VideoPreviewType]*bool)
+	for _, t := range AllVideoPreviewTypes {
+		Config.Integrations.Media.Convert.VideoPreview[t] = boolPtr(true)
+	}
+
+	// Apply user overrides (only for keys explicitly set in YAML)
+	for k, v := range userVideoConfig {
+		Config.Integrations.Media.Convert.VideoPreview[k] = v
 	}
-	return realPath
 }
 
 func setupSources(generate bool) {
@@ -101,7 +324,14 @@ func setupSources(generate bool) {
 			if source.Config.Disabled {
 				continue
 			}
-			realPath := getRealPath(source.Path)
+			realPath, err := filepath.Abs(source.Path)
+			if err != nil {
+				logger.Fatalf("error getting real path for source %v: %v", source.Path, err)
+			}
+			exists := utils.CheckPathExists(realPath)
+			if !exists {
+				logger.Warningf("source path %v is currently not available", realPath)
+			}
 			name := filepath.Base(realPath)
 			if name == "\\" {
 				name = strings.Split(realPath, ":")[0]
@@ -119,8 +349,8 @@ func setupSources(generate bool) {
 					source.Name = name
 				}
 			}
-			modifyExcludeInclude(&source)
-
+			modifyExcludeInclude(source)
+			setConditionals(source)
 			if source.Config.DefaultUserScope == "" {
 				source.Config.DefaultUserScope = "/"
 			}
@@ -129,15 +359,19 @@ func setupSources(generate bool) {
 		}
 	}
 	// clean up the in memory source list to be accurate and unique
-	sourceList := []Source{}
+	sourceList := []*Source{}
 	defaultScopes := []users.SourceScope{}
 	allSourceNames := []string{}
+	if len(Config.Server.Sources) == 1 {
+		Config.Server.Sources[0].Config.DefaultEnabled = true
+	}
 	for _, sourcePathOnly := range Config.Server.Sources {
-		realPath := getRealPath(sourcePathOnly.Path)
+		absPath := sourcePathOnly.Path
 		if generate {
-			realPath = generatorPath // use placeholder path
+			// When generating, skip path validation and use the already-set path
+			absPath = sourcePathOnly.Path
 		}
-		source, ok := Config.Server.SourceMap[realPath]
+		source, ok := Config.Server.SourceMap[absPath]
 		if ok && !slices.Contains(allSourceNames, source.Name) {
 			sourceList = append(sourceList, source)
 			if source.Config.DefaultEnabled {
@@ -148,7 +382,7 @@ func setupSources(generate bool) {
 			}
 			allSourceNames = append(allSourceNames, source.Name)
 		} else {
-			logger.Warningf("source %v is not configured correctly, skipping", sourcePathOnly.Path)
+			logger.Warningf("skipping source: %v", sourcePathOnly.Path)
 		}
 	}
 	Config.UserDefaults.DefaultScopes = defaultScopes
@@ -219,15 +453,22 @@ func setupLogging() {
 		}
 	}
 	for _, logConfig := range Config.Server.Logging {
-		logConfig := logger.JsonConfig{
-			Levels:    logConfig.Levels,
-			ApiLevels: logConfig.ApiLevels,
-			Output:    logConfig.Output,
-			Utc:       logConfig.Utc,
-			NoColors:  logConfig.NoColors,
-			Json:      logConfig.Json,
+		// Enable debug logging automatically in dev mode
+		levels := logConfig.Levels
+		if os.Getenv("FILEBROWSER_DEVMODE") == "true" {
+			levels = "info|warning|error|debug"
 		}
-		err := logger.SetupLogger(logConfig)
+
+		logConfig := logger.JsonConfig{
+			Levels:     levels,
+			ApiLevels:  logConfig.ApiLevels,
+			Output:     logConfig.Output,
+			Utc:        logConfig.Utc,
+			NoColors:   logConfig.NoColors,
+			Json:       logConfig.Json,
+			Structured: false,
+		}
+		err := logger.EnableCompatibilityMode(logConfig)
 		if err != nil {
 			log.Println("[ERROR] Failed to set up logger:", err)
 		}
@@ -236,13 +477,13 @@ func setupLogging() {
 
 func loadConfigWithDefaults(configFile string, generate bool) error {
 	Config = setDefaults(generate)
-	// Open and read the YAML file
-	yamlFile, err := os.Open(configFile)
-	if err != nil {
+
+	// Check if config file exists
+	if _, err := os.Stat(configFile); err != nil {
 		if configFile != "" {
 			logger.Errorf("could not open config file '%v', using default settings.", configFile)
 		}
-		Config.Server.Sources = []Source{
+		Config.Server.Sources = []*Source{
 			{
 				Path: ".",
 			},
@@ -250,37 +491,90 @@ func loadConfigWithDefaults(configFile string, generate bool) error {
 		loadEnvConfig()
 		return nil
 	}
-	defer yamlFile.Close()
-	stat, err := yamlFile.Stat()
+
+	// Try multi-file config first (combine all YAML files in the directory)
+	combinedYAML, err := combineYAMLFiles(configFile)
 	if err != nil {
-		return err
-	}
-	yamlData := make([]byte, stat.Size())
-	_, err = yamlFile.Read(yamlData)
-	if err != nil && configFile != "config.yaml" {
-		return fmt.Errorf("could not load specified config file: %v", err.Error())
+		return fmt.Errorf("failed to combine YAML files: %v", err)
 	}
+
+	// First pass: Unmarshal into a generic map to resolve all anchors and aliases
+	// This allows YAML anchors defined in auxiliary files to be properly merged
+	var rawConfig map[string]interface{}
+	err = yaml.Unmarshal(combinedYAML, &rawConfig)
 	if err != nil {
-		logger.Warningf("Could not load config file '%v', using default settings: %v", configFile, err)
+		return fmt.Errorf("error parsing YAML data: %v", err)
 	}
-	err = yaml.NewDecoder(strings.NewReader(string(yamlData)), yaml.DisallowUnknownField()).Decode(&Config)
+
+	// Filter to only keep valid top-level Settings struct fields
+	// This removes anchor definitions that are just templates (e.g., "test_server: &test_server")
+	validFields := map[string]bool{
+		"server":       true,
+		"auth":         true,
+		"integrations": true,
+		"frontend":     true,
+		"userDefaults": true,
+	}
+
+	filteredConfig := make(map[string]interface{})
+	for key, value := range rawConfig {
+		if validFields[key] {
+			filteredConfig[key] = value
+		}
+	}
+
+	// Marshal the filtered config back to YAML
+	filteredYAML, err := yaml.Marshal(filteredConfig)
+	if err != nil {
+		return fmt.Errorf("error re-marshaling filtered YAML: %v", err)
+	}
+
+	// Second pass: Decode with strict validation (disallow unknown fields within valid sections)
+	decoder := yaml.NewDecoder(bytes.NewReader(filteredYAML), yaml.DisallowUnknownField())
+	err = decoder.Decode(&Config)
 	if err != nil {
 		return fmt.Errorf("error unmarshaling YAML data: %v", err)
 	}
+
 	loadEnvConfig()
 	return nil
 }
 
 func ValidateConfig(config Settings) error {
-
 	validate := validator.New()
-	err := validate.Struct(Config)
+
+	// Register custom validator for file permissions
+	err := validate.RegisterValidation("file_permission", validateFilePermission)
+	if err != nil {
+		return fmt.Errorf("could not register file_permission validator: %v", err)
+	}
+
+	err = validate.Struct(Config)
 	if err != nil {
 		return fmt.Errorf("could not validate config: %v", err)
 	}
 	return nil
 }
 
+// validateFilePermission validates that a string is a valid Unix octal file permission (3-4 digits, 0-7)
+func validateFilePermission(fl validator.FieldLevel) bool {
+	value := fl.Field().String()
+
+	// Must be 3 or 4 characters long
+	if len(value) < 3 || len(value) > 4 {
+		return false
+	}
+
+	// All characters must be octal digits (0-7)
+	for _, char := range value {
+		if char < '0' || char > '7' {
+			return false
+		}
+	}
+
+	return true
+}
+
 func loadEnvConfig() {
 	adminPassword, ok := os.LookupEnv("FILEBROWSER_ADMIN_PASSWORD")
 	if ok {
@@ -341,16 +635,29 @@ func setDefaults(generate bool) Settings {
 	if database == "" {
 		database = "database.db"
 	}
-	return Settings{
+	if _, err := os.Stat(database); os.IsNotExist(err) {
+		logger.Warning("database file could not be found. If this is unexpected, please set the FILEBROWSER_DATABASE environment variable to the correct path.")
+	}
+	s := Settings{
 		Server: Server{
 			Port:               80,
 			NumImageProcessors: numCpus,
 			BaseURL:            "",
 			Database:           database,
-			SourceMap:          map[string]Source{},
-			NameToSource:       map[string]Source{},
+			SourceMap:          map[string]*Source{},
+			NameToSource:       map[string]*Source{},
 			MaxArchiveSizeGB:   50,
 			CacheDir:           "tmp",
+			IndexSqlConfig: IndexSqlConfig{
+				WalMode:      false,
+				BatchSize:    1000,
+				CacheSizeMB:  32,
+				DisableReuse: false,
+			},
+			Filesystem: Filesystem{
+				CreateFilePermission:      "644",
+				CreateDirectoryPermission: "755",
+			},
 		},
 		Auth: Auth{
 			AdminUsername:        "admin",
@@ -366,160 +673,313 @@ func setDefaults(generate bool) Settings {
 		Frontend: Frontend{
 			Name: "FileBrowser Quantum",
 		},
-
 		UserDefaults: UserDefaults{
-			StickySidebar:   true,
-			LockPassword:    false,
-			ShowHidden:      false,
-			DarkMode:        true,
-			DisableSettings: false,
-			ViewMode:        "normal",
-			Locale:          "en",
-			GallerySize:     3,
-			ThemeColor:      "var(--blue)",
-			Permissions: users.Permissions{
-				Modify: false,
-				Share:  false,
-				Admin:  false,
-				Api:    false,
+			DisableOnlyOfficeExt: ".md .txt .pdf .html .xml",
+			StickySidebar:        true,
+			LockPassword:         false,
+			ShowHidden:           false,
+			DarkMode:             boolPtr(true),
+			DisableSettings:      false,
+			ViewMode:             "normal",
+			Locale:               "en",
+			GallerySize:          3,
+			ThemeColor:           "var(--blue)",
+			Permissions: UserDefaultsPermissions{
+				Modify:   false,
+				Share:    false,
+				Admin:    false,
+				Api:      false,
+				Download: boolPtr(true), // defaults to true
+			},
+			Preview: UserDefaultsPreview{
+				HighQuality:        boolPtr(true),
+				Image:              boolPtr(true),
+				Video:              boolPtr(true),
+				MotionVideoPreview: boolPtr(true),
+				Office:             boolPtr(true),
+				PopUp:              boolPtr(true),
+				AutoplayMedia:      boolPtr(true),
+				Folder:             boolPtr(true),
 			},
 			FileLoading: users.FileLoading{
-				MaxConcurrent: 10,
-				ChunkSize:     10, // 10MB
+				MaxConcurrent:     10,
+				UploadChunkSize:   10, // 10MB
+				DownloadChunkSize: 0,  // 0MB, default to no chunking
 			},
 		},
 	}
+	// Initialize ImagePreview map with defaults
+	s.Integrations.Media.Convert.ImagePreview = make(map[ImagePreviewType]*bool)
+	s.Integrations.Media.Convert.ImagePreview[HEICImagePreview] = boolPtr(false) // HEIC defaults to disabled
+	s.Integrations.Media.Convert.ImagePreview[JPEGImagePreview] = boolPtr(true)  // JPEG fallback defaults to enabled
+	// Initialize VideoPreview map with defaults (all enabled)
+	s.Integrations.Media.Convert.VideoPreview = make(map[VideoPreviewType]*bool)
+	for _, t := range AllVideoPreviewTypes {
+		s.Integrations.Media.Convert.VideoPreview[t] = boolPtr(true)
+	}
+	return s
 }
 
-func ConvertToBackendScopes(scopes []users.SourceScope) ([]users.SourceScope, error) {
-	if len(scopes) == 0 {
-		return Config.UserDefaults.DefaultScopes, nil
+// validateCustomImage validates a custom image file path and returns the absolute path or error
+func validateCustomImage(configPath, imageName string, allowedFormats []string) (absolutePath string, err error) {
+	// Get absolute path
+	absolutePath, err = filepath.Abs(configPath)
+	if err != nil {
+		return "", fmt.Errorf("could not resolve path: %w", err)
 	}
-	newScopes := []users.SourceScope{}
-	for _, scope := range scopes {
 
-		// first check if its already a path name and keep it
-		source, ok := Config.Server.SourceMap[scope.Name]
-		if ok {
-			if scope.Scope == "" {
-				scope.Scope = source.Config.DefaultUserScope
+	// Check if file exists
+	_, err = os.Stat(absolutePath)
+	if err != nil {
+		return "", fmt.Errorf("could not access file: %w", err)
+	}
+
+	// Validate file format
+	ext := strings.ToLower(filepath.Ext(absolutePath))
+	validFormat := false
+	for _, format := range allowedFormats {
+		if ext == format {
+			validFormat = true
+			break
+		}
+	}
+	if !validFormat {
+		return "", fmt.Errorf("unsupported format '%s', supported formats: %v", ext, allowedFormats)
+	}
+
+	return absolutePath, nil
+}
+
+func loadCustomFavicon() {
+	const imageName = "favicon"
+	allowedFormats := []string{".ico", ".png", ".svg", ".jpg", ".jpeg", ".gif", ".webp"}
+
+	// Set default embedded favicon path
+	Env.FaviconEmbeddedPath = "img/icons/favicon.svg"
+
+	// Check if a custom favicon path is configured
+	if Config.Frontend.Favicon == "" {
+		Env.FaviconPath = Env.FaviconEmbeddedPath
+		Env.FaviconIsCustom = false
+		return
+	}
+
+	// Validate custom favicon
+	validatedPath, err := validateCustomImage(Config.Frontend.Favicon, imageName, allowedFormats)
+	if err != nil {
+		logger.Warningf("Custom favicon validation failed: %v, using default", err)
+		Config.Frontend.Favicon = ""
+		Env.FaviconPath = Env.FaviconEmbeddedPath
+		Env.FaviconIsCustom = false
+		return
+	}
+
+	// Update to validated path and mark as custom
+	Config.Frontend.Favicon = validatedPath
+	Env.FaviconPath = validatedPath
+	Env.FaviconIsCustom = true
+	logger.Infof("Using custom favicon: %s", Env.FaviconPath)
+}
+
+func loadLoginIcon() {
+	const imageName = "login icon"
+	allowedFormats := []string{".svg", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".ico"}
+
+	// Set default embedded icon path - just use favicon.svg (light/dark handled by CSS)
+	Env.LoginIconEmbeddedPath = "img/icons/favicon.svg"
+
+	// Check if a custom login icon path is configured
+	if Config.Frontend.LoginIcon == "" {
+		Env.LoginIconPath = Env.LoginIconEmbeddedPath
+		Env.LoginIconIsCustom = false
+		return
+	}
+
+	// Validate custom login icon
+	validatedPath, err := validateCustomImage(Config.Frontend.LoginIcon, imageName, allowedFormats)
+	if err != nil {
+		logger.Warningf("Custom login icon validation failed: %v, using default", err)
+		Env.LoginIconPath = Env.LoginIconEmbeddedPath
+		Env.LoginIconIsCustom = false
+		return
+	}
+
+	// Update to validated path and mark as custom
+	Env.LoginIconPath = validatedPath
+	Env.LoginIconIsCustom = true
+	logger.Infof("Using custom login icon: %s", Env.LoginIconPath)
+}
+
+// setConditionalsMap builds optimized map structures from conditional rules for O(1) lookups
+func setConditionals(config *Source) {
+
+	// Merge rules from both old format (Conditionals.ItemRules) and new format (Rules)
+	rules := append(config.Config.Conditionals.ItemRules, config.Config.Rules...)
+
+	// Initialize the maps structure (only exact match maps for Names)
+	resolved := ResolvedRulesConfig{
+		FileNames:                make(map[string]ConditionalRule),
+		FolderNames:              make(map[string]ConditionalRule),
+		FilePaths:                make(map[string]ConditionalRule),
+		FolderPaths:              make(map[string]ConditionalRule),
+		FileEndsWith:             make([]ConditionalRule, 0),
+		FolderEndsWith:           make([]ConditionalRule, 0),
+		FileStartsWith:           make([]ConditionalRule, 0),
+		FolderStartsWith:         make([]ConditionalRule, 0),
+		NeverWatchPaths:          make(map[string]struct{}),
+		IncludeRootItems:         make(map[string]struct{}),
+		IgnoreAllHidden:          false,
+		IgnoreAllZeroSizeFolders: false,
+		IgnoreAllSymlinks:        false,
+		IndexingDisabled:         false,
+	}
+
+	// backwards compatibility
+	if config.Config.Conditionals.Hidden {
+		logger.Warning("source.conditionals.hidden is deprecated, use source.rules instead")
+		resolved.IgnoreAllHidden = true
+	}
+	// Backwards compatibility: if old format fields are set, treat as global rules
+	if config.Config.Conditionals.IgnoreHidden {
+		logger.Warning("source.conditionals.ignoreHidden is deprecated, use source.rules instead")
+		resolved.IgnoreAllHidden = true
+	}
+	if config.Config.DisableIndexing {
+		logger.Warning("source.disableIndexing is deprecated, use source.rules instead")
+		resolved.IndexingDisabled = true
+	}
+
+	if config.Config.Conditionals.ZeroSizeFolders {
+		logger.Warning("source.conditionals.zeroSizeFolders is deprecated, use source.rules instead")
+		resolved.IgnoreAllZeroSizeFolders = true
+	}
+
+	// Process all rules and infer global flags from root-level rules
+	for _, rule := range rules {
+		// Check if this is a root-level rule (folderPath == "/")
+		// Root-level rules with ignoreHidden/ignoreZeroSizeFolders/viewable set global flags
+		isRootLevelRule := rule.FolderPath == "/"
+
+		// Infer global flags from root-level rules
+		if isRootLevelRule {
+			if rule.IgnoreHidden {
+				resolved.IgnoreAllHidden = true
 			}
-			if !strings.HasPrefix(scope.Scope, "/") {
-				scope.Scope = "/" + scope.Scope
+			if rule.IgnoreSymlinks {
+				resolved.IgnoreAllSymlinks = true
 			}
-			if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
-				scope.Scope = strings.TrimSuffix(scope.Scope, "/")
+			if rule.IgnoreZeroSizeFolders {
+				resolved.IgnoreAllZeroSizeFolders = true
+			}
+			if rule.Viewable {
+				resolved.IndexingDisabled = true
 			}
-			newScopes = append(newScopes, users.SourceScope{
-				Name:  source.Path, // backend name is path
-				Scope: scope.Scope,
-			})
-			continue
 		}
 
-		// check if its the name of a source and convert it to a path
-		source, ok = Config.Server.NameToSource[scope.Name]
-		if !ok {
-			// source might no longer be configured
-			continue
+		// Build optimized lookup structures
+		if rule.FileEndsWith != "" {
+			resolved.FileEndsWith = append(resolved.FileEndsWith, rule)
 		}
-		if scope.Scope == "" {
-			scope.Scope = source.Config.DefaultUserScope
+		if rule.FolderEndsWith != "" {
+			resolved.FolderEndsWith = append(resolved.FolderEndsWith, rule)
 		}
-		if !strings.HasPrefix(scope.Scope, "/") {
-			scope.Scope = "/" + scope.Scope
+		if rule.FileStartsWith != "" {
+			resolved.FileStartsWith = append(resolved.FileStartsWith, rule)
 		}
-		if scope.Scope != "/" && strings.HasSuffix(scope.Scope, "/") {
-			scope.Scope = strings.TrimSuffix(scope.Scope, "/")
+		if rule.FolderStartsWith != "" {
+			resolved.FolderStartsWith = append(resolved.FolderStartsWith, rule)
 		}
-		newScopes = append(newScopes, users.SourceScope{
-			Name:  source.Path, // backend name is path
-			Scope: scope.Scope,
-		})
-	}
-	return newScopes, nil
-}
-
-func ConvertToFrontendScopes(scopes []users.SourceScope) []users.SourceScope {
-	newScopes := []users.SourceScope{}
-	for _, scope := range scopes {
-		if source, ok := Config.Server.SourceMap[scope.Name]; ok {
-			// Replace scope.Name with source.Path while keeping the same Scope value
-			newScopes = append(newScopes, users.SourceScope{
-				Name:  source.Name,
-				Scope: scope.Scope,
-			})
+		if rule.FilePath != "" {
+			resolved.FilePaths[rule.FilePath] = rule
+		}
+		if rule.FolderPath != "" {
+			resolved.FolderPaths[rule.FolderPath] = rule
+		}
+		if rule.NeverWatchPath != "" {
+			resolved.NeverWatchPaths[rule.NeverWatchPath] = struct{}{}
+		}
+		if rule.IncludeRootItem != "" {
+			resolved.IncludeRootItems[rule.IncludeRootItem] = struct{}{}
+		}
+		if rule.FileNames != "" {
+			resolved.FileNames[rule.FileNames] = rule
+		}
+		if rule.FolderNames != "" {
+			resolved.FolderNames[rule.FolderNames] = rule
+		}
+		if rule.FileName != "" {
+			resolved.FileNames[rule.FileName] = rule
+		}
+		if rule.FolderName != "" {
+			resolved.FolderNames[rule.FolderName] = rule
 		}
 	}
-	return newScopes
-}
-
-func HasSourceByPath(scopes []users.SourceScope, sourcePath string) bool {
-	for _, scope := range scopes {
-		if scope.Name == sourcePath {
-			return true
-		}
-	}
-	return false
-}
-
-func GetScopeFromSourceName(scopes []users.SourceScope, sourceName string) (string, error) {
-	source, ok := Config.Server.NameToSource[sourceName]
-	if !ok {
-		logger.Debug("Could not get scope from source name: ", sourceName)
-		return "", fmt.Errorf("source with name not found %v", sourceName)
-	}
-	for _, scope := range scopes {
-		if scope.Name == source.Path {
-			return scope.Scope, nil
-		}
-	}
-	logger.Debugf("scope not found for source %v", sourceName)
-	return "", fmt.Errorf("scope not found for source %v", sourceName)
-}
-
-func GetScopeFromSourcePath(scopes []users.SourceScope, sourcePath string) (string, error) {
-	for _, scope := range scopes {
-		if scope.Name == sourcePath {
-			return scope.Scope, nil
-		}
-	}
-	return "", fmt.Errorf("scope not found for source %v", sourcePath)
-}
-
-// assumes backend style scopes
-func GetSources(u *users.User) []string {
-	sources := []string{}
-	for _, scope := range u.Scopes {
-		source, ok := Config.Server.SourceMap[scope.Name]
-		if ok {
-			sources = append(sources, source.Name)
-		}
-	}
-	return sources
+	config.Config.ResolvedRules = resolved
 }
 
 func modifyExcludeInclude(config *Source) {
-	normalize := func(s []string, checkExists bool) {
-		for i, v := range s {
-			s[i] = "/" + strings.Trim(v, "/")
-			// check if file/folder exists
-			if checkExists {
-				realPath, err := filepath.Abs(config.Path + s[i])
-				if err != nil {
-					logger.Warningf("could not get absolute path for %v: %v", s[i], err)
-					continue
-				}
-				if _, err := os.Stat(realPath); os.IsNotExist(err) {
-					logger.Warningf("configured exclude/include path %v does not exist", realPath)
-				}
+	// Helper to normalize a full path value (FilePaths, FolderPaths)
+	// These always start with "/" and match against full index paths
+	normalizeFullPath := func(value string, checkExists bool) string {
+		if value == "" {
+			return ""
+		}
+		normalized := "/" + strings.Trim(value, "/")
+		// check if file/folder exists
+		if checkExists {
+			realPath, err := filepath.Abs(config.Path + normalized)
+			if err != nil {
+				logger.Warningf("could not get absolute path for %v: %v", normalized, err)
+				return normalized
+			}
+			if _, err := os.Stat(realPath); os.IsNotExist(err) {
+				logger.Warningf("configured exclude/include path %v does not exist", realPath)
 			}
 		}
+		return normalized
 	}
 
-	normalize(config.Config.Exclude.FolderPaths, true)
-	normalize(config.Config.Exclude.FilePaths, true)
-	normalize(config.Config.Include.RootFolders, true)
-	normalize(config.Config.Include.RootFiles, true)
-	normalize(config.Config.NeverWatchPaths, true)
+	// Helper to normalize a name-based value (FileNames, FolderNames, StartsWith, EndsWith)
+	// These match against baseName, so no leading slash
+	normalizeName := func(value string) string {
+		// Just trim slashes - names shouldn't have slashes
+		return strings.Trim(value, "/")
+	}
+
+	// Normalize []ConditionalRule slices for full paths
+	// Handle both old format (Conditionals.ItemRules) and new format (Rules)
+	allRules := append(config.Config.Conditionals.ItemRules, config.Config.Rules...)
+
+	for i, rule := range allRules {
+		// normalize full paths
+		allRules[i].FilePath = normalizeFullPath(rule.FilePath, true)
+		// FolderPath gets trailing slash for proper prefix matching
+		if rule.FolderPath != "" {
+			normalized := normalizeFullPath(rule.FolderPath, true)
+			if normalized != "/" && !strings.HasSuffix(normalized, "/") {
+				normalized = normalized + "/"
+			}
+			allRules[i].FolderPath = normalized
+		}
+		allRules[i].NeverWatchPath = normalizeFullPath(rule.NeverWatchPath, true)
+		if rule.IncludeRootItem != "" {
+			normalized := normalizeFullPath(rule.IncludeRootItem, true)
+			if normalized != "/" && !strings.HasSuffix(normalized, "/") {
+				normalized = normalized + "/"
+			}
+			allRules[i].IncludeRootItem = normalized
+		}
+
+		// normalize names
+		allRules[i].FileNames = normalizeName(rule.FileNames)
+		allRules[i].FolderNames = normalizeName(rule.FolderNames)
+		allRules[i].FileName = normalizeName(rule.FileName)
+		allRules[i].FolderName = normalizeName(rule.FolderName)
+	}
+
+	// Update the original slices with normalized values
+	itemRulesLen := len(config.Config.Conditionals.ItemRules)
+	config.Config.Conditionals.ItemRules = allRules[:itemRulesLen]
+	config.Config.Rules = allRules[itemRulesLen:]
+
 }

backend/common/settings/configFunctions.go

@@ -0,0 +1,27 @@
+package settings
+
+func CanConvertImage(ext string) bool {
+	if !MediaEnabled() {
+		return false
+	}
+	val := Config.Integrations.Media.Convert.ImagePreview[ImagePreviewType(ext)]
+	if val == nil {
+		return false // Extension not in the configured list
+	}
+	return *val
+}
+
+func CanConvertVideo(ext string) bool {
+	if !MediaEnabled() {
+		return false
+	}
+	val := Config.Integrations.Media.Convert.VideoPreview[VideoPreviewType(ext)]
+	if val == nil {
+		return false // Extension not in the configured list
+	}
+	return *val
+}
+
+func MediaEnabled() bool {
+	return Env.FFmpegPath != "" && Env.FFprobePath != ""
+}

backend/common/settings/config_test.go

@@ -2,6 +2,7 @@ package settings
 
 import (
 	"os"
+	"path/filepath"
 	"reflect"
 	"testing"
 
@@ -42,8 +43,19 @@ func Test_setDefaults(t *testing.T) {
 }
 
 func TestConfigLoadChanged(t *testing.T) {
+	// Create isolated test directory
+	testDir := t.TempDir()
+	validContent, err := os.ReadFile("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("failed to read validConfig.yaml: %v", err)
+	}
+	configFile := filepath.Join(testDir, "config.yaml")
+	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
 	defaultConfig := setDefaults(true)
-	err := loadConfigWithDefaults("./validConfig.yaml", true)
+	err = loadConfigWithDefaults(configFile, true)
 	if err != nil {
 		t.Fatalf("error loading config file: %v", err)
 	}
@@ -54,11 +66,22 @@ func TestConfigLoadChanged(t *testing.T) {
 }
 
 func TestConfigLoadEnvVars(t *testing.T) {
+	// Create isolated test directory
+	testDir := t.TempDir()
+	validContent, err := os.ReadFile("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("failed to read validConfig.yaml: %v", err)
+	}
+	configFile := filepath.Join(testDir, "config.yaml")
+	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
 	defaultConfig := setDefaults(true)
 	expectedKey := "MYKEY"
 	// mock environment variables
 	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
-	err := loadConfigWithDefaults("./validConfig.yaml", true)
+	err = loadConfigWithDefaults(configFile, true)
 	if err != nil {
 		t.Fatalf("error loading config file: %v", err)
 	}
@@ -72,8 +95,19 @@ func TestConfigLoadEnvVars(t *testing.T) {
 }
 
 func TestConfigLoadSpecificValues(t *testing.T) {
+	// Create isolated test directory
+	testDir := t.TempDir()
+	validContent, err := os.ReadFile("./validConfig.yaml")
+	if err != nil {
+		t.Fatalf("failed to read validConfig.yaml: %v", err)
+	}
+	configFile := filepath.Join(testDir, "config.yaml")
+	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
 	defaultConfig := setDefaults(true)
-	err := loadConfigWithDefaults("./validConfig.yaml", true)
+	err = loadConfigWithDefaults(configFile, true)
 	if err != nil {
 		t.Fatalf("error loading config file: %v", err)
 	}
@@ -93,9 +127,23 @@ func TestConfigLoadSpecificValues(t *testing.T) {
 }
 
 func TestInvalidConfig(t *testing.T) {
-	configFile := "./invalidConfig.yaml"
-	err := loadConfigWithDefaults(configFile, true)
+	// Create isolated test directory
+	testDir := t.TempDir()
+	invalidContent, err := os.ReadFile("./invalidConfig.yaml")
+	if err != nil {
+		t.Fatalf("failed to read invalidConfig.yaml: %v", err)
+	}
+	configFile := filepath.Join(testDir, "config.yaml")
+	if err = os.WriteFile(configFile, invalidContent, 0644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	err = loadConfigWithDefaults(configFile, true)
+	// Config loads successfully but validation should catch missing sources
 	if err == nil {
-		t.Fatalf("expected error loading config file %s, got nil", configFile)
+		err = ValidateConfig(Config)
+		if err == nil {
+			t.Fatal("expected validation error for config with missing required sources, got nil")
+		}
 	}
 }

backend/common/settings/functions.go

@@ -0,0 +1,60 @@
+package settings
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// InitializeUserResolvers sets up the global resolvers and config providers in the users package
+// This should be called once during application initialization
+func InitializeUserResolvers() {
+	// Set up the source name resolver
+	users.SetSourceNameResolver(func(sourceName string) (string, error) {
+		source, ok := Config.Server.NameToSource[sourceName]
+		if !ok {
+			logger.Debug("Could not get scope from source name: ", sourceName)
+			return "", nil
+		}
+		return source.Path, nil
+	})
+
+	// Set up the source config provider
+	users.SetSourceConfig(&users.SourceConfigProvider{
+		GetSourceByPath: func(path string) (users.SourceInfo, bool) {
+			source, ok := Config.Server.SourceMap[path]
+			if !ok {
+				return users.SourceInfo{}, false
+			}
+			return users.SourceInfo{
+				Path:             source.Path,
+				Name:             source.Name,
+				DefaultUserScope: source.Config.DefaultUserScope,
+			}, true
+		},
+		GetSourceByName: func(name string) (users.SourceInfo, bool) {
+			source, ok := Config.Server.NameToSource[name]
+			if !ok {
+				return users.SourceInfo{}, false
+			}
+			return users.SourceInfo{
+				Path:             source.Path,
+				Name:             source.Name,
+				DefaultUserScope: source.Config.DefaultUserScope,
+			}, true
+		},
+		GetAllSources: func() []users.SourceInfo {
+			sources := make([]users.SourceInfo, 0, len(Config.Server.Sources))
+			for _, source := range Config.Server.Sources {
+				sources = append(sources, users.SourceInfo{
+					Path:             source.Path,
+					Name:             source.Name,
+					DefaultUserScope: source.Config.DefaultUserScope,
+				})
+			}
+			return sources
+		},
+		GetDefaultScopes: func() []users.SourceScope {
+			return Config.UserDefaults.DefaultScopes
+		},
+	})
+}

backend/common/settings/generator_simple_test.go

@@ -0,0 +1,236 @@
+package settings
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestGenerateConfigYaml_Basic(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Test using the actual source directory structure
+	trueVal := true
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "es",          // Non-default value
+			DarkMode:                &trueVal,      // Default value
+			DisableOfficePreviewExt: ".docx .xlsx", // This field is deprecated
+		},
+		Auth: Auth{
+			Key:           "secret123",    // This is a secret field
+			AdminUsername: "testadmin",    // This is a secret field
+			AdminPassword: "testpassword", // This is a secret field
+		},
+	}
+
+	// Test different combinations
+	testCases := []struct {
+		name             string
+		showComments     bool
+		showFull         bool
+		filterDeprecated bool
+		expectSecrets    bool
+		expectDeprecated bool
+	}{
+		{
+			name:             "API_mode_all_fields",
+			showComments:     false,
+			showFull:         true,
+			filterDeprecated: false,
+			expectSecrets:    true, // Secrets should be hidden
+			expectDeprecated: true, // Deprecated should be shown
+		},
+		{
+			name:             "Static_config_filter_deprecated",
+			showComments:     true,
+			showFull:         true,
+			filterDeprecated: true,
+			expectSecrets:    true,  // Secrets should be hidden
+			expectDeprecated: false, // Deprecated should be filtered
+		},
+		{
+			name:             "Filtered_non_defaults",
+			showComments:     false,
+			showFull:         false,
+			filterDeprecated: false,
+			expectSecrets:    true,  // Secrets should be hidden
+			expectDeprecated: false, // Might not appear if matches default
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Use the current directory structure for real testing
+			yamlOutput, err := GenerateConfigYaml(config, tc.showComments, tc.showFull, tc.filterDeprecated)
+			if err != nil {
+				t.Fatalf("GenerateConfigYaml failed: %v", err)
+			}
+
+			// Basic validation - should produce some output
+			if len(yamlOutput) == 0 {
+				t.Fatal("Generated empty YAML")
+			}
+
+			// Test string quoting - string values should be quoted, numbers and booleans should not
+			lines := strings.Split(yamlOutput, "\n")
+			for _, line := range lines {
+				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+					// This is a key-value line, skip comment portion
+					parts := strings.SplitN(line, ":", 2)
+					if len(parts) == 2 {
+						value := strings.TrimSpace(parts[1])
+						// Remove comments
+						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+							value = strings.TrimSpace(value[:commentIdx])
+						}
+
+						// Skip empty values, arrays, and objects
+						if value == "" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
+							continue
+						}
+
+						// Check if it's a number (should NOT be quoted)
+						if reNumber.MatchString(value) {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's a boolean (should NOT be quoted)
+						if value == "true" || value == "false" {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's null (should NOT be quoted - it's a YAML literal for nil)
+						if value == "null" {
+							continue
+						}
+
+						// Everything else should be a quoted string
+						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+							// Add debug info to see what's wrong
+							t.Logf("DEBUG: Checking value '%s' from line '%s'", value, strings.TrimSpace(line))
+							t.Errorf("String value should be quoted in line: %s (value: %s)", strings.TrimSpace(line), value)
+						}
+					}
+				}
+			}
+
+			// Test secret hiding
+			if tc.expectSecrets {
+				if !strings.Contains(yamlOutput, "**hidden**") {
+					t.Error("Expected secrets to be hidden with **hidden**")
+				}
+				if strings.Contains(yamlOutput, "secret123") || strings.Contains(yamlOutput, "testadmin") || strings.Contains(yamlOutput, "testpassword") {
+					t.Error("Secret values should not appear in output")
+				}
+			}
+
+			// Test deprecated field filtering
+			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
+			if tc.expectDeprecated && !hasDeprecated {
+				t.Error("Expected deprecated field to be present")
+			}
+			if !tc.expectDeprecated && hasDeprecated && tc.filterDeprecated {
+				t.Error("Expected deprecated field to be filtered out when filterDeprecated=true")
+			}
+
+			// Test comments
+			hasComments := strings.Contains(yamlOutput, "#")
+			if tc.showComments && !hasComments {
+				t.Error("Expected comments to be present when showComments=true")
+			}
+
+			t.Logf("Test case: %s\nGenerated YAML:\n%s\n", tc.name, yamlOutput)
+		})
+	}
+}
+
+func TestCollectCommentsAndSecrets_Basic(t *testing.T) {
+	// Test the comment and secret collection directly
+	comments, secrets, deprecated, err := CollectCommentsAndSecrets(".")
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Should find some secrets in the actual source files
+	foundSecrets := false
+	for typeName, typeSecrets := range secrets {
+		for fieldName := range typeSecrets {
+			t.Logf("Found secret: %s.%s", typeName, fieldName)
+			foundSecrets = true
+		}
+	}
+	if !foundSecrets {
+		t.Error("Expected to find some secret fields in the actual source code")
+	}
+
+	// Should find some deprecated fields
+	foundDeprecated := false
+	for typeName, typeDeprecated := range deprecated {
+		for fieldName := range typeDeprecated {
+			t.Logf("Found deprecated: %s.%s", typeName, fieldName)
+			foundDeprecated = true
+		}
+	}
+	if !foundDeprecated {
+		t.Error("Expected to find some deprecated fields in the actual source code")
+	}
+
+	t.Logf("Comments: %d types", len(comments))
+	t.Logf("Secrets: %d types", len(secrets))
+	t.Logf("Deprecated: %d types", len(deprecated))
+}
+
+func TestGenerateYaml_StaticGeneration(t *testing.T) {
+	// Test the static generation function that's used by FILEBROWSER_GENERATE_CONFIG=true
+
+	// Create a temporary config for testing
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "en",
+			DisableOfficePreviewExt: ".docx .xlsx", // This should be filtered out
+		},
+		Auth: Auth{
+			Key: "test-secret", // This should be redacted
+		},
+	}
+
+	// Test static generation with comments and deprecated filtering
+	yamlOutput, err := GenerateConfigYamlWithSource(config, true, true, true, ".")
+	if err != nil {
+		t.Fatalf("Static generation failed: %v", err)
+	}
+
+	// Verify comments are included
+	if !strings.Contains(yamlOutput, "#") {
+		t.Error("Static generation should include comments")
+	}
+
+	// Verify deprecated field is filtered out
+	if strings.Contains(yamlOutput, "disableOfficePreviewExt") {
+		t.Error("Static generation should filter out deprecated field disableOfficePreviewExt")
+	}
+
+	// Verify secrets are redacted
+	if !strings.Contains(yamlOutput, "**hidden**") {
+		t.Error("Static generation should redact secrets")
+	}
+	if strings.Contains(yamlOutput, "test-secret") {
+		t.Error("Static generation should not contain actual secret values")
+	}
+
+	// Verify it has proper structure
+	if !strings.Contains(yamlOutput, "userDefaults:") {
+		t.Error("Static generation should contain userDefaults section")
+	}
+	if !strings.Contains(yamlOutput, "auth:") {
+		t.Error("Static generation should contain auth section")
+	}
+
+	t.Logf("Static generation successful with comments and proper filtering")
+}

backend/common/settings/generator_test.go

@@ -0,0 +1,477 @@
+package settings
+
+import (
+	"os"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// Test structs for comprehensive testing
+type TestConfig struct {
+	PublicField     string     `json:"publicField"`     // A regular public field
+	SecretField     string     `json:"secretField"`     // secret: this should be hidden
+	DeprecatedField string     `json:"deprecatedField"` // deprecated: this field is old
+	EmptyField      string     `json:"emptyField"`      // An empty string field
+	DefaultField    string     `json:"defaultField"`    // A field that matches default
+	NonDefaultField string     `json:"nonDefaultField"` // A field that differs from default
+	NestedStruct    TestNested `json:"nestedStruct"`
+}
+
+type TestNested struct {
+	NestedPublic     string `json:"nestedPublic"`     // A nested public field
+	NestedSecret     string `json:"nestedSecret"`     // secret: nested secret field
+	NestedDeprecated string `json:"nestedDeprecated"` // deprecated: nested deprecated field
+}
+
+// Helper to create test source files for comment parsing
+func createTestSourceFile(t *testing.T, content string) (string, func()) {
+	tmpFile, err := os.CreateTemp("", "test_*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := tmpFile.WriteString(content); err != nil {
+		t.Fatal(err)
+	}
+	tmpFile.Close()
+
+	cleanup := func() {
+		os.Remove(tmpFile.Name())
+	}
+
+	return tmpFile.Name(), cleanup
+}
+
+func TestGenerateConfigYaml_StringQuoting(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Create a simple test source file for this test
+	sourceContent := `package settings
+
+type Settings struct {
+	UserDefaults UserDefaults ` + "`json:\"userDefaults\"`" + `
+	Auth Auth ` + "`json:\"auth\"`" + `
+}
+
+type UserDefaults struct {
+	Locale string ` + "`json:\"locale\"`" + `
+}
+
+type Auth struct {
+	AdminUsername string ` + "`json:\"adminUsername\"`" + `
+}
+`
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]
+
+	// Create real Settings with string values to test quoting
+	settings := &Settings{
+		UserDefaults: UserDefaults{
+			Locale: "en-US",
+		},
+		Auth: Auth{
+			AdminUsername: "admin",
+		},
+	}
+
+	// Test with no filtering - should quote all strings
+	yamlOutput, err := GenerateConfigYamlWithSource(settings, false, true, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml failed: %v", err)
+	}
+
+	// All string values should be quoted
+	lines := strings.Split(yamlOutput, "\n")
+	for _, line := range lines {
+		if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+			// This is a key-value line
+			parts := strings.SplitN(line, ":", 2)
+			if len(parts) == 2 {
+				value := strings.TrimSpace(parts[1])
+
+				// Remove comments
+				if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+					value = strings.TrimSpace(value[:commentIdx])
+				}
+
+				// Skip empty values, arrays, objects, booleans
+				if value == "" || value == "false" || value == "true" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
+					continue
+				}
+
+				// Check if it's a number (should NOT be quoted)
+				if reNumber.MatchString(value) {
+					if strings.HasPrefix(value, "\"") {
+						t.Errorf("Numeric value should not be quoted: %s (value: '%s')", line, value)
+					}
+					continue
+				}
+
+				// Check if it's null (should NOT be quoted - it's a YAML literal for nil)
+				if value == "null" {
+					continue
+				}
+
+				// Everything else should be a quoted string
+				if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+					t.Errorf("String value should be quoted: %s (value: '%s')", line, value)
+				}
+			}
+		}
+	}
+}
+
+func TestGenerateConfigYaml_SecretHiding(t *testing.T) {
+	// Create temporary source file with our test structs
+	sourceContent := `package settings
+
+type TestConfig struct {
+	PublicField string ` + "`json:\"publicField\"`" + ` // A regular public field
+	SecretField string ` + "`json:\"secretField\"`" + ` // secret: this should be hidden
+}
+
+type TestNested struct {
+	NestedPublic string ` + "`json:\"nestedPublic\"`" + ` // A nested public field
+	NestedSecret string ` + "`json:\"nestedSecret\"`" + ` // secret: nested secret field
+}
+`
+
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+
+	// Test secret detection
+	_, secrets, _, err := CollectCommentsAndSecrets(tmpFile)
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Verify secret fields are detected
+	if !secrets["TestConfig"]["SecretField"] {
+		t.Error("SecretField should be marked as secret")
+	}
+	if !secrets["TestNested"]["NestedSecret"] {
+		t.Error("NestedSecret should be marked as secret")
+	}
+	if secrets["TestConfig"]["PublicField"] {
+		t.Error("PublicField should not be marked as secret")
+	}
+
+	// Test that secrets are properly collected
+	if len(secrets["TestConfig"]) != 1 {
+		t.Errorf("Expected 1 secret field in TestConfig, got %d", len(secrets["TestConfig"]))
+	}
+}
+
+func TestGenerateConfigYaml_DeprecatedFiltering(t *testing.T) {
+	// Create temporary source file with deprecated fields
+	sourceContent := `package settings
+
+type TestConfig struct {
+	PublicField     string ` + "`json:\"publicField\"`" + ` // A regular public field
+	DeprecatedField string ` + "`json:\"deprecatedField\"`" + ` // deprecated: this field is old
+}
+`
+
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+
+	// Test deprecated detection
+	_, _, deprecated, err := CollectCommentsAndSecrets(tmpFile)
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Verify deprecated fields are detected
+	if !deprecated["TestConfig"]["DeprecatedField"] {
+		t.Error("DeprecatedField should be marked as deprecated")
+	}
+	if deprecated["TestConfig"]["PublicField"] {
+		t.Error("PublicField should not be marked as deprecated")
+	}
+}
+
+func TestGenerateConfigYaml_FullVsFiltered(t *testing.T) {
+	// Create minimal test source
+	sourceContent := `package settings
+
+type Settings struct {
+	UserDefaults UserDefaults ` + "`json:\"userDefaults\"`" + `
+}
+
+type UserDefaults struct {
+	DarkMode bool ` + "`json:\"darkMode\"`" + `
+	Locale string ` + "`json:\"locale\"`" + `
+}
+`
+	tmpFile, cleanup := createTestSourceFile(t, sourceContent)
+	defer cleanup()
+	sourcePath := tmpFile[:strings.LastIndex(tmpFile, "/")]
+
+	// Create a config with both default and non-default values
+	trueVal := true
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			DarkMode: &trueVal, // This matches default
+			Locale:   "es",     // This differs from default ("en")
+		},
+	}
+
+	// Test full=true - should show all fields
+	fullYaml, err := GenerateConfigYamlWithSource(config, false, true, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with full=true failed: %v", err)
+	}
+
+	// Test full=false - should only show non-default fields
+	filteredYaml, err := GenerateConfigYamlWithSource(config, false, false, false, sourcePath)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with full=false failed: %v", err)
+	}
+
+	// Full output should be longer than filtered
+	if len(fullYaml) <= len(filteredYaml) {
+		t.Error("Full YAML should be longer than filtered YAML")
+	}
+
+	// Filtered output should contain the non-default field
+	if !strings.Contains(filteredYaml, "locale") {
+		t.Error("Filtered YAML should contain non-default locale field")
+	}
+
+	// Full output should contain default fields
+	if !strings.Contains(fullYaml, "darkMode") {
+		t.Error("Full YAML should contain darkMode field")
+	}
+}
+
+func TestGenerateConfigYaml_CommentsOnOff(t *testing.T) {
+	// Use the actual settings source directory since comments work there
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale: "en",
+		},
+	}
+
+	// Test with comments=true using the real source
+	withComments, err := GenerateConfigYaml(config, true, true, false)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with comments=true failed: %v", err)
+	}
+
+	// Test with comments=false using the real source
+	withoutComments, err := GenerateConfigYaml(config, false, true, false)
+	if err != nil {
+		t.Fatalf("GenerateConfigYaml with comments=false failed: %v", err)
+	}
+
+	// Output with comments should be longer
+	if len(withComments) <= len(withoutComments) {
+		t.Errorf("YAML with comments (%d chars) should be longer than without comments (%d chars)", len(withComments), len(withoutComments))
+	}
+
+	// With comments should contain '#' characters
+	if !strings.Contains(withComments, "#") {
+		t.Error("YAML with comments should contain '#' characters")
+	}
+
+	// Without comments should not contain '#' characters
+	if strings.Contains(withoutComments, "#") {
+		t.Error("YAML without comments should not contain '#' characters")
+	}
+}
+
+func TestGenerateConfigYaml_IntegrationTest(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Comprehensive test with all features
+	trueVal := true
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "es",          // Non-default
+			DarkMode:                &trueVal,      // Default
+			DisableOfficePreviewExt: ".docx .xlsx", // This is deprecated
+		},
+		Auth: Auth{
+			Key:           "secret123", // This is secret
+			AdminUsername: "admin",     // This is secret
+			AdminPassword: "password",  // This is secret
+		},
+	}
+
+	tests := []struct {
+		name             string
+		showComments     bool
+		showFull         bool
+		filterDeprecated bool
+		expectSecret     bool
+		expectDeprecated bool
+		expectFull       bool
+		expectComments   bool
+	}{
+		{
+			name:             "API mode: show all including deprecated",
+			showComments:     false,
+			showFull:         true,
+			filterDeprecated: false,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: true,  // deprecated should be shown
+			expectFull:       true,  // all fields shown
+			expectComments:   false, // no comments
+		},
+		{
+			name:             "Static config mode: filter deprecated",
+			showComments:     true,
+			showFull:         true,
+			filterDeprecated: true,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: false, // deprecated should be filtered
+			expectFull:       true,  // all non-deprecated fields shown
+			expectComments:   true,  // comments included
+		},
+		{
+			name:             "Filtered output: only changes",
+			showComments:     false,
+			showFull:         false,
+			filterDeprecated: false,
+			expectSecret:     true,  // secrets should be hidden
+			expectDeprecated: false, // might not appear if matches default
+			expectFull:       false, // only non-default fields
+			expectComments:   false, // no comments
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			yamlOutput, err := GenerateConfigYaml(config, tt.showComments, tt.showFull, tt.filterDeprecated)
+			if err != nil {
+				t.Fatalf("GenerateConfigYaml failed: %v", err)
+			}
+
+			// Check secret hiding
+			if tt.expectSecret {
+				if !strings.Contains(yamlOutput, "**hidden**") {
+					t.Error("Expected secrets to be hidden with **hidden**")
+				}
+				if strings.Contains(yamlOutput, "secret123") {
+					t.Error("Secret values should not appear in output")
+				}
+			}
+
+			// Check deprecated field filtering
+			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
+			if tt.expectDeprecated && !hasDeprecated {
+				t.Error("Expected deprecated field to be present")
+			}
+			if !tt.expectDeprecated && hasDeprecated && tt.filterDeprecated {
+				t.Error("Expected deprecated field to be filtered out")
+			}
+
+			// Check comments
+			hasComments := strings.Contains(yamlOutput, "#")
+			if tt.expectComments && !hasComments {
+				t.Error("Expected comments to be present")
+			}
+			if !tt.expectComments && hasComments {
+				t.Error("Expected no comments")
+			}
+
+			// Check string quoting - all string values should be quoted
+			lines := strings.Split(yamlOutput, "\n")
+			for _, line := range lines {
+				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+					// This is a key-value line
+					parts := strings.SplitN(line, ":", 2)
+					if len(parts) == 2 {
+						value := strings.TrimSpace(parts[1])
+						// Skip comments and empty values
+						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+							// If comment starts at the beginning, there's no value, just a comment
+							if commentIdx == 0 {
+								continue
+							}
+							value = strings.TrimSpace(value[:commentIdx])
+						}
+						// Check if it's a number (should NOT be quoted)
+						if reNumber.MatchString(value) {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's a boolean (should NOT be quoted)
+						if value == "true" || value == "false" {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Skip arrays, objects, empty values, and null
+						if value == "" || value == "null" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") || strings.Contains(value, ":") {
+							continue
+						}
+
+						// Everything else should be a quoted string
+						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+							t.Errorf("String value should be quoted in line: %s (value: '%s')", line, value)
+						}
+					}
+				}
+			}
+
+			t.Logf("Generated YAML for %s:\n%s", tt.name, yamlOutput)
+		})
+	}
+}
+
+func TestGenerateConfigYaml_EdgeCases(t *testing.T) {
+	tests := []struct {
+		name   string
+		config *Settings
+		desc   string
+	}{
+		{
+			name:   "empty_config",
+			config: &Settings{},
+			desc:   "Empty config should generate valid YAML",
+		},
+		{
+			name: "only_defaults",
+			config: &Settings{
+				UserDefaults: UserDefaults{
+					DarkMode: boolPtr(true), // default value
+					Locale:   "en",          // default value
+				},
+			},
+			desc: "Config with only default values",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test all combinations
+			for _, showComments := range []bool{false, true} {
+				for _, showFull := range []bool{false, true} {
+					for _, filterDeprecated := range []bool{false, true} {
+						yamlOutput, err := GenerateConfigYaml(tt.config, showComments, showFull, filterDeprecated)
+						if err != nil {
+							t.Fatalf("GenerateConfigYaml failed for %s (comments=%v, full=%v, filterDeprecated=%v): %v",
+								tt.desc, showComments, showFull, filterDeprecated, err)
+						}
+
+						// Basic validation - should produce valid YAML structure
+						if yamlOutput == "" {
+							t.Errorf("Generated empty YAML for %s", tt.desc)
+						}
+
+						// Should not contain obvious error messages (but allow "error" in log levels etc)
+						if strings.Contains(yamlOutput, "Error:") || strings.Contains(yamlOutput, "ERROR:") {
+							t.Errorf("YAML contains error for %s", tt.desc)
+						}
+					}
+				}
+			}
+		})
+	}
+}

backend/common/settings/multiconfig_test.go

@@ -0,0 +1,233 @@
+package settings
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestMultiConfigLoad(t *testing.T) {
+	// Setup test directory
+	testDir := t.TempDir()
+
+	// Create anchors file that will be referenced
+	anchorsConfig := `
+# Simple anchors for testing
+simple_sources: &simple_sources
+  - path: "/srv/files"
+    name: "Files"
+  - path: "/srv/media"  
+    name: "Media"
+
+simple_logging: &simple_logging
+  - levels: "info|warning|error"
+    output: "stdout"
+
+simple_auth: &simple_auth
+  methods:
+    password:
+      enabled: true
+      minLength: 8
+`
+	// Use pattern-based naming: main config is "config.yaml", so anchors must be "*-config.yaml"
+	anchorsPath := filepath.Join(testDir, "definitions-config.yaml")
+	if err := os.WriteFile(anchorsPath, []byte(anchorsConfig), 0644); err != nil {
+		t.Fatalf("Failed to write anchors config: %v", err)
+	}
+
+	// Create main config file that references the anchors
+	mainConfig := `
+server:
+  port: 9000
+  baseURL: "/test/"
+  minSearchLength: 2
+  sources: *simple_sources
+  logging: *simple_logging
+
+auth:
+  tokenExpirationHours: 3
+  <<: *simple_auth
+
+frontend:
+  name: "Test FileBrowser"
+
+userDefaults:
+  darkMode: true
+  viewMode: "grid"
+  locale: "en"
+`
+	mainPath := filepath.Join(testDir, "config.yaml")
+	if err := os.WriteFile(mainPath, []byte(mainConfig), 0644); err != nil {
+		t.Fatalf("Failed to write main config: %v", err)
+	}
+
+	// Test loading the multi-config setup
+	// Use generate=true to skip filesystem validation of fake paths
+	err := loadConfigWithDefaults(mainPath, true)
+	if err != nil {
+		t.Fatalf("Failed to load multi-config: %v", err)
+	}
+
+	// Verify that values from different files were loaded correctly
+	if Config.Server.Port != 9000 {
+		t.Errorf("Expected server port 9000, got %d", Config.Server.Port)
+	}
+
+	if Config.Server.BaseURL != "/test/" {
+		t.Errorf("Expected baseURL '/test/', got '%s'", Config.Server.BaseURL)
+	}
+
+	if Config.Server.MinSearchLength != 2 {
+		t.Errorf("Expected minSearchLength 2, got %d", Config.Server.MinSearchLength)
+	}
+
+	if Config.Auth.TokenExpirationHours != 3 {
+		t.Errorf("Expected token expiration 3 hours, got %d", Config.Auth.TokenExpirationHours)
+	}
+
+	if !Config.Auth.Methods.PasswordAuth.Enabled {
+		t.Error("Expected password auth to be enabled")
+	}
+
+	if Config.Auth.Methods.PasswordAuth.MinLength != 8 {
+		t.Errorf("Expected password min length 8, got %d", Config.Auth.Methods.PasswordAuth.MinLength)
+	}
+
+	if len(Config.Server.Sources) != 2 {
+		t.Errorf("Expected 2 sources, got %d", len(Config.Server.Sources))
+	}
+
+	if Config.Frontend.Name != "Test FileBrowser" {
+		t.Errorf("Expected frontend name 'Test FileBrowser', got '%s'", Config.Frontend.Name)
+	}
+
+	if Config.UserDefaults.ViewMode != "grid" {
+		t.Errorf("Expected view mode 'grid', got '%s'", Config.UserDefaults.ViewMode)
+	}
+}
+
+func TestMultiConfigFallback(t *testing.T) {
+	// Setup test directory
+	testDir := t.TempDir()
+
+	// Create a simple config file (no anchors)
+	simpleConfig := `
+server:
+  port: 8080
+  baseURL: "/"
+  sources:
+    - path: "/srv"
+
+auth:
+  tokenExpirationHours: 2
+
+frontend:
+  name: "Simple FileBrowser"
+`
+	configPath := filepath.Join(testDir, "simple-config.yaml")
+	if err := os.WriteFile(configPath, []byte(simpleConfig), 0644); err != nil {
+		t.Fatalf("Failed to write simple config: %v", err)
+	}
+
+	// Test that fallback works for simple configs
+	// Use generate=true to skip filesystem validation
+	err := loadConfigWithDefaults(configPath, true)
+	if err != nil {
+		t.Fatalf("Failed to load simple config: %v", err)
+	}
+
+	// Verify values were loaded correctly
+	if Config.Server.Port != 8080 {
+		t.Errorf("Expected server port 8080, got %d", Config.Server.Port)
+	}
+
+	if Config.Frontend.Name != "Simple FileBrowser" {
+		t.Errorf("Expected frontend name 'Simple FileBrowser', got '%s'", Config.Frontend.Name)
+	}
+}
+
+func TestMultiConfigWithNestedReferences(t *testing.T) {
+	// Note: Logger output may appear during tests - this is normal
+
+	// Setup test directory
+	testDir := t.TempDir()
+
+	// Create anchors file with nested structure
+	anchorsConfig := `
+# Base logging configuration
+base_logging: &base_logging
+  - levels: "info|warning|error"
+    output: "stdout"
+
+# Base permissions  
+base_permissions: &base_permissions
+  modify: false
+  share: false
+  admin: false
+  api: false
+`
+	// Use pattern-based naming: main config is "config.yaml", so anchors must be "*-config.yaml"
+	anchorsPath := filepath.Join(testDir, "definitions-config.yaml")
+	if err := os.WriteFile(anchorsPath, []byte(anchorsConfig), 0644); err != nil {
+		t.Fatalf("Failed to write anchors config: %v", err)
+	}
+
+	// Create main config that uses references
+	mainConfig := `
+server:
+  port: 8080
+  sources:
+    - path: "/srv"
+  logging: *base_logging
+
+auth:
+  tokenExpirationHours: 2
+
+userDefaults:
+  darkMode: true
+  locale: "en"
+  viewMode: "normal"
+  permissions: *base_permissions
+
+frontend:
+  name: "Nested Reference Test"
+`
+	mainPath := filepath.Join(testDir, "config.yaml")
+	if err := os.WriteFile(mainPath, []byte(mainConfig), 0644); err != nil {
+		t.Fatalf("Failed to write main config: %v", err)
+	}
+
+	// Test loading the nested reference setup
+	// Use generate=true to skip filesystem validation
+	err := loadConfigWithDefaults(mainPath, true)
+	if err != nil {
+		t.Fatalf("Failed to load nested config: %v", err)
+	}
+
+	// Verify nested references work
+	if len(Config.Server.Logging) == 0 {
+		t.Error("Expected logging configuration to be loaded")
+	}
+
+	if Config.Server.Logging[0].Output != "stdout" {
+		t.Errorf("Expected logging output 'stdout', got '%s'", Config.Server.Logging[0].Output)
+	}
+
+	// Verify user defaults
+	if Config.UserDefaults.DarkMode == nil || !*Config.UserDefaults.DarkMode {
+		t.Errorf("Expected dark mode true, got %v", Config.UserDefaults.DarkMode)
+	}
+
+	if Config.UserDefaults.Locale != "en" {
+		t.Errorf("Expected locale 'en', got '%s'", Config.UserDefaults.Locale)
+	}
+
+	// Verify permissions were loaded from anchor
+	if Config.UserDefaults.Permissions.Modify != false {
+		t.Errorf("Expected modify permission false (from base), got %v", Config.UserDefaults.Permissions.Modify)
+	}
+
+	if Config.UserDefaults.Permissions.Share != false {
+		t.Errorf("Expected share permission false (from base), got %v", Config.UserDefaults.Permissions.Share)
+	}
+}

backend/common/settings/settings.go

@@ -7,6 +7,33 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
+// boolPtr returns a pointer to a bool value
+func boolPtr(b bool) *bool {
+	return &b
+}
+
+// boolValueOrDefault returns the value of a bool pointer, or the default if nil
+func boolValueOrDefault(ptr *bool, defaultValue bool) bool {
+	if ptr != nil {
+		return *ptr
+	}
+	return defaultValue
+}
+
+// ConvertPermissionsToUsers converts UserDefaultsPermissions to users.Permissions
+func ConvertPermissionsToUsers(p UserDefaultsPermissions) users.Permissions {
+	return users.Permissions{
+		Api:      p.Api,
+		Admin:    p.Admin,
+		Modify:   p.Modify,
+		Share:    p.Share,
+		Realtime: p.Realtime,
+		Delete:   p.Delete,
+		Create:   p.Create,
+		Download: boolValueOrDefault(p.Download, true),
+	}
+}
+
 const DefaultUsersHomeBasePath = "/users"
 
 // AuthMethod describes an authentication method.
@@ -14,7 +41,7 @@ type AuthMethod string
 
 // GenerateKey generates a key of 512 bits.
 func GenerateKey() ([]byte, error) {
-	b := make([]byte, 64) //nolint:gomnd
+	b := make([]byte, 64)
 	_, err := rand.Read(b)
 	// Note that err == nil only if we read len(b) bytes.
 	if err != nil {
@@ -41,12 +68,36 @@ func AdminPerms() users.Permissions {
 func ApplyUserDefaults(u *users.User) {
 	u.StickySidebar = Config.UserDefaults.StickySidebar
 	u.DisableSettings = Config.UserDefaults.DisableSettings
-	u.DarkMode = Config.UserDefaults.DarkMode
+
+	// Handle DarkMode with default - dereference pointer from config
+	u.DarkMode = boolValueOrDefault(Config.UserDefaults.DarkMode, true)
+
 	u.Locale = Config.UserDefaults.Locale
 	u.ViewMode = Config.UserDefaults.ViewMode
 	u.SingleClick = Config.UserDefaults.SingleClick
-	u.Permissions = Config.UserDefaults.Permissions
-	u.Preview = Config.UserDefaults.Preview
+
+	// Handle Permissions - convert from pointer-based defaults to regular bools
+	u.Permissions.Api = Config.UserDefaults.Permissions.Api
+	u.Permissions.Admin = Config.UserDefaults.Permissions.Admin
+	u.Permissions.Modify = Config.UserDefaults.Permissions.Modify
+	u.Permissions.Share = Config.UserDefaults.Permissions.Share
+	u.Permissions.Realtime = Config.UserDefaults.Permissions.Realtime
+	u.Permissions.Delete = Config.UserDefaults.Permissions.Delete
+	u.Permissions.Create = Config.UserDefaults.Permissions.Create
+	u.Permissions.Download = boolValueOrDefault(Config.UserDefaults.Permissions.Download, true)
+
+	// Handle Preview - convert from pointer-based defaults to regular bools
+	u.Preview.DisableHideSidebar = Config.UserDefaults.Preview.DisableHideSidebar
+	u.Preview.HighQuality = boolValueOrDefault(Config.UserDefaults.Preview.HighQuality, true)
+	u.Preview.Image = boolValueOrDefault(Config.UserDefaults.Preview.Image, true)
+	u.Preview.Video = boolValueOrDefault(Config.UserDefaults.Preview.Video, true)
+	u.Preview.MotionVideoPreview = boolValueOrDefault(Config.UserDefaults.Preview.MotionVideoPreview, true)
+	u.Preview.Office = boolValueOrDefault(Config.UserDefaults.Preview.Office, true)
+	u.Preview.PopUp = boolValueOrDefault(Config.UserDefaults.Preview.PopUp, true)
+	u.Preview.AutoplayMedia = boolValueOrDefault(Config.UserDefaults.Preview.AutoplayMedia, true)
+	u.Preview.DefaultMediaPlayer = Config.UserDefaults.Preview.DefaultMediaPlayer
+	u.Preview.Folder = boolValueOrDefault(Config.UserDefaults.Preview.Folder, true)
+
 	u.ShowHidden = Config.UserDefaults.ShowHidden
 	u.DateFormat = Config.UserDefaults.DateFormat
 	u.DisableViewingExt = Config.UserDefaults.DisableViewingExt
@@ -54,6 +105,9 @@ func ApplyUserDefaults(u *users.User) {
 	u.GallerySize = Config.UserDefaults.GallerySize
 	u.QuickDownload = Config.UserDefaults.QuickDownload
 	u.LockPassword = Config.UserDefaults.LockPassword
+	u.DisableOnlyOfficeExt = Config.UserDefaults.DisableOnlyOfficeExt
+	u.FileLoading = Config.UserDefaults.FileLoading
+	u.DisableOfficePreviewExt = Config.UserDefaults.DisableOfficePreviewExt
 	if len(u.Scopes) == 0 {
 		for _, source := range Config.Server.Sources {
 			if source.Config.DefaultEnabled {

backend/common/settings/structs.go

@@ -6,6 +6,8 @@ import (
 
 type AllowedMethods string
 
+var Env Environment
+
 const (
 	ProxyAuth    AllowedMethods = "proxyAuth"
 	NoAuth       AllowedMethods = "noAuth"
@@ -20,28 +22,65 @@ type Settings struct {
 	Integrations Integrations `json:"integrations"`
 }
 
+type Environment struct {
+	IsPlaywright          bool   `json:"-"`
+	IsDevMode             bool   `json:"-"`
+	IsFirstLoad           bool   `json:"-"` // used internally to track if this is the first load of the application
+	MuPdfAvailable        bool   `json:"-"` // used internally if compiled with mupdf support
+	EmbeddedFs            bool   `json:"-"` // used internally if compiled with embedded fs support
+	FFmpegPath            string `json:"-"`
+	FFprobePath           string `json:"-"`
+	LoginIconPath         string `json:"-"` // resolved login icon path (filesystem or embedded)
+	LoginIconIsCustom     bool   `json:"-"` // true if login icon is from custom filesystem path
+	LoginIconEmbeddedPath string `json:"-"` // embedded asset path for default icon
+	FaviconPath           string `json:"-"` // resolved favicon path (filesystem or embedded)
+	FaviconIsCustom       bool   `json:"-"` // true if favicon is from custom filesystem path
+	FaviconEmbeddedPath   string `json:"-"` // embedded asset path for default favicon
+	PWAIconsDir           string `json:"-"` // directory where generated PWA icons are stored
+	PWAIcon192            string `json:"-"` // path to 192x192 PWA icon
+	PWAIcon256            string `json:"-"` // path to 256x256 PWA icon
+	PWAIcon512            string `json:"-"` // path to 512x512 PWA icon
+}
+
 type Server struct {
-	NumImageProcessors           int         `json:"numImageProcessors"`           // number of concurrent image processing jobs used to create previews, default is number of cpu cores available.
-	Socket                       string      `json:"socket"`                       // socket to listen on
-	TLSKey                       string      `json:"tlsKey"`                       // path to TLS key
-	TLSCert                      string      `json:"tlsCert"`                      // path to TLS cert
-	DisablePreviews              bool        `json:"disablePreviews"`              // disable all previews thumbnails, simple icons will be used
-	DisableResize                bool        `json:"disablePreviewResize"`         // disable resizing of previews for faster loading over slow connections
-	DisableTypeDetectionByHeader bool        `json:"disableTypeDetectionByHeader"` // disable type detection by header, useful if filesystem is slow.
-	Port                         int         `json:"port"`                         // port to listen on
-	BaseURL                      string      `json:"baseURL"`                      // base URL for the server, the subpath that the server is running on.
-	Logging                      []LogConfig `json:"logging"`
-	DebugMedia                   bool        `json:"debugMedia"` // output ffmpeg stdout for media integration -- careful can produces lots of output!
-	Database                     string      `json:"database"`   // path to the database file
-	Sources                      []Source    `json:"sources" validate:"required,dive"`
-	ExternalUrl                  string      `json:"externalUrl"`    // used by share links if set (eg. http://mydomain.com)
-	InternalUrl                  string      `json:"internalUrl"`    // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
-	CacheDir                     string      `json:"cacheDir"`       // path to the cache directory, used for thumbnails and other cached files
-	MaxArchiveSizeGB             int64       `json:"maxArchiveSize"` // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
+	MinSearchLength              int            `json:"minSearchLength" yaml:"minSearchLength"` // minimum length of search query to begin searching (default: 3)
+	DisableUpdateCheck           bool           `json:"disableUpdateCheck"`                     // disables backend update check service
+	NumImageProcessors           int            `json:"numImageProcessors"`                     // number of concurrent image processing jobs used to create previews, default is number of cpu cores available.
+	Socket                       string         `json:"socket"`                                 // socket to listen on
+	TLSKey                       string         `json:"tlsKey"`                                 // path to TLS key
+	TLSCert                      string         `json:"tlsCert"`                                // path to TLS cert
+	DisablePreviews              bool           `json:"disablePreviews"`                        // disable all previews thumbnails, simple icons will be used
+	DisableResize                bool           `json:"disablePreviewResize"`                   // disable resizing of previews for faster loading over slow connections
+	DisableTypeDetectionByHeader bool           `json:"disableTypeDetectionByHeader"`           // disable type detection by header, useful if filesystem is slow.
+	Port                         int            `json:"port"`                                   // port to listen on
+	ListenAddress                string         `json:"listen"`                                 // address to listen on (default: 0.0.0.0)
+	BaseURL                      string         `json:"baseURL"`                                // base URL for the server, the subpath that the server is running on.
+	Logging                      []LogConfig    `json:"logging" yaml:"logging"`
+	Database                     string         `json:"database"` // path to the database file
+	Sources                      []*Source      `json:"sources" validate:"required,dive"`
+	ExternalUrl                  string         `json:"externalUrl"`     // used by share links if set (eg. http://mydomain.com)
+	InternalUrl                  string         `json:"internalUrl"`     // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
+	CacheDir                     string         `json:"cacheDir"`        // path to the cache directory, used for thumbnails and other cached files
+	CacheDirCleanup              bool           `json:"cacheDirCleanup"` // whether to automatically cleanup the cache directory. Note: docker must also mount a persistent volume to persist the cache (default: false)
+	MaxArchiveSizeGB             int64          `json:"maxArchiveSize"`  // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
+	Filesystem                   Filesystem     `json:"filesystem"`      // filesystem settings
+	IndexSqlConfig               IndexSqlConfig `json:"indexSqlConfig"`  // Index database SQL configuration
+
 	// not exposed to config
-	SourceMap      map[string]Source `json:"-" validate:"omitempty"` // uses realpath as key
-	NameToSource   map[string]Source `json:"-" validate:"omitempty"` // uses name as key
-	MuPdfAvailable bool              `json:"-"`                      // used internally if compiled with mupdf support
+	SourceMap    map[string]*Source `json:"-" validate:"omitempty"` // uses realpath as key
+	NameToSource map[string]*Source `json:"-" validate:"omitempty"` // uses name as key
+}
+
+type Filesystem struct {
+	CreateFilePermission      string `json:"createFilePermission" validate:"required,file_permission"`      // Unix permissions like 644, 755, 2755 (default: 644)
+	CreateDirectoryPermission string `json:"createDirectoryPermission" validate:"required,file_permission"` // Unix permissions like 755, 2755, 1777 (default: 755)
+}
+
+type IndexSqlConfig struct {
+	BatchSize    int  `json:"batchSize"`    // number of items to batch in a single transaction, typically 500-5000. higher = faster but could use more memory.
+	CacheSizeMB  int  `json:"cacheSizeMB"`  // size of the SQLite cache in MB
+	WalMode      bool `json:"walMode"`      // enable the more complex WAL journaling mode. Slower, more memory usage, but better for deployments with constant user activity.
+	DisableReuse bool `json:"disableReuse"` // enable to always create a new indexing database on startup.
 }
 
 type Integrations struct {
@@ -52,58 +91,175 @@ type Integrations struct {
 // onlyoffice secret is stored in the local.json file
 // docker exec <containerID> /var/www/onlyoffice/documentserver/npm/json -f /etc/onlyoffice/documentserver/local.json 'services.CoAuthoring.secret.session.string'
 type OnlyOffice struct {
-	Url         string `json:"url" validate:"required"` // The URL to the OnlyOffice Document Server, needs to be accessible to the user.
-	InternalUrl string `json:"internalUrl"`             // An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
-	Secret      string `json:"secret" validate:"required"`
+	Url         string `json:"url" validate:"required"`    // The URL to the OnlyOffice Document Server, needs to be accessible to the user.
+	InternalUrl string `json:"internalUrl"`                // An optional internal address that the filebrowser server can use to communicate with the OnlyOffice Document Server, could be useful to bypass proxy.
+	Secret      string `json:"secret" validate:"required"` // secret: authentication key for OnlyOffice integration
+	ViewOnly    bool   `json:"viewOnly"`                   // view only mode for OnlyOffice
 }
 
 type Media struct {
-	FfmpegPath string `json:"ffmpegPath"` // path to ffmpeg directory with ffmpeg and ffprobe (eg. /usr/local/bin)
+	FfmpegPath               string        `json:"ffmpegPath"`               // path to ffmpeg directory with ffmpeg and ffprobe (eg. /usr/local/bin)
+	Convert                  FfmpegConvert `json:"convert"`                  // config for ffmpeg conversion settings
+	Debug                    bool          `json:"debug"`                    // output ffmpeg stdout for media integration -- careful can produces lots of output!
+	ExtractEmbeddedSubtitles bool          `json:"extractEmbeddedSubtitles"` // extract embedded subtitles from media files
+}
+
+type FfmpegConvert struct {
+	ImagePreview map[ImagePreviewType]*bool `json:"imagePreview"` // supported image preview formats. defaults vary by type (see individual type docs)
+	VideoPreview map[VideoPreviewType]*bool `json:"videoPreview"` // supported video preview formats. defaults to true for all types unless explicitly disabled.
+}
+
+type ImagePreviewType string
+
+const (
+	HEICImagePreview ImagePreviewType = "heic"
+	JPEGImagePreview ImagePreviewType = "jpeg" // only used as fallback for JPEG formats that can't otherwise be decoded
+	//RAWImagePreview  ImagePreviewType = "raw"
+)
+
+func (i ImagePreviewType) String() string {
+	return string(i)
+}
+
+// AllImagePreviewTypes contains all supported image preview types.
+var AllImagePreviewTypes = []ImagePreviewType{
+	HEICImagePreview,
+	JPEGImagePreview,
+	//RAWImagePreview,
+}
+
+type VideoPreviewType string
+
+const (
+	MP4VideoPreview      VideoPreviewType = "mp4"
+	WebMVideoPreview     VideoPreviewType = "webm"
+	MOVVideoPreview      VideoPreviewType = "mov"
+	AVIVideoPreview      VideoPreviewType = "avi"
+	MKVVideoPreview      VideoPreviewType = "mkv"
+	FLVVideoPreview      VideoPreviewType = "flv"
+	WMVVideoPreview      VideoPreviewType = "wmv"
+	M4VVideoPreview      VideoPreviewType = "m4v"
+	ThreeGPVideoPreview  VideoPreviewType = "3gp"
+	ThreeGP2VideoPreview VideoPreviewType = "3g2"
+	TSVideoPreview       VideoPreviewType = "ts"
+	M2TSVideoPreview     VideoPreviewType = "m2ts"
+	VOBVideoPreview      VideoPreviewType = "vob"
+	ASFVideoPreview      VideoPreviewType = "asf"
+	MPGVideoPreview      VideoPreviewType = "mpg"
+	MPEGVideoPreview     VideoPreviewType = "mpeg"
+	F4VVideoPreview      VideoPreviewType = "f4v"
+	OGVVideoPreview      VideoPreviewType = "ogv"
+)
+
+func (v VideoPreviewType) String() string {
+	return string(v)
+}
+
+// AllVideoPreviewTypes contains all supported video preview types.
+var AllVideoPreviewTypes = []VideoPreviewType{
+	MP4VideoPreview,
+	WebMVideoPreview,
+	MOVVideoPreview,
+	AVIVideoPreview,
+	MKVVideoPreview,
+	FLVVideoPreview,
+	WMVVideoPreview,
+	M4VVideoPreview,
+	ThreeGPVideoPreview,
+	ThreeGP2VideoPreview,
+	TSVideoPreview,
+	M2TSVideoPreview,
+	VOBVideoPreview,
+	ASFVideoPreview,
+	MPGVideoPreview,
+	MPEGVideoPreview,
+	F4VVideoPreview,
+	OGVVideoPreview,
 }
 
 type LogConfig struct {
-	Levels    string `json:"levels"`    // separated list of log levels to enable. (eg. "info|warning|error|debug")
-	ApiLevels string `json:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
-	Output    string `json:"output"`    // output location. (eg. "stdout" or "path/to/file.log")
-	NoColors  bool   `json:"noColors"`  // disable colors in the output
-	Json      bool   `json:"json"`      // output in json format, currently not supported
-	Utc       bool   `json:"utc"`       // use UTC time in the output instead of local time
+	Levels    string `json:"levels" yaml:"levels"`       // separated list of log levels to enable. (eg. "info|warning|error|debug")
+	ApiLevels string `json:"apiLevels" yaml:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
+	Output    string `json:"output" yaml:"output"`       // output location. (eg. "stdout" or "path/to/file.log")
+	NoColors  bool   `json:"noColors" yaml:"noColors"`   // disable colors in the output
+	Json      bool   `json:"json" yaml:"json"`           // output in json format
+	Utc       bool   `json:"utc" yaml:"utc"`             // use UTC time in the output instead of local time
 }
 
 type Source struct {
 	Path   string       `json:"path" validate:"required"` // file system path. (Can be relative)
 	Name   string       `json:"name"`                     // display name
-	Config SourceConfig `json:"config"`
+	Config SourceConfig `json:"config,omitempty"`
 }
 
 type SourceConfig struct {
-	Private          bool               `json:"private"`                 // designate as source as private -- currently just means no sharing permitted.
-	Disabled         bool               `json:"disabled"`                // disable the source, this is useful so you don't need to remove it from the config file
-	IndexingInterval uint32             `json:"indexingIntervalMinutes"` // optional manual overide interval in minutes to re-index the source
-	DisableIndexing  bool               `json:"disableIndexing"`         // disable the indexing of this source
-	MaxWatchers      int                `json:"maxWatchers"`             // number of concurrent watchers to use for this source, currently not supported
-	NeverWatchPaths  []string           `json:"neverWatchPaths"`         // paths that get initially once. Useful for folders that rarely change contents (without source path prefix)
-	Exclude          ExcludeIndexFilter `json:"exclude"`                 // exclude files and folders from indexing, if include is not set
-	Include          IncludeIndexFilter `json:"include"`                 // include files and folders from indexing, if exclude is not set
-	DefaultUserScope string             `json:"defaultUserScope"`        // default "/" should match folders under path
-	DefaultEnabled   bool               `json:"defaultEnabled"`          // should be added as a default source for new users?
-	CreateUserDir    bool               `json:"createUserDir"`           // create a user directory for each user
+	DenyByDefault    bool              `json:"denyByDefault,omitempty"`           // deny access unless an "allow" access rule was specifically created.
+	Private          bool              `json:"private"`                           // designate as source as private -- currently just means no sharing permitted.
+	Disabled         bool              `json:"disabled,omitempty"`                // disable the source, this is useful so you don't need to remove it from the config file
+	IndexingInterval uint32            `json:"indexingIntervalMinutes,omitempty"` // deprecated: create a rule with indexingIntervalMinutes to set the indexing interval for this source
+	DisableIndexing  bool              `json:"disableIndexing,omitempty"`         // deprecated: use indexingDisabled instead to disable the indexing of this source
+	Conditionals     ConditionalFilter `json:"conditionals"`                      // deprecated: use source.rules instead
+	Rules            []ConditionalRule `json:"rules"`                             // list of item rules to apply to specific paths
+	DefaultUserScope string            `json:"defaultUserScope"`                  // defaults to root of index "/" should match folders under path
+	DefaultEnabled   bool              `json:"defaultEnabled"`                    // should be added as a default source for new users?
+	CreateUserDir    bool              `json:"createUserDir"`                     // create a user directory for each user under defaultUserScope + username
+	UseLogicalSize   bool              `json:"useLogicalSize"`                    // calculate sizes based on logical size instead of disk utilization (du -sh), folders will be 0 bytes when empty.
+	// hidden but used internally - optimized map lookups for conditional rules
+	ResolvedRules ResolvedRulesConfig `json:"-"`
 }
 
-type IncludeIndexFilter struct {
-	RootFolders []string `json:"rootFolders"` // list of root folders to include, relative to the source path (eg. "folder1")
-	RootFiles   []string `json:"rootFiles"`   // list of root files to include, relative to the source path (eg. "file1.txt")
+type ConditionalFilter struct {
+	Hidden          bool              `json:"hidden"`                // deprecated: use ignoreHidden instead. eg, FolderPath: "/" and ignoreHidden: true will exclude hidden files and folders under the root folder.
+	IgnoreHidden    bool              `json:"ignoreHidden"`          // deprecated: use ignoreHidden instead. eg, FolderPath: "/" and ignoreHidden: true will exclude hidden files and folders under the root folder.
+	ZeroSizeFolders bool              `json:"ignoreZeroSizeFolders"` // deprecated: use ignoreZeroSizeFolders instead. eg, FolderPath: "/" and ignoreZeroSizeFolders: true will ignore folders with 0 size under the root folder.
+	ItemRules       []ConditionalRule `json:"rules"`                 // list of item rules to apply to specific paths
 }
 
-type ExcludeIndexFilter struct {
-	Hidden          bool     `json:"hidden"`                // exclude hidden files and folders.
-	ZeroSizeFolders bool     `json:"ignoreZeroSizeFolders"` // ignore folders with 0 size
-	FilePaths       []string `json:"filePaths"`             // list of filepaths Eg. "folder1" or "file1.txt" or "folder1/file1.txt" (without source path prefix)
-	FolderPaths     []string `json:"folderPaths"`           // (filepath) list of folder names to include/exclude. Eg. "folder1" or "folder1/subfolder" (do not include source path, just the subpaths from the source path)
-	FileNames       []string `json:"fileNames"`             // (global) list of file names to include/exclude. Eg. "a.jpg"
-	FolderNames     []string `json:"folderNames"`           // (global) list of folder names to include/exclude. Eg. "@eadir" or ".thumbnails"
-	FileEndsWith    []string `json:"fileEndsWith"`          // (global) exclude files that end with these suffixes. Eg. ".jpg" or ".txt"
-	FolderEndsWith  []string `json:"folderEndsWith"`        // (global) exclude folders that end with these suffixes. Eg. ".thumbnails" or ".git"
+type ConditionalRule struct {
+	NeverWatchPath   string `json:"neverWatchPath"`   // index the folder in the first pass to get included in search, but never re-indexed.
+	IncludeRootItem  string `json:"includeRootItem"`  // include only these items at root folder level
+	FileStartsWith   string `json:"fileStartsWith"`   // (global) exclude files that start with these prefixes. Eg. "archive-" or "backup-"
+	FolderStartsWith string `json:"folderStartsWith"` // (global) exclude folders that start with these prefixes. Eg. "archive-" or "backup-"
+	FileEndsWith     string `json:"fileEndsWith"`     // (global) exclude files that end with these suffixes. Eg. ".jpg" or ".txt"
+	FolderEndsWith   string `json:"folderEndsWith"`   // (global) exclude folders that end with these suffixes. Eg. ".thumbnails" or ".git"
+	FolderPath       string `json:"folderPath"`       // (global) exclude folders that match this path. Eg. "/path/to/folder" or "/path/to/folder/subfolder"
+	FilePath         string `json:"filePath"`         // (global) exclude files that match this path. Eg. "/path/to/file.txt" or "/path/to/file.txt/subfile.txt"
+	FileNames        string `json:"fileNames"`        // deprecated: exclude files that match these names. Eg. "file.txt" or "test.csv"
+	FolderNames      string `json:"folderNames"`      // deprecated: exclude folders that match these names. Eg. "folder" or "subfolder"
+	FileName         string `json:"fileName"`         // (global) exclude files that match these names. Eg. "file.txt" or "test.csv"
+	FolderName       string `json:"folderName"`       // (global) exclude folders that match these names. Eg. "folder" or "subfolder"
+
+	Viewable              bool `json:"viewable"`              // Enable viewing in UI but exclude from indexing
+	IgnoreHidden          bool `json:"ignoreHidden"`          // Excludes only hidden files and folders
+	IgnoreZeroSizeFolders bool `json:"ignoreZeroSizeFolders"` // Excludes only folders with 0 size
+	IgnoreSymlinks        bool `json:"ignoreSymlinks"`        // Excludes symbolic links
+}
+
+// ConditionalMaps provides O(1) lookup performance for conditional rules
+// Maps are built from ConditionalFilter during initialization
+type ResolvedRulesConfig struct {
+	// Exact match maps - O(1) lookup (only for names, not StartsWith/EndsWith)
+	FileNames   map[string]ConditionalRule // key: file name
+	FolderNames map[string]ConditionalRule // key: folder name
+
+	// exact match for paths
+	FilePaths   map[string]ConditionalRule // key: file path
+	FolderPaths map[string]ConditionalRule // key: folder path
+
+	FileEndsWith     []ConditionalRule // list of item rules that have been resolved for specific paths
+	FolderEndsWith   []ConditionalRule // list of item rules that have been resolved for specific paths
+	FileStartsWith   []ConditionalRule // list of item rules that have been resolved for specific paths
+	FolderStartsWith []ConditionalRule // list of item rules that have been resolved for specific paths
+
+	// NeverWatch paths map - O(1) lookup for all paths with neverWatch: true
+	// This replaces the old NeverWatchPaths slice
+	NeverWatchPaths  map[string]struct{} // key: full folder path
+	IncludeRootItems map[string]struct{} // key: inclusive root item
+
+	IgnoreAllHidden          bool // Excludes all hidden files and folders
+	IgnoreAllZeroSizeFolders bool // Excludes all folders with 0 size
+	IgnoreAllSymlinks        bool // Excludes all symbolic links
+	IndexingDisabled         bool // Excludes all files and folders from indexing
 }
 
 type Frontend struct {
@@ -113,19 +269,27 @@ type Frontend struct {
 	ExternalLinks         []ExternalLink `json:"externalLinks"`
 	DisableNavButtons     bool           `json:"disableNavButtons"` // disable the nav buttons in the sidebar
 	Styling               StylingConfig  `json:"styling"`
+	Favicon               string         `json:"favicon"`             // path to a favicon to use for the frontend
+	Description           string         `json:"description"`         // description that shows up in html head meta description
+	LoginIcon             string         `json:"loginIcon"`           // path to an image file for the login page icon
+	OIDCLoginButtonText   string         `json:"oidcLoginButtonText"` // text to display on the OIDC login button
 }
 
 type StylingConfig struct {
-	CustomCSS          string                 `json:"customCSS"`       // if a valid path to a css file is provided, it will be applied for all users. (eg. "reduce-rounded-corners.css")
-	LightBackground    string                 `json:"lightBackground"` // specify a valid CSS color property value to use as the background color in light mode
-	DarkBackground     string                 `json:"darkBackground"`  // Specify a valid CSS color property value to use as the background color in dark mode
-	CustomThemes       map[string]CustomTheme `json:"customThemes"`    // A list of custom css files that each user can select to override the default styling. if "default" is key name then it will be the default option.
-	CustomThemeOptions map[string]CustomTheme `json:"-"`               // not exposed
+	DisableEventBasedThemes bool                   `json:"disableEventThemes"` // disable the event based themes,
+	CustomCSS               string                 `json:"customCSS"`          // if a valid path to a css file is provided, it will be applied for all users. (eg. "reduce-rounded-corners.css")
+	CustomCSSRaw            string                 `json:"-"`                  // The css raw content to use for the custom css.
+	LightBackground         string                 `json:"lightBackground"`    // specify a valid CSS color property value to use as the background color in light mode
+	DarkBackground          string                 `json:"darkBackground"`     // Specify a valid CSS color property value to use as the background color in dark mode
+	CustomThemes            map[string]CustomTheme `json:"customThemes"`       // A list of custom css files that each user can select to override the default styling. if "default" is key name then it will be the default option.
+	// In-memory (not exposed to config)
+	CustomThemeOptions map[string]CustomTheme `json:"-"` // not exposed
 }
 
 type CustomTheme struct {
 	Description string `json:"description"`   // The description of the theme to display in the UI.
 	CSS         string `json:"css,omitempty"` // The css file path and filename to use for the theme.
+	CssRaw      string `json:"-"`             // The css raw content to use for the theme.
 }
 
 type ExternalLink struct {
@@ -134,36 +298,63 @@ type ExternalLink struct {
 	Url   string `json:"url" validate:"required"`  // the url to link to
 }
 
+// UserDefaultsPreview holds preview settings with pointer types for defaults
+type UserDefaultsPreview struct {
+	DisableHideSidebar bool  `json:"disableHideSidebar"` // keep sidebar open when previewing files
+	HighQuality        *bool `json:"highQuality"`        // use high quality thumbnails
+	Image              *bool `json:"image"`              // show thumbnails for image files
+	Video              *bool `json:"video"`              // show thumbnails for video files
+	MotionVideoPreview *bool `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
+	Office             *bool `json:"office"`             // show thumbnails for office files
+	PopUp              *bool `json:"popup"`              // show larger popup preview when hovering over thumbnail
+	AutoplayMedia      *bool `json:"autoplayMedia"`      // autoplay media files in preview
+	DefaultMediaPlayer bool  `json:"defaultMediaPlayer"` // disable the styled feature-rich media player for browser default
+	Folder             *bool `json:"folder"`             // show thumbnails for folders that have previewable contents
+}
+
+// UserDefaultsPermissions holds permission settings with pointer types for defaults
+type UserDefaultsPermissions struct {
+	Api      bool  `json:"api"`      // allow api access
+	Admin    bool  `json:"admin"`    // allow admin access
+	Modify   bool  `json:"modify"`   // allow modifying files
+	Share    bool  `json:"share"`    // allow sharing files
+	Realtime bool  `json:"realtime"` // allow realtime updates
+	Delete   bool  `json:"delete"`   // allow deleting files
+	Create   bool  `json:"create"`   // allow creating or uploading files
+	Download *bool `json:"download"` // allow downloading files
+}
+
 // UserDefaults is a type that holds the default values
 // for some fields on User.
 type UserDefaults struct {
-	EditorQuickSave            bool                `json:"editorQuickSave"`           // show quick save button in editor
-	HideSidebarFileActions     bool                `json:"hideSidebarFileActions"`    // hide the file actions in the sidebar
-	DisableQuickToggles        bool                `json:"disableQuickToggles"`       // disable the quick toggles in the sidebar
-	DisableSearchOptions       bool                `json:"disableSearchOptions"`      // disable the search options in the search bar
-	StickySidebar              bool                `json:"stickySidebar"`             // keep sidebar open when navigating
-	DarkMode                   bool                `json:"darkMode"`                  // should dark mode be enabled
-	Locale                     string              `json:"locale"`                    // language to use: eg. de, en, or fr
-	ViewMode                   string              `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
-	SingleClick                bool                `json:"singleClick"`               // open directory on single click, also enables middle click to open in new tab
-	ShowHidden                 bool                `json:"showHidden"`                // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-	DateFormat                 bool                `json:"dateFormat"`                // when false, the date is relative, when true, the date is an exact timestamp
-	GallerySize                int                 `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
-	ThemeColor                 string              `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-	QuickDownload              bool                `json:"quickDownload"`             // show icon to download in one click
-	DisablePreviewExt          string              `json:"disablePreviewExt"`         // comma separated list of file extensions to disable preview for
-	DisableViewingExt          string              `json:"disableViewingExt"`         // comma separated list of file extensions to disable viewing for
-	LockPassword               bool                `json:"lockPassword"`              // disable the user from changing their password
-	DisableSettings            bool                `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
-	Preview                    users.Preview       `json:"preview"`
-	DefaultScopes              []users.SourceScope `json:"-"`
-	Permissions                users.Permissions   `json:"permissions"`
-	LoginMethod                string              `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
-	DisableUpdateNotifications bool                `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
-	DeleteWithoutConfirming    bool                `json:"deleteWithoutConfirming"`    // delete files without confirmation
-	FileLoading                users.FileLoading   `json:"fileLoading"`                // upload and download settings
-	DisableOfficePreviewExt    string              `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
-	DisableOnlyOfficeExt       string              `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
-	CustomTheme                string              `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
-	ShowSelectMultiple         bool                `json:"showSelectMultiple"`         // show select multiple files on desktop
+	EditorQuickSave            bool                    `json:"editorQuickSave"`           // show quick save button in editor
+	HideSidebarFileActions     bool                    `json:"hideSidebarFileActions"`    // hide the file actions in the sidebar
+	DisableQuickToggles        bool                    `json:"disableQuickToggles"`       // disable the quick toggles in the sidebar
+	DisableSearchOptions       bool                    `json:"disableSearchOptions"`      // disable the search options in the search bar
+	StickySidebar              bool                    `json:"stickySidebar"`             // keep sidebar open when navigating
+	DarkMode                   *bool                   `json:"darkMode"`                  // should dark mode be enabled
+	Locale                     string                  `json:"locale"`                    // language to use: eg. de, en, or fr
+	ViewMode                   string                  `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
+	SingleClick                bool                    `json:"singleClick"`               // open directory on single click, also enables middle click to open in new tab
+	ShowHidden                 bool                    `json:"showHidden"`                // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	DateFormat                 bool                    `json:"dateFormat"`                // when false, the date is relative, when true, the date is an exact timestamp
+	GallerySize                int                     `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
+	ThemeColor                 string                  `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+	QuickDownload              bool                    `json:"quickDownload"`             // show icon to download in one click
+	DisablePreviewExt          string                  `json:"disablePreviewExt"`         // space separated list of file extensions to disable preview for
+	DisableViewingExt          string                  `json:"disableViewingExt"`         // space separated list of file extensions to disable viewing for
+	LockPassword               bool                    `json:"lockPassword"`              // disable the user from changing their password
+	DisableSettings            bool                    `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
+	Preview                    UserDefaultsPreview     `json:"preview"`
+	DefaultScopes              []users.SourceScope     `json:"-"`
+	Permissions                UserDefaultsPermissions `json:"permissions"`
+	LoginMethod                string                  `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
+	DisableUpdateNotifications bool                    `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
+	DeleteWithoutConfirming    bool                    `json:"deleteWithoutConfirming"`    // delete files without confirmation
+	FileLoading                users.FileLoading       `json:"fileLoading"`                // upload and download settings
+	DisableOfficePreviewExt    string                  `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
+	DisableOnlyOfficeExt       string                  `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
+	CustomTheme                string                  `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
+	ShowSelectMultiple         bool                    `json:"showSelectMultiple"`         // show select multiple files on desktop
+	DebugOffice                bool                    `json:"debugOffice"`                // debug onlyoffice editor
 }

backend/common/settings/styling.go

@@ -1,6 +1,8 @@
 package settings
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"regexp"
 	"strings"
@@ -74,36 +76,45 @@ func FallbackColor(val, defaultColor string) string {
 }
 
 func addCustomTheme(name, description, cssFilePath string) {
-	cssContent := ""
-	if cssFilePath != "" {
-		cssContent = readCustomCSS(cssFilePath)
-	}
+	// Store only file path in config (for YAML export)
 	Config.Frontend.Styling.CustomThemes[name] = CustomTheme{
 		Description: description,
-		CSS:         cssContent,
+		CSS:         cssFilePath, // Store file path, not content
+	}
+
+	// Load CSS content for runtime use (frontend consumption)
+	cssContent := ""
+	if cssFilePath != "" {
+		var err error
+		cssContent, err = readCustomCSS(cssFilePath)
+		if err != nil {
+			logger.Warning(err.Error())
+			return
+		}
+
 	}
 	Config.Frontend.Styling.CustomThemeOptions[name] = CustomTheme{
 		Description: description,
 		CSS:         cssFilePath,
+		CssRaw:      cssContent, // Store loaded content
 	}
+	logger.Debugf("Added custom theme: %s", name)
 }
 
-func readCustomCSS(path string) string {
+func readCustomCSS(path string) (string, error) {
 	if path == "" {
-		return ""
+		return "", errors.New("path is empty")
 	}
 	content, err := os.ReadFile(path)
 	if err != nil {
-		// Only log if the file exists but cannot be read (e.g., permission error)
-		if !os.IsNotExist(err) {
-			logger.Warningf("Could not read custom CSS file %s: %v", path, err)
-			return ""
-		}
+		return "", fmt.Errorf("could not read custom CSS file: %v", err)
 	}
 	if len(content) > 128*1024 {
-		logger.Warningf("Custom CSS file %s is too large (%d bytes), ignoring", path, len(content))
-		return ""
+		return "", fmt.Errorf("custom CSS file is too large (%d bytes)", len(content))
 	}
-	logger.Infof("Loaded custom CSS from: %s (%d bytes)", path, len(content))
-	return string(content)
+	if len(content) == 0 {
+		return "", fmt.Errorf("custom CSS file is empty: %s", path)
+	}
+	logger.Debugf("Loaded custom CSS from: %s (%d bytes)", path, len(content))
+	return string(content), nil
 }

backend/common/settings/video_preview_test.go

@@ -0,0 +1,317 @@
+package settings
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestVideoPreviewDefaults(t *testing.T) {
+	// Test 1: No videoPreview config at all - should enable all
+	t.Run("NoVideoPreviewConfig", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      imagePreview:
+        heic: false
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// All video formats should be enabled by default
+			for _, format := range AllVideoPreviewTypes {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
+				}
+			}
+		})
+	})
+
+	// Test 2: Empty videoPreview config - should enable all
+	t.Run("EmptyVideoPreviewConfig", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      imagePreview:
+        heic: false
+      videoPreview: {}
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// All video formats should be enabled by default
+			for _, format := range AllVideoPreviewTypes {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
+				}
+			}
+		})
+	})
+
+	// Test 3: Partial videoPreview config - should enable all except explicitly disabled
+	t.Run("PartialVideoPreviewConfig", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      imagePreview:
+        heic: false
+      videoPreview:
+        mp4: true
+        webm: false
+        mkv: false
+        wmv: false
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// Check explicitly set formats
+			if !*config.Integrations.Media.Convert.VideoPreview[MP4VideoPreview] {
+				t.Error("Expected mp4 to be enabled")
+			}
+			if *config.Integrations.Media.Convert.VideoPreview[WebMVideoPreview] {
+				t.Error("Expected webm to be disabled")
+			}
+			if *config.Integrations.Media.Convert.VideoPreview[MKVVideoPreview] {
+				t.Error("Expected mkv to be disabled")
+			}
+			if *config.Integrations.Media.Convert.VideoPreview[WMVVideoPreview] {
+				t.Error("Expected wmv to be disabled")
+			}
+
+			// Check that unmentioned formats are still enabled
+			unmentionedFormats := []VideoPreviewType{
+				AVIVideoPreview, MOVVideoPreview, FLVVideoPreview,
+				M4VVideoPreview, ThreeGPVideoPreview, TSVideoPreview, VOBVideoPreview,
+			}
+			for _, format := range unmentionedFormats {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled (not mentioned in config), but it was disabled", format)
+				}
+			}
+		})
+	})
+
+	// Test 4: All videoPreview config - should respect all settings
+	t.Run("AllVideoPreviewConfig", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      imagePreview:
+        heic: false
+      videoPreview:
+        mp4: true
+        webm: true
+        mov: true
+        avi: false
+        mkv: true
+        flv: false
+        wmv: true
+        m4v: false
+        3gp: true
+        3g2: false
+        ts: true
+        m2ts: false
+        vob: true
+        asf: false
+        mpg: true
+        mpeg: false
+        f4v: true
+        ogv: false
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// Check all explicitly set formats
+			expectedEnabled := []VideoPreviewType{
+				MP4VideoPreview, WebMVideoPreview, MOVVideoPreview, MKVVideoPreview,
+				WMVVideoPreview, ThreeGPVideoPreview, TSVideoPreview, VOBVideoPreview,
+				MPGVideoPreview, F4VVideoPreview,
+			}
+			expectedDisabled := []VideoPreviewType{
+				AVIVideoPreview, FLVVideoPreview, M4VVideoPreview,
+				ThreeGP2VideoPreview, M2TSVideoPreview, ASFVideoPreview,
+				MPEGVideoPreview, OGVVideoPreview,
+			}
+
+			for _, format := range expectedEnabled {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled, but it was disabled", format)
+				}
+			}
+
+			for _, format := range expectedDisabled {
+				if *config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be disabled, but it was enabled", format)
+				}
+			}
+		})
+	})
+
+	// Test 5: No integrations section at all - should enable all
+	t.Run("NoIntegrationsSection", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// All video formats should be enabled by default
+			for _, format := range AllVideoPreviewTypes {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
+					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
+				}
+			}
+		})
+	})
+}
+
+func TestVideoPreviewFormatCategories(t *testing.T) {
+	// Test that all video format categories are properly supported
+	t.Run("FormatCategories", func(t *testing.T) {
+		config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
+			// Test format categories
+			categories := map[string][]VideoPreviewType{
+				"Common Web Formats":     {MP4VideoPreview, WebMVideoPreview, OGVVideoPreview},
+				"Apple Formats":          {MOVVideoPreview, M4VVideoPreview},
+				"Microsoft Formats":      {AVIVideoPreview, WMVVideoPreview, ASFVideoPreview},
+				"Open Source":            {MKVVideoPreview, FLVVideoPreview},
+				"Mobile Formats":         {ThreeGPVideoPreview, ThreeGP2VideoPreview},
+				"Broadcast/Professional": {TSVideoPreview, M2TSVideoPreview},
+				"Legacy Formats":         {VOBVideoPreview, MPGVideoPreview, MPEGVideoPreview, F4VVideoPreview},
+			}
+
+			for category, formats := range categories {
+				t.Run(category, func(t *testing.T) {
+					for _, format := range formats {
+						if !*config.Integrations.Media.Convert.VideoPreview[format] {
+							t.Errorf("Expected %s (%s) to be enabled by default, but it was disabled", format, category)
+						}
+					}
+				})
+			}
+		})
+	})
+}
+
+func TestVideoPreviewFormatCount(t *testing.T) {
+	// Test that we have the expected number of video formats
+	t.Run("FormatCount", func(t *testing.T) {
+		expectedCount := 18
+		actualCount := len(AllVideoPreviewTypes)
+		if actualCount != expectedCount {
+			t.Errorf("Expected %d video formats, but got %d", expectedCount, actualCount)
+		}
+
+		// Test that all formats are unique
+		formatMap := make(map[VideoPreviewType]bool)
+		for _, format := range AllVideoPreviewTypes {
+			if formatMap[format] {
+				t.Errorf("Duplicate video format found: %s", format)
+			}
+			formatMap[format] = true
+		}
+	})
+}
+
+func BenchmarkVideoPreviewSetup(b *testing.B) {
+	config := `
+server:
+  sources:
+    - path: "."
+integrations:
+  media:
+    convert:
+      videoPreview:
+        mp4: true
+        webm: false
+        mkv: true
+        wmv: false
+  office:
+    url: "http://localhost:8080"
+    secret: "test-secret"
+`
+
+	// Create temporary config file
+	tmpFile, err := os.CreateTemp("", "benchmark_video_preview_*.yaml")
+	if err != nil {
+		b.Fatalf("Error creating temp file: %v", err)
+	}
+	defer os.Remove(tmpFile.Name())
+
+	// Create a temporary directory for cache
+	tmpCacheDir, err := os.MkdirTemp("", "benchmark_cache_*")
+	if err != nil {
+		b.Fatalf("Error creating temp cache dir: %v", err)
+	}
+	defer os.RemoveAll(tmpCacheDir)
+
+	// Modify config to use absolute temp directory
+	modifiedConfig := strings.Replace(config, "server:", fmt.Sprintf("server:\n  cacheDir: %s", tmpCacheDir), 1)
+
+	_, err = tmpFile.WriteString(modifiedConfig)
+	if err != nil {
+		b.Fatalf("Error writing config: %v", err)
+	}
+	tmpFile.Close()
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		Initialize(tmpFile.Name())
+	}
+}
+
+// Helper function to test video preview configuration
+func testVideoPreviewConfig(t *testing.T, configContent string, testFunc func(t *testing.T, config *Settings)) {
+	// Create temporary config file
+	tmpFile, err := os.CreateTemp("", "test_video_preview_*.yaml")
+	if err != nil {
+		t.Fatalf("Error creating temp file: %v", err)
+	}
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.WriteString(configContent)
+	if err != nil {
+		t.Fatalf("Error writing config: %v", err)
+	}
+	tmpFile.Close()
+
+	// Initialize settings
+	Initialize(tmpFile.Name())
+
+	// Run the test function
+	testFunc(t, &Config)
+}

backend/common/settings/yaml.go

@@ -0,0 +1,111 @@
+package settings
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// combineYAMLFiles combines multiple YAML files from a directory into a single YAML document
+// This allows YAML anchors defined in one file to be referenced in another
+//
+// Pattern matching: If main config is "config.yaml", only files matching "*-config.yaml" are merged
+// Examples:
+//   - config.yaml + server-config.yaml + auth-config.yaml
+//   - test.yaml + database-test.yaml + frontend-test.yaml
+//   - myapp.yml + server-myapp.yml
+func combineYAMLFiles(configFilePath string) ([]byte, error) {
+	// Get absolute path and expand tilde
+	expandedPath := configFilePath
+	if strings.HasPrefix(configFilePath, "~/") {
+		homeDir, err := os.UserHomeDir()
+		if err != nil {
+			return nil, fmt.Errorf("failed to expand home directory: %v", err)
+		}
+		expandedPath = filepath.Join(homeDir, configFilePath[2:])
+	}
+
+	absPath, err := filepath.Abs(expandedPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve config file path: %v", err)
+	}
+
+	configDir := filepath.Dir(absPath)
+	configFileName := filepath.Base(absPath)
+
+	// Extract base name pattern for matching related config files
+	// e.g., "config.yaml" -> match "*-config.yaml"
+	//       "test.yml" -> match "*-test.yml"
+	ext := filepath.Ext(configFileName)
+	baseName := strings.TrimSuffix(configFileName, ext)
+	pattern := "-" + baseName + ext
+
+	// Find all YAML files in the directory that match the pattern
+	entries, err := os.ReadDir(configDir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read config directory: %v", err)
+	}
+
+	var yamlFiles []string
+	var mainConfigContent []byte
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+
+		name := entry.Name()
+
+		// Skip hidden files (dotfiles like .goreleaser.yaml)
+		if strings.HasPrefix(name, ".") {
+			continue
+		}
+
+		fileExt := strings.ToLower(filepath.Ext(name))
+
+		// Only process .yaml and .yml files
+		if fileExt != ".yaml" && fileExt != ".yml" {
+			continue
+		}
+
+		fullPath := filepath.Join(configDir, name)
+
+		// Keep track of the main config file to process it last
+		if name == configFileName {
+			content, err := os.ReadFile(fullPath)
+			if err != nil {
+				return nil, fmt.Errorf("failed to read main config file: %v", err)
+			}
+			mainConfigContent = content
+		} else if strings.HasSuffix(name, pattern) {
+			// Only include files that match the pattern (e.g., *-config.yaml)
+			yamlFiles = append(yamlFiles, fullPath)
+		}
+	}
+
+	// Sort the auxiliary files for consistent ordering
+	sort.Strings(yamlFiles)
+
+	// Combine all YAML files as raw text into a single document
+	// We do NOT use `---` separators because anchors don't work across document boundaries
+	var combined strings.Builder
+
+	// First, add all auxiliary YAML files (these typically contain anchor definitions)
+	for _, file := range yamlFiles {
+		content, err := os.ReadFile(file)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read YAML file %s: %v", file, err)
+		}
+		combined.Write(content)
+		combined.WriteString("\n") // Add newline between files
+	}
+
+	// Finally, add the main config file (this typically contains the references)
+	if mainConfigContent != nil {
+		combined.Write(mainConfigContent)
+	}
+
+	return []byte(combined.String()), nil
+}

backend/common/utils/cache.go

@@ -7,9 +7,9 @@ import (
 )
 
 var (
-	DiskUsageCache     = cache.NewCache(30*time.Second, 24*time.Hour)
-	RealPathCache      = cache.NewCache(48*time.Hour, 72*time.Hour)
-	SearchResultsCache = cache.NewCache(15*time.Second, 1*time.Hour)
-	OnlyOfficeCache    = cache.NewCache(48*time.Hour, 1*time.Hour)
-	JwtCache           = cache.NewCache(1*time.Hour, 72*time.Hour)
+	DiskUsageCache     = cache.NewCache[bool](30*time.Second, 24*time.Hour)
+	RealPathCache      = cache.NewCache[string](48*time.Hour, 72*time.Hour)
+	SearchResultsCache = cache.NewCache[string](15*time.Second, 1*time.Hour)
+	OnlyOfficeCache    = cache.NewCache[string](48*time.Hour, 1*time.Hour)
+	JwtCache           = cache.NewCache[string](1*time.Hour, 72*time.Hour)
 )

backend/common/utils/checkForUpdates.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
@@ -30,6 +31,10 @@ func CheckForUpdates() (updateInfo, error) {
 	repoOwner := "gtsteffaniak"
 	repoName := "filebrowser"
 	currentVersion := version.Version
+	isDevMode := os.Getenv("FILEBROWSER_DEVMODE") == "true"
+	if currentVersion == "untracked" || currentVersion == "testing" || currentVersion == "" || isDevMode {
+		return updateInfo{}, nil
+	}
 	splitVersion := strings.Split(currentVersion, "-")
 	versionCategory := "stable"
 	if len(splitVersion) > 1 {
@@ -51,13 +56,13 @@ func CheckForUpdates() (updateInfo, error) {
 	if err := json.NewDecoder(resp.Body).Decode(&tags); err != nil {
 		return updateInfo{}, err
 	}
-	// Find the latest beta version greater than the current one
+	// Find the latest version greater than the current one that matches the version category
 	var NewVersion string
 	for _, tag := range tags {
-		// Check if the version is valid, is a pre-release, and contains "beta"
+		// Check if the version is valid and the prerelease contains the version category
 		if semver.IsValid(tag.Name) && strings.Contains(semver.Prerelease(tag.Name), versionCategory) {
 			// Check if this tag is greater than the current version
-			// and also greater than any other beta version we've found so far
+			// and also greater than any other version we've found so far
 			if semver.Compare(tag.Name, currentVersion) > 0 {
 				if NewVersion == "" || semver.Compare(tag.Name, NewVersion) > 0 {
 					NewVersion = tag.Name

backend/common/utils/file.go

@@ -0,0 +1,81 @@
+package utils
+
+import (
+	"crypto/md5"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/hex"
+	"fmt"
+	"hash"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+)
+
+// GetChecksum calculates the checksum of a file using the specified algorithm.
+// Returns the checksum as a hex-encoded string.
+func GetChecksum(fullPath, algo string) (string, error) {
+	reader, err := os.Open(fullPath)
+	if err != nil {
+		return "", err
+	}
+	defer reader.Close()
+
+	hashFuncs := map[string]hash.Hash{
+		"md5":    md5.New(),
+		"sha1":   sha1.New(),
+		"sha256": sha256.New(),
+		"sha512": sha512.New(),
+	}
+
+	h, ok := hashFuncs[algo]
+	if !ok {
+		return "", errors.ErrInvalidOption
+	}
+
+	_, err = io.Copy(h, reader)
+	if err != nil {
+		return "", err
+	}
+
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+// FileOptions are the options when getting a file info.
+type FileOptions struct {
+	Path                     string // realpath
+	Source                   string
+	IsDir                    bool
+	Expand                   bool
+	Content                  bool
+	Recursive                bool // whether to recursively index directories
+	Metadata                 bool // whether to get metadata
+	ExtractEmbeddedSubtitles bool // whether to extract embedded subtitles from media files
+	AlbumArt                 bool // whether to get album art from media files
+	ShowHidden               bool // whether to show hidden files (true = show, false = hide)
+	FollowSymlinks           bool // whether to follow symlinks
+}
+
+// SanitizeUserPath prevents path traversal attacks by cleaning and validating user input.
+// Rule 1: Do Not Use User Input in File Paths (without validation)
+func SanitizeUserPath(userPath string) (string, error) {
+	clean := filepath.Clean(userPath)
+
+	// Split the path into segments to check for path traversal attempts
+	// We check if ".." appears as a complete path segment (not just in a filename)
+	segments := strings.Split(clean, string(filepath.Separator))
+
+	for _, segment := range segments {
+		// Check if any segment is exactly ".." (path traversal attempt)
+		// This catches any ".." that filepath.Clean couldn't resolve (i.e., escape attempts)
+		if segment == ".." {
+			return "", fmt.Errorf("invalid path: path traversal detected")
+		}
+	}
+
+	return clean, nil
+}

backend/common/utils/main.go

@@ -1,11 +1,13 @@
 package utils
 
 import (
+	"cmp"
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
 	math "math/rand"
+	"os"
 	"path/filepath"
 	"reflect"
 	"runtime"
@@ -121,3 +123,44 @@ func NonNilSlice[T any](in []T) []T {
 	}
 	return in
 }
+
+func Ternary[T any](cond bool, vtrue, vfalse T) T {
+	if cond {
+		return vtrue
+	}
+	return vfalse
+}
+
+// Clamp returns value clamped between min and max.
+// If value < min, returns min.
+// If value > max, returns max.
+// Otherwise, returns value.
+func Clamp[T cmp.Ordered](value, min, max T) T {
+	if value < min {
+		return min
+	}
+	if value > max {
+		return max
+	}
+	return value
+}
+
+// NormalizeRulePath ensures directory paths have trailing slashes for consistent rule storage
+func AddTrailingSlashIfNotExists(indexPath string) string {
+	// Root path stays as "/"
+	if indexPath == "/" {
+		return "/"
+	}
+	// For all other paths, ensure they have trailing slashes
+	if !strings.HasSuffix(indexPath, "/") {
+		return indexPath + "/"
+	}
+	return indexPath
+}
+
+func CheckPathExists(realPath string) bool {
+	if _, err := os.Stat(realPath); os.IsNotExist(err) {
+		return false
+	}
+	return true
+}

backend/common/utils/media.go

@@ -0,0 +1,43 @@
+package utils
+
+import (
+	"errors"
+	"os"
+)
+
+type SubtitleTrack struct {
+	Name     string `json:"name"`            // filename for external, or descriptive name for embedded
+	Language string `json:"language"`        // language code
+	Title    string `json:"title,omitempty"` // title/description
+	Index    *int   `json:"index,omitempty"` // stream index for embedded subtitles (nil for external)
+	Codec    string `json:"codec,omitempty"` // codec name for embedded subtitles
+	Embedded bool   `json:"embedded"`        // true for embedded subtitles, false for external files
+}
+
+func GetSubtitleSidecarContent(subtitlePath string) (string, error) {
+	// validate the size is not too large
+	info, err := os.Stat(subtitlePath)
+	if err != nil {
+		return "", err
+	}
+	if info.Size() > 1024*1024*50 { // 50MB
+		return "", errors.New("subtitle file is too large")
+	}
+
+	// First check if it's a text file using the consolidated validation logic
+	isText, err := IsTextFile(subtitlePath)
+	if err != nil {
+		return "", err
+	}
+	if !isText {
+		// Not a text file, return empty string (no error, just not text)
+		return "", nil
+	}
+
+	// read the file content
+	content, err := os.ReadFile(subtitlePath)
+	if err != nil {
+		return "", err
+	}
+	return string(content), nil
+}

backend/common/utils/textfile.go

@@ -0,0 +1,65 @@
+package utils
+
+import (
+	"os"
+	"unicode/utf8"
+)
+
+// IsTextFile checks if a file is viewable/editable as text (like with cat or a text editor).
+// It returns true if the file appears to be text, false if it's likely binary.
+// This function uses simple heuristics:
+// - Valid UTF-8 encoding
+// - Not full of null bytes (which indicate binary data)
+func IsTextFile(realPath string) (bool, error) {
+	const sampleSize = 8192       // Read first 8KB to check
+	const maxNullByteRatio = 0.05 // Reject if more than 5% null bytes
+	// Read sample from file
+	content, err := os.ReadFile(realPath)
+	if err != nil {
+		return false, err
+	}
+	// Empty files are considered text
+	if len(content) == 0 {
+		return true, nil
+	}
+	// Use sample for large files to avoid reading entire file into memory
+	sample := content
+	if len(content) > sampleSize {
+		sample = content[:sampleSize]
+	}
+	// Check 1: Count null bytes - binary files typically have many nulls
+	nullCount := 0
+	for _, b := range sample {
+		if b == 0x00 {
+			nullCount++
+		}
+	}
+
+	if nullCount > 0 {
+		nullRatio := float64(nullCount) / float64(len(sample))
+		if nullRatio > maxNullByteRatio {
+			return false, nil
+		}
+	}
+
+	// Check 2: Validate UTF-8 encoding
+	// Trim sample to last complete UTF-8 rune to avoid false negatives
+	trimmedSample := sample
+	for len(trimmedSample) > 0 {
+		lastRune, size := utf8.DecodeLastRune(trimmedSample)
+		if lastRune != utf8.RuneError {
+			break
+		}
+		if size == 1 {
+			trimmedSample = trimmedSample[:len(trimmedSample)-1]
+		} else {
+			break
+		}
+	}
+
+	if len(trimmedSample) > 0 && !utf8.Valid(trimmedSample) {
+		return false, nil
+	}
+
+	return true, nil
+}

backend/config.yaml

@@ -6,17 +6,46 @@ server:
   sources:
     - path: "/srv"
 userDefaults:
+  editorQuickSave: false                  # show quick save button in editor
+  hideSidebarFileActions: false           # hide the file actions in the sidebar
+  disableQuickToggles: false              # disable the quick toggles in the sidebar
+  disableSearchOptions: false             # disable the search options in the search bar
+  stickySidebar: true                     # keep sidebar open when navigating
+  darkMode: true                          # should dark mode be enabled (defaults to true if not set)
+  viewMode: "normal"                      # view mode to use: eg. normal, list, grid, or compact
+  singleClick: false                      # open directory on single click, also enables middle click to open in new tab
+  showHidden: false                       # show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+  dateFormat: false                       # when false, the date is relative, when true, the date is an exact timestamp
+  gallerySize: 3                          # 0-9 - the size of the gallery thumbnails
+  themeColor: "var(--blue)"               # theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+  quickDownload: false                    # show icon to download in one click
+  disablePreviewExt: ""                   # space separated list of file extensions to disable preview for
+  disableViewingExt: ""                   # space separated list of file extensions to disable viewing for
+  lockPassword: false                     # disable the user from changing their password
+  disableSettings: false                  # disable the user from viewing the settings page
   preview:
-    image: true
-    popup: true
-    video: false
-    office: false
-    highQuality: false
-  darkMode: true
-  disableSettings: false
-  singleClick: false
+    disableHideSidebar: false             # disable the hide sidebar preview for previews and editors
+    highQuality: true                     # generate high quality thumbnail preview images (defaults to true if not set)
+    image: true                           # show thumbnail preview image for image files (defaults to true if not set)
+    video: true                           # show thumbnail preview image for video files (defaults to true if not set)
+    motionVideoPreview: true              # show multiple frames for videos in thumbnail preview when hovering (defaults to true if not set)
+    office: true                          # show thumbnail preview image for office files (defaults to true if not set)
+    popup: true                           # show larger popup preview when hovering over thumbnail (defaults to true if not set)
+    autoplayMedia: true                   # autoplay media files in preview (defaults to true if not set)
+    defaultMediaPlayer: false             # disable html5 media player and use the default media player
+    folder: true                          # show thumbnail preview image for folder files (defaults to true if not set)
   permissions:
-    admin: false
-    modify: false
-    share: false
-    api: false
+    api: false                            # allow api access
+    admin: false                          # allow admin access
+    modify: false                         # allow modifying files
+    share: false                          # allow sharing files
+    realtime: false                       # allow realtime updates
+    delete: false                         # allow deleting files
+    create: false                         # allow creating or uploading files
+    download: true                        # allow downloading files (defaults to true if not set)
+  disableUpdateNotifications: false       # disable update notifications banner for admin users
+  deleteWithoutConfirming: false          # delete files without confirmation
+  disableOnlyOfficeExt: ".md .txt .pdf .html .xml"   # list of file extensions to disable onlyoffice editor for
+  customTheme: ""                         # Name of theme to use chosen from custom themes config.
+  showSelectMultiple: false               # show select multiple files on desktop
+  debugOffice: false                      # debug onlyoffice editor

backend/database/access/access.go

@@ -4,20 +4,28 @@ import (
 	"encoding/json"
 	"fmt"
 	"maps"
+	"path/filepath"
 	"slices"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/asdine/storm/v3"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-cache/cache"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
-var accessCache = cache.NewCache(1 * time.Minute)
+var (
+	accessCache     = cache.NewCache[string](1 * time.Minute)                        // for accessChangedKey
+	versionCache    = cache.NewCache[int](1 * time.Minute)                           // for version keys
+	permissionCache = cache.NewCache[bool](1 * time.Minute)                          // for permission keys
+	rulesCache      = cache.NewCache[map[string]FrontendAccessRule](1 * time.Minute) // for rules
+)
 
 const accessRulesBucket = "access_rules"
 const accessRulesKey = "rules"
@@ -52,9 +60,11 @@ type FrontendRuleSet struct {
 }
 
 type FrontendAccessRule struct {
-	DenyAll bool            `json:"denyAll,omitempty"`
-	Deny    FrontendRuleSet `json:"deny"`
-	Allow   FrontendRuleSet `json:"allow"`
+	DenyAll           bool            `json:"denyAll,omitempty"`
+	Deny              FrontendRuleSet `json:"deny"`
+	Allow             FrontendRuleSet `json:"allow"`
+	SourceDenyDefault bool            `json:"sourceDenyDefault"`
+	PathExists        bool            `json:"pathExists"`
 }
 
 // GroupMap maps group names to a set of usernames.
@@ -134,21 +144,64 @@ func NewStorage(db *storm.DB, usersStore *users.Storage) *Storage {
 	return s
 }
 
+// ClearCache clears the access cache (useful for testing)
+func ClearCache() {
+	// Recreate the caches to clear them
+	accessCache = cache.NewCache[string](1 * time.Minute)
+	versionCache = cache.NewCache[int](1 * time.Minute)
+	permissionCache = cache.NewCache[bool](1 * time.Minute)
+	rulesCache = cache.NewCache[map[string]FrontendAccessRule](1 * time.Minute)
+}
+
+// clearAllCaches clears ALL caches. This should be called whenever rules are created, updated, or deleted.
+func (s *Storage) clearAllCaches() {
+	accessCache.ClearAll()
+	versionCache.ClearAll()
+	permissionCache.ClearAll()
+	rulesCache.ClearAll()
+}
+
+// RemoveRuleByPath removes a rule by its exact path from the internal storage
+func (s *Storage) RemoveRuleByPath(sourcePath, indexPath string) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return
+	}
+
+	// Remove the rule by exact path match (don't normalize)
+	if _, exists := rulesBySource[indexPath]; exists {
+		delete(rulesBySource, indexPath)
+		// If no rules left for this source, remove the source entry
+		if len(rulesBySource) == 0 {
+			delete(s.AllRules, sourcePath)
+		}
+		s.clearAllCaches()
+		err := s.SaveToDB()
+		if err != nil {
+			logger.Errorf("error saving access rules to database: %v", err)
+		}
+	}
+}
+
 // getOrCreateRuleNL ensures a rule exists for the given source and index path.
 // The caller must hold the lock.
 func (s *Storage) getOrCreateRuleNL(sourcePath, indexPath string) *AccessRule {
+	// Normalize the path to ensure consistent rule storage
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
 	if _, ok := s.AllRules[sourcePath]; !ok {
 		s.AllRules[sourcePath] = make(RuleMap)
 	}
-	rule, ok := s.AllRules[sourcePath][indexPath]
+	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		rule = &AccessRule{
 			Deny:  RuleSet{Users: make(StringSet), Groups: make(StringSet)},
 			Allow: RuleSet{Users: make(StringSet), Groups: make(StringSet)},
 		}
-		s.AllRules[sourcePath][indexPath] = rule
+		s.AllRules[sourcePath][normalizedPath] = rule
 	}
-	logger.Debugf("Created rule for source: %s and index: %s", sourcePath, indexPath)
 	return rule
 }
 
@@ -167,7 +220,7 @@ func (s *Storage) DenyUser(sourcePath, indexPath, username string) error {
 		return errors.ErrExist
 	}
 	rule.Deny.Users[username] = struct{}{}
-	s.incrementSourceVersion(sourcePath)
+	s.clearAllCaches()
 	return s.SaveToDB()
 }
 
@@ -186,7 +239,7 @@ func (s *Storage) AllowUser(sourcePath, indexPath, username string) error {
 		return errors.ErrExist
 	}
 	rule.Allow.Users[username] = struct{}{}
-	s.incrementSourceVersion(sourcePath)
+	s.clearAllCaches()
 	return s.SaveToDB()
 }
 
@@ -203,7 +256,7 @@ func (s *Storage) DenyGroup(sourcePath, indexPath, groupname string) error {
 		return errors.ErrExist
 	}
 	rule.Deny.Groups[groupname] = struct{}{}
-	s.incrementSourceVersion(sourcePath)
+	s.clearAllCaches()
 	return s.SaveToDB()
 }
 
@@ -220,7 +273,7 @@ func (s *Storage) AllowGroup(sourcePath, indexPath, groupname string) error {
 		return errors.ErrExist
 	}
 	rule.Allow.Groups[groupname] = struct{}{}
-	s.incrementSourceVersion(sourcePath)
+	s.clearAllCaches()
 	return s.SaveToDB()
 }
 
@@ -233,105 +286,131 @@ func (s *Storage) DenyAll(sourcePath, indexPath string) error {
 		return errors.ErrExist
 	}
 	rule.DenyAll = true
-	s.incrementSourceVersion(sourcePath)
+	s.clearAllCaches()
 	return s.SaveToDB()
 }
 
 // Permitted checks if a username is permitted for a given sourcePath and indexPath, recursively checking parent directories.
 func (s *Storage) Permitted(sourcePath, indexPath, username string) bool {
+	// Ensure leading slash
+	if !strings.HasPrefix(indexPath, "/") {
+		indexPath = "/" + indexPath
+	}
+	indexPath = utils.AddTrailingSlashIfNotExists(indexPath)
+
 	// Get current version for the sourcePath
 	versionKey := "version:" + sourcePath
 	version := 0
-	if v, ok := accessCache.Get(versionKey).(int); ok {
+	if v, ok := versionCache.Get(versionKey); ok {
 		version = v
 	}
 
 	// Check cache with versioned key
 	permKey := fmt.Sprintf("perm:%s:%d:%s:%s", sourcePath, version, indexPath, username)
-	if p, ok := accessCache.Get(permKey).(bool); ok {
+	if p, ok := permissionCache.Get(permKey); ok {
 		return p
 	}
 
 	// Not in cache, compute, then cache it.
 	result := s.computePermitted(sourcePath, indexPath, username)
-	accessCache.Set(permKey, result)
+
+	permissionCache.Set(permKey, result)
 	return result
 }
 
 func (s *Storage) computePermitted(sourcePath, indexPath, username string) bool {
+	var rulesFound []*AccessRule
+
+	// Walk up the path hierarchy and collect all relevant rules
+	currentPath := indexPath
+	pathLevel := 0
 	for {
-		permitted, found := s.permittedAtExactPath(sourcePath, indexPath, username)
+		rule, found := s.getRuleAtExactPath(sourcePath, currentPath)
 		if found {
-			return permitted
+			rulesFound = append(rulesFound, rule)
 		}
-		indexPath = utils.GetParentDirectoryPath(indexPath)
-		if indexPath == "" {
+		if currentPath == "/" || currentPath == "." || currentPath == "" {
 			break
 		}
+		oldPath := currentPath
+		currentPath = utils.GetParentDirectoryPath(currentPath)
+
+		// Safety check to prevent infinite loops
+		if currentPath == oldPath {
+			break
+		}
+		pathLevel++
 	}
-	return true
+
+	// Now evaluate the rules, starting from the most specific (indexPath) to the least specific (root)
+	for _, rule := range rulesFound {
+		permitted, hasSpecificRule := s.evaluateRuleForUser(rule, username)
+		if hasSpecificRule {
+			return permitted
+		}
+	}
+
+	// No specific user or group rule found in the hierarchy.
+	// Check for any DenyAll rule in the path.
+	for _, rule := range rulesFound {
+		if rule.DenyAll {
+			return false
+		}
+	}
+
+	// No specific rules found anywhere in the path hierarchy.
+	// Fallback to the source's DenyByDefault setting.
+	sourceInfo, ok := settings.Config.Server.SourceMap[sourcePath]
+	if !ok {
+		logger.Errorf("source %s not found in config during access check", sourcePath)
+		return false
+	}
+
+	return !sourceInfo.Config.DenyByDefault
 }
 
-// permittedAtExactPath checks if a rule exists at the given path and evaluates it if so.
-func (s *Storage) permittedAtExactPath(sourcePath, indexPath, username string) (bool, bool) {
+// getRuleAtExactPath is a helper to get a rule without the recursive logic.
+func (s *Storage) getRuleAtExactPath(sourcePath, indexPath string) (*AccessRule, bool) {
 	s.mux.RLock()
+	defer s.mux.RUnlock()
 	rulesBySource, ok := s.AllRules[sourcePath]
 	if !ok {
-		s.mux.RUnlock()
-		return true, false
+		return nil, false
 	}
-	rule, ok := rulesBySource[indexPath]
-	s.mux.RUnlock()
-	if !ok {
-		return true, false
-	}
-	return s.permittedRule(rule, username), true
+	// Normalize the path to ensure consistent rule lookup
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rule, ok := rulesBySource[normalizedPath]
+	return rule, ok
 }
 
-// permittedRule contains the old Permitted logic, but operates on a rule and username only.
-func (s *Storage) permittedRule(rule *AccessRule, username string) bool {
-	// Check user deny
+// evaluateRuleForUser evaluates a single rule for a user and returns if a specific rule was found.
+func (s *Storage) evaluateRuleForUser(rule *AccessRule, username string) (permitted bool, hasSpecificRule bool) {
+	// Check user deny first
 	if _, found := rule.Deny.Users[username]; found {
-		return false
-	}
-	if rule.DenyAll {
-		return false
+		return false, true
 	}
+
 	// Check group deny
 	for group := range rule.Deny.Groups {
 		if s.isUserInGroup(username, group) {
-			return false
+			return false, true
 		}
 	}
-	// If any allow is present, user must be in at least one
-	hasUserAllow := len(rule.Allow.Users) > 0
-	hasGroupAllow := len(rule.Allow.Groups) > 0
-	if hasUserAllow || hasGroupAllow {
-		if hasUserAllow {
-			if _, found := rule.Allow.Users[username]; found {
-				return true
-			}
-		}
-		if hasGroupAllow {
-			for group := range rule.Allow.Groups {
-				if s.isUserInGroup(username, group) {
-					return true
-				}
-			}
-		}
-	} else {
-		return true
+
+	// Check user allow
+	if _, found := rule.Allow.Users[username]; found {
+		return true, true
 	}
-	// Fallback to deny rules
-	if _, found := rule.Deny.Users[username]; found {
-		return false
-	}
-	for group := range rule.Deny.Groups {
+
+	// Check group allow
+	for group := range rule.Allow.Groups {
 		if s.isUserInGroup(username, group) {
-			return false
+			return true, true
 		}
 	}
-	return true
+
+	// No specific rule for this user in this rule set.
+	return false, false
 }
 
 // isUserInGroup checks if a username is in a group.
@@ -350,7 +429,20 @@ func (s *Storage) isUserInGroup(username, group string) bool {
 func (s *Storage) GetFrontendRules(sourcePath, indexPath string) (FrontendAccessRule, bool) {
 	s.mux.RLock()
 	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
+	// Check if path exists on filesystem
+	pathExists := utils.CheckPathExists(filepath.Join(sourcePath, indexPath))
+
 	frontendRules := FrontendAccessRule{
+		SourceDenyDefault: sourceDenyDefault,
+		PathExists:        pathExists,
 		Deny: FrontendRuleSet{
 			Users:  make([]string, 0),
 			Groups: make([]string, 0),
@@ -374,20 +466,31 @@ func (s *Storage) GetFrontendRules(sourcePath, indexPath string) (FrontendAccess
 	frontendRules.Deny.Groups = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups)))
 	frontendRules.Allow.Users = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Users)))
 	frontendRules.Allow.Groups = utils.NonNilSlice(slices.Collect(maps.Keys(rule.Allow.Groups)))
-
-	logger.Debugf("Returning frontend rules for source: %s and index: %s", sourcePath, indexPath)
 	return frontendRules, ok
 }
 
 // GetAllRules returns all access rules as a map.
 func (s *Storage) GetAllRules(sourcePath string) (map[string]FrontendAccessRule, error) {
-	value, ok := accessCache.Get(accessChangedKey + sourcePath).(map[string]FrontendAccessRule)
-	if ok {
-		return value, nil
+	// Check if rules have changed by looking at the access cache
+	_, hasChanged := accessCache.Get(accessChangedKey + sourcePath)
+	if !hasChanged {
+		// If no change marker, check if we have cached rules
+		value, ok := rulesCache.Get(accessChangedKey + sourcePath)
+		if ok {
+			return value, nil
+		}
 	}
 
 	s.mux.RLock()
 	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
 	// Return a copy to avoid external mutation
 	frontendRules := make(map[string]FrontendAccessRule, len(s.AllRules))
 	rules, ok := s.AllRules[sourcePath]
@@ -395,9 +498,18 @@ func (s *Storage) GetAllRules(sourcePath string) (map[string]FrontendAccessRule,
 		return frontendRules, nil
 	}
 	for indexPath, rule := range rules {
+		// Use the internal path as the frontend path (with trailing slash)
+		// This ensures consistency between internal storage and frontend display
+		frontendPath := indexPath
+
+		// Check if path exists on filesystem
+		pathExists := utils.CheckPathExists(filepath.Join(sourcePath, indexPath))
+
 		// Convert AccessRule to FrontendAccessRule
-		frontendRules[indexPath] = FrontendAccessRule{
-			DenyAll: rule.DenyAll,
+		frontendRules[frontendPath] = FrontendAccessRule{
+			DenyAll:           rule.DenyAll,
+			SourceDenyDefault: sourceDenyDefault,
+			PathExists:        pathExists,
 			Deny: FrontendRuleSet{
 				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
 				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
@@ -409,7 +521,7 @@ func (s *Storage) GetAllRules(sourcePath string) (map[string]FrontendAccessRule,
 		}
 	}
 	// cache responses
-	accessCache.Set(accessChangedKey+sourcePath, frontendRules)
+	rulesCache.Set(accessChangedKey+sourcePath, frontendRules)
 	return frontendRules, nil
 }
 
@@ -515,7 +627,8 @@ func (s *Storage) RemoveUserFromGroup(group, username string) error {
 func (s *Storage) RemoveAllowUser(sourcePath, indexPath, username string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
 	}
@@ -523,20 +636,16 @@ func (s *Storage) RemoveAllowUser(sourcePath, indexPath, username string) (bool,
 	if exists {
 		delete(rule.Allow.Users, username)
 	}
-	removed := false
-	if exists {
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
+	removed := exists
 	// If rule is now empty, remove it
 	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
+		delete(s.AllRules[sourcePath], normalizedPath)
 		if len(s.AllRules[sourcePath]) == 0 {
 			delete(s.AllRules, sourcePath)
 		}
 	}
 	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
+		s.clearAllCaches()
 		return exists, s.SaveToDB()
 	}
 	return false, nil
@@ -546,7 +655,8 @@ func (s *Storage) RemoveAllowUser(sourcePath, indexPath, username string) (bool,
 func (s *Storage) RemoveAllowGroup(sourcePath, indexPath, groupname string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
 	}
@@ -554,20 +664,16 @@ func (s *Storage) RemoveAllowGroup(sourcePath, indexPath, groupname string) (boo
 	if exists {
 		delete(rule.Allow.Groups, groupname)
 	}
-	removed := false
-	if exists {
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
+	removed := exists
 	// If rule is now empty, remove it
 	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
+		delete(s.AllRules[sourcePath], normalizedPath)
 		if len(s.AllRules[sourcePath]) == 0 {
 			delete(s.AllRules, sourcePath)
 		}
 	}
 	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
+		s.clearAllCaches()
 		return exists, s.SaveToDB()
 	}
 	return exists, nil
@@ -577,7 +683,8 @@ func (s *Storage) RemoveAllowGroup(sourcePath, indexPath, groupname string) (boo
 func (s *Storage) RemoveDenyUser(sourcePath, indexPath, username string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
 	}
@@ -585,20 +692,16 @@ func (s *Storage) RemoveDenyUser(sourcePath, indexPath, username string) (bool,
 	if exists {
 		delete(rule.Deny.Users, username)
 	}
-	removed := false
-	if exists {
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
+	removed := exists
 	// If rule is now empty, remove it
 	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
+		delete(s.AllRules[sourcePath], normalizedPath)
 		if len(s.AllRules[sourcePath]) == 0 {
 			delete(s.AllRules, sourcePath)
 		}
 	}
 	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
+		s.clearAllCaches()
 		return exists, s.SaveToDB()
 	}
 	return false, nil
@@ -608,7 +711,8 @@ func (s *Storage) RemoveDenyUser(sourcePath, indexPath, username string) (bool,
 func (s *Storage) RemoveDenyGroup(sourcePath, indexPath, groupname string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
 	}
@@ -616,20 +720,16 @@ func (s *Storage) RemoveDenyGroup(sourcePath, indexPath, groupname string) (bool
 	if exists {
 		delete(rule.Deny.Groups, groupname)
 	}
-	removed := false
-	if exists {
-		s.incrementSourceVersion(sourcePath)
-		removed = true
-	}
+	removed := exists
 	// If rule is now empty, remove it
 	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
+		delete(s.AllRules[sourcePath], normalizedPath)
 		if len(s.AllRules[sourcePath]) == 0 {
 			delete(s.AllRules, sourcePath)
 		}
 	}
 	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
+		s.clearAllCaches()
 		return exists, s.SaveToDB()
 	}
 	return exists, nil
@@ -639,25 +739,25 @@ func (s *Storage) RemoveDenyGroup(sourcePath, indexPath, groupname string) (bool
 func (s *Storage) RemoveDenyAll(sourcePath, indexPath string) (bool, error) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	rule, ok := s.AllRules[sourcePath][indexPath]
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rule, ok := s.AllRules[sourcePath][normalizedPath]
 	if !ok {
 		return false, nil
 	}
 	removed := false
 	if rule.DenyAll {
 		rule.DenyAll = false
-		s.incrementSourceVersion(sourcePath)
 		removed = true
 	}
 	// If rule is now empty, remove it
 	if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 && len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 {
-		delete(s.AllRules[sourcePath], indexPath)
+		delete(s.AllRules[sourcePath], normalizedPath)
 		if len(s.AllRules[sourcePath]) == 0 {
 			delete(s.AllRules, sourcePath)
 		}
 	}
 	if removed {
-		accessCache.Set(accessChangedKey+sourcePath, false)
+		s.clearAllCaches()
 		return true, s.SaveToDB()
 	}
 	return false, nil
@@ -689,11 +789,8 @@ func (s *Storage) RemoveAllRulesForUser(username string) error {
 			}
 		}
 	}
-	for sp := range changedSourcePaths {
-		s.incrementSourceVersion(sp)
-		accessCache.Set(accessChangedKey+sp, false)
-	}
 	if changed {
+		s.clearAllCaches()
 		return s.SaveToDB()
 	}
 	return nil
@@ -725,11 +822,8 @@ func (s *Storage) RemoveAllRulesForGroup(groupname string) error {
 			}
 		}
 	}
-	for sp := range changedSourcePaths {
-		s.incrementSourceVersion(sp)
-		accessCache.Set(accessChangedKey+sp, false)
-	}
 	if changed {
+		s.clearAllCaches()
 		return s.SaveToDB()
 	}
 	return nil
@@ -739,6 +833,14 @@ func (s *Storage) RemoveAllRulesForGroup(groupname string) error {
 func (s *Storage) GetRulesForUser(sourcePath, username string) map[string]FrontendAccessRule {
 	s.mux.RLock()
 	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
 	userRules := make(map[string]FrontendAccessRule)
 	rulesBySource, ok := s.AllRules[sourcePath]
 	if !ok {
@@ -756,7 +858,8 @@ func (s *Storage) GetRulesForUser(sourcePath, username string) map[string]Fronte
 		}
 		if userHasRule {
 			userRules[indexPath] = FrontendAccessRule{
-				DenyAll: rule.DenyAll,
+				DenyAll:           rule.DenyAll,
+				SourceDenyDefault: sourceDenyDefault,
 				Deny: FrontendRuleSet{
 					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
 					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
@@ -775,6 +878,14 @@ func (s *Storage) GetRulesForUser(sourcePath, username string) map[string]Fronte
 func (s *Storage) GetRulesForGroup(sourcePath, groupname string) map[string]FrontendAccessRule {
 	s.mux.RLock()
 	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
 	groupRules := make(map[string]FrontendAccessRule)
 	rulesBySource, ok := s.AllRules[sourcePath]
 	if !ok {
@@ -792,7 +903,8 @@ func (s *Storage) GetRulesForGroup(sourcePath, groupname string) map[string]Fron
 		}
 		if groupHasRule {
 			groupRules[indexPath] = FrontendAccessRule{
-				DenyAll: rule.DenyAll,
+				DenyAll:           rule.DenyAll,
+				SourceDenyDefault: sourceDenyDefault,
 				Deny: FrontendRuleSet{
 					Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
 					Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
@@ -811,6 +923,14 @@ func (s *Storage) GetRulesForGroup(sourcePath, groupname string) map[string]Fron
 func (s *Storage) GetAllRulesByUsers(sourcePath string) map[string]map[string]FrontendAccessRule {
 	s.mux.RLock()
 	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
 	allUserRules := make(map[string]map[string]FrontendAccessRule)
 	rulesBySource, ok := s.AllRules[sourcePath]
 	if !ok {
@@ -822,8 +942,14 @@ func (s *Storage) GetAllRulesByUsers(sourcePath string) map[string]map[string]Fr
 		if !hasAllowUsers && !hasDenyUsers {
 			continue
 		}
+
+		// Use the internal path as the frontend path (with trailing slash)
+		// This ensures consistency between internal storage and frontend display
+		frontendPath := indexPath
+
 		frontendRule := FrontendAccessRule{
-			DenyAll: rule.DenyAll,
+			DenyAll:           rule.DenyAll,
+			SourceDenyDefault: sourceDenyDefault,
 			Deny: FrontendRuleSet{
 				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
 				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
@@ -837,13 +963,13 @@ func (s *Storage) GetAllRulesByUsers(sourcePath string) map[string]map[string]Fr
 			if _, ok := allUserRules[user]; !ok {
 				allUserRules[user] = make(map[string]FrontendAccessRule)
 			}
-			allUserRules[user][indexPath] = frontendRule
+			allUserRules[user][frontendPath] = frontendRule
 		}
 		for user := range rule.Deny.Users {
 			if _, ok := allUserRules[user]; !ok {
 				allUserRules[user] = make(map[string]FrontendAccessRule)
 			}
-			allUserRules[user][indexPath] = frontendRule
+			allUserRules[user][frontendPath] = frontendRule
 		}
 	}
 	return allUserRules
@@ -853,6 +979,14 @@ func (s *Storage) GetAllRulesByUsers(sourcePath string) map[string]map[string]Fr
 func (s *Storage) GetAllRulesByGroups(sourcePath string) map[string]map[string]FrontendAccessRule {
 	s.mux.RLock()
 	defer s.mux.RUnlock()
+
+	// Get source configuration
+	sourceDenyDefault := false
+	sourceInfo, sourceExists := settings.Config.Server.SourceMap[sourcePath]
+	if sourceExists {
+		sourceDenyDefault = sourceInfo.Config.DenyByDefault
+	}
+
 	allGroupRules := make(map[string]map[string]FrontendAccessRule)
 	rulesBySource, ok := s.AllRules[sourcePath]
 	if !ok {
@@ -864,8 +998,14 @@ func (s *Storage) GetAllRulesByGroups(sourcePath string) map[string]map[string]F
 		if !hasAllowGroups && !hasDenyGroups {
 			continue
 		}
+
+		// Use the internal path as the frontend path (with trailing slash)
+		// This ensures consistency between internal storage and frontend display
+		frontendPath := indexPath
+
 		frontendRule := FrontendAccessRule{
-			DenyAll: rule.DenyAll,
+			DenyAll:           rule.DenyAll,
+			SourceDenyDefault: sourceDenyDefault,
 			Deny: FrontendRuleSet{
 				Users:  utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Users))),
 				Groups: utils.NonNilSlice(slices.Collect(maps.Keys(rule.Deny.Groups))),
@@ -879,25 +1019,220 @@ func (s *Storage) GetAllRulesByGroups(sourcePath string) map[string]map[string]F
 			if _, ok := allGroupRules[group]; !ok {
 				allGroupRules[group] = make(map[string]FrontendAccessRule)
 			}
-			allGroupRules[group][indexPath] = frontendRule
+			allGroupRules[group][frontendPath] = frontendRule
 		}
 		for group := range rule.Deny.Groups {
 			if _, ok := allGroupRules[group]; !ok {
 				allGroupRules[group] = make(map[string]FrontendAccessRule)
 			}
-			allGroupRules[group][indexPath] = frontendRule
+			allGroupRules[group][frontendPath] = frontendRule
 		}
 	}
 	return allGroupRules
 }
 
-// incrementSourceVersion increments the version of a sourcePath to invalidate caches.
-// The caller MUST hold the mutex lock.
-func (s *Storage) incrementSourceVersion(sourcePath string) {
-	key := "version:" + sourcePath
-	version := 0
-	if v, ok := accessCache.Get(key).(int); ok {
-		version = v
+// HasAnyVisibleItems checks if a user has access to any items in a given parent path.
+// This is used to determine if a user should see a folder's contents even when
+// they don't have direct access to the parent folder.
+func (s *Storage) HasAnyVisibleItems(sourcePath, parentPath string, itemNames []string, username string) bool {
+	parentPath = utils.AddTrailingSlashIfNotExists(parentPath)
+	// Check if user has access to any of the items
+	for _, itemName := range itemNames {
+		indexPath := parentPath + itemName
+		if s.Permitted(sourcePath, indexPath, username) {
+			return true
+		}
 	}
-	accessCache.Set(key, version+1)
+
+	return false
+}
+
+// RemoveUserCascade removes a user from either the allow or deny list for a given path and all its subpaths.
+// This is used for cascade delete operations when deleting user access from a directory tree.
+// The allow parameter determines which list to remove from: true for allow list, false for deny list.
+func (s *Storage) RemoveUserCascade(sourcePath, indexPath, username string, allow bool) (int, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return 0, nil
+	}
+
+	changed := false
+	removedCount := 0
+
+	// Iterate through all rules for this source
+	for rulePath, rule := range rulesBySource {
+		// Check if this rule path matches or is a subpath of the target path
+		if rulePath == normalizedPath || strings.HasPrefix(rulePath, normalizedPath) {
+			if allow {
+				// Remove user from allow list only
+				if _, exists := rule.Allow.Users[username]; exists {
+					delete(rule.Allow.Users, username)
+					changed = true
+					removedCount++
+				}
+			} else {
+				// Remove user from deny list only
+				if _, exists := rule.Deny.Users[username]; exists {
+					delete(rule.Deny.Users, username)
+					changed = true
+					removedCount++
+				}
+			}
+
+			// If rule is now empty, mark it for deletion
+			if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 &&
+				len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 && !rule.DenyAll {
+				delete(s.AllRules[sourcePath], rulePath)
+			}
+		}
+	}
+
+	// If no rules left for this source, remove the source entry
+	if len(s.AllRules[sourcePath]) == 0 {
+		delete(s.AllRules, sourcePath)
+	}
+
+	if changed {
+		s.clearAllCaches()
+		return removedCount, s.SaveToDB()
+	}
+
+	return 0, nil
+}
+
+// RemoveGroupCascade removes a group from either the allow or deny list for a given path and all its subpaths.
+// This is used for cascade delete operations when deleting group access from a directory tree.
+// The allow parameter determines which list to remove from: true for allow list, false for deny list.
+func (s *Storage) RemoveGroupCascade(sourcePath, indexPath, groupname string, allow bool) (int, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	normalizedPath := utils.AddTrailingSlashIfNotExists(indexPath)
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return 0, nil
+	}
+
+	changed := false
+	removedCount := 0
+
+	// Iterate through all rules for this source
+	for rulePath, rule := range rulesBySource {
+		// Check if this rule path matches or is a subpath of the target path
+		if rulePath == normalizedPath || strings.HasPrefix(rulePath, normalizedPath) {
+			if allow {
+				// Remove group from allow list only
+				if _, exists := rule.Allow.Groups[groupname]; exists {
+					delete(rule.Allow.Groups, groupname)
+					changed = true
+					removedCount++
+				}
+			} else {
+				// Remove group from deny list only
+				if _, exists := rule.Deny.Groups[groupname]; exists {
+					delete(rule.Deny.Groups, groupname)
+					changed = true
+					removedCount++
+				}
+			}
+
+			// If rule is now empty, mark it for deletion
+			if len(rule.Allow.Users) == 0 && len(rule.Allow.Groups) == 0 &&
+				len(rule.Deny.Users) == 0 && len(rule.Deny.Groups) == 0 && !rule.DenyAll {
+				delete(s.AllRules[sourcePath], rulePath)
+			}
+		}
+	}
+
+	// If no rules left for this source, remove the source entry
+	if len(s.AllRules[sourcePath]) == 0 {
+		delete(s.AllRules, sourcePath)
+	}
+
+	if changed {
+		s.clearAllCaches()
+		return removedCount, s.SaveToDB()
+	}
+
+	return 0, nil
+}
+
+// UpdateRules updates all access rules that match oldPath to point to newPath.
+// Handles both exact matches and subdirectories. Similar to share.Storage.UpdateShares.
+func (s *Storage) UpdateRules(sourcePath, oldPath, newPath string) (int, error) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return 0, nil // No rules for this source, not an error
+	}
+
+	// Normalize paths (always add trailing slash for access rules)
+	oldPath = utils.AddTrailingSlashIfNotExists(oldPath)
+	newPath = utils.AddTrailingSlashIfNotExists(newPath)
+
+	updated := 0
+	rulesToUpdate := make(map[string]string) // old path -> new path
+
+	// Find all rules that need to be updated
+	for rulePath := range rulesBySource {
+		if rulePath == oldPath {
+			// Exact match
+			rulesToUpdate[rulePath] = newPath
+		} else if strings.HasPrefix(rulePath, oldPath) {
+			// Subdirectory - replace prefix
+			newRulePath := newPath + strings.TrimPrefix(rulePath, oldPath)
+			rulesToUpdate[rulePath] = newRulePath
+		}
+	}
+
+	// Update all matched rules
+	for oldRulePath, newRulePath := range rulesToUpdate {
+		rule := rulesBySource[oldRulePath]
+		delete(rulesBySource, oldRulePath)
+		rulesBySource[newRulePath] = rule
+		logger.Info("access rule updated", "source", sourcePath, "fromPath", oldRulePath, "toPath", newRulePath)
+		updated++
+	}
+
+	if updated > 0 {
+		s.clearAllCaches()
+		if err := s.SaveToDB(); err != nil {
+			return updated, err
+		}
+	}
+
+	return updated, nil
+}
+
+// UpdateRulePath updates the path for a specific access rule (used by PATCH API endpoint).
+func (s *Storage) UpdateRulePath(sourcePath, oldPath, newPath string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	// Normalize paths
+	oldPath = utils.AddTrailingSlashIfNotExists(oldPath)
+	newPath = utils.AddTrailingSlashIfNotExists(newPath)
+
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok {
+		return fmt.Errorf("no rules found for source: %s", sourcePath)
+	}
+
+	rule, ok := rulesBySource[oldPath]
+	if !ok {
+		return fmt.Errorf("no rule found for path: %s", oldPath)
+	}
+
+	// Remove the old rule and add it with the new path
+	delete(rulesBySource, oldPath)
+	rulesBySource[newPath] = rule
+	s.clearAllCaches()
+	logger.Debugf("access rule path updated: source=%s, fromPath=%s, toPath=%s", sourcePath, oldPath, newPath)
+	return s.SaveToDB()
 }

backend/database/access/helper.go

@@ -0,0 +1,60 @@
+package access
+
+import (
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+)
+
+func (s *Storage) CheckChildItemAccess(response *iteminfo.ExtendedFileInfo, index *indexing.Index, username string) error {
+
+	// Collect all item names to check
+	allItemNames := make([]string, 0, len(response.Folders)+len(response.Files))
+	for _, folder := range response.Folders {
+		allItemNames = append(allItemNames, folder.Name)
+	}
+	for _, file := range response.Files {
+		allItemNames = append(allItemNames, file.Name)
+	}
+
+	// Use standardized path with trailing slash for proper path construction
+	// response is an ExtendedFileInfo which represents a directory (has Folders and Files)
+	parentPath := index.MakeIndexPath(response.Path, true)
+
+	// Check if user has access to any items
+	if !s.HasAnyVisibleItems(index.Path, parentPath, allItemNames, username) && len(allItemNames) > 0 {
+		return errors.ErrAccessDenied
+	}
+
+	// Save original folders and files before filtering
+	originalFolders := response.Folders
+	originalFiles := response.Files
+
+	// Filter and return only the items the user has access to
+	response.Folders = make([]iteminfo.ItemInfo, 0)
+	response.Files = make([]iteminfo.ExtendedItemInfo, 0)
+
+	// Check each subfolder for access permissions
+	for _, folder := range originalFolders {
+		indexPath := parentPath + folder.Name
+		if s.Permitted(index.Path, indexPath, username) {
+			response.Folders = append(response.Folders, folder)
+		}
+	}
+
+	// Check each subfile for access permissions
+	for _, file := range originalFiles {
+		indexPath := parentPath + file.Name
+		if s.Permitted(index.Path, indexPath, username) {
+			response.Files = append(response.Files, file)
+		}
+	}
+
+	return nil
+}
+
+type FileOptionsExtended struct {
+	utils.FileOptions
+	Access *Storage
+}

backend/database/dbindex/indexing.go

@@ -0,0 +1,34 @@
+package dbindex
+
+import (
+	"time"
+)
+
+// IndexInfo stores persistent information about an index and its scanners
+type IndexInfo struct {
+	// Index identifier - uses the real filesystem path (index.Path) as the key
+	Path string `json:"path" storm:"id,index"`
+
+	// Source name (index.Name) for reference
+	Source string `json:"source" storm:"index"`
+
+	// Index-level stats
+	Complexity uint   `json:"complexity"`
+	NumDirs    uint64 `json:"numDirs"`
+	NumFiles   uint64 `json:"numFiles"`
+
+	// Scanner information - map of scanner path to scanner stats
+	Scanners map[string]*PersistedScannerInfo `json:"scanners"`
+}
+
+// PersistedScannerInfo stores persistent information about a scanner
+type PersistedScannerInfo struct {
+	Path            string    `json:"path"`
+	Complexity      uint      `json:"complexity"`
+	CurrentSchedule int       `json:"currentSchedule"`
+	NumDirs         uint64    `json:"numDirs"`
+	NumFiles        uint64    `json:"numFiles"`
+	QuickScanTime   int       `json:"quickScanTime"`
+	FullScanTime    int       `json:"fullScanTime"`
+	LastScanned     time.Time `json:"lastScanned"`
+}

backend/database/dbindex/storage.go

@@ -0,0 +1,203 @@
+package dbindex
+
+import (
+	"sync"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/database/crud"
+)
+
+// StorageBackend is the interface to implement for an indexing storage.
+type StorageBackend interface {
+	All() ([]*IndexInfo, error)
+	GetByPath(path string) (*IndexInfo, error)
+	GetBySource(source string) ([]*IndexInfo, error)
+	Save(info *IndexInfo) error
+	Delete(path string) error
+}
+
+// crudBackend implements crud.CrudBackend[IndexInfo] for indexing storage.
+type crudBackend struct {
+	back StorageBackend
+}
+
+func (c *crudBackend) GetByID(id any) (*IndexInfo, error) {
+	path, ok := id.(string)
+	if !ok {
+		return nil, errors.ErrInvalidDataType
+	}
+	return c.back.GetByPath(path)
+}
+
+func (c *crudBackend) GetAll() ([]*IndexInfo, error) {
+	return c.back.All()
+}
+
+func (c *crudBackend) Save(obj *IndexInfo) error {
+	return c.back.Save(obj)
+}
+
+func (c *crudBackend) DeleteByID(id any) error {
+	path, ok := id.(string)
+	if !ok {
+		return errors.ErrInvalidDataType
+	}
+	return c.back.Delete(path)
+}
+
+// Storage is an indexing storage using generics.
+type Storage struct {
+	Generic    *crud.Storage[IndexInfo]
+	back       StorageBackend
+	indexCache map[string]*IndexInfo
+	mu         sync.RWMutex
+}
+
+// NewStorage creates an indexing storage from a backend.
+func NewStorage(back StorageBackend) *Storage {
+	return &Storage{
+		Generic:    crud.NewStorage[IndexInfo](&crudBackend{back: back}),
+		back:       back,
+		indexCache: make(map[string]*IndexInfo),
+	}
+}
+
+// All wraps StorageBackend.All
+func (s *Storage) All() ([]*IndexInfo, error) {
+	infos, err := s.back.All()
+	if err != nil {
+		return nil, err
+	}
+
+	s.mu.Lock()
+	for i, info := range infos {
+		if info == nil {
+			continue
+		}
+		if existing, ok := s.indexCache[info.Path]; ok && existing != nil {
+			infos[i] = existing
+		} else {
+			s.indexCache[info.Path] = info
+		}
+	}
+	s.mu.Unlock()
+	return infos, nil
+}
+
+// GetByPath wraps StorageBackend.GetByPath
+func (s *Storage) GetByPath(path string) (*IndexInfo, error) {
+	// return stable in-memory pointer if available
+	s.mu.RLock()
+	if info, ok := s.indexCache[path]; ok && info != nil {
+		s.mu.RUnlock()
+		return info, nil
+	}
+	s.mu.RUnlock()
+
+	info, err := s.back.GetByPath(path)
+	if err != nil {
+		return nil, err
+	}
+
+	s.mu.Lock()
+	s.indexCache[path] = info
+	s.mu.Unlock()
+	return info, nil
+}
+
+// GetBySource wraps StorageBackend.GetBySource
+func (s *Storage) GetBySource(source string) ([]*IndexInfo, error) {
+	infos, err := s.back.GetBySource(source)
+	if err != nil {
+		return nil, err
+	}
+
+	s.mu.Lock()
+	for i, info := range infos {
+		if info == nil {
+			continue
+		}
+		if existing, ok := s.indexCache[info.Path]; ok && existing != nil {
+			infos[i] = existing
+		} else {
+			s.indexCache[info.Path] = info
+		}
+	}
+	s.mu.Unlock()
+	return infos, nil
+}
+
+// Save wraps StorageBackend.Save
+func (s *Storage) Save(info *IndexInfo) error {
+	if err := s.back.Save(info); err != nil {
+		return err
+	}
+	s.mu.Lock()
+	s.indexCache[info.Path] = info
+	s.mu.Unlock()
+	return nil
+}
+
+// Delete wraps StorageBackend.Delete
+func (s *Storage) Delete(path string) error {
+	if err := s.back.Delete(path); err != nil {
+		return err
+	}
+	s.mu.Lock()
+	delete(s.indexCache, path)
+	s.mu.Unlock()
+	return nil
+}
+
+// Flush persists the current in-memory state of all indexes to the backing store.
+// Call during graceful shutdown to ensure DB matches memory.
+func (s *Storage) Flush() error {
+	s.mu.RLock()
+	infos := make([]*IndexInfo, 0, len(s.indexCache))
+	for _, info := range s.indexCache {
+		if info != nil {
+			infos = append(infos, info)
+		}
+	}
+	s.mu.RUnlock()
+	for _, info := range infos {
+		if err := s.back.Save(info); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ResetAllComplexities sets the complexity to 0 for all indexes and their scanners.
+// This should be called when the index database is recreated (either fresh start or after corruption).
+func (s *Storage) ResetAllComplexities() error {
+	// Get all indexes from storage
+	infos, err := s.All()
+	if err != nil {
+		return err
+	}
+
+	// Reset complexity for each index
+	for _, info := range infos {
+		if info == nil {
+			continue
+		}
+
+		// Reset index-level complexity
+		info.Complexity = 0
+
+		// Reset scanner-level complexities
+		for _, scanner := range info.Scanners {
+			if scanner != nil {
+				scanner.Complexity = 0
+			}
+		}
+
+		// Save the updated info
+		if err := s.Save(info); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

backend/database/share/extended.go

@@ -0,0 +1,172 @@
+package share
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// IsSingleFileShare determines if this share is for a single file (not a directory).
+// It checks both the file extension and filesystem to determine if the path points to a file.
+func (l *Link) IsSingleFileShare() bool {
+	if l.Path == "" {
+		return false
+	}
+
+	// First, check if the path has a file extension (common indicator of a file)
+	ext := filepath.Ext(l.Path)
+	if ext != "" {
+		// If it has an extension, it's likely a file, but let's verify with filesystem
+		return l.isFileOnFilesystem()
+	}
+
+	// If no extension, check if it's a directory by looking at the filesystem
+	return !l.isDirectoryOnFilesystem()
+}
+
+// isFileOnFilesystem checks if the path exists and is a file on the filesystem
+func (l *Link) isFileOnFilesystem() bool {
+	// Construct the full path using Source and Path
+	fullPath := l.Path
+	if l.Source != "" {
+		// If Source is provided, it might be a relative path from the source
+		fullPath = filepath.Join(l.Source, l.Path)
+	}
+
+	info, err := os.Stat(fullPath)
+	if err != nil {
+		// If we can't stat the file, fall back to extension check
+		return filepath.Ext(l.Path) != ""
+	}
+
+	return !info.IsDir()
+}
+
+// isDirectoryOnFilesystem checks if the path exists and is a directory on the filesystem
+func (l *Link) isDirectoryOnFilesystem() bool {
+	// Construct the full path using Source and Path
+	fullPath := l.Path
+	if l.Source != "" {
+		// If Source is provided, it might be a relative path from the source
+		fullPath = filepath.Join(l.Source, l.Path)
+	}
+
+	info, err := os.Stat(fullPath)
+	if err != nil {
+		// If we can't stat the file, assume it's a file if it has an extension
+		return filepath.Ext(l.Path) == ""
+	}
+
+	return info.IsDir()
+}
+
+// IsExpired checks if the share has expired based on the Expire timestamp
+func (l *Link) IsExpired() bool {
+	if l.Expire == 0 {
+		return false // No expiration set
+	}
+	// This would need time.Now().Unix() but we avoid importing time here
+	// The actual expiration check is handled in the storage layer
+	return false // Placeholder - actual implementation would check current time
+}
+
+// HasPassword checks if the share is password protected
+func (l *Link) HasPassword() bool {
+	return l.PasswordHash != ""
+}
+
+// IsPermanent checks if the share is permanent (no expiration)
+func (l *Link) IsPermanent() bool {
+	return l.Expire == 0
+}
+
+// GetFileExtension returns the file extension of the shared file
+func (l *Link) GetFileExtension() string {
+	if l.Path == "" {
+		return ""
+	}
+	return filepath.Ext(l.Path)
+}
+
+// GetFileName returns just the filename (without path) of the shared item
+func (l *Link) GetFileName() string {
+	if l.Path == "" {
+		return ""
+	}
+	return filepath.Base(l.Path)
+}
+
+// InitUserDownloads initializes the user downloads map if needed
+func (l *Link) InitUserDownloads() {
+	l.Mu.Lock()
+	defer l.Mu.Unlock()
+	if l.UserDownloads == nil {
+		l.UserDownloads = make(map[string]int)
+	}
+}
+
+// IncrementUserDownload increments the download count for a specific user
+func (l *Link) IncrementUserDownload(username string) {
+	l.Mu.Lock()
+	defer l.Mu.Unlock()
+	if l.UserDownloads == nil {
+		l.UserDownloads = make(map[string]int)
+	}
+	l.UserDownloads[username]++
+}
+
+// GetUserDownloadCount returns the download count for a specific user
+func (l *Link) GetUserDownloadCount(username string) int {
+	l.Mu.Lock()
+	defer l.Mu.Unlock()
+	if l.UserDownloads == nil {
+		return 0
+	}
+	return l.UserDownloads[username]
+}
+
+// ResetDownloadCounts resets both global and per-user download counts
+func (l *Link) ResetDownloadCounts() {
+	l.Mu.Lock()
+	defer l.Mu.Unlock()
+	l.Downloads = 0
+	l.UserDownloads = make(map[string]int)
+}
+
+// HasReachedUserLimit checks if a user has reached their download limit
+func (l *Link) HasReachedUserLimit(username string) bool {
+	if !l.PerUserDownloadLimit || l.DownloadsLimit == 0 {
+		return false
+	}
+	count := l.GetUserDownloadCount(username)
+	return count >= l.DownloadsLimit
+}
+
+func (l *Link) GetSourceName() string {
+	sourceInfo, ok := settings.Config.Server.SourceMap[l.Source]
+	if !ok {
+		return ""
+	}
+	return sourceInfo.Name
+}
+
+func (l *Link) UserCanEdit(user *users.User) bool {
+	return l.UserID == user.ID || user.Permissions.Admin
+}
+
+func (l *Link) SourceURL(user *users.User) string {
+	sourceName := l.GetSourceName()
+	// get user scope path from share
+	userScope, err := user.GetScopeForSourceName(sourceName)
+	if err != nil {
+		return ""
+	}
+	if !strings.HasPrefix(l.Path, userScope) {
+		return ""
+	}
+	scopedPath := strings.TrimPrefix(l.Path, userScope)
+	return "/" + filepath.Join("files", sourceName, scopedPath)
+}

backend/database/share/share.go

@@ -1,32 +1,52 @@
 package share
 
-import "sync"
+import (
+	"sync"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
 
 type CommonShare struct {
-	//AllowEdit           bool   `json:"allowEdit,omitempty"`
-	AllowUpload         bool     `json:"allowUpload,omitempty"`
-	DisablingFileViewer bool     `json:"disableFileViewer,omitempty"`
-	DownloadsLimit      int      `json:"downloadsLimit,omitempty"`
-	ShareTheme          string   `json:"shareTheme,omitempty"`
-	DisableAnonymous    bool     `json:"disableAnonymous,omitempty"`
-	MaxBandwidth        int      `json:"maxBandwidth,omitempty"`
-	DisableThumbnails   bool     `json:"disableThumbnails,omitempty"`
-	KeepAfterExpiration bool     `json:"keepAfterExpiration,omitempty"`
-	AllowedUsernames    []string `json:"allowedUsernames,omitempty"`
-	ThemeColor          string   `json:"themeColor,omitempty"`
-	Banner              string   `json:"banner,omitempty"`
-	Title               string   `json:"title,omitempty"`
-	Description         string   `json:"description,omitempty"`
-	Favicon             string   `json:"favicon,omitempty"`
-	QuickDownload       bool     `json:"quickDownload,omitempty"`
-	HideNavButtons      bool     `json:"hideNavButtons,omitempty"`
-	DisableSidebar      bool     `json:"disableSidebar"`
-	ViewMode            string   `json:"viewMode,omitempty"`
-	Source              string   `json:"source,omitempty"` // backend source is path to maintain between name changes
-	Path                string   `json:"path,omitempty"`
-	DownloadURL         string   `json:"downloadURL,omitempty"`
-	DisableShareCard    bool     `json:"disableShareCard,omitempty"`
-	Username            string   `json:"username,omitempty"`
+	DownloadsLimit           int                 `json:"downloadsLimit,omitempty"`
+	ShareTheme               string              `json:"shareTheme,omitempty"`
+	DisableAnonymous         bool                `json:"disableAnonymous,omitempty"`
+	MaxBandwidth             int                 `json:"maxBandwidth,omitempty"`
+	DisableThumbnails        bool                `json:"disableThumbnails,omitempty"`
+	KeepAfterExpiration      bool                `json:"keepAfterExpiration,omitempty"`
+	AllowedUsernames         []string            `json:"allowedUsernames,omitempty"`
+	ThemeColor               string              `json:"themeColor,omitempty"`
+	Banner                   string              `json:"banner,omitempty"`
+	Title                    string              `json:"title,omitempty"`
+	Description              string              `json:"description,omitempty"`
+	Favicon                  string              `json:"favicon,omitempty"`
+	QuickDownload            bool                `json:"quickDownload,omitempty"`
+	HideNavButtons           bool                `json:"hideNavButtons,omitempty"`
+	DisableSidebar           bool                `json:"disableSidebar"`
+	Source                   string              `json:"source,omitempty"` // backend source is path to maintain between name changes
+	Path                     string              `json:"path,omitempty"`
+	DownloadURL              string              `json:"downloadURL,omitempty"`
+	ShareURL                 string              `json:"shareURL,omitempty"`
+	FaviconUrl               string              `json:"faviconUrl,omitempty"`
+	BannerUrl                string              `json:"bannerUrl,omitempty"`
+	DisableShareCard         bool                `json:"disableShareCard,omitempty"`
+	EnforceDarkLightMode     string              `json:"enforceDarkLightMode,omitempty"` // "dark" or "light"
+	ViewMode                 string              `json:"viewMode,omitempty"`             // default view mode for anonymous users: "list", "compact", "normal", "gallery"
+	EnableOnlyOffice         bool                `json:"enableOnlyOffice,omitempty"`
+	ShareType                string              `json:"shareType"` // type of share: normal, upload, max
+	PerUserDownloadLimit     bool                `json:"perUserDownloadLimit,omitempty"`
+	ExtractEmbeddedSubtitles bool                `json:"extractEmbeddedSubtitles,omitempty"` // can be io intensive for large files and take 10-30 seconds.
+	AllowDelete              bool                `json:"allowDelete,omitempty"`
+	AllowCreate              bool                `json:"allowCreate,omitempty"`       // allow creating files
+	AllowModify              bool                `json:"allowModify,omitempty"`       // allow modifying files
+	DisableFileViewer        bool                `json:"disableFileViewer,omitempty"` // don't allow viewing files
+	DisableDownload          bool                `json:"disableDownload,omitempty"`   // don't allow downloading files
+	AllowReplacements        bool                `json:"allowReplacements,omitempty"` // allow replacements of files
+	SidebarLinks             []users.SidebarLink `json:"sidebarLinks"`                // customizable sidebar links
+	HasPassword              bool                `json:"hasPassword,omitempty"`
+	ShowHidden               bool                `json:"showHidden,omitempty"` // show hidden files in share (true = show, false = hide)
+	DisableLoginOption       bool                `json:"disableLoginOption"`   // disable login option in share (true = hide, false = show)
+	SourceURL                string              `json:"sourceURL,omitempty"`
+	CanEdit                  bool                `json:"canEdit,omitempty"`
 }
 type CreateBody struct {
 	CommonShare
@@ -39,14 +59,17 @@ type CreateBody struct {
 // Link is the information needed to build a shareable link.
 type Link struct {
 	CommonShare
-	Mu           sync.Mutex `json:"-"`
-	Downloads    int        `json:"downloads"`
-	Hash         string     `json:"hash" storm:"id,index"`
-	UserID       uint       `json:"userID"`
-	Expire       int64      `json:"expire"`
-	PasswordHash string     `json:"password_hash,omitempty"`
+	Downloads    int    `json:"downloads"`
+	Hash         string `json:"hash" storm:"id,index"`
+	UserID       uint   `json:"userID"`
+	Expire       int64  `json:"expire"`
+	PasswordHash string `json:"password_hash,omitempty"`
 	// Token is a random value that will only be set when PasswordHash is set. It is
 	// URL-Safe and is used to download links in password-protected shares via a
 	// query arg.
 	Token string `json:"token,omitempty"`
+
+	Mu            sync.Mutex     `json:"-"`
+	UserDownloads map[string]int `json:"userDownloads,omitempty"` // Track downloads per username
+	Version       int            `json:"version,omitempty"`
 }

backend/database/share/storage.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/crud"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
@@ -16,6 +17,7 @@ type StorageBackend interface {
 	All() ([]*Link, error)
 	FindByUserID(id uint) ([]*Link, error)
 	GetByHash(hash string) (*Link, error)
+	GetCommonShareByHash(hash string) (*CommonShare, error)
 	GetPermanent(path, source string, id uint) (*Link, error)
 	GetBySourcePath(path, source string) ([]*Link, error)
 	Gets(path, source string, id uint) ([]*Link, error)
@@ -71,17 +73,6 @@ func NewStorage(back StorageBackend, usersStore *users.Storage) *Storage {
 	}
 }
 
-// setUsername populates the Link.Username from the users store using UserID, if available.
-func (s *Storage) setUsername(l *Link) {
-	if l == nil || s.users == nil {
-		return
-	}
-	user, err := s.users.Get(l.UserID)
-	if err == nil && user != nil {
-		l.Username = user.Username
-	}
-}
-
 // All wraps StorageBackend.All and handles expiry.
 func (s *Storage) All() ([]*Link, error) {
 	links, err := s.back.All()
@@ -92,10 +83,7 @@ func (s *Storage) All() ([]*Link, error) {
 	if err != nil {
 		return nil, err
 	}
-	// warm cache: avoid DB calls under lock
-	for _, l := range filtered {
-		s.setUsername(l)
-	}
+
 	s.mu.Lock()
 	for i, l := range filtered {
 		if l == nil {
@@ -121,10 +109,7 @@ func (s *Storage) FindByUserID(id uint) ([]*Link, error) {
 	if err != nil {
 		return nil, err
 	}
-	// inject username outside lock
-	for _, l := range filtered {
-		s.setUsername(l)
-	}
+
 	s.mu.Lock()
 	for i, l := range filtered {
 		if l == nil {
@@ -165,8 +150,11 @@ func (s *Storage) GetByHash(hash string) (*Link, error) {
 		_ = s.back.Delete(hash)
 		return nil, errors.ErrNotExist
 	}
+
+	// Initialize UserDownloads map
+	link.InitUserDownloads()
+
 	s.mu.Lock()
-	s.setUsername(link)
 	s.shareCache[hash] = link
 	s.mu.Unlock()
 	return link, nil
@@ -177,7 +165,7 @@ func (s *Storage) GetPermanent(path, source string, id uint) (*Link, error) {
 	l, err := s.back.GetPermanent(path, source, id)
 	if err == nil && l != nil {
 		s.mu.Lock()
-		s.setUsername(l)
+
 		s.shareCache[l.Hash] = l
 		s.mu.Unlock()
 	}
@@ -194,9 +182,6 @@ func (s *Storage) Gets(sourcePath, source string, id uint) ([]*Link, error) {
 	if err != nil {
 		return nil, err
 	}
-	for _, l := range filtered {
-		s.setUsername(l)
-	}
 	s.mu.Lock()
 	for i, l := range filtered {
 		if l == nil {
@@ -222,9 +207,6 @@ func (s *Storage) GetBySourcePath(path, source string) ([]*Link, error) {
 	if err != nil {
 		return nil, err
 	}
-	for _, l := range filtered {
-		s.setUsername(l)
-	}
 	s.mu.Lock()
 	for i, l := range filtered {
 		if l == nil {
@@ -240,51 +222,77 @@ func (s *Storage) GetBySourcePath(path, source string) ([]*Link, error) {
 	return filtered, nil
 }
 
-// UpdateShares updates all shares that exactly match oldSource and oldPath
-// to point to newSource and newPath. Returns the number of updated shares.
+// UpdateShares updates all shares that match oldSource and oldPath to point to newSource and newPath.
+// Handles both exact matches and subdirectories, regardless of trailing slashes.
 func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (int, error) {
 	links, err := s.back.All()
 	if err != nil && err != errors.ErrNotExist {
 		logger.Error("failed to list shares", "error", err)
 		return 0, err
 	}
+
+	// Normalize paths for comparison (remove trailing slashes)
+	oldPath = utils.AddTrailingSlashIfNotExists(oldPath)
+	newPath = utils.AddTrailingSlashIfNotExists(newPath)
+
 	updated := 0
 	for _, l := range links {
-		if l == nil {
-			continue
-		}
-		if l.Source != oldSource {
+		if l == nil || l.Source != oldSource {
 			continue
 		}
+		l.Path = utils.AddTrailingSlashIfNotExists(l.Path)
+
 		pos := strings.Index(l.Path, oldPath)
 		if pos < 0 {
 			continue
 		}
-		oldFullPath := l.Path
+
 		l.Source = newSource
-		l.Path = oldFullPath[:pos] + newPath + oldFullPath[pos+len(oldPath):]
+		l.Path = newPath
+
 		if err := s.back.Save(l); err != nil {
 			logger.Error("failed to save updated share", "hash", l.Hash, "error", err)
 			return updated, err
 		}
+
 		s.mu.Lock()
 		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
-			// update existing cached pointer fields
 			existing.Source = l.Source
 			existing.Path = l.Path
 		} else {
 			s.shareCache[l.Hash] = l
 		}
 		s.mu.Unlock()
-		logger.Info("share updated", "hash", l.Hash, "fromPath", oldFullPath, "toPath", l.Path)
 		updated++
 	}
-	if updated == 0 {
-		logger.Warning("no matching shares to update for provided source/path")
-	}
 	return updated, nil
 }
 
+// UpdateSharePath updates the path for a specific share identified by hash
+func (s *Storage) UpdateSharePath(hash, newPath string) error {
+	link, err := s.GetByHash(hash)
+	if err != nil {
+		return err
+	}
+
+	oldPath := link.Path
+	link.Path = newPath
+
+	if err := s.back.Save(link); err != nil {
+		logger.Error("failed to save updated share", "hash", hash, "error", err)
+		return err
+	}
+
+	s.mu.Lock()
+	if existing, ok := s.shareCache[hash]; ok && existing != nil {
+		existing.Path = newPath
+	}
+	s.mu.Unlock()
+
+	logger.Debug("share path updated", "hash", hash, "fromPath", oldPath, "toPath", newPath)
+	return nil
+}
+
 // Save wraps StorageBackend.Save
 func (s *Storage) Save(l *Link) error {
 	if err := s.back.Save(l); err != nil {
@@ -341,3 +349,8 @@ func (s *Storage) filterExpired(links []*Link) ([]*Link, error) {
 	}
 	return filtered, nil
 }
+
+// GetCommonShareByHash retrieves only the CommonShare attributes for a given hash
+func (s *Storage) GetCommonShareByHash(hash string) (*CommonShare, error) {
+	return s.back.GetCommonShareByHash(hash)
+}

backend/database/sql/driver_cgo.go

@@ -0,0 +1,10 @@
+//go:build cgosql
+// +build cgosql
+
+package sql
+
+import (
+	_ "github.com/mattn/go-sqlite3"
+)
+
+const SqliteDriver = "sqlite3"

backend/database/sql/driver_nocgo.go

@@ -0,0 +1,10 @@
+//go:build !cgosql
+// +build !cgosql
+
+package sql
+
+import (
+	_ "modernc.org/sqlite"
+)
+
+const SqliteDriver = "sqlite"

backend/database/sql/duplicates.go

@@ -0,0 +1,121 @@
+package sql
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+// FileLocation represents a file location in the index with metadata
+// needed for duplicate detection operations.
+type FileLocation struct {
+	DirPath        string
+	FileIdx        int
+	Name           string
+	NormalizedName string
+	Extension      string
+}
+
+// CreateDuplicatesTable creates the files table and indexes needed for duplicate detection.
+// This should be called once after creating a TempDB for duplicate operations.
+// Indexes are created before data insertion so they're immediately available for queries.
+// For small datasets (typical for duplicate detection), the performance difference is negligible.
+func (t *TempDB) CreateDuplicatesTable() error {
+	createTableSQL := `
+	CREATE TABLE IF NOT EXISTS files (
+		id INTEGER PRIMARY KEY AUTOINCREMENT,
+		dir_path TEXT NOT NULL,
+		file_idx INTEGER NOT NULL,
+		size INTEGER NOT NULL,
+		name TEXT NOT NULL,
+		normalized_name TEXT NOT NULL,
+		extension TEXT NOT NULL,
+		UNIQUE(dir_path, file_idx)
+	);
+	CREATE INDEX IF NOT EXISTS idx_size ON files(size);
+	CREATE INDEX IF NOT EXISTS idx_size_count ON files(size, normalized_name);
+	`
+
+	_, err := t.Exec(createTableSQL)
+	return err
+}
+
+// InsertFileForDuplicates inserts a file entry into the duplicates table.
+// This is called during the first pass through the index to stream files into the database.
+func (t *TempDB) InsertFileForDuplicates(dirPath string, fileIdx int, size int64, name, normalizedName, extension string) error {
+	_, err := t.Exec(
+		"INSERT OR IGNORE INTO files (dir_path, file_idx, size, name, normalized_name, extension) VALUES (?, ?, ?, ?, ?, ?)",
+		dirPath, fileIdx, size, name, normalizedName, extension,
+	)
+	return err
+}
+
+// GetSizeGroupsForDuplicates queries for all size groups that have 2+ files.
+// Returns sizes in descending order (largest first) as a slice, and a map of size -> count.
+// This is used to identify potential duplicate groups before detailed comparison.
+// The SQL query efficiently filters and sorts, avoiding the need to create intermediate maps.
+func (t *TempDB) GetSizeGroupsForDuplicates(minSize int64) ([]int64, map[int64]int, error) {
+	// Query to get sizes with 2+ files, sorted by size DESC
+	rows, err := t.Query(`
+		SELECT size, COUNT(*) as count
+		FROM files
+		WHERE size >= ?
+		GROUP BY size
+		HAVING COUNT(*) >= 2
+		ORDER BY size DESC
+	`, minSize)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to query size groups: %w", err)
+	}
+	defer rows.Close()
+
+	var sizes []int64
+	sizeCounts := make(map[int64]int)
+	for rows.Next() {
+		var size int64
+		var count int
+		if err := rows.Scan(&size, &count); err != nil {
+			return nil, nil, fmt.Errorf("failed to scan row: %w", err)
+		}
+		sizes = append(sizes, size)
+		sizeCounts[size] = count
+	}
+
+	return sizes, sizeCounts, rows.Err()
+}
+
+// GetFilesBySizeForDuplicates queries for all files with a specific size.
+// Used for processing one size group at a time to minimize memory usage.
+func (t *TempDB) GetFilesBySizeForDuplicates(size int64) ([]FileLocation, error) {
+	rows, err := t.Query(`
+		SELECT dir_path, file_idx, name, normalized_name, extension
+		FROM files
+		WHERE size = ?
+		ORDER BY normalized_name
+	`, size)
+	if err != nil {
+		return nil, fmt.Errorf("failed to query files by size: %w", err)
+	}
+	defer rows.Close()
+
+	var locations []FileLocation
+	for rows.Next() {
+		var loc FileLocation
+		if err := rows.Scan(&loc.DirPath, &loc.FileIdx, &loc.Name, &loc.NormalizedName, &loc.Extension); err != nil {
+			return nil, fmt.Errorf("failed to scan row: %w", err)
+		}
+		locations = append(locations, loc)
+	}
+
+	return locations, rows.Err()
+}
+
+// BulkInsertFilesForDuplicates inserts multiple files in a single transaction.
+// This is more efficient than calling InsertFileForDuplicates multiple times.
+// The transaction must be started by the caller using BeginTransaction().
+func BulkInsertFilesForDuplicates(tx *sql.Tx, dirPath string, fileIdx int, size int64, name, normalizedName, extension string) error {
+	_, err := tx.Exec(
+		"INSERT OR IGNORE INTO files (dir_path, file_idx, size, name, normalized_name, extension) VALUES (?, ?, ?, ?, ?, ?)",
+		dirPath, fileIdx, size, name, normalizedName, extension,
+	)
+	return err
+}