updated with rate limiting (#2484)

Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>

.devcontainer/devcontainer.json

@@ -0,0 +1,39 @@
+{
+  "name": "filebrowser",
+  "image": "mcr.microsoft.com/devcontainers/go:1.25-bookworm",
+  
+
+  "features": {
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "20"
+    },
+    "ghcr.io/devcontainers/features/docker-in-docker:2": {}
+  },
+
+  "containerEnv": {
+    "CGO_ENABLED": "1",
+    "FILEBROWSER_DEVMODE": "true"
+  },
+
+  "forwardPorts": [80],
+  "portsAttributes": {
+    "80": {
+      "label": "filebrowser app",
+      "onAutoForward": "notify"
+    }
+  },
+
+  "postCreateCommand": "make setup",
+
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "golang.go",
+        "Vue.volar",
+        "dbaeumer.vscode-eslint",
+        "esbenp.prettier-vscode",
+        "ms-azuretools.vscode-docker"
+      ]
+    }
+  }
+}

.dockerignore

@@ -1,4 +1,6 @@
 backend/**.db
+**.crt
+**.key
 backend/tmp
 backend/dist
 backend/backend*

.github/workflows/pr.yaml

@@ -80,6 +80,12 @@ jobs:
             dockerfile: ./_docker/Dockerfile.playwright-no-config
           - name: settings
             dockerfile: ./_docker/Dockerfile.playwright-settings
+          - name: screenshots
+            dockerfile: ./_docker/Dockerfile.playwright-screenshots
+          - name: previews
+            dockerfile: ./_docker/Dockerfile.playwright-previews
+          - name: jwt
+            dockerfile: ./_docker/Dockerfile.playwright-jwt
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/regular-tests.yaml

@@ -14,7 +14,7 @@ jobs:
         with:
           go-version: 'stable'
       - working-directory: backend
-        run: go test -race -v ./...
+        run: go test -race -v ./... -timeout 30s
   lint-backend:
     runs-on: ubuntu-latest
     steps:
@@ -56,4 +56,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
       - working-directory: frontend
-        run: npm i && npm run i18n:check
+        run: npm i && npm run i18n:check
+  check-docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - run: make generate-docs
+      - run: git diff --exit-code

.github/workflows/update-build-images.yaml

@@ -27,7 +27,7 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/gtsteffaniak/playwright-base
-          tags: latest
+          tags: chromium
       - name: Build and push playwright-base
         uses: docker/build-push-action@v6
         with:

.gitignore

@@ -1,4 +1,6 @@
 *.db
+*.db.old
+*.sqlite
 *.bak
 *.log
 *.mjs
@@ -18,8 +20,10 @@ frontend/tsconfig.tsbuildinfo
 /frontend/test-results
 /frontend/playwright-files
 /frontend/screenshots
+/frontend/generated
 /frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
+/frontend/sharePrepStorage.json
 /backend/vendor
 /backend/*.cov
 /backend/*test_config.yaml

CHANGELOG.md

@@ -2,6 +2,431 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
+## v1.4.2
+
+ **Security**:
+ - [Moderate] Add Rate Limiting on Authentication Endpoint Enables Brute Force Attacks (GHSA-r4v7-6wcg-ghj5)
+ - [Critical] Path traversal in public share PATCH allows file ops outside shared directory -- thanks @Revanth011 and @fg0x0 (GHSA-qqqm-5547-774x)
+
+ **New Features**:
+ - read-only source configuration via `source.config.readOnly: true` (#2438)
+
+ **Notes**:
+ - auth rate limiting can be disabled via `auth.disableRateLimit`
+ - updated share hash middleware (#2443)
+ - updated source info popup to include private and readOnly properties
+
+ **BugFixes**:
+ - Logout from share page now redirects to the share instead of `/Login` again. (#2245)
+ - `This location cannot be reached` error when navigating with FileTree in shares. (#2245)
+ - Fix FileTree rename and move actions in previews. (#2245)
+ - Delete prompt not showing date and thumbnails in some previews. (#2245)
+ - fix path slash issue on windows (#2451) (#2433) (#2419)
+ - Always force url rewrite for onlyoffice internal URL. Fixes Error saving with OnlyOffice (#2450)
+ - Overriding a Deny with an Allow not working (#2405)
+
+## v1.4.1
+
+ **Security**:
+ - Fix critical: unauthenticated user can view source info
+
+## v1.4.0
+
+ **New Features**:
+ - Add Passkey (WebAuthn) support for passwordless authentication (#2287) (#2379) -- thanks @juansoler
+ - Lyrics support for audio files (#2360):
+   - Updated UI for audio previews!
+   - The lyrics and the player gets syncronized in UI with the audio player.
+   - Supports embedded lyrics (ID3v2 USLT, flac, ogg, clyr) and sidecar `.lrc` files with the same name as the audio file.
+   - The `Q` shortcut in audio files will toggle the new panel visibility.
+   - `E` shortcut to change between tabs of the panel if it's open.
+ - Api log filtering support via `apiFilter` option for logging.
+   - regex filter that excludes matching full api paths from being logged. (eg. `/user\?id\=self`) Defaults to `^/health|^/favicon.ico|^/static|^/public/static`
+   - Add config option to disable /health endpoint logging (#2291)
+ - More shortcuts (#2300)
+   - `CTRL+F1` switch to normal view.
+   - `CTRL+F2` switch to gallery view.
+   - `CTRL+F3` switch to list view.
+   - `Double click` on empty space to select all items.
+ - Option to hide certain files in UI by extension (#2403) (#2277)
+ - Additional search features
+   - wildcard search similar to regex, but limited to sqlite GLOB syntax (#769)
+   - advanced search tool that shows all results in a listing thats sortable and actionable like a normal listing (#1051)
+   - advanced search supports multiple custom scopes per search
+   - multiple search terms with AND or OR logic support
+
+ **Notes**:
+ - Enhanced indexing scheduler which doesn't wake the disk as often.
+ - New API route `media/lyrics` used to fetch and parse lyrics (embedded or from `.lrc` sidecar) (#2360)
+ - Swiping down gesture in fullscreen videos exit fullscreen instead of close preview.
+ - Improved styles for path selection and tables
+ - Improved style of drag and drop into listing view (#2407)
+ - Edit Sidebar links has new "show tools in sidebar" toggle and all users have this enabled by default. can be disabled via for new users `userDefaults.sidebar.showTools: false`
+ - Update user defaults ordering (#1140)
+ - Save view modes and sizes into local storage instead of db (#2301) 
+
+ **BugFixes**:
+ - Blue overlay when using gestures in video files on mobile (#2360)
+ - Playback queue wasn't updating when changing of folder (#2360)
+ - Added missing `UserDefaults.listing.showCopyPath` option to config file (#2364)
+ - Delete prompt thumbnail didn't worked when using it with the `delete` shortcut. (#2407)
+ - Searching icons in the Icon picker prompt wasn't working properly (#2407) 
+ - Drag and drop style state was stuck until page reload (#2407)
+ - Navigate close settings shows "something went wrong" (#2047)
+
+## v1.3.10
+
+ **Notes**:
+ - When indexing is disabled for a source, the usage will always reported as partition size.
+ - removed deprecated `source.config.disableIndexing`, see [rules](https://filebrowserquantum.com/en/docs/advanced/source-configuration/conditional-rules/#disable-indexing)
+
+ **BugFixes**:
+ - Disable index option not working (#2385)
+
+## v1.3.9
+
+ **Security**:
+ - [Critical] Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion GHSA-fwj3-42wh-8673
+ - [Moderate] Stored XSS via SVG File in Public Share (Missing CSP Header) GHSA-mmpx-jh39-wrv6
+
+ **BugFixes**:
+ - Fix context menu items and adjusted when items show to more accurately reflect permissions.
+
+## v1.3.8
+
+ **BugFixes**:
+ - Quick download icon style after icon change.
+ - Missing error popup for resource creatoin actions (upload/create)
+ - EnforcedOtp login failure until restart (#2330)
+ - Thumbnails for Folders only display sporadically (#2353)
+ - Unwanted user scope change for users with non-default scopes (#2347)
+ - Fix sidebar source info totals (#2321) (#2322) (#982)
+ - Error uploading a large number of photos -- only 100 items get uploaded (#2348)
+
+## v1.3.7
+
+ **Notes**:
+ - creating/deleting password-based user requires reauthentication (#2112)
+
+ **BugFixes**:
+ - TOTP works for admin but fails for standard users on re-login until Docker is restarted (#2330)
+ - No Loginfields shown if password authentification is set to false (#2331)
+
+## v1.3.6
+
+ **BugFixes**:
+ - file watcher not working for files and not respecting line count (#2314)
+ - "source" type link shows up multiple times when adding sidebar links if user has multiple sources.
+ - JWT ES256 results in error (#2188)
+ - single file shares not loading editor text content (#2122)
+
+## v1.3.5
+
+ **Notes**:
+ - any password change or admin user property change for a password user requires reauthentication (#2112)
+
+ **BugFixes**:
+ - PWA icon fixes (#2292)
+ - deny-rule'd folders visible in directory listings (regression from v1.2.4-stable) (#2295)
+ - OTP and password requirement fixes (#2112) (#2263)
+ - CLI not picking up config properly
+ - Storage usage numbers on first load adjusted.
+ - Some items in userDefaults are not setting defaults for new users properly #2278
+ - Fix copy to clipboard and simplify code (#2281) (#2274)
+ - Fix search shortcut `/` and pdf previews (#2307)
+ - Special permissions bit not set when declared in createDirectoryPermission (#2283)
+ - Execute permission altered after editing sh script with FB Quantum (#2309)
+ - Source is red but working (#2289)
+
+## v1.3.4
+
+ **New Features**:
+ - Epub placementg url anchors to bookmark a specific location on the doc.
+ - Add Requirement for Current Password When Changing Account Password (#2112)
+ - Copy file path to clipborad through right click (#2204)
+
+ **Notes**:
+ - user scope editing has path picker and filesystem validation
+
+ **BugFixes**:
+ - Swiping media files doesn't respect Playback Queue (#2243)
+ - Audio metadata and album thumbnails doesn't work (#2236)
+ - Search spinner wouldn't show up sometimes while searching
+ - The default landing page source should always be the first source in the sidebar, that wasn't always respected.
+
+## v1.3.3
+
+ **New Features**:
+ - Copy/paste files and folders (`CTRL+C`/`CTRL+V`) from other apps (win explorer, thunar, finder, etc) to upload them directly (#2197)
+ - Caption font size can be adjusted in video settings
+ - Ability to adjust the startup check method for sql database via `server.startupIntegrityCheck` (#2221)
+ - Status bar for editor and markdown viewer (#2226)
+
+ **Notes**:
+ - `.fbx` 3d model files added to supported previews.
+ - removed upx compression on docker image (#2193)
+ - videos double tap to fast-forward and rewind added.
+ - Adjust Image album swipe behavior (#2068)
+   - swipe animation for next/previous
+   - swipe down on image to close and go to parent folder.
+   - supports videos
+ - chunked uploads will save to a temporary file at the destination and renamed on completion. Better upload pause handling (#2129)
+ - The Icons in the UI were updated! (#2203)
+   - More supported icons in the Icon Picker tool.
+   - More file types have new icons across all the listings (such as `.md`, `.apk`, etc).
+ - `.fbx` 3d model files added to supported previews.
+ - removed upx compression on docker image (#2193)
+ - chunked uploads will save to a temporary file at the destination and renamed on completion. Better upload pause handling (#2129)
+ - deprecated `source.config.CreateUserDir`, now its always `true`. If a user directory doesn't exist it will get created empty.
+ - `CTRL`+`Mouse Wheel` shortcut to change listing size. Also for change font size in editor (#2227)
+
+ **BugFixes**:
+ - Archives don't preserve file metadata (#2063)
+ - Chunked upload setting fails: "0" does not disable chunking as expected (#2202)
+ - Incorrect Chinese labels for Upload controls in Quantum UI (#2191)
+ - Chunked download stops after first chunk, add message explaining (#2074)
+ - Esc to Cancel and Enter to confirm popup (#2079)
+ - Language-tagged subtitle files not detected for videos (#2199)
+ - Unable to use proxy auth since 1.3.0-beta (#2173)
+ - Updating setting on a LDAP user turns the "Login Method" to password. Thus preventing further logins. (#2179)
+
+## v1.3.2-beta
+
+ **Security**:
+ - Patched Username Enumeration via Authentication Timing Side-Channel  GHSA-7789-65hx-f26w
+
+ **New Features**:
+  - Option in settings `userDefaults.preferEditorForMarkdown` to prefer editor first for Markdown files (#2136)
+  - Copy to clipboard button for code blocks in Markdown Viewer (#2160)
+  - Add "Last modified" filter in search dialog (#2157)
+
+ **Notes**:
+ - docs preview for text and pdf has a 2 second timeout. If it hangs for whatever reason, the maximum time would be 2 seconds. (#2105) (#2114)
+ - Downloading multiple files streams the archive creation rather than using cacheDir -- thanks @janakoram (#2125) (#2130)
+   - `server.maxArchiveSizeGB` now defaults to 20 (GB) and only applies to archive/unarchive actions (not downloads).
+   - browser download progress bar will no longer show for archive downloads. this is the main drawback to the streaming approach.
+   - should allow for much higher parallel download support and lower cleanup maintenenance.
+ - [docker] ffmpeg version upgraded to 8.1
+ - remote ip in logs now prefers `X-Forwarded-For` if it exists, then `X-Real-IP`, then lastly the standard RemoteAddr. Useful when running behind a proxy to log the public IP of each request. (#2110)
+ - changed loading spinner style to be more compatible with safari browsers.
+
+ **BugFixes**:
+ - Wrong username in share settings (#2147) (#2148)
+ - [OnlyOffice] Error when saving a file under a user scope #2133
+ - Cannot edit shared file in OnlyOffice #2143
+ - PWA install button disappeared (#2086)
+ - Deleting a root folder was possible #2128
+ - PUT resource api errors if action against a folder (#2153) 
+ - LDAP authentication issue if a password caontains @ symbol (#2154)
+ - Share banner seems to be not working for custom urls (#2120)
+
+## v1.3.1-beta
+
+ **Security**:
+ - Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse) GHSA-r633-fcgp-m532
+ - Patched Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info GHSA-525j-95gf-766f
+
+ **New Features**:
+  - More user options for settings (#2072) (#2067):
+    - Option to disable thumbnails `userDefaults.preview.audio` and `userDefaults.preview.models` for Audio and 3D Models.
+    - Option to disable files in the Tree navigation `userDefaults.hideFilesInTree`
+    - Option to disable source files deletion when creating/extracting archives. `userDefaults.deleteAfterArchive`
+
+ **Notes**:
+ - Share icon does not show in share listing or for shares for other users.
+ - File Size Analyzer tool max items increased from 100 to 200.
+ - changed symlink detection logic.
+
+ **BugFixes**:
+ - 405 response code error on Webdav in 1.3.0-beta (#2054)
+ - Motion Preview setting not saving when changed in profile settings.
+ - Context menu on tools not working.
+
+## v1.3.0-beta
+
+Note: a potentially breaking change for docker users: \the default user is now "filebrowser" 1000:1000 instead of root.
+
+ **New Features**:
+ - New Sidebar Features
+   - Sidebar tree navigation (#2006) (#350)
+   - Source usage to be customized to show os-reported values rather than calculated. This can be changed per source by editing the source link in the sidebar. (#1266) (#982)
+ - Archive/Unarchive actions in UI (#1252) (#335) (#1569) 
+   - new api to archive/unarchive files on the server
+   - requires `create` user permissions
+   - archiving actions respect `server.maxArchiveSize`
+ - Added share icon to items that are shared (#1420)
+ - Authentication enhancements
+   - LDAP login support with OIDC feature parity. (#591)
+   - userGroup for OIDC and LDAP, only users in a group will get access. (#1964)
+   - Add JWT token authentication support (#1364)
+ - Enhanced thumbnail and item previews
+   - Added ability to show "motion preview" for folders with multiple child items that have previews. cycles through the first 4 images.
+   - support for reading embedded images from raw image or heic/heif files (#215)
+   - reorganized and simplified thumbnail settings in profile settings (#1968)
+   - removed `highQuality` thumbnail option which only affected gallery view. Now its always enabled.
+   - improved caching for unsupported images, the same file won't be attempted again with the same modtime.
+   - supports 3d model previews.
+ - FileWatcher also supports watching directories
+ - Support previews for 3D model files (STL, OBJ, 3MF, etc.) (#1273)
+   - supported formats via threejs: GLTF, GLB, OBJ, STL, PLY, DAE (Collada), 3MF, 3DS, USDZ, USD, USDA, USDC, AMF, VRML, WRL, VTK, VTP, PCD, XYZ, VOX, KMZ
+   - supports animations (for formats that contain them)
+   - supports embedded textures, external neighboring file textures, or textures in `/textures` subdirectory
+ - Enhanced prompts
+   - All prompts have a taskbar with a close button
+   - Prompts can be freely moved by dragging taskbar
+   - Prompt styling has been updated
+   - Clicking outside of prompts no longer automatically closes them.
+ - add webdav support (#209) -- thanks to @reddac for (#1764)
+   - see docs on how to use
+   - requires api an un-customized api token as password
+   - respects access rules
+   - requires download permission to view and modify/create/delete permission to modify.
+
+ **Notes**:
+ - Docker images default to `filebrowser` user instead of root
+ - reorganized api routes
+   - consolidated tags for swagger to be more accurately grouped
+   - tools are all behind `/api/tools` routes
+   - `/api/raw` is deprecated (but functional). The `/api/resources/download` route will be used instead.
+   - `/api/preview` has been removed and replaced with `/api/resources/preview`
+   - `/api/onlyoffice` have been replaced with `/api/office`
+   - `/api/shares` has been moved to `/api/share/list`
+   - `/api/auth/tokens` has been moved to `/api/auth/token/list` and `/api/auth/token` added to get specific token info
+   - `PUT /api/token` has been moved to `POST /api/token`
+   - `/public/api/shareinfo` has been moved to `/public/api/share/info`
+   - `POST /resources/bulk/delete` api has been moved to `DELETE /resources/bulk` (#1984)
+
+ **BugFixes**:
+ - Long folder names get cut off at top navigation bar (#1934)
+
+## v1.2.2-stable
+
+ **Security**:
+ - Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse)
+
+ **New Features**:
+ - "Divider" option in sidebar links to add a text or divider between links ()
+ - shares offer a "go to source Location" sidebar link and button when editing a share.
+
+ **Notes**:
+ - Share edit/delete permissions are scoped to the user's shares rather than global (#2050)
+
+ **BugFixes**:
+ - fixed the requirement that the database path needed to be set in the config file, now it loads `FILEBROWSER_DATABASE` value by default, fallback to config file property.
+ - Error downloading zipped directory: no such file or directory (users with scope) #2015
+
+## v1.2.1-stable
+
+ **BugFixes**:
+ - startup icon generation order issue (#2019)
+ - login button on shares not showing (#2028)
+ - removed file watcher link in context menu for shares (#2025)
+ - Direct download link for single-file shares generates incorrect URL (#2026)
+ - Deleting files causes error V1.2.0 #2039
+
+## v1.2.7-beta
+
+ **BugFixes**:
+ - head > title > infinitely duplicating titles (#2016)
+ - Proxy auth not working with Nginx, stuck at logo (#2013)
+
+## v1.2.6-beta
+
+ **Security**:
+ - resolves https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6
+
+## v1.2.5-beta
+
+ **Notes**:
+ - Dependency Updates for frontend and backend packages
+ - Upgrade to go 1.26
+ - file list prompt interaction behavior, single-click always selects, double-click navigates. (#1911)
+
+ **BugFixes**:
+ - .ssa and .ass subtitle files get their styling removed during conversion (#1933)
+ - custom icons issue
+ - new database message for noauth (#1935)
+
+## v1.2.4-beta
+
+ **Notes**:
+ - Changed `/api/media/subtitles` api endpoint to better support subtitles.
+ - Correcting some errors in French language (#1947)
+ - add Dutch `nl.json` for frontend i18n -- thanks @Stephan-P (#1957)
+ - share banner and icon images automatically serve a scaled down 1024x1024
+
+ **BugFixes**:
+ - Can't access directories with space (and possibly other special characters) when browsing a public link share (#1956)
+ - External ASS subtitles are not usable in web preview (#1933)
+ - Filename blocking rename/move (#1950)
+ - enforcedOtp: true blocks all user settings updates with HTTP 400 (#1962)
+ - Share favicon URL not showing up and Share description causing endless loading (#1911)
+ - folder sizes not updated for changes to filesystem outside of filebrowser (#1974)
+
+## v1.2.3-beta
+
+ **Notes**:
+ - Removed upload api behavior to assume paths ending in "/" are folders, strictly uses isDir query param
+ - renamed public upload api query param from `targetPath` to `path`. see swagger docs.
+
+ **BugFixes**:
+ - fix stuck motion preview popup window issue
+ - Chunked uploads ignore User Scope and are saved to Source Root (#1894)
+ - share delete with user scope issue
+ - fix favicon pwa icon, having the PWA respect the favicon/loginIcon (#1899)
+ - delete prompt icons show image previews
+
+## v1.2.2-beta
+
+ **New Features**:
+ - Resizable sidebar (#1896)
+ - OIDC Authentication: Change Button Text via `frontend.oidcLoginButtonText` (#1708)
+ - improved favicon processing (#1899)
+   - supports more formats
+   - supports larger images
+   - automatcially generates multiple favicon sizes on startup for non-svg images. Custom svg favicons need a companion *.png to exist broad compatibilty
+   - Enhanced media playback: Ability to control the queue from your device's lock screen and notification panel - Will also show
+   metadata of the current playing media if available (#1917)
+
+ **Notes**:
+ - Better text file content detection (#1726)
+ - More url encoding changes for API which should make things more consistent. Open issues if you see path/source not found errors.
+ - adjustments to the startup behavior for sqlite index for reusing the previous database on startup
+ - CTRL + B disables sticky sidebar forever (#1869)
+ - added context menu back to duplicate finder
+ - Sharing a link for uploads - folder/file access and UX polishing (#1902)
+ - improved listing view and scrolling performance
+ - improved image viewer which will utilize recent thumbnails as a placeholder when loading the full image.
+ - Small reorganization of "Share" settings to make the popup clear (#1826)
+
+ **BugFixes**:
+ - Added docker default `FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"` back -- mistakenly removed. see https://filebrowserquantum.com/en/docs/getting-started/config/#3-default-locations. (#1891)
+ - Fix brand text in login screen (#1898)
+ - Sidebar links cointains urls with 2x repeated source name (#1847)
+ - 2 factor auth getting overwritten if you edit the auth from admin (#1819)
+ - New created user's files are listing error, Probably related with language setting. (#1565)
+ - thumbnail generation cpu/memory and concurrency bug.
+   - added 75MB filesize limit for image previews
+   - optimized concurrency for large vs small images
+
+
+## v1.2.1-beta
+
+ **New Features**:
+ - Global disable onlyoffice editor via "*" file option to disable all files for a specific user. (#1533) 
+
+ **Notes**:
+ - upgraded imaging package and improved thumbnail generation performance. (#1797) (#1850)
+ - updated download api to use repeated `file` query param for path instead of `files` with comma. See swagger for details (#1881)
+
+ **BugFixes**:
+ - OnlyOffice stopped working after 1.2.0 upgrade due to download api changes
+ - Search result link to wrong path when search context other than / (#1863)
+ - File actions doesn't work if using user scopes (#1879)
+ - Drop items into folders doesn't work (#1860)
+ - duplicate finder context menu (#1862)
+ - File list in previews doesn't show the parent items (#1861)
+
 ## v1.2.0-beta
 
 This is a major version update with many code changes which could cause unexpected behavior. Upgrades should proceed with caution and report any undesriable behavior by opening an issue on github. The index is now fully in sqlite database - see [Indexing Overview](https://filebrowserquantum.com/en/docs/features/indexing/) for more information.

README.md

@@ -1,7 +1,7 @@
 <div align="center">
 
   [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
-  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
+  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/0b548794f2ac4871a0cf7aa9ecab049f)](https://app.codacy.com/gh/gtsteffaniak/filebrowser/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
   [![latest version](https://img.shields.io/github/v/release/gtsteffaniak/filebrowser)](https://github.com/gtsteffaniak/filebrowser/releases)
   [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
   [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
@@ -17,7 +17,7 @@
 
 ## Pinned
 
-:loudspeaker: [What's Coming Soon](https://github.com/gtsteffaniak/filebrowser/discussions/1622)
+:loudspeaker: [New Announcement](https://github.com/gtsteffaniak/filebrowser/discussions/2048)
 
 :pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)
 
@@ -25,7 +25,7 @@
 
 FileBrowser Quantum provides an easy way to access and manage your files from the web. It has a modern responsive interface that has many advanced features to manage users, access, sharing, and file preview and editing.
 
-This version is called "Quantum" because it packs tons of advanced features into a tiny easy to run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
+This version is called "Quantum" because it packs tons of advanced features into a tiny and easy-to-run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
 
 The goal for this repo is to become the best open-source self-hosted file browsing application that exists -- **all for free**. This repo will always be free and open-source.
 
@@ -35,20 +35,20 @@ Ready to try it out? See [Getting Started Docs](https://filebrowserquantum.com/e
 
 FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:
 
-  1. ✅ Add and configure multiple sources
-  2. ✅ Login support for OIDC, password + 2FA, and proxy.
+  1. ✅ Better source configuration - multiple sources, include/exclude rules, and [more](https://filebrowserquantum.com/en/docs/configuration/sources/)
+  2. ✅ Login support for OIDC, LDAP, JWT, password + 2FA, and proxy.
   3. ✅ Beautiful, Responsive, and Customizable user interface.
   4. ✅ Streamlined configuration via `config.yaml` config file.
-  5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
+  5. ✅ Ultra-efficient Sqlite [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing)
      - Real-time search results as you type.
      - Real-time monitoring and updates in the UI.
      - Search supports file and folder sizes, along with various filters.
   6. ✅ Better listing browsing
-     - Better thumbnail support including **office**, **video**, and **album artwork**
+     - Better thumbnail support including **office**, **video**, and **album artwork**, and **3D models**.
      - Faster and more responsive views with animations.
-     - Folder sizes are displayed and support for thumbnails
+     - Folder sizes are displayed and support thumbnails
      - Navigating remembers the last scroll position.
-  7. ✅ Highly configurable and customizable sharing options
+  7. ✅ Highly configurable and [customizable sharing options](https://filebrowserquantum.com/en/docs/shares/options/)
      - share expiration time
      - users who can access share (including anonymous)
      - styling and themes
@@ -59,20 +59,10 @@ FileBrowser Quantum is a massive fork of the file browser open-source project wi
      - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.
 
 Notable features that this fork *does not* have (removed):
-
- - :construction: jobs are not supported yet.
  - ❌ shell commands are completely removed and will not be returned.
 
 FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.
 
-## System Requirements
-
-> [!WARNING]
-> Every file and directory in the source gets indexed (by default). This enables powerful features such as instant search, but large source filesystems can increase your system requirements. [See indexing wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) for more info.
-
- - **Memory**: depends on configured source complexity. See [how much RAM does it require?](https://github.com/gtsteffaniak/filebrowser/discussions/787)
- - **GPU**: Not currently used (planned)
-
 ## The UI
 
 The UI has a simple three-component navigation system:
@@ -104,45 +94,45 @@ Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Self hostable                 | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Has Stable Release?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
-webdav support                | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
+webdav support                | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Dedicated docs site?          | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Docker image size             | 180 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
-Min. Memory Requirements      | 256 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
-has standalone binary         | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
+Min. Memory Requirements      | 512 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
+has standalone binary         | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
 price                         | free | free | free | free tier | free tier | $99+ |
 rich media preview            | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Advanced Search?              | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
-Indexed Search?               | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
-Content-aware search?         | ❌ | ❌ | ❌ | configurable | ✅ | ✅ |
-Custom job support            | :construction: | ✅ | ❌ | ✅ | ❌ | ✅ |
+Advanced Search?              | ✅ | ❌ | ✅ | configurable | ✅ | ✅ |
+Indexed Search?               | ✅ | ❌ | ✅ | configurable | ✅ | ✅ |
+Content-aware search?         | ❌ | ❌ | ✅ | configurable | ✅ | ✅ |
+Custom job support            | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
 Multiple users                | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Single sign-on support        | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
-LDAP sign-on support          | :construction: | ❌ | ❌ | ✅ | ❌ | ✅ |
+Single sign-on support        | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+LDAP sign-on support          | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Long-live API key support     | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 API documentation page        | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Mobile App                    | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ |
+Mobile App                    | ❌ | ❌ | ✅ | ✅ | ✅ | ❌ |
 open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
-tags support                  | :construction: | ❌ | ❌ | ✅ | ❌ | ✅ |
+tags support                  | :construction: | ❌ | ✅ | ✅ | ❌ | ✅ |
 shareable web links?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Event-based notifications     | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Metrics                       | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
-file space quotas             | :construction: | ❌ | ❌ | ❌ | ✅ | ✅ |
+Event-based notifications     | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
+Metrics                       | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
+file space quotas             | :construction: | ❌ | ✅ | ❌ | ✅ | ✅ |
 text-based files editor       | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
-Themes                        | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
-Branding support              | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
-activity log                  | :construction: | ❌ | ❌ | ✅ | ✅ | ✅ |
-Comments support              | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
-trash support                 | :construction: | ❌ | ❌ | ✅ | ✅ | ✅ |
-Starred/pinned files          | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
+Themes                        | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+Branding support              | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+activity log                  | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
+Comments support              | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ |
+trash support                 | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
+Starred/pinned files          | ❌ | ❌ | ✅ | ❌ | ✅ | ✅ |
 Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
 Share collections of files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can archive selected files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can browse archive files      | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can convert documents         | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can convert videos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
-Can convert photos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
+Can archive selected files    | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can browse archive files      | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
+Can convert documents         | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
+Can convert videos            | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
+Can convert photos            | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |

_docker/Dockerfile

@@ -1,17 +1,15 @@
-FROM gtstef/ffmpeg:8.0.1-decode AS ffmpeg
+FROM gtstef/ffmpeg:8.1-decode AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION
 WORKDIR /app
 COPY ./backend ./
-RUN apk update && apk add --no-cache gcc musl-dev upx
+RUN apk update && apk add --no-cache gcc musl-dev
 ENV CGO_ENABLED=1
-ENV GOEXPERIMENT=greenteagc
 RUN go build -tags mupdf,musl -ldflags="-w -s \
   -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
   -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
   -o filebrowser .
-RUN upx filebrowser
 
 FROM node:jod-slim AS nbuild
 WORKDIR /app
@@ -27,6 +25,7 @@ FROM alpine:latest
 COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
 ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
 ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
+ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
 ENV PATH="$PATH:/home/filebrowser"
 RUN apk --no-cache add ca-certificates mailcap tzdata curl exiftool
 RUN adduser -D -s /bin/true -u 1000 filebrowser
@@ -43,7 +42,6 @@ RUN [ "filebrowser", "version" ]
 RUN [ "ffmpeg", "-version" ]
 RUN [ "ffprobe", "-version" ]
 RUN [ "exiftool", "-ver" ]
-USER root
 # exposing default port for auto discovery.
 EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \

_docker/Dockerfile.playwright-base

@@ -1,4 +1,5 @@
 FROM node:22-slim
 WORKDIR /app/frontend
+
 RUN npm i @playwright/test oauth2-mock-server @types/node
-RUN npx playwright install --with-deps firefox
+RUN npx playwright install --with-deps chromium

_docker/Dockerfile.playwright-general

@@ -14,6 +14,9 @@ COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
 RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]
 
+# generate duplicate 1.1MB files
+RUN dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1MB.bin bs=1024 count=1126 && dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1mb.bin bs=1024 count=1126
+
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser set -u testuser1,testuser1

_docker/Dockerfile.playwright-jwt

@@ -0,0 +1,14 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:latest
+WORKDIR /app
+COPY [ "./_docker/src/jwt/", "./" ]
+WORKDIR /app/frontend
+COPY [ "./frontend/tests", "./tests" ]
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+RUN apt update && apt install nginx -y
+RUN mv default.conf /etc/nginx/conf.d/default.conf
+RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-local

@@ -0,0 +1,14 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:chromium
+WORKDIR /app
+
+WORKDIR /app/frontend
+COPY [ "./frontend/", "./" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+COPY [ "./_docker/src/screenshots/backend/*", "./"]
+
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-previews

@@ -0,0 +1,17 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:chromium
+WORKDIR /app
+
+# Copy setup scripts first to leverage caching
+COPY [ "./_docker/src/previews/", "./" ]
+
+WORKDIR /app/frontend
+COPY [ "./frontend/tests", "./tests" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+# Run tests
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-screenshots

@@ -0,0 +1,15 @@
+FROM ghcr.io/gtsteffaniak/playwright-base:chromium
+WORKDIR /app
+
+WORKDIR /app/frontend
+COPY [ "./frontend/", "./" ]
+
+WORKDIR /app/backend/
+COPY [ "./backend/filebrowser*", "./"]
+COPY [ "./_docker/src/screenshots/backend/*", "./"]
+
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots

_docker/Dockerfile.playwright-settings

@@ -18,5 +18,8 @@ COPY [ "./backend/http/embed/", "./http/dist/"]
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser set -u testuser1,testuser1
-RUN ./filebrowser set rule -f /tests/playwright-files -p / -r user -v admin -allow -c config.yaml
-RUN ./filebrowser set rule -f /tests/playwright-files -p /excluded -r user -v admin -c config.yaml
+RUN ./filebrowser set rule -s access -p / -r user -v admin -allow -c config.yaml
+RUN ./filebrowser set rule -s access -p /excluded/showme.txt -r user -v admin -allow -c config.yaml
+RUN ./filebrowser set rule -s access -p /denied -r user -v admin -c config.yaml
+RUN ./filebrowser set rule -s access -p /excluded -r user -v admin -c config.yaml
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.slim

@@ -3,13 +3,11 @@ ARG VERSION
 ARG REVISION
 WORKDIR /app
 COPY ./backend ./
-RUN apk update && apk add upx
-ENV GOEXPERIMENT=greenteagc
+RUN apk update && apk add
 RUN go build -ldflags="-w -s \
   -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
   -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
   -o filebrowser .
-RUN upx filebrowser
 
 FROM node:jod-slim AS nbuild
 WORKDIR /app
@@ -23,6 +21,7 @@ RUN npm run build:docker
 
 FROM alpine:latest
 ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
+ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
 ENV PATH="$PATH:/home/filebrowser"
 RUN apk --no-cache add ca-certificates mailcap tzdata curl
 RUN adduser -D -s /bin/true -u 1000 filebrowser
@@ -35,7 +34,6 @@ COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "
 COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
-USER root
 # exposing default port for auto discovery.
 EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \

_docker/docker-compose.yaml

@@ -1,4 +1,19 @@
 services:
+  local-playwright:
+    container_name: local-playwright
+    ports:
+      - "8080:8080"
+    build:
+      dockerfile: ./_docker/Dockerfile.playwright-local
+      context: ../
+  local-playwright-screenshots:
+    container_name: local-playwright
+    volumes:
+      - ../frontend/generated:/app/frontend/generated
+    entrypoint: ["/bin/sh", "-c", "./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots && npx playwright test --project light-screenshots"]
+    build:
+      dockerfile: ./_docker/Dockerfile.playwright-local
+      context: ../
   nginx-proxy-auth:
     image: nginx
     container_name: nginx-proxy-auth
@@ -7,11 +22,30 @@ services:
     volumes:
       - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
       - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
+  nginx-proxy-jwt:
+    image: nginx
+    container_name: nginx-proxy-jwt
+    ports:
+      - "8081:8081"  # Admin user
+      - "8082:8082"  # Regular user
+      - "8083:8083"  # Wrong key
+      - "8084:8084"  # No user
+    volumes:
+      - ./src/jwt/backend/default.conf:/etc/nginx/conf.d/default.conf
+      - ./src/jwt/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
+  filebrowser-jwt:
+    hostname: filebrowser
+    volumes:
+      - '../frontend:/home/frontend'
+      - "./src/jwt/backend/config.yaml:/home/filebrowser/data/config.yaml"
+    build:
+      context: ../
+      dockerfile: ./_docker/Dockerfile.slim
   filebrowser:
     hostname: filebrowser
     volumes:
       - '../frontend:/home/frontend'
-      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
+      - "./src/proxy/backend/config.yaml:/home/filebrowser/data/config.yaml"
     build:
       context: ../
       dockerfile: ./_docker/Dockerfile.slim

_docker/src/general/backend/config.yaml

@@ -8,8 +8,11 @@ userDefaults:
     image: true
     popup: true
     video: true
+    audio: true
+    models: true
     office: true
     highQuality: true
   permissions:
     download: true
-    create: true
+    create: true
+    share: true

_docker/src/general/backend/server-config.yaml

@@ -2,7 +2,8 @@ server-main: &server-main
   port: 80
   baseURL:  "/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"
@@ -11,5 +12,7 @@ server-main: &server-main
     - path: "."
       name: "docker"
       config:
-        disableIndexing: true
-        defaultEnabled: true
+        defaultEnabled: true
+        rules:
+          - folderPath: "/"
+            viewable: true

_docker/src/jwt/backend/config.yaml

@@ -0,0 +1,49 @@
+server:
+  port: 8080
+  logging:
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      config:
+        defaultEnabled: true
+        createUserDir: true
+
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+  styling:
+    disableEventThemes: true
+auth:
+  methods:
+    password:
+      enabled: false
+    jwt:
+      enabled: true
+      secret: "test-jwt-secret-key-for-development-only-do-not-use-in-production"
+      algorithm: "HS256"
+      header: "X-JWT-Assertion"
+      userIdentifier: "sub"
+      groupsClaim: "mygroup"
+      adminGroup: "admin"
+userDefaults:
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: true
+    api: false
+    download: true
+    create: true

_docker/src/jwt/backend/default.conf

@@ -0,0 +1,66 @@
+# Admin user (port 8081)
+server {
+    listen 8081;
+    server_name localhost 127.0.0.1;
+    
+    set $admin_token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RhZG1pbkBleGFtcGxlLmNvbSIsImV4cCI6MjA4NzU2NTc2NiwiZ3JvdXBzIjpbImFkbWluIl0sImlhdCI6MTc3MjIwNTc2NiwibmFtZSI6IlRlc3QgQWRtaW4iLCJuYmYiOjE3NzIyMDU3NjYsInN1YiI6InRlc3RhZG1pbiJ9.pxuKGyMmEe94m0xQ7y1QzcUZgU-lZSvqjoKUVoVd3F4";
+    
+    location / {
+        proxy_set_header X-JWT-Assertion $admin_token;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://filebrowser:8080;
+    }
+}
+
+# Regular user (port 8082)
+server {
+    listen 8082;
+    server_name localhost 127.0.0.1;
+    
+    set $regular_token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20iLCJleHAiOjIwODc1NjU2OTIsImdyb3VwcyI6WyJteWdyb3VwIl0sImlhdCI6MTc3MjIwNTY5MiwibmFtZSI6IlRlc3QgVXNlciIsIm5iZiI6MTc3MjIwNTY5Miwic3ViIjoidGVzdHVzZXIifQ.X8fUYbhnZpgvP5CnGdms9eGo8yRLyNhRbj7xUSxEgl8";
+    
+    location / {
+        proxy_set_header X-JWT-Assertion $regular_token;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://filebrowser:8080;
+    }
+}
+
+# Valid token but signed with different secret (port 8083)
+server {
+    listen 8083;
+    server_name localhost 127.0.0.1;
+    
+    # Valid JWT token structure, but signed with wrong secret - should fail signature verification
+    set $wrong_key "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RhZG1pbkBleGFtcGxlLmNvbSIsImV4cCI6MjA4NzU2NjAyMywiZ3JvdXBzIjpbImFkbWluIl0sImlhdCI6MTc3MjIwNjAyMywibmFtZSI6IlRlc3QgQWRtaW4iLCJuYmYiOjE3NzIyMDYwMjMsInN1YiI6InRlc3RhZG1pbiJ9.afBobbJ3VQ-fKnUebGr-gxFIqegyICi6E3EgkUSeFNw";
+    
+    location / {
+        proxy_set_header X-JWT-Assertion $wrong_key;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://filebrowser:8080;
+    }
+}
+
+# No authentication (port 8084)
+server {
+    listen 8084;
+    server_name localhost 127.0.0.1;
+    
+    location / {
+        proxy_set_header X-JWT-Assertion "";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://filebrowser:8080;
+    }
+}

_docker/src/jwt/backend/generate-jwt.go

@@ -0,0 +1,101 @@
+package main
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+)
+
+// Simple JWT generator without external dependencies
+func main() {
+	// Secret key - must match the one in your config file
+	secret := "wrong-key"
+
+	// Check if custom secret provided via command line
+	if len(os.Args) > 1 {
+		secret = os.Args[1]
+	}
+
+	// Create token claims with 10 year expiration
+	now := time.Now()
+	expiresAt := now.Add(10 * 365 * 24 * time.Hour) // 10 years
+
+	header := map[string]interface{}{
+		"alg": "HS256",
+		"typ": "JWT",
+	}
+
+	claims := map[string]interface{}{
+		"sub":    "testadmin",             // username (subject)
+		"email":  "testadmin@example.com", // email claim
+		"name":   "Test Admin",            // full name
+		"groups": []string{"admin"},       // groups - includes admin for testing
+		"iat":    now.Unix(),              // issued at
+		"exp":    expiresAt.Unix(),        // expires at
+		"nbf":    now.Unix(),              // not before
+	}
+
+	// Encode header
+	headerJSON, err := json.Marshal(header)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error encoding header: %v\n", err)
+		os.Exit(1)
+	}
+	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)
+
+	// Encode claims
+	claimsJSON, err := json.Marshal(claims)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error encoding claims: %v\n", err)
+		os.Exit(1)
+	}
+	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)
+
+	// Create signature
+	message := headerB64 + "." + claimsB64
+	h := hmac.New(sha256.New, []byte(secret))
+	h.Write([]byte(message))
+	signature := base64.RawURLEncoding.EncodeToString(h.Sum(nil))
+
+	// Combine to form complete JWT
+	tokenString := message + "." + signature
+
+	// Output the token
+	fmt.Println("=== JWT Token Generated ===")
+	fmt.Println()
+	fmt.Println("Token:")
+	fmt.Println(tokenString)
+	fmt.Println()
+	// Verify token can be decoded
+	parts := strings.Split(tokenString, ".")
+	if len(parts) == 3 {
+		fmt.Println("✓ Token structure is valid (3 parts)")
+	} else {
+		fmt.Fprintf(os.Stderr, "✗ Invalid token structure\n")
+		os.Exit(1)
+	}
+
+	// Save to file for easy access
+	filename := "test-jwt-token.txt"
+	if err := os.WriteFile(filename, []byte(tokenString), 0644); err != nil {
+		fmt.Fprintf(os.Stderr, "Warning: Could not write token to file: %v\n", err)
+	} else {
+		fmt.Printf("✓ Token saved to: %s\n", filename)
+		fmt.Println()
+	}
+
+	// Also save to shell script for easy sourcing
+	scriptContent := fmt.Sprintf("#!/bin/bash\n# Source this file to set JWT token as environment variable\n# Usage: source jwt-env.sh\nexport TEST_JWT_TOKEN=\"%s\"\necho \"JWT token loaded into TEST_JWT_TOKEN\"\n", tokenString)
+	if err := os.WriteFile("jwt-env.sh", []byte(scriptContent), 0755); err != nil {
+		fmt.Fprintf(os.Stderr, "Warning: Could not write shell script: %v\n", err)
+	} else {
+		fmt.Println("✓ Shell script saved to: jwt-env.sh")
+		fmt.Println("  Usage: source jwt-env.sh")
+		fmt.Println()
+	}
+}

_docker/src/jwt/backend/go.mod

@@ -0,0 +1,3 @@
+module test
+
+go 1.25.6

_docker/src/jwt/frontend/playwright.config.ts

@@ -0,0 +1,66 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/jwt-setup.ts",
+  timeout: 5000,
+  testDir: "./tests/playwright/jwt",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  /* Opt out of parallel tests on CI. */
+  workers: 1, // required for now! todo parallel some tests
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    actionTimeout: 5000,
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for different JWT test scenarios */
+  projects: [
+    {
+      name: "admin-user",
+      use: { 
+        ...devices["Desktop Firefox"],
+        baseURL: "http://127.0.0.1:8081", // Admin user JWT
+      },
+    },
+    {
+      name: "regular-user",
+      use: { 
+        ...devices["Desktop Firefox"],
+        baseURL: "http://127.0.0.1:8082", // Regular user JWT
+      },
+    },
+    {
+      name: "wrong-key",
+      use: { 
+        ...devices["Desktop Firefox"],
+        baseURL: "http://127.0.0.1:8083", // Wrong secret key
+      },
+    },
+    {
+      name: "no-user",
+      use: { 
+        ...devices["Desktop Firefox"],
+        baseURL: "http://127.0.0.1:8084", // No JWT token
+      },
+    },
+  ],
+});

_docker/src/noauth/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 80
   baseURL:  "/files/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "exclude"

_docker/src/oidc/backend/config.yaml

@@ -1,6 +1,7 @@
 server:
   logging:
     - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       config:

_docker/src/previews/backend/config.yaml

@@ -0,0 +1,36 @@
+server:
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
+  sources:
+    - path: "../frontend/tests/playwright-files"
+
+auth:
+  methods:
+    noauth: true
+
+frontend:
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"
+  styling:
+    disableEventThemes: true
+
+userDefaults:
+  showHidden: true
+  preview:
+    image: true
+    popup: true
+    video: true
+    audio: true
+    office: true
+    models: true
+    highQuality: true
+  permissions:
+    download: true
+    create: true

_docker/src/previews/frontend/playwright.config.ts

@@ -0,0 +1,54 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/previews-setup",
+  timeout: 10000,
+  testDir: "./tests/playwright/previews",
+  /* Run tests in files in parallel */
+  fullyParallel: true,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 2,
+  workers: 10,
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    launchOptions: {
+      args: [
+        '--disable-gpu',
+        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
+        '--enable-webgl',
+        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
+        '--no-sandbox',  // Required for Docker
+      ],
+    },
+    storageState: "previews.json",
+    actionTimeout: 5000,
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://127.0.0.1",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "chromium",
+      use: { ...devices["Desktop Chrome"] },
+    },
+  ],
+});

_docker/src/proxy/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 8080
   baseURL:  "/subpath"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       config:

_docker/src/proxy/frontend/playwright.config.ts

@@ -11,14 +11,14 @@ import { defineConfig, devices } from "@playwright/test";
  */
 export default defineConfig({
   globalSetup: "./tests/playwright/proxy-setup.ts",
-  timeout: 5000,
+  timeout: 10000,
   testDir: "./tests/playwright/proxy",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: false,
   /* Retry on CI only */
-  retries: 2,
+  retries: 3,
   /* Opt out of parallel tests on CI. */
   workers: 1, // required for now! todo parallel some tests
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */

_docker/src/screenshots/backend/config.yaml

@@ -0,0 +1,11 @@
+server:
+  port: 8080
+  baseURL:  "/files/"
+  logging:
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
+  sources:
+    - path: "../frontend/tests/playwright-files"
+      name: "playwright"
+      config:
+        defaultEnabled: true

_docker/src/screenshots/frontend/playwright.config.ts

@@ -0,0 +1,65 @@
+import { defineConfig, devices } from "@playwright/test";
+
+/**
+ * Read environment variables from file.
+ * https://github.com/motdotla/dotenv
+ */
+// require('dotenv').config();
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+  globalSetup: "./tests/playwright/screenshots-setup.ts",
+  timeout: 5000,
+  testDir: "./tests/playwright/screenshots",
+  /* Run tests in files in parallel */
+  fullyParallel: false,
+  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  forbidOnly: false,
+  /* Retry on CI only */
+  retries: 1,
+  /* Opt out of parallel tests on CI. */
+  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
+  reporter: "line",
+  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
+  use: {
+    launchOptions: {
+      args: [
+        '--disable-gpu',
+        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
+        '--enable-webgl',
+        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
+        '--no-sandbox',  // Required for Docker
+      ],
+    },
+    actionTimeout: 5000,
+    storageState: "loginAuth.json",
+    /* Base URL to use in actions like `await page.goto('/')`. */
+    baseURL: "http://localhost:8080",
+
+    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
+    trace: "on-first-retry",
+
+    /* Set default locale to English (US) */
+    locale: "en-US",
+  },
+
+  /* Configure projects for major browsers */
+  projects: [
+    {
+      name: "dark-screenshots",
+      use: {
+        ...devices["Desktop Chrome"],
+        theme: 'dark',
+      },
+    },
+    {
+      name: "light-screenshots",
+      use: {
+        ...devices["Desktop Chrome"],
+        theme: 'light',
+      },
+    },
+  ],
+});

_docker/src/settings/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 80
   baseURL:  "/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"
@@ -11,8 +12,10 @@ server:
     - path: "."
       name: "docker"
       config:
-        disableIndexing: true
         defaultEnabled: true
+        rules:
+          - folderPath: "/"
+            viewable: true
     - path: "/tests/playwright-files"
       name: "access"
       config:

_docker/src/settings/frontend/playwright.config.ts

@@ -11,7 +11,7 @@ import { defineConfig, devices } from "@playwright/test";
  */
 export default defineConfig({
   globalSetup: "./tests/playwright/global-setup",
-  timeout: 3000,
+  timeout: 5000,
   testDir: "./tests/playwright/settings",
   /* Run tests in files in parallel */
   fullyParallel: false,

_docker/src/sharing/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 80
   baseURL:  "/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"

backend/adapters/fs/diskcache/file_cache.go

@@ -10,6 +10,9 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/go-logger/logger"
 )
 
 // Cache interface for caching operations
@@ -29,9 +32,61 @@ type FileCache struct {
 	}
 }
 
-// NewFileCache creates a new FileCache
 func NewFileCache(dir string) (*FileCache, error) {
-	return &FileCache{dir: dir}, nil
+	cacheDir := filepath.Join(dir, "diskcache")
+
+	// Migrate existing cache files from old structure (if any)
+	if err := migrateOldCacheStructure(dir, cacheDir); err != nil {
+		logger.Warningf("failed to migrate old cache structure: %v\n", err)
+	}
+
+	// Create the cache directory immediately with proper permissions
+	if err := os.MkdirAll(cacheDir, fileutils.PermDir); err != nil {
+		return nil, fmt.Errorf("failed to create cache directory: %w", err)
+	}
+	return &FileCache{dir: cacheDir}, nil
+}
+
+// migrateOldCacheStructure moves cache files from old structure (dir/a/...) to new structure (dir/diskcache/a/...)
+func migrateOldCacheStructure(oldDir, newDir string) error {
+	// Read the old cache directory
+	entries, err := os.ReadDir(oldDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil // Directory doesn't exist yet, nothing to migrate
+		}
+		return err
+	}
+
+	migrated := 0
+	for _, entry := range entries {
+		// Only migrate single-character directories (cache hash directories like a, b, c, etc.)
+		if !entry.IsDir() || len(entry.Name()) != 1 {
+			continue
+		}
+
+		// Skip if it's already the diskcache directory
+		if entry.Name() == "d" && filepath.Join(oldDir, entry.Name()) == newDir {
+			continue
+		}
+
+		oldPath := filepath.Join(oldDir, entry.Name())
+		newPath := filepath.Join(newDir, entry.Name())
+
+		// Create parent directory in new location
+		if err := os.MkdirAll(newDir, fileutils.PermDir); err != nil {
+			return err
+		}
+
+		// Move the directory
+		if err := os.Rename(oldPath, newPath); err != nil {
+			// If rename fails (e.g., cross-device), skip this one
+			continue
+		}
+		migrated++
+	}
+
+	return nil
 }
 
 func (f *FileCache) Store(ctx context.Context, key string, value []byte) error {
@@ -40,11 +95,11 @@ func (f *FileCache) Store(ctx context.Context, key string, value []byte) error {
 	defer mu.Unlock()
 
 	fileName := f.getFileName(key)
-	if err := os.MkdirAll(filepath.Dir(fileName), 0700); err != nil {
+	if err := os.MkdirAll(filepath.Dir(fileName), fileutils.PermDir); err != nil {
 		return err
 	}
 
-	if err := os.WriteFile(fileName, value, 0600); err != nil {
+	if err := os.WriteFile(fileName, value, fileutils.PermFile); err != nil {
 		return err
 	}
 

backend/adapters/fs/diskcache/file_cache_test.go

@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/stretchr/testify/require"
 )
 
@@ -19,6 +20,9 @@ func TestFileCache(t *testing.T) {
 		cachedFilePath = "a/62/a62f2225bf70bfaccbc7f1ef2a397836717377de"
 	)
 
+	// Set up file permissions before creating cache
+	fileutils.SetFsPermissions(0644, 0755)
+
 	// Create temporary directory for the cache
 	cacheDir, err := os.MkdirTemp("", cacheRoot)
 	require.NoError(t, err)
@@ -28,19 +32,20 @@ func TestFileCache(t *testing.T) {
 	require.NoError(t, err)
 
 	// store new key
+	// Note: NewFileCache creates a "diskcache" subdirectory, so the actual path includes it
 	err = cache.Store(ctx, key, []byte(value))
 	require.NoError(t, err)
-	checkValue(t, ctx, cache, filepath.Join(cacheDir, cachedFilePath), key, value)
+	checkValue(t, ctx, cache, filepath.Join(cacheDir, "diskcache", cachedFilePath), key, value)
 
 	// update existing key
 	err = cache.Store(ctx, key, []byte(newValue))
 	require.NoError(t, err)
-	checkValue(t, ctx, cache, filepath.Join(cacheDir, cachedFilePath), key, newValue)
+	checkValue(t, ctx, cache, filepath.Join(cacheDir, "diskcache", cachedFilePath), key, newValue)
 
 	// delete key
 	err = cache.Delete(ctx, key)
 	require.NoError(t, err)
-	exists := fileExists(filepath.Join(cacheDir, cachedFilePath))
+	exists := fileExists(filepath.Join(cacheDir, "diskcache", cachedFilePath))
 	require.False(t, exists)
 }
 

backend/adapters/fs/files/file_test.go

@@ -1,14 +1,18 @@
 package files
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	liberrors "github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	dbsql "github.com/gtsteffaniak/filebrowser/backend/database/sql"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
@@ -86,6 +90,111 @@ func Test_GetRealPath(t *testing.T) {
 	}
 }
 
+// Regression: PUT / save must not os.Chmod to PermFile for existing files, or +x (and other mode bits) are lost (#2309).
+func TestWriteFilePreservesExecutableBit(t *testing.T) {
+	cacheDir := t.TempDir()
+	originalCache := settings.Config.Server.CacheDir
+	settings.Config.Server.CacheDir = cacheDir
+	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
+
+	fileutils.SetFsPermissions(0o644, 0o755)
+
+	if indexing.GetIndexDB() == nil {
+		db, _, err := dbsql.NewIndexDB("test_writefile_exec", "OFF", 1000, 32, false)
+		if err != nil {
+			t.Fatalf("Failed to create test database: %v", err)
+		}
+		indexing.SetIndexDBForTesting(db)
+	}
+
+	root := t.TempDir()
+	scriptName := "backupscript.sh"
+	scriptAbs := filepath.Join(root, scriptName)
+	if err := os.WriteFile(scriptAbs, []byte("#!/bin/sh\necho hi\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	sourceName := "test_writefile_exec"
+	indexing.Initialize(&settings.Source{
+		Name: sourceName,
+		Path: root,
+	}, false, false)
+
+	idx := indexing.GetIndex(sourceName)
+	if idx == nil {
+		t.Fatal("Failed to get test index")
+	}
+	stopPoll := startScannerStatusPoll(t, idx, 1)
+	defer stopPoll()
+	waitForScannerReady(t, idx)
+
+	indexPath := "/" + scriptName
+	if err := WriteFile(sourceName, indexPath, strings.NewReader("#!/bin/sh\necho bye\n")); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	st, err := os.Stat(scriptAbs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Mode()&0o111 == 0 {
+		t.Fatalf("executable bits cleared after save: mode=%v", st.Mode())
+	}
+
+	indexing.StopAllScanners()
+	time.Sleep(50 * time.Millisecond)
+	indexing.ClearTestIndices()
+}
+
+func TestWriteFileRejectsExistingDirectory(t *testing.T) {
+	cacheDir := t.TempDir()
+	originalCache := settings.Config.Server.CacheDir
+	settings.Config.Server.CacheDir = cacheDir
+	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
+
+	fileutils.SetFsPermissions(0o644, 0o755)
+
+	if indexing.GetIndexDB() == nil {
+		db, _, err := dbsql.NewIndexDB("test_writefile_isdir", "OFF", 1000, 32, false)
+		if err != nil {
+			t.Fatalf("Failed to create test database: %v", err)
+		}
+		indexing.SetIndexDBForTesting(db)
+	}
+
+	root := t.TempDir()
+	dirName := "folder"
+	if err := os.Mkdir(filepath.Join(root, dirName), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	sourceName := "test_writefile_isdir"
+	indexing.Initialize(&settings.Source{
+		Name: sourceName,
+		Path: root,
+	}, false, false)
+
+	idx := indexing.GetIndex(sourceName)
+	if idx == nil {
+		t.Fatal("Failed to get test index")
+	}
+	stopPoll := startScannerStatusPoll(t, idx, 1)
+	defer stopPoll()
+	waitForScannerReady(t, idx)
+
+	err := WriteFile(sourceName, "/"+dirName, strings.NewReader("file content"))
+	if err == nil {
+		t.Fatal("expected error when path is an existing directory")
+	}
+	if !errors.Is(err, liberrors.ErrIsDirectory) {
+		t.Fatalf("expected ErrIsDirectory, got: %v", err)
+	}
+
+	indexing.StopAllScanners()
+	time.Sleep(50 * time.Millisecond)
+	indexing.ClearTestIndices()
+}
+
 func TestSortItems(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -208,7 +317,7 @@ func TestOverrideDirectoryToFile(t *testing.T) {
 
 	// Initialize the database first (use test helper to avoid permission issues)
 	if indexing.GetIndexDB() == nil {
-		db, err := dbsql.NewIndexDB("test_file", "OFF", 1000, 32, false)
+		db, _, err := dbsql.NewIndexDB("test_file", "OFF", 1000, 32, false)
 		if err != nil {
 			t.Fatalf("Failed to create test database: %v", err)
 		}
@@ -219,7 +328,7 @@ func TestOverrideDirectoryToFile(t *testing.T) {
 	indexing.Initialize(&settings.Source{
 		Name: "test",
 		Path: "/mock/path",
-	}, true) // true for mock mode
+	}, true, false) // true for mock mode, false for isNewDb
 
 	// Get the index and set up mock data
 	idx := indexing.GetIndex("test")
@@ -318,7 +427,7 @@ func TestOverrideFileToDirectory(t *testing.T) {
 
 	// Initialize the database first (use test helper to avoid permission issues)
 	if indexing.GetIndexDB() == nil {
-		db, err := dbsql.NewIndexDB("test_file", "OFF", 1000, 32, false)
+		db, _, err := dbsql.NewIndexDB("test_file", "OFF", 1000, 32, false)
 		if err != nil {
 			t.Fatalf("Failed to create test database: %v", err)
 		}
@@ -329,7 +438,7 @@ func TestOverrideFileToDirectory(t *testing.T) {
 	indexing.Initialize(&settings.Source{
 		Name: "test",
 		Path: "/mock/path",
-	}, true) // true for mock mode
+	}, true, false) // true for mock mode, false for isNewDb
 
 	// Get the index and set up mock data
 	idx := indexing.GetIndex("test")
@@ -409,3 +518,218 @@ func TestOverrideFileToDirectory(t *testing.T) {
 		t.Error("Directory 'Test Object' should have been added to Folders")
 	}
 }
+
+// TestDeleteFilesRootProtection tests that DeleteFiles refuses to delete
+// the source root directory itself, preventing catastrophic data loss.
+// This is a regression test for the safety guard added to prevent accidental
+// deletion of the entire source directory.
+func TestDeleteFilesRootProtection(t *testing.T) {
+	// Use a temporary directory for cache
+	tmpDir := t.TempDir()
+	originalCacheDir := settings.Config.Server.CacheDir
+	settings.Config.Server.CacheDir = tmpDir
+	defer func() {
+		settings.Config.Server.CacheDir = originalCacheDir
+	}()
+
+	// Ensure fileutils permissions are set
+	if fileutils.PermDir == 0 {
+		fileutils.SetFsPermissions(0644, 0755)
+	}
+
+	// Initialize the database
+	if indexing.GetIndexDB() == nil {
+		db, _, err := dbsql.NewIndexDB("test_root_protection", "OFF", 1000, 32, false)
+		if err != nil {
+			t.Fatalf("Failed to create test database: %v", err)
+		}
+		indexing.SetIndexDBForTesting(db)
+	}
+
+	// Create a real temporary directory to use as source root
+	realTmpDir := t.TempDir()
+
+	// Initialize the index with a real path
+	indexing.Initialize(&settings.Source{
+		Name: "test_root_protection",
+		Path: realTmpDir,
+	}, false, false) // false for mock mode (real path), false for isNewDb
+
+	// Wait for scanner to be ready
+	idx := indexing.GetIndex("test_root_protection")
+	if idx == nil {
+		t.Fatal("Failed to get test index")
+	}
+
+	// Wait for scanner to finish
+	for i := 0; i < 50; i++ {
+		time.Sleep(10 * time.Millisecond)
+		status := idx.GetScannerStatus()
+		if status["status"] == "ready" || status["status"] == "unavailable" {
+			break
+		}
+	}
+
+	// Test: Attempting to delete the root directory should return an error
+	err := DeleteFiles("test_root_protection", realTmpDir, true)
+	if err == nil {
+		t.Error("DeleteFiles should return an error when trying to delete root directory")
+	}
+
+	// Verify the error message contains expected text
+	expectedErrMsg := "refusing to delete source root directory"
+	if err != nil && !strings.Contains(err.Error(), expectedErrMsg) {
+		t.Errorf("Expected error message to contain '%s', got: %v", expectedErrMsg, err.Error())
+	}
+
+	// Test with trailing slash - should still be blocked
+	err = DeleteFiles("test_root_protection", realTmpDir+"/", true)
+	if err == nil {
+		t.Error("DeleteFiles should return an error for root directory with trailing slash")
+	}
+
+	// Test with cleaned path variations
+	err = DeleteFiles("test_root_protection", realTmpDir+"/.", true)
+	if err == nil {
+		t.Error("DeleteFiles should return an error for root directory with /. suffix")
+	}
+}
+
+// TestDeleteFilesSubfolderWithRootName tests that deleting a subfolder
+// with the same name as the root directory works correctly and doesn't
+// accidentally delete the root.
+// Regression test for path handling bug where /srv/srv could be mistaken for /srv.
+func TestDeleteFilesSubfolderWithRootName(t *testing.T) {
+	for iter := 1; iter <= raceStressIterations; iter++ {
+		iter := iter
+		t.Run(fmt.Sprintf("stress-iter-%d", iter), func(t *testing.T) {
+			runDeleteFilesSubfolderWithRaceStress(t, iter)
+		})
+	}
+}
+
+const (
+	raceStressIterations   = 3
+	raceStatusPollInterval = 5 * time.Millisecond
+	waitStatusMaxTries     = 100
+	waitStatusSleep        = 50 * time.Millisecond
+)
+
+func runDeleteFilesSubfolderWithRaceStress(t *testing.T, iter int) {
+	t.Helper()
+	start := time.Now()
+	t.Logf("iteration %d: start", iter)
+
+	cacheDir := t.TempDir()
+	originalCache := settings.Config.Server.CacheDir
+	settings.Config.Server.CacheDir = cacheDir
+	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
+
+	if fileutils.PermDir == 0 {
+		fileutils.SetFsPermissions(0644, 0755)
+	}
+
+	if indexing.GetIndexDB() == nil {
+		db, _, err := dbsql.NewIndexDB("test_subfolder_rootname", "OFF", 1000, 32, false)
+		if err != nil {
+			t.Fatalf("Failed to create test database: %v", err)
+		}
+		indexing.SetIndexDBForTesting(db)
+	}
+
+	realTmpDir := t.TempDir()
+	subfolderName := filepath.Base(realTmpDir)
+	subfolderPath := filepath.Join(realTmpDir, subfolderName)
+
+	if err := os.Mkdir(subfolderPath, 0755); err != nil {
+		t.Fatalf("Failed to create subfolder: %v", err)
+	}
+
+	testFile := filepath.Join(subfolderPath, "test.txt")
+	if err := os.WriteFile(testFile, []byte("test content"), 0644); err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	sourceName := fmt.Sprintf("test_subfolder_rootname-%d", iter)
+	indexing.Initialize(&settings.Source{
+		Name: sourceName,
+		Path: realTmpDir,
+	}, false, false)
+
+	idx := indexing.GetIndex(sourceName)
+	if idx == nil {
+		t.Fatalf("Failed to get test index for %s", sourceName)
+	}
+
+	stopPolling := startScannerStatusPoll(t, idx, iter)
+	defer stopPolling()
+
+	waitForScannerReady(t, idx)
+
+	err := DeleteFiles(sourceName, subfolderPath, true)
+	stopPolling()
+
+	t.Logf("iteration %d: DeleteFiles finished in %s (err=%v)", iter, time.Since(start), err)
+
+	if err != nil {
+		t.Fatalf("DeleteFiles should succeed for subfolder with root-like name, got error: %v", err)
+	}
+
+	if _, err := os.Stat(subfolderPath); !os.IsNotExist(err) {
+		t.Fatal("Subfolder should have been deleted")
+	}
+
+	if _, err := os.Stat(realTmpDir); os.IsNotExist(err) {
+		t.Fatal("Root directory should NOT have been deleted")
+	}
+
+	indexing.StopAllScanners()
+	// Give scanners time to finish their cleanup (defer blocks in executeScan)
+	time.Sleep(100 * time.Millisecond)
+	indexing.ClearTestIndices()
+	t.Logf("iteration %d: cleaned scanners and indices", iter)
+}
+
+func waitForScannerReady(t *testing.T, idx *indexing.Index) {
+	t.Helper()
+	// Give the scanners a moment to initialize, but don't wait for full "ready" status
+	// The initial scan can take longer than the test timeout, but DeleteFiles will work
+	// as long as the scanners are initialized and running
+	time.Sleep(500 * time.Millisecond)
+	
+	// Verify scanners exist
+	status := idx.GetScannerStatus()
+	if totalScanners, ok := status["totalScanners"].(int); !ok || totalScanners == 0 {
+		t.Fatal("No scanners were created")
+	}
+	t.Log("Scanners initialized, proceeding with delete operation")
+}
+
+func startScannerStatusPoll(t *testing.T, idx *indexing.Index, iter int) func() {
+	t.Helper()
+	stop := make(chan struct{})
+	done := make(chan struct{})
+	var once sync.Once
+
+	go func() {
+		ticker := time.NewTicker(raceStatusPollInterval)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-stop:
+				close(done)
+				return
+			case <-ticker.C:
+				idx.GetScannerStatus()
+			}
+		}
+	}()
+
+	return func() {
+		once.Do(func() {
+			close(stop)
+			<-done
+			t.Logf("iteration %d: poll watcher stopped", iter)
+		})
+	}
+}

backend/adapters/fs/files/files.go

@@ -1,18 +1,17 @@
 package files
 
 import (
+	"bufio"
 	"context"
-	"encoding/base64"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
-	"unicode"
-	"unicode/utf8"
 
 	"github.com/dhowden/tag"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
@@ -28,6 +27,39 @@ import (
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
+// CheckPermissionsFunc allows tests to override CheckPermissions behavior
+var CheckPermissionsFunc = checkPermissionsImpl
+
+// addMetadataToChildren runs concurrent ffmpeg/tag extraction for audio/video children.
+// Each goroutine is registered on wg. Caller must invoke wg.Wait() after scheduling.
+func addMetadataToChildren(response *iteminfo.ExtendedFileInfo, opts utils.FileOptions, wg *sync.WaitGroup) {
+	sharedFFmpegService := ffmpeg.NewFFmpegService(10, false, "")
+	if sharedFFmpegService == nil {
+		return
+	}
+	for i := range response.Files {
+		fileItem := &response.Files[i]
+		isItemAudio := strings.HasPrefix(fileItem.Type, "audio")
+		isItemVideo := strings.HasPrefix(fileItem.Type, "video")
+		if !isItemAudio && !isItemVideo {
+			continue
+		}
+		isAudio := isItemAudio
+		wg.Go(func() {
+			fullPath := response.RealPath + "/" + fileItem.Name
+			if isAudio {
+				if err := extractAudioMetadata(context.Background(), fileItem, fullPath, opts.AlbumArt, opts.Metadata, false, sharedFFmpegService); err != nil {
+					logger.Debugf("failed to extract metadata for file: %s, error: %v", fileItem.Name, err)
+				}
+			} else {
+				if err := extractVideoMetadata(context.Background(), fileItem, fullPath, sharedFFmpegService); err != nil {
+					logger.Debugf("failed to extract video metadata for file: %s, error: %v", fileItem.Name, err)
+				}
+			}
+		})
+	}
+}
+
 // processDirectoryMetadata extracts metadata for audio/video files in directories
 func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts utils.FileOptions) {
 	metadataCount := 0
@@ -39,59 +71,20 @@ func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing
 			metadataCount++
 		}
 	}
+	var wg sync.WaitGroup
 
-	// Set hasMetadata flag if there are files with potential metadata
-	if metadataCount > 0 {
-		response.HasMetadata = true
-	}
-
-	// Only process metadata if explicitly requested
-	if opts.Metadata && metadataCount > 0 {
-		processedCount := 0
-
-		// Create a single shared FFmpegService instance for all files to coordinate concurrency
-		sharedFFmpegService := ffmpeg.NewFFmpegService(10, false, "")
-		if sharedFFmpegService != nil {
-			// Process files concurrently using goroutines
-			var wg sync.WaitGroup
-			var mu sync.Mutex // Protects processedCount
-
-			for i := range response.Files {
-				fileItem := &response.Files[i]
-				isItemAudio := strings.HasPrefix(fileItem.Type, "audio")
-				isItemVideo := strings.HasPrefix(fileItem.Type, "video")
-
-				if isItemAudio || isItemVideo {
-					wg.Go(func() {
-						// Extract metadata for audio files (without album art for performance)
-						if isItemAudio {
-							err := extractAudioMetadata(context.Background(), fileItem, response.RealPath+"/"+fileItem.Name, opts.AlbumArt, opts.Metadata, sharedFFmpegService)
-							if err != nil {
-								logger.Debugf("failed to extract metadata for file: %s, error: %v", fileItem.Name, err)
-							} else {
-								mu.Lock()
-								processedCount++
-								mu.Unlock()
-							}
-						} else {
-							// Extract duration for video files
-							err := extractVideoMetadata(context.Background(), fileItem, response.RealPath+"/"+fileItem.Name, sharedFFmpegService)
-							if err != nil {
-								logger.Debugf("failed to extract video metadata for file: %s, error: %v", fileItem.Name, err)
-							} else {
-								mu.Lock()
-								processedCount++
-								mu.Unlock()
-							}
-						}
-					})
-				}
-			}
-
-			// Wait for all goroutines to complete
-			wg.Wait()
+	wg.Go(func() {
+		indexPath := idx.MakeIndexPath(response.Path, true)
+		err := idx.RefreshDirectory(indexPath, false)
+		if err != nil {
+			logger.Debugf("Failed to refresh directory for folder size update: %v", err)
 		}
+	})
+
+	if opts.Metadata && metadataCount > 0 {
+		addMetadataToChildren(response, opts, &wg)
 	}
+	wg.Wait()
 }
 
 // finalizeResponse handles final response adjustments (OnlyOffice ID, scope stripping)
@@ -110,35 +103,41 @@ func finalizeResponse(response *iteminfo.ExtendedFileInfo, info *iteminfo.FileIn
 	}
 }
 
-func FileInfoFaster(opts utils.FileOptions, access *access.Storage, user *users.User) (*iteminfo.ExtendedFileInfo, error) {
-	response := &iteminfo.ExtendedFileInfo{}
+// CheckPermissions validates user access and returns the resolved index path and user scope
+func CheckPermissions(opts utils.FileOptions, access *access.Storage, user *users.User) (string, string, error) {
+	return CheckPermissionsFunc(opts, access, user)
+}
+
+// checkPermissionsImpl is the actual implementation of CheckPermissions
+func checkPermissionsImpl(opts utils.FileOptions, access *access.Storage, user *users.User) (string, string, error) {
 	if access == nil {
-		return response, fmt.Errorf("access not provided")
+		return "", "", fmt.Errorf("access not provided")
 	}
 	if user == nil {
-		return response, fmt.Errorf("user not provided")
+		return "", "", fmt.Errorf("user not provided")
 	}
 	if opts.Path == "" {
-		return response, fmt.Errorf("path not provided")
+		return "", "", fmt.Errorf("path not provided")
 	}
 	if opts.Source == "" {
-		return response, fmt.Errorf("source not provided")
+		return "", "", fmt.Errorf("source not provided")
 	}
+
 	// Get index
 	idx := indexing.GetIndex(opts.Source)
 	if idx == nil {
-		return response, fmt.Errorf("could not get index: %v ", opts.Source)
+		return "", "", fmt.Errorf("could not get index: %v ", opts.Source)
 	}
 
 	// Resolve user scope
 	userScope, scopeErr := user.GetScopeForSourcePath(idx.Path)
 	if scopeErr != nil || userScope == "" {
-		return response, fmt.Errorf("user has no access to source: %v", opts.Source)
+		return "", "", fmt.Errorf("user has no access to source: %v", opts.Source)
 	}
 
 	safePath, err := utils.SanitizeUserPath(opts.Path)
 	if err != nil {
-		return response, errors.ErrAccessDenied
+		return "", "", errors.ErrAccessDenied
 	}
 
 	// Combine scope + sanitized path
@@ -146,49 +145,157 @@ func FileInfoFaster(opts utils.FileOptions, access *access.Storage, user *users.
 	// Layer 1: USER ACCESS CONTROL
 	// Quick check: Does THIS user have permission?
 	if !access.Permitted(idx.Path, indexPath, user.Username) {
-		return response, errors.ErrAccessDenied
+		return indexPath, "", errors.ErrAccessDenied
 	}
+	return indexPath, userScope, nil
+}
 
+type Items struct {
+	Files   []string `json:"files,omitempty"`
+	Folders []string `json:"folders,omitempty"`
+}
+
+// This removes files whose names match any extension in hideFileExt.
+func filterFilesByExt(files []iteminfo.ExtendedItemInfo, hideFileExt string) []iteminfo.ExtendedItemInfo {
+	if hideFileExt == "" {
+		return files
+	}
+	filtered := files[:0]
+	for _, f := range files {
+		if !utils.HideFileByExt(f.Name, hideFileExt) {
+			filtered = append(filtered, f)
+		}
+	}
+	return filtered
+}
+
+func GetDirItems(opts utils.FileOptions, access *access.Storage, user *users.User) (Items, error) {
+	items := Items{}
+	indexPath, _, topLevelErr := CheckPermissions(opts, access, user)
+	accessRulesErr := topLevelErr != nil && topLevelErr == errors.ErrAccessDenied && indexPath != ""
+	if topLevelErr != nil && !accessRulesErr {
+		return items, topLevelErr
+	}
+	// Get index
+	idx := indexing.GetIndex(opts.Source)
+	if idx == nil {
+		return items, fmt.Errorf("could not get index: %v ", opts.Source)
+	}
+	info, err := idx.GetFileInfo(indexing.FileInfoRequest{
+		IndexPath:         indexPath,
+		FollowSymlinks:    opts.FollowSymlinks,
+		ShowHidden:        opts.ShowHidden,
+		HideFileExt:       opts.HideFileExt,
+		Expand:            true,
+		SkipExtendedAttrs: true,
+	})
+	if err != nil {
+		return items, err // Path excluded by index rules OR doesn't exist
+	}
+	if info.Type != "directory" {
+		return items, fmt.Errorf("path is not a directory: %v ", indexPath)
+	}
+	if err := access.CheckChildItemAccess(info, idx, user.Username); err != nil {
+		return items, err
+	}
+	hasAccessibleItems := len(info.Files) > 0 || len(info.Folders) > 0
+	if accessRulesErr && !hasAccessibleItems {
+		return items, errors.ErrAccessDenied
+	}
+	if opts.Only == "files" || opts.Only == "" {
+		for _, file := range info.Files {
+			if opts.HideFileExt != "" && utils.HideFileByExt(file.Name, opts.HideFileExt) {
+				continue
+			}
+			items.Files = append(items.Files, file.Name)
+		}
+	}
+	if opts.Only == "folders" || opts.Only == "" {
+		for _, folder := range info.Folders {
+			items.Folders = append(items.Folders, folder.Name)
+		}
+	}
+	return items, nil
+}
+
+// FileInfoFasterFunc is a variable that can be mocked in tests
+var FileInfoFasterFunc = fileInfoFasterImpl
+
+func FileInfoFaster(opts utils.FileOptions, access *access.Storage, user *users.User, share *share.Storage) (*iteminfo.ExtendedFileInfo, error) {
+	return FileInfoFasterFunc(opts, access, user, share)
+}
+
+// fileInfoFasterImpl is the actual implementation of FileInfoFaster
+func fileInfoFasterImpl(opts utils.FileOptions, access *access.Storage, user *users.User, share *share.Storage) (*iteminfo.ExtendedFileInfo, error) {
+	response := &iteminfo.ExtendedFileInfo{}
+	indexPath, userScope, topLevelErr := CheckPermissions(opts, access, user)
+	accessRulesErr := topLevelErr != nil && topLevelErr == errors.ErrAccessDenied && indexPath != ""
+	if topLevelErr != nil && !accessRulesErr {
+		return response, topLevelErr
+	}
+	// Get index
+	idx := indexing.GetIndex(opts.Source)
+	if idx == nil {
+		return response, fmt.Errorf("could not get index: %v ", opts.Source)
+	}
 	// Layer 2: INDEX RULES (global)
 	// Get file info using unified entry point (applies IsViewable/ShouldSkip)
 	info, err := idx.GetFileInfo(indexing.FileInfoRequest{
-		IndexPath:      indexPath,
-		FollowSymlinks: opts.FollowSymlinks,
-		ShowHidden:     opts.ShowHidden,
-		Expand:         opts.Expand,
-		IsRoutineScan:  false, // API call
+		IndexPath:         indexPath,
+		FollowSymlinks:    opts.FollowSymlinks,
+		ShowHidden:        opts.ShowHidden,
+		HideFileExt:       opts.HideFileExt,
+		Expand:            opts.Expand,
+		SkipExtendedAttrs: opts.SkipExtendedAttrs,
 	})
 	if err != nil {
 		return response, err // Path excluded by index rules OR doesn't exist
 	}
+	// otherwise response keeps unfiltered Folders/Files while CheckChildItemAccess only mutates info.
+	if info.Type == "directory" {
+		if err := access.CheckChildItemAccess(info, idx, user.Username); err != nil {
+			return response, err
+		}
+	}
+	hasAccessibleItems := len(info.Files) > 0 || len(info.Folders) > 0
+	if accessRulesErr && !hasAccessibleItems {
+		return response, errors.ErrAccessDenied
+	}
 
 	// Build response
 	response.FileInfo = *info
 	response.RealPath = filepath.Join(idx.Path, indexPath)
 	response.Source = opts.Source
-
-	// Layer 3: FILTER CHILDREN (user access)
-	// Remove child items THIS user can't access
-	if info.Type == "directory" {
-		if err := access.CheckChildItemAccess(response, idx, user.Username); err != nil {
-			return response, err
+	if share != nil && user.Permissions.Share && opts.ShowSharedAttr {
+		for i := range response.Files {
+			file := &response.Files[i]
+			file.IsShared = share.IsShared(response.Path+file.Name, idx.Path, user.ID)
 		}
+		for i := range response.Folders {
+			folder := &response.Folders[i]
+			folder.IsShared = share.IsShared(response.Path+folder.Name, idx.Path, user.ID)
+		}
+		response.IsShared = share.IsShared(response.Path, idx.Path, user.ID)
+	}
+	defer finalizeResponse(response, info, response.RealPath, user, userScope)
+	if opts.SkipExtendedAttrs {
+		if info.Type == "directory" && opts.HideFileExt != "" {
+			response.Files = filterFilesByExt(response.Files, opts.HideFileExt)
+		}
+		return response, nil
 	}
-
 	// Process directory metadata if requested
 	if info.Type == "directory" {
 		processDirectoryMetadata(response, idx, opts)
+		if opts.HideFileExt != "" {
+			response.Files = filterFilesByExt(response.Files, opts.HideFileExt)
+		}
 	}
-
 	// Process single file content/metadata
 	isAudioVideo := strings.HasPrefix(info.Type, "audio") || strings.HasPrefix(info.Type, "video")
 	if opts.Content || opts.Metadata || isAudioVideo {
 		processContent(response, idx, opts)
 	}
-
-	// Finalize response (OnlyOffice ID, scope stripping)
-	finalizeResponse(response, info, response.RealPath, user, userScope)
-
 	return response, nil
 }
 
@@ -199,9 +306,13 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 	if isFolder {
 		return
 	}
-
+	if isVideo && !opts.Metadata {
+		return
+	}
+	if isAudio && !(opts.Metadata || opts.AlbumArt) {
+		return
+	}
 	if isVideo {
-		// Extract duration for video
 		extItem := &iteminfo.ExtendedItemInfo{
 			ItemInfo: info.ItemInfo,
 		}
@@ -212,49 +323,36 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 			info.Metadata = extItem.Metadata
 		}
 
-		// Handle subtitles if requested
+		parentPath := filepath.Dir(info.Path)
+		parentInfo, exists := idx.GetMetadataInfo(parentPath, true, false)
+		if exists {
+			info.GetSubtitles(parentInfo)
+		}
 		if opts.ExtractEmbeddedSubtitles {
-			parentPath := filepath.Dir(info.Path)
-			parentInfo, exists := idx.GetReducedMetadata(parentPath, true)
-			if exists {
-				info.DetectSubtitles(parentInfo)
-				err := info.LoadSubtitleContent()
-				if err != nil {
-					logger.Debug("failed to load subtitle content: " + err.Error())
-				}
-			}
+			subtitles := ffmpeg.DetectEmbeddedSubtitles(info.RealPath, info.ModTime)
+			info.Subtitles = append(info.Subtitles, subtitles...)
 		}
 		return
 	}
 
+	// Audio: run tag/album-art extraction when full metadata or preview (AlbumArt) is requested.
+	// Preview uses AlbumArt without Metadata so we do not load arbitrary files as text content.
 	if isAudio {
-		// Create an ExtendedItemInfo to hold the metadata
 		extItem := &iteminfo.ExtendedItemInfo{
 			ItemInfo: info.ItemInfo,
 		}
-		err := extractAudioMetadata(context.Background(), extItem, info.RealPath, opts.AlbumArt || opts.Content, opts.Metadata || opts.Content, nil)
+		err := extractAudioMetadata(context.Background(), extItem, info.RealPath, opts.AlbumArt || opts.Content, opts.Metadata || opts.Content, false, nil)
 		if err != nil {
 			logger.Debugf("failed to extract audio metadata for file: "+info.RealPath, info.Name, err)
 		} else {
-			// Copy metadata to ExtendedFileInfo
 			info.Metadata = extItem.Metadata
-			info.HasPreview = extItem.Metadata != nil && extItem.Metadata.AlbumArt != ""
+			info.HasPreview = extItem.Metadata != nil && len(extItem.Metadata.AlbumArt) > 0
 		}
 		return
 	}
 
 	// Process text content for non-video, non-audio files
 	if info.Size < 20*1024*1024 { // 20 megabytes in bytes
-		// Check if file is text before reading content
-		isText, err := utils.IsTextFile(info.RealPath)
-		if err != nil {
-			logger.Debugf("could not check file type for: "+info.RealPath, info.Name, err)
-			return
-		}
-		if !isText {
-			// Not a text file, skip content extraction
-			return
-		}
 		content, err := getContent(info.RealPath)
 		if err != nil {
 			logger.Debugf("could not get content for file: "+info.RealPath, info.Name, err)
@@ -277,10 +375,58 @@ func generateOfficeId(realPath string) string {
 	return key
 }
 
+// Parses raw LRC text into a slice of Lyric.
+// Lines with [hh:mm:ss.xx] (timestamps) will be parsed to ms for synced lyrics
+// The ones without timestamp are kept as unsynced (timestamp 0).
+func parseLRC(raw string) []iteminfo.Lyric {
+	var lines []iteminfo.Lyric
+	scanner := bufio.NewScanner(strings.NewReader(raw))
+	re := regexp.MustCompile(`^\[(?:(\d{1,2}):)?(\d{1,2}):(\d{1,2})\.(\d+)\](.*)`)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+		matches := re.FindStringSubmatch(line)
+		if len(matches) == 6 {
+			// Hours default to 0 (if not present in the timestamps)
+			h := 0
+			if matches[1] != "" {
+				h, _ = strconv.Atoi(matches[1])
+			}
+			min, _ := strconv.Atoi(matches[2])
+			sec, _ := strconv.Atoi(matches[3])
+
+			msStr := matches[4]
+			// Normalise to 3 digits, some songs have more than 3 digits in the milliseconds
+			switch {
+			case len(msStr) < 3:
+				msStr += strings.Repeat("0", 3-len(msStr))
+			case len(msStr) > 3:
+				msStr = msStr[:3]
+			}
+			ms, _ := strconv.Atoi(msStr)
+			timestamp := int64((h*3600+min*60+sec)*1000 + ms)
+			text := strings.TrimSpace(matches[5])
+			lines = append(lines, iteminfo.Lyric{
+				Text:      text,
+				Timestamp: timestamp,
+			})
+		} else {
+			// Line without a valid timestamp – treat as unsynced (timestamp 0)
+			lines = append(lines, iteminfo.Lyric{
+				Text:      line,
+				Timestamp: 0,
+			})
+		}
+	}
+	return lines
+}
+
 // extractAudioMetadata extracts metadata from an audio file using dhowden/tag
 // and optionally extracts duration using the ffmpeg service with concurrency control
 // If ffmpegService is nil, a new service will be created (for backward compatibility)
-func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, getArt bool, getDuration bool, ffmpegService *ffmpeg.FFmpegService) error {
+func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, getArt bool, getDuration bool, getLyrics bool, ffmpegService *ffmpeg.FFmpegService) error {
 	file, err := os.Open(realPath)
 	if err != nil {
 		return err
@@ -316,6 +462,30 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 	track, _ := m.Track()
 	item.Metadata.Track = track
 
+	// Check if lyrics are available without extract them
+	if rawLyrics := m.Lyrics(); rawLyrics != "" {
+		item.Metadata.HasLyrics = true
+	} else {
+		// Check for sidecar .lrc file
+		dir := filepath.Dir(realPath)
+		base := filepath.Base(realPath)
+		ext := filepath.Ext(base)
+		nameWithoutExt := strings.TrimSuffix(base, ext)
+		lrcPath := filepath.Join(dir, nameWithoutExt+".lrc")
+		if _, err := os.Stat(lrcPath); err == nil {
+			item.Metadata.HasLyrics = true
+		}
+	}
+
+	if getLyrics {
+		lyrics, err := ExtractLyrics(realPath)
+		if err != nil {
+			logger.Debugf("failed to extract lyrics for %s: %v", realPath, err)
+		} else if len(lyrics) > 0 {
+			item.Metadata.Lyrics = lyrics
+		}
+	}
+
 	// Extract duration ONLY if explicitly requested using the ffmpeg VideoService
 	// This respects concurrency limits and gracefully handles missing ffmpeg
 	if getDuration {
@@ -335,11 +505,11 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 		return nil
 	}
 
-	// Extract album art and encode as base64 with strict size limits
+	// Extract album art if available (stored as raw bytes, auto-encoded to base64 in JSON)
 	if picture := m.Picture(); picture != nil && picture.Data != nil {
-		// More aggressive size limit to prevent memory issues (max 5MB)
+		// Size limit to prevent memory issues (max 5MB)
 		if len(picture.Data) <= 5*1024*1024 {
-			item.Metadata.AlbumArt = base64.StdEncoding.EncodeToString(picture.Data)
+			item.Metadata.AlbumArt = picture.Data
 		} else {
 			logger.Debugf("Skipping album art for %s: too large (%d bytes)", realPath, len(picture.Data))
 		}
@@ -348,6 +518,37 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 	return nil
 }
 
+// Returns lyrics from an audio file (from embedded tags or from a .lrc file with the same name).
+func ExtractLyrics(realPath string) ([]iteminfo.Lyric, error) {
+	file, err := os.Open(realPath)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	m, err := tag.ReadFrom(file)
+	if err != nil {
+		return nil, err
+	}
+
+	var lyrics []iteminfo.Lyric
+	if raw := m.Lyrics(); raw != "" {
+		lyrics = parseLRC(raw)
+	}
+	if len(lyrics) == 0 {
+		// Check for sidecar .lrc file
+		dir := filepath.Dir(realPath)
+		base := filepath.Base(realPath)
+		ext := filepath.Ext(base)
+		nameWithoutExt := strings.TrimSuffix(base, ext)
+		lrcPath := filepath.Join(dir, nameWithoutExt+".lrc")
+		if data, err := os.ReadFile(lrcPath); err == nil {
+			lyrics = parseLRC(string(data))
+		}
+	}
+	return lyrics, nil
+}
+
 // extractVideoMetadata extracts duration from video files using ffprobe
 // If ffmpegService is nil, a new service will be created (for backward compatibility)
 func extractVideoMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, ffmpegService *ffmpeg.FFmpegService) error {
@@ -376,8 +577,13 @@ func DeleteFiles(source, absPath string, isDir bool) error {
 	if index == nil {
 		return fmt.Errorf("could not get index: %v ", source)
 	}
+	// Safety guard: never allow deletion of the source root directory itself
+	cleanAbs := filepath.Clean(absPath)
+	if cleanAbs == filepath.Clean(index.Path) {
+		return fmt.Errorf("refusing to delete source root directory: %s", absPath)
+	}
 
-	if !index.Config.DisableIndexing {
+	if !index.Config.ResolvedRules.IndexingDisabled {
 		indexPath := index.MakeIndexPath(absPath, isDir)
 
 		// Perform the physical deletion
@@ -414,7 +620,7 @@ func RefreshIndex(source string, path string, isDir bool, recursive bool) error
 	if idx == nil {
 		return fmt.Errorf("could not get index: %v ", source)
 	}
-	if idx.Config.DisableIndexing {
+	if idx.Config.ResolvedRules.IndexingDisabled {
 		return nil
 	}
 	// Always normalize path using MakeIndexPath
@@ -522,7 +728,7 @@ func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 
 	// Handle SOURCE cleanup (treat as deletion)
 	// Run async to avoid blocking the HTTP response
-	if !srcIdx.Config.DisableIndexing {
+	if !srcIdx.Config.ResolvedRules.IndexingDisabled {
 		go func() {
 			if isSrcDir {
 				srcIdx.DeleteMetadata(srcIndexPath, true, true)
@@ -537,7 +743,7 @@ func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 
 	// Handle DESTINATION indexing
 	// Run async to avoid blocking the HTTP response
-	if !dstIdx.Config.DisableIndexing {
+	if !dstIdx.Config.ResolvedRules.IndexingDisabled {
 		if isSrcDir {
 			go func() {
 				// Recursively index the moved directory tree
@@ -595,7 +801,7 @@ func CopyResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 
 	// Refresh source (non-recursive, just metadata)
 	srcIdx := indexing.GetIndex(sourceIndex)
-	if srcIdx != nil && !srcIdx.Config.DisableIndexing {
+	if srcIdx != nil && !srcIdx.Config.ResolvedRules.IndexingDisabled {
 		srcRefreshPath := realsrc
 		if !isSrcDir {
 			srcRefreshPath = filepath.Dir(realsrc)
@@ -606,7 +812,7 @@ func CopyResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 	// Refresh destination (RECURSIVE for directories to capture full tree)
 	// Run async to avoid blocking the HTTP response
 	dstIdx := indexing.GetIndex(destIndex)
-	if dstIdx != nil && !dstIdx.Config.DisableIndexing {
+	if dstIdx != nil && !dstIdx.Config.ResolvedRules.IndexingDisabled {
 		if isSrcDir {
 			go func() {
 				// Recursively index the copied directory tree
@@ -693,22 +899,21 @@ func WriteFile(source, path string, in io.Reader) error {
 	if err != nil {
 		return err
 	}
+	applyDefaultFilePerm := false
 	var stat os.FileInfo
-	// Check if the destination exists and is a directory
-	if stat, err = os.Stat(realPath); err == nil {
-		if stat.IsDir() {
-			// If it's a directory and we're trying to create a file, remove the directory first
-			err = os.RemoveAll(realPath)
-			if err != nil {
-				return fmt.Errorf("could not remove existing directory to create file: %v", err)
-			}
+	stat, err = os.Stat(realPath)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return fmt.Errorf("stat file: %w", err)
 		}
-		// If file exists, its permissions will be preserved (O_TRUNC doesn't change permissions)
+		applyDefaultFilePerm = true
+	} else if stat.IsDir() {
+		return fmt.Errorf("%w: %q", errors.ErrIsDirectory, path)
 	}
 
 	// Open the file for writing (create if it doesn't exist, truncate if it does)
-	// For new files: permissions are set to fileutils.PermFile (subject to umask, which is usually acceptable)
-	// For existing files: permissions are preserved automatically (O_TRUNC doesn't change them)
+	// For new files: permissions are set to fileutils.PermFile (subject to umask, then Chmod bypasses umask)
+	// For existing regular files: do not Chmod so saves preserve mode and special bits
 	file, err := os.OpenFile(realPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileutils.PermFile)
 	if err != nil {
 		return err
@@ -721,11 +926,11 @@ func WriteFile(source, path string, in io.Reader) error {
 		return err
 	}
 
-	// Explicitly set file permissions to bypass umask
-	err = os.Chmod(realPath, fileutils.PermFile)
-	if err != nil {
-		// Handle chmod error gracefully
-		logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", realPath, err)
+	if applyDefaultFilePerm {
+		err = os.Chmod(realPath, fileutils.PermFile)
+		if err != nil {
+			logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", realPath, err)
+		}
 	}
 
 	// Refresh the file itself
@@ -746,149 +951,30 @@ func WriteFile(source, path string, in io.Reader) error {
 }
 
 // getContent reads and returns the file content if it's considered an editable text file.
+// This is a wrapper around utils.IsTextFile that also returns the file content.
 func getContent(realPath string) (string, error) {
-	const headerSize = 4096
-	// Thresholds for detecting binary-like content (these can be tuned)
-	const maxNullBytesInHeaderAbs = 10    // Max absolute null bytes in header
-	const maxNullByteRatioInHeader = 0.1  // Max 10% null bytes in header
-	const maxNullByteRatioInFile = 0.05   // Max 5% null bytes in the entire file
-	const maxNonPrintableRuneRatio = 0.05 // Max 5% non-printable runes in the entire file
-
-	// Open file
-	f, err := os.Open(realPath)
+	// First check if it's a text file using the consolidated validation logic
+	isText, err := utils.IsTextFile(realPath)
 	if err != nil {
 		return "", err
 	}
-	defer f.Close()
-
-	// Read header
-	headerBytes := make([]byte, headerSize)
-	n, err := f.Read(headerBytes)
-	if err != nil && err != io.EOF {
-		return "", err
+	if !isText {
+		// Not a text file, return empty string (no error, just not text)
+		return "", nil
 	}
-	actualHeader := headerBytes[:n]
 
-	// --- Start of new heuristic checks ---
-
-	if n > 0 {
-		// Trim header to last complete UTF-8 rune to avoid false negatives
-		// when the header read cuts off in the middle of a multi-byte sequence.
-		// We decode runes from the end until we find a valid one, trimming
-		// any incomplete sequences at the end.
-		trimmedHeader := actualHeader
-		for len(trimmedHeader) > 0 {
-			lastRune, size := utf8.DecodeLastRune(trimmedHeader)
-			if lastRune != utf8.RuneError {
-				// Found a valid complete rune
-				break
-			}
-			// RuneError occurred - this could be an incomplete sequence or invalid byte
-			// Trim the last byte and try again
-			if size == 1 && len(trimmedHeader) > 0 {
-				trimmedHeader = trimmedHeader[:len(trimmedHeader)-1]
-			} else {
-				// Shouldn't happen, but break to avoid infinite loop
-				break
-			}
-		}
-
-		// 1. Basic Check: Is the header valid UTF-8?
-		// If not, it's unlikely an editable UTF-8 text file.
-		// Use trimmed header to avoid false negatives from truncated sequences
-		if len(trimmedHeader) > 0 && !utf8.Valid(trimmedHeader) {
-			return "", nil // Not an error, just not the text file we want
-		}
-
-		// 2. Check for excessive null bytes in the header
-		nullCountInHeader := 0
-		for _, b := range actualHeader {
-			if b == 0x00 {
-				nullCountInHeader++
-			}
-		}
-		// Reject if too many nulls absolutely or relatively in the header
-		if nullCountInHeader > 0 { // Only perform check if there are any nulls
-			if nullCountInHeader > maxNullBytesInHeaderAbs ||
-				(float64(nullCountInHeader)/float64(n) > maxNullByteRatioInHeader) {
-				return "", nil // Too many nulls in header
-			}
-		}
-
-		// 3. Check for other non-text ASCII control characters in the header
-		// (C0 controls excluding \t, \n, \r)
-		for _, b := range actualHeader {
-			if b < 0x20 && b != '\t' && b != '\n' && b != '\r' {
-				return "", nil // Found problematic control character
-			}
-			// C1 control characters (0x80-0x9F) would be caught by utf8.Valid if part of invalid sequences,
-			// or by the non-printable rune check later if they form valid (but undesirable) codepoints.
-		}
-
-		// Optional: Use http.DetectContentType for an additional check on the header
-		// contentType := http.DetectContentType(actualHeader)
-		// if !strings.HasPrefix(contentType, "text/") && contentType != "application/octet-stream" {
-		//     // If it's clearly a non-text MIME type (e.g., "image/jpeg"), reject it.
-		//     // "application/octet-stream" is ambiguous, so we rely on other heuristics.
-		//     return "", nil
-		// }
-	}
-	// --- End of new heuristic checks for header ---
-
-	// Now read the full file (original logic)
+	// It's a text file, read and return the content
 	content, err := os.ReadFile(realPath)
 	if err != nil {
 		return "", err
 	}
-	// Handle empty file (original logic - returns specific string)
+
+	// Handle empty file (return specific marker string)
 	if len(content) == 0 {
 		return "empty-file-x6OlSil", nil
 	}
 
-	stringContent := string(content)
-
-	// 4. Final UTF-8 validation for the entire file
-	// (This is crucial as the header might be fine, but the rest of the file isn't)
-	if !utf8.ValidString(stringContent) {
-		return "", nil
-	}
-
-	// 5. Check for excessive null bytes in the entire file content
-	if len(content) > 0 { // Check only for non-empty files
-		totalNullCount := 0
-		for _, b := range content {
-			if b == 0x00 {
-				totalNullCount++
-			}
-		}
-		if float64(totalNullCount)/float64(len(content)) > maxNullByteRatioInFile {
-			return "", nil // Too many nulls in the entire file
-		}
-	}
-
-	// 6. Check for excessive non-printable runes in the entire file content
-	// (Excluding tab, newline, carriage return, which are common in text files)
-	if len(stringContent) > 0 { // Check only for non-empty strings
-		nonPrintableRuneCount := 0
-		totalRuneCount := 0
-		for _, r := range stringContent {
-			totalRuneCount++
-			// unicode.IsPrint includes letters, numbers, punctuation, symbols, and spaces.
-			// It excludes control characters. We explicitly allow \t, \n, \r.
-			if !unicode.IsPrint(r) && r != '\t' && r != '\n' && r != '\r' {
-				nonPrintableRuneCount++
-			}
-		}
-
-		if totalRuneCount > 0 { // Avoid division by zero
-			if float64(nonPrintableRuneCount)/float64(totalRuneCount) > maxNonPrintableRuneRatio {
-				return "", nil // Too many non-printable runes
-			}
-		}
-	}
-
-	// The file has passed all checks and is considered editable text.
-	return stringContent, nil
+	return string(content), nil
 }
 
 func IsNamedPipe(mode os.FileMode) bool {

backend/adapters/fs/files/mime.go

@@ -108,7 +108,6 @@ var types = map[string]string{
 	".chrt":      "application/vnd.kde.kchart",
 	".class":     "application/java",
 	".com":       ContentTextHeaderValue,
-	".conf":      ContentTextHeaderValue,
 	".cpio":      "application/x-cpio",
 	".cpp":       "text/x-c",
 	".cpt":       "application/mac-compactpro",
@@ -149,7 +148,11 @@ var types = map[string]string{
 	".es":        "application/x-esrehber",
 	".etx":       "text/x-setext",
 	".evy":       "application/envoy",
-	".exe":       "application/octet-stream",
+	".exe":       "application/x-msdownload",
+	".dll":       "application/x-msdownload",
+	".bat":       "application/x-msdos-program",
+	".cmd":       "application/x-msdos-program",
+	".msi":       "application/x-msdownload",
 	".f77":       "text/x-fortran",
 	".f90":       "text/x-fortran",
 	".f":         "text/x-fortran",
@@ -225,7 +228,6 @@ var types = map[string]string{
 	".js":        ContentJavascriptHeaderValue,
 	".mjs":       ContentJavascriptHeaderValue,
 	".json":      ContentJSONHeaderValue,
-	".vue":       ContentJavascriptHeaderValue,
 	".jut":       "image/jutvision",
 	".kar":       "audio/midi",
 	".karbon":    "application/vnd.kde.karbon",
@@ -243,8 +245,8 @@ var types = map[string]string{
 	".la":        "audio/nspaudio",
 	".lam":       "audio/x-liveaudio",
 	".latex":     "application/x-latex",
-	".lha":       "application/lha",
-	".lhx":       "application/octet-stream",
+	".lha":       "application/x-lzh-compressed",
+	".lhx":       "application/x-lzh-compressed",
 	".list":      ContentTextHeaderValue,
 	".lma":       "audio/nspaudio",
 	".log":       ContentTextHeaderValue,
@@ -257,7 +259,6 @@ var types = map[string]string{
 	".m1v":       "video/mpeg",
 	".m2a":       "audio/mpeg",
 	".m2v":       "video/mpeg",
-	".m3u":       "audio/x-mpegurl",
 	".m":         "text/x-m",
 	".man":       "application/x-troff-man",
 	".manifest":  "text/cache-manifest",
@@ -307,7 +308,6 @@ var types = map[string]string{
 	".ncm":       "application/vndnokiaconfiguration-message",
 	".nif":       "image/x-niff",
 	".niff":      "image/x-niff",
-	".nix":       "application/x-mix-transfer",
 	".nsc":       "application/x-conference",
 	".nvd":       "application/x-navidoc",
 	".o":         "application/octet-stream",
@@ -343,15 +343,14 @@ var types = map[string]string{
 	".p7m":       "application/pkcs7-mime",
 	".p7r":       "application/x-pkcs7-certreqresp",
 	".p7s":       "application/pkcs7-signature",
-	".p":         "text/x-pascal",
 	".part":      "application/pro_eng",
-	".pas":       "text/pascal",
 	".pbm":       "image/x-portable-bitmap",
 	".pcl":       "application/vndhp-pcl",
 	".pct":       "image/x-pict",
 	".pcx":       "image/x-pcx",
 	".pdb":       "chemical/x-pdb",
 	".pdf":       "application/pdf",
+	".pdfa":      "application/pdf",
 	".pfunk":     "audio/make",
 	".pgm":       "image/x-portable-graymap",
 	".pic":       "image/pict",
@@ -375,7 +374,7 @@ var types = map[string]string{
 	".pre":       "application/x-freelance",
 	".prt":       "application/pro_eng",
 	".ps":        "application/postscript",
-	".psd":       "application/octet-stream",
+	".psd":       "image/vnd.adobe.photoshop",
 	".pvu":       "paleovu/x-pv",
 	".pwz":       "application/vndms-powerpoint",
 	".py":        "text/x-scriptphyton",
@@ -443,9 +442,12 @@ var types = map[string]string{
 	".sprite":    "application/x-sprite",
 	".spx":       "audio/ogg",
 	".src":       "application/x-wais-source",
-	".srt":       "text/plain",
+	".srt":       "text/subtitle-srt",
+	".ass":       "text/subtitle-ass",
+	".vtt":       "text/subtitle-vtt",
+	".ssa":       "text/subtitle-ssa",
+	".lrc":       "text/lyrics",
 	".sbv":       "text/plain",
-	".ssa":       "text/plain",
 	".ssi":       "text/x-server-parsed-html",
 	".ssm":       "application/streamingmedia",
 	".sst":       "application/vndms-pkicertstore",
@@ -597,11 +599,105 @@ var types = map[string]string{
 	".ogx":       "application/ogg",
 	".m4v":       "video/mp4",
 	".mkv":       "video/x-matroska",
+	".webm":      "video/webm",
+	".weba":      "audio/webm",
 	".caf":       "audio/x-caf",
-	".m3u8":      "application/x-mpegURL",
+	".m3u":       "text/x-mpegurl", // .m3u and .m3u8 are playlist files - They contain paths, we set it as text to allow edition.
+	".m3u8":      "text/x-mpegURL",
+	".pls":       "text/x-scpls",
+	".xspf":      "application/xspf+xml",
 	".mpd":       "application/dash+xml",
 	".webp":      "image/webp",
 	".epub":      "application/epub+zip",
+	".db":        "application/x-db",
+	".db2":       "application/x-db",
+	".db3":       "application/x-db",
+	".sql":       "application/sql",
+	".sqlite":    "application/vnd.sqlite3",
+	".sqlite3":   "application/vnd.sqlite3",
+	".yaml":      "application/yaml",
+	".app":       "application/x-application",
+	".geojson":   "application/geo+json",
+	".sketch":    "application/x-sketch",
+	".bak":       "application/backup",
+	".backup":    "application/backup",
+	".xfc":       "application/x-xcf",
+	".vue":       "text/vue",
+	".conf":      "text/config-file",
+	".ini":       "text/ini",
+	".ps1":       "application/x-powershell",
+	".ps2":       "application/x-powershell",
+	".ps3":       "application/x-powershell",
+	".dart":      "application/vnd.dart",
+	".flutter":   "text/flutter",
+	".tsx":       "text/x-typescript",
+	".ts":        "text/x-typescript",
+	".php":       "application/x-php",
+	".php2":      "application/x-php",
+	".php3":      "application/x-php",
+	".phtml":     "application/x-php",
+	".p":         "text/x-pascal",
+	".pas":       "text/x-pascal",
+	".zig":       "text/x-zig",
+	".ex":        "text/x-elixir",
+	".exs":       "text/x-elixir",
+	".json5":     "application/json5",
+	".pmx":       "model/x-pmx",
+	".nix":       "text/nix-lang",
+	".cjs":       "text/javascript",
+	".torrent":   "application/x-bittorrent",
+	".tmp":       "text/tmp",
+	".temp":      "text/tmp",
+	// the ones below are some from: https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types
+	".adp":       "audio/adpcm",
+	".mp4a":      "audio/mp4",
+	".mp2a":      "audio/mpeg",
+	".m3a":       "audio/mpeg",
+	".sil":       "audio/silk",
+	".uva":       "audio/vnd.dece.audio",
+	".uvva":      "audio/vnd.dece.audio",
+	".eol":       "audio/vnd.digital-winds",
+	".dra":       "audio/vnd.dra",
+	".dts":       "audio/vnd.dts",
+	".dtshd":     "audio/vnd.dts.hd",
+	".lvp":       "audio/vnd.lucent.voice",
+	".pya":       "audio/vnd.ms-playready.media.pya",
+	".rip":       "audio/vnd.rip",
+	".mka":       "audio/x-matroska",
+	".h261":      "video/h261",
+	".h263":      "video/h263",
+	".h264":      "video/h264",
+	".jpgv":      "video/jpeg",
+	".jpm":       "video/jpm",
+	".jpgm":      "video/jpm",
+	".mj2":       "video/mj2",
+	".mjp2":      "video/mj2",
+	".m2t":       "video/mp2t",
+	".m2ts":      "video/mp2t",
+	".mts":       "video/mp2t",
+	".mp4v":      "video/mp4",
+	".mpg4":      "video/mp4",
+	".uvh":       "video/vnd.dece.hd",
+	".uvvh":      "video/vnd.dece.hd",
+	".uvm":       "video/vnd.dece.mobile",
+	".uvvm":      "video/vnd.dece.mobile",
+	".uvp":       "video/vnd.dece.pd",
+	".uvvp":      "video/vnd.dece.pd",
+	".uvs":       "video/vnd.dece.sd",
+	".uvvs":      "video/vnd.dece.sd",
+	".uvv":       "video/vnd.dece.video",
+	".uvvv":      "video/vnd.dece.video",
+	".dvb":       "video/vnd.dvb.file",
+	".fvt":       "video/vnd.fvt",
+	".mxu":       "video/vnd.mpegurl",
+	".pyv":       "video/vnd.ms-playready.media.pyv",
+	".uvu":       "video/vnd.uvvu.mp4",
+	".uvvu":      "video/vnd.uvvu.mp4",
+	".f4v":       "video/x-f4v",
+	".mk3d":      "video/x-matroska",
+	".mks":       "video/x-matroska",
+	".vob":       "video/x-ms-vob",
+	".smv":       "video/x-smv",
 }
 
 //nolint:gochecknoinits

backend/adapters/fs/files/user.go

@@ -19,56 +19,43 @@ func MakeUserDir(fullPath string) error {
 	return nil
 }
 
-func MakeUserDirs(u *users.User, disableScopeChange bool) error {
+func MakeUserDirs(u *users.User, createDir bool) error {
 	cleanedUserName := users.CleanUsername(u.Username)
 	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
 		return fmt.Errorf("MakeUserDirs: invalid user for home dir creation: [%s]", u.Username)
 	}
 	for i, scope := range u.Scopes {
-		source, ok := settings.Config.Server.SourceMap[scope.Name]
+		info, ok := users.ResolveSourceKey(scope.Name)
 		if !ok {
-			logger.Errorf("MakeUserDirs: source not found: %s", scope.Name)
-			continue
+			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
 		}
-		// create directory and append user name
-		if filepath.Base(scope.Scope) != cleanedUserName && source.Config.CreateUserDir && !disableScopeChange {
-			fullPath := filepath.Join(source.Path, scope.Scope, cleanedUserName)
-			parentDir := filepath.Join(source.Path, scope.Scope)
-			// If parent directory doesn't exist and createUserDir is enabled, create it
+		source, ok := settings.Config.Server.SourceMap[info.Path]
+		if !ok {
+			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
+		}
+		fullPath := filepath.Join(source.Path, scope.Scope)
+		parentDir := filepath.Dir(fullPath)
+		if createDir {
+			if source.Config.CreateUserDir && filepath.Base(scope.Scope) != cleanedUserName {
+				scope.Scope = utils.JoinPathAsUnix(scope.Scope, cleanedUserName)
+				fullPath = filepath.Join(fullPath, cleanedUserName)
+			}
 			if !Exists(parentDir) {
 				if err := MakeUserDir(parentDir); err != nil {
 					logger.Errorf("MakeUserDirs: failed to create parent scope directory: %s - %v", scope.Scope, err)
 					continue
 				}
 			}
-			// Use JoinPathAsUnix to ensure scope remains in Unix format (forward slashes)
-			scope.Scope = utils.JoinPathAsUnix(scope.Scope, cleanedUserName)
 			err := MakeUserDir(fullPath)
 			if err != nil {
-				logger.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
-				// Continue to next scope even if this one failed
-			}
-		} else if filepath.Base(scope.Scope) == cleanedUserName && source.Config.CreateUserDir {
-			// create directory exactly as specified
-			fullPath := filepath.Join(source.Path, scope.Scope)
-			parentDir := filepath.Dir(fullPath)
-			if !Exists(parentDir) {
-				logger.Errorf("MakeUserDirs: scope folder does not exist: %s", parentDir)
-				continue
-			}
-			err := MakeUserDir(fullPath)
-			if err != nil {
-				logger.Errorf("create user: failed to create user home dir: %s", err)
-				// Continue to next scope even if this one failed
+				return fmt.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
 			}
 		} else {
-			// just assigning scope to path provided, so just check that it exists
-			path := filepath.Join(source.Path, scope.Scope)
-			if !Exists(path) {
-				logger.Errorf("MakeUserDirs: scope folder does not exist: %s", path)
-				continue
+			if !Exists(fullPath) {
+				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", fullPath)
 			}
 		}
+
 		u.Scopes[i] = scope
 	}
 	return nil

backend/adapters/fs/fileutils/assets.go

@@ -0,0 +1,36 @@
+package fileutils
+
+import (
+	"io/fs"
+	"net/http"
+)
+
+var (
+	assetFs fs.FS
+)
+
+// Custom dirFS to handle both embedded and non-embedded file systems
+type dirFS struct {
+	http.Dir
+}
+
+// Implement the Open method for dirFS, which wraps http.Dir
+func (d dirFS) Open(name string) (fs.File, error) {
+	return d.Dir.Open(name)
+}
+
+// InitAssetFS initializes the asset filesystem for the application
+// This should be called once during startup before http or preview services start
+func InitAssetFS(embeddedAssets fs.FS, useEmbedded bool) {
+	if useEmbedded {
+		assetFs = embeddedAssets
+	} else {
+		// Dev mode: Serve files from http/dist directory
+		assetFs = dirFS{Dir: http.Dir("http/dist")}
+	}
+}
+
+// GetAssetFS returns the initialized asset filesystem
+func GetAssetFS() fs.FS {
+	return assetFs
+}

backend/adapters/fs/fileutils/file.go

@@ -12,9 +12,45 @@ import (
 var PermFile os.FileMode
 var PermDir os.FileMode
 
-func SetFsPermissions(PermFileOctal os.FileMode, PermDirOctal os.FileMode) {
-	PermFile = PermFileOctal
-	PermDir = PermDirOctal
+// SetFsPermissions sets create modes from Unix chmod(2)-style values (for example
+// values produced by strconv.ParseUint(s, 8, 32)). setuid, setgid, and sticky
+// bits must be converted for Go's os.FileMode; a plain cast from Unix octal is
+// incorrect for those bits.
+func SetFsPermissions(unixFileMode, unixDirMode uint32) {
+	PermFile = unixModeToFileMode(unixFileMode)
+	PermDir = unixModeToFileMode(unixDirMode)
+}
+
+// EffectiveDirPerm returns [PermDir] if [SetFsPermissions] was called, otherwise 0o755. On Unix,
+// [os.Mkdir] with perm 0 fails with permission denied, so use this (or [PermFile]) for creates when
+// the process has not set globals yet.
+func EffectiveDirPerm() os.FileMode {
+	if PermDir == 0 {
+		return 0o755
+	}
+	return PermDir
+}
+
+// EffectiveFilePerm returns [PermFile] if set, otherwise 0o644.
+func EffectiveFilePerm() os.FileMode {
+	if PermFile == 0 {
+		return 0o644
+	}
+	return PermFile
+}
+
+func unixModeToFileMode(u uint32) os.FileMode {
+	m := os.FileMode(u & 0777)
+	if u&0o4000 != 0 {
+		m |= os.ModeSetuid
+	}
+	if u&0o2000 != 0 {
+		m |= os.ModeSetgid
+	}
+	if u&0o1000 != 0 {
+		m |= os.ModeSticky
+	}
+	return m
 }
 
 // MoveFile moves a file from src to dst.
@@ -204,3 +240,22 @@ func ClearCacheDir(cacheDir string) {
 	}
 
 }
+
+// ClearDirectoryContents removes all files and subdirectories inside dir; dir itself remains.
+// If dir does not exist, returns nil.
+func ClearDirectoryContents(dir string) error {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	for _, entry := range entries {
+		path := filepath.Join(dir, entry.Name())
+		if err := os.RemoveAll(path); err != nil {
+			return err
+		}
+	}
+	return nil
+}

backend/adapters/fs/fileutils/file_test.go

@@ -1,6 +1,22 @@
 package fileutils
 
-import "testing"
+import (
+	"os"
+	"testing"
+)
+
+func TestUnixModeToFileMode_setgid(t *testing.T) {
+	m := unixModeToFileMode(0o2770)
+	if got := m.Perm(); got != 0o770 {
+		t.Fatalf("Perm() = %#o, want 0770", got)
+	}
+	if m&os.ModeSetgid == 0 {
+		t.Fatal("expected ModeSetgid")
+	}
+	if m&os.ModeSetuid != 0 || m&os.ModeSticky != 0 {
+		t.Fatalf("unexpected special bits: %#o", m)
+	}
+}
 
 func TestCommonPrefix(t *testing.T) {
 	testCases := map[string]struct {

backend/adapters/fs/fileutils/partition_unix.go

@@ -29,3 +29,16 @@ func GetFreeSpace(path string) (uint64, error) {
 	free := uint64(stat.Bavail) * uint64(stat.Bsize)
 	return free, nil
 }
+
+// GetPartitionUsed returns the used space for Unix systems (total - free)
+func GetPartitionUsed(path string) (uint64, error) {
+	var stat syscall.Statfs_t
+	err := syscall.Statfs(path, &stat)
+	if err != nil {
+		return 0, err
+	}
+	total := uint64(stat.Blocks) * uint64(stat.Bsize)
+	free := uint64(stat.Bavail) * uint64(stat.Bsize)
+	used := total - free
+	return used, nil
+}

backend/adapters/fs/fileutils/partition_windows.go

@@ -33,3 +33,18 @@ func GetFreeSpace(path string) (uint64, error) {
 	}
 	return freeBytes, nil
 }
+
+// GetPartitionUsed returns the used space for Windows systems (total - free)
+func GetPartitionUsed(path string) (uint64, error) {
+	pathPtr, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+	var freeBytes, totalBytes, totalFreeBytes uint64
+	err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytes, &totalBytes, &totalFreeBytes)
+	if err != nil {
+		return 0, err
+	}
+	used := totalBytes - freeBytes
+	return used, nil
+}

backend/auth/auth.go

@@ -1,34 +1,65 @@
 package auth
 
 import (
+	"fmt"
 	"net/http"
-	"sync"
+	"time"
 
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
-var (
-	revokedApiKeyList map[string]struct{}
-	revokeMu          sync.Mutex
-)
-
-func init() {
-	revokedApiKeyList = make(map[string]struct{})
-}
-
 // Auther is the authentication interface.
 type Auther interface {
 	// Auth is called to authenticate a request.
 	Auth(r *http.Request, userStore *users.Storage) (*users.User, error)
 }
 
-func IsRevokedApiKey(key string) bool {
-	_, exists := revokedApiKeyList[key]
-	return exists
+const FB_ISSUER = "FileBrowser Quantum" // don't change
+
+// IsRevokedApiToken checks if a token is in the revoked list.
+func IsRevokedApiToken(accessStore *access.Storage, token string) bool {
+	if accessStore == nil {
+		return false
+	}
+	return accessStore.IsTokenRevoked(token)
 }
 
-func RevokeAPIKey(key string) {
-	revokeMu.Lock()
-	defer revokeMu.Unlock()
-	revokedApiKeyList[key] = struct{}{}
+// RevokeApiToken adds a token to the revoked list.
+func RevokeApiToken(accessStore *access.Storage, token string) error {
+	if accessStore == nil {
+		return fmt.Errorf("access storage not available")
+	}
+	return accessStore.RevokeToken(token)
+}
+
+func MakeSignedTokenAPI(user *users.User, name string, duration time.Duration, perms users.Permissions, minimal bool) (string, users.AuthToken, error) {
+	if _, ok := user.Tokens[name]; ok {
+		return "", users.AuthToken{}, fmt.Errorf("key already exists with same name %v ", name)
+	}
+	now := time.Now()
+	expires := now.Add(duration)
+	// Create minimal token with only JWT standard claims
+	claim := users.AuthToken{
+		MinimalAuthToken: users.MinimalAuthToken{
+			RegisteredClaims: jwt.RegisteredClaims{
+				IssuedAt:  jwt.NewNumericDate(now),
+				ExpiresAt: jwt.NewNumericDate(expires),
+				Issuer:    FB_ISSUER,
+			},
+		},
+	}
+	if !minimal {
+		claim.Permissions = perms
+		claim.BelongsTo = user.ID
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claim)
+	tokenString, err := token.SignedString([]byte(settings.Config.Auth.Key))
+	if err != nil {
+		return "", users.AuthToken{}, err
+	}
+	return tokenString, claim, nil
+
 }

backend/auth/json.go

@@ -9,12 +9,14 @@ import (
 	"strings"
 
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // JSONAuth is a json implementation of an Auther.
 type JSONAuth struct {
-	ReCaptcha *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
+	ReCaptcha  *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
+	DisableOtp bool       `json:"disableOtp" yaml:"disableOtp"`
 }
 
 // Auth authenticates the user via a json in content body.
@@ -22,12 +24,12 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 	username := r.URL.Query().Get("username")
 	recaptcha := r.URL.Query().Get("recaptcha")
 	password := r.Header.Get("X-Password")
+	totpCode := r.Header.Get("X-Secret")
 	// URL-decode password to support special characters in headers
 	password, err := url.QueryUnescape(password)
 	if err != nil {
 		return nil, fmt.Errorf("invalid password encoding: %v", err)
 	}
-	totpCode := r.Header.Get("X-Secret")
 
 	// If ReCaptcha is enabled, check the code.
 	if auther.ReCaptcha != nil && len(auther.ReCaptcha.Secret) > 0 {
@@ -42,17 +44,22 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 		}
 	}
 
-	user, err := userStore.Get(username)
-	if err != nil {
-		return nil, fmt.Errorf("unable to get user from store: %v", err)
+	user, getErr := userStore.Get(username)
+	var passwordHash string
+	if getErr != nil {
+		passwordHash = utils.InvalidPasswordHash
+	} else {
+		passwordHash = user.Password
 	}
-	err = users.CheckPwd(password, user.Password)
+	// always run checkPwd to prevent timing attacks
+	err = utils.CheckPwd(password, passwordHash)
 	if err != nil {
 		return nil, err
 	}
-
-	// check for OTP for password
-	if user.TOTPSecret != "" {
+	if getErr != nil {
+		return nil, fmt.Errorf("unable to get user from store: %v", err)
+	}
+	if user.TOTPSecret != "" && !auther.DisableOtp {
 		if totpCode == "" {
 			return nil, errors.ErrNoTotpProvided
 		}

backend/auth/json_timing_test.go

@@ -0,0 +1,375 @@
+// Package auth_test contains timing attack tests for authentication.
+//
+// These tests verify that the JSON authentication implementation is protected
+// against timing attacks that could leak information about valid usernames.
+//
+// Timing Attack Background:
+// A timing attack is a side-channel attack where an attacker measures how long
+// authentication operations take to determine if a username exists in the system.
+// If authentication fails faster for non-existent users than for valid users
+// with wrong passwords, an attacker can enumerate valid usernames.
+//
+// Protection Mechanism:
+// The json.go Auth() implementation protects against timing attacks by:
+// 1. Always running the bcrypt password comparison, even for non-existent users
+// 2. Using utils.InvalidPasswordHash (a pre-computed bcrypt hash) when the user doesn't exist
+// 3. Ensuring both valid and invalid user authentication paths take similar time
+//
+// Test Coverage:
+// - TestJSONAuth_NoTimingAttack: Statistical analysis of timing differences
+// - TestJSONAuth_InvalidPasswordHashInitialized: Verifies protection is in place
+// - TestJSONAuth_ValidUserVsInvalidUserDirectComparison: Direct comparison test
+package auth_test
+
+import (
+	"fmt"
+	"math"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// mockUserBackend is a simple in-memory user storage for testing.
+type mockUserBackend struct {
+	usersByUsername map[string]*users.User
+	usersByID       map[uint]*users.User
+}
+
+func newMockUserBackend() *mockUserBackend {
+	return &mockUserBackend{
+		usersByUsername: make(map[string]*users.User),
+		usersByID:       make(map[uint]*users.User),
+	}
+}
+
+func (m *mockUserBackend) GetBy(id interface{}) (*users.User, error) {
+	switch v := id.(type) {
+	case string:
+		if user, ok := m.usersByUsername[v]; ok {
+			return user, nil
+		}
+		return nil, fmt.Errorf("user not found: %s", v)
+	case uint:
+		if user, ok := m.usersByID[v]; ok {
+			return user, nil
+		}
+		return nil, fmt.Errorf("user not found: %d", v)
+	default:
+		return nil, fmt.Errorf("invalid id type")
+	}
+}
+
+func (m *mockUserBackend) Gets() ([]*users.User, error) {
+	result := make([]*users.User, 0, len(m.usersByID))
+	for _, user := range m.usersByID {
+		result = append(result, user)
+	}
+	return result, nil
+}
+
+func (m *mockUserBackend) Save(u *users.User, changePass bool, disableScopeChange bool) error {
+	m.usersByUsername[u.Username] = u
+	m.usersByID[u.ID] = u
+	return nil
+}
+
+func (m *mockUserBackend) Update(u *users.User, adminActor bool, fields ...string) error {
+	m.usersByUsername[u.Username] = u
+	m.usersByID[u.ID] = u
+	return nil
+}
+
+func (m *mockUserBackend) DeleteByID(id uint) error {
+	if user, ok := m.usersByID[id]; ok {
+		delete(m.usersByUsername, user.Username)
+		delete(m.usersByID, id)
+		return nil
+	}
+	return fmt.Errorf("user not found: %d", id)
+}
+
+func (m *mockUserBackend) DeleteByUsername(username string) error {
+	if user, ok := m.usersByUsername[username]; ok {
+		delete(m.usersByID, user.ID)
+		delete(m.usersByUsername, username)
+		return nil
+	}
+	return fmt.Errorf("user not found: %s", username)
+}
+
+// setupTestUsers creates a user storage with 2 valid test users
+func setupTestUsers(t *testing.T) *users.Storage {
+	t.Helper()
+
+	// Reduce bcrypt cost for faster tests (default is 10, min is 4)
+	// This significantly speeds up password hashing during tests
+	originalCost := utils.BcryptCost
+	utils.BcryptCost = 4 // Minimum bcrypt cost for testing
+	t.Cleanup(func() {
+		utils.BcryptCost = originalCost // Restore original cost after test
+	})
+
+	// Initialize InvalidPasswordHash to prevent timing attacks
+	// This simulates the application startup initialization
+	err := utils.SetInvalidPasswordHash()
+	if err != nil {
+		t.Fatalf("Failed to set invalid password hash: %v", err)
+	}
+
+	backend := newMockUserBackend()
+	storage := users.NewStorage(backend)
+
+	// Create two valid users with hashed passwords
+	password1Hash, err := utils.HashPwd("password123")
+	if err != nil {
+		t.Fatalf("Failed to hash password: %v", err)
+	}
+
+	password2Hash, err := utils.HashPwd("securepass456")
+	if err != nil {
+		t.Fatalf("Failed to hash password: %v", err)
+	}
+
+	user1 := &users.User{
+		ID:       1,
+		Username: "admin",
+		NonAdminEditable: users.NonAdminEditable{
+			Password: password1Hash,
+		},
+		LoginMethod: users.LoginMethodPassword,
+	}
+
+	user2 := &users.User{
+		ID:       2,
+		Username: "testuser",
+		NonAdminEditable: users.NonAdminEditable{
+			Password: password2Hash,
+		},
+		LoginMethod: users.LoginMethodPassword,
+	}
+
+	err = storage.Save(user1, false, false)
+	if err != nil {
+		t.Fatalf("Failed to save user1: %v", err)
+	}
+
+	err = storage.Save(user2, false, false)
+	if err != nil {
+		t.Fatalf("Failed to save user2: %v", err)
+	}
+
+	return storage
+}
+
+// measureAuthTime measures the time taken to authenticate with given credentials
+func measureAuthTime(t *testing.T, auther auth.JSONAuth, userStore *users.Storage, username, password string) time.Duration {
+	t.Helper()
+
+	// Create a mock HTTP request
+	req, err := http.NewRequest("POST", "/api/auth/login?username="+url.QueryEscape(username), nil)
+	if err != nil {
+		t.Fatalf("Failed to create request: %v", err)
+	}
+	req.Header.Set("X-Password", url.QueryEscape(password))
+
+	start := time.Now()
+	_, _ = auther.Auth(req, userStore)
+	elapsed := time.Since(start)
+
+	return elapsed
+}
+
+// TestJSONAuth_NoTimingAttack tests that authentication timing does not leak user existence
+func TestJSONAuth_NoTimingAttack(t *testing.T) {
+	storage := setupTestUsers(t)
+	auther := auth.JSONAuth{}
+
+	// Test cases: mix of valid and invalid usernames
+	testCases := []struct {
+		username string
+		isValid  bool
+	}{
+		{"admin", true},
+		{"testuser", true},
+		{"nonexistent1", false},
+		{"invaliduser", false},
+		{"notauser", false},
+		{"fakeadmin", false},
+	}
+
+	// Number of samples per test case for statistical analysis
+	samplesPerCase := 5
+
+	// Collect timing measurements
+	measurements := make(map[string][]time.Duration)
+	for _, tc := range testCases {
+		measurements[tc.username] = make([]time.Duration, 0, samplesPerCase)
+	}
+
+	// Run multiple iterations to gather statistical data
+	for i := 0; i < samplesPerCase; i++ {
+		// Randomize order to avoid cache effects
+		for _, tc := range testCases {
+			elapsed := measureAuthTime(t, auther, storage, tc.username, "wrongpassword123")
+			measurements[tc.username] = append(measurements[tc.username], elapsed)
+		}
+	}
+
+	// Calculate statistics for each test case
+	type stats struct {
+		mean   time.Duration
+		stddev time.Duration
+		min    time.Duration
+		max    time.Duration
+	}
+
+	calculateStats := func(durations []time.Duration) stats {
+		if len(durations) == 0 {
+			return stats{}
+		}
+
+		// Calculate mean
+		var sum time.Duration
+		for _, d := range durations {
+			sum += d
+		}
+		mean := sum / time.Duration(len(durations))
+
+		// Calculate standard deviation
+		var variance float64
+		for _, d := range durations {
+			diff := float64(d - mean)
+			variance += diff * diff
+		}
+		variance /= float64(len(durations))
+		stddev := time.Duration(math.Sqrt(variance))
+
+		// Find min and max
+		min := durations[0]
+		max := durations[0]
+		for _, d := range durations {
+			if d < min {
+				min = d
+			}
+			if d > max {
+				max = d
+			}
+		}
+
+		return stats{mean: mean, stddev: stddev, min: min, max: max}
+	}
+
+	// Analyze results
+	validUserStats := make([]stats, 0)
+	invalidUserStats := make([]stats, 0)
+
+	t.Log("\n=== Timing Analysis Results ===")
+	for _, tc := range testCases {
+		s := calculateStats(measurements[tc.username])
+		t.Logf("%s (valid=%v): mean=%.4fms, stddev=%.4fms, min=%.4fms, max=%.4fms",
+			tc.username, tc.isValid,
+			float64(s.mean.Microseconds())/1000.0,
+			float64(s.stddev.Microseconds())/1000.0,
+			float64(s.min.Microseconds())/1000.0,
+			float64(s.max.Microseconds())/1000.0)
+
+		if tc.isValid {
+			validUserStats = append(validUserStats, s)
+		} else {
+			invalidUserStats = append(invalidUserStats, s)
+		}
+	}
+
+	// Calculate overall statistics for valid vs invalid users
+	var validMeanSum, invalidMeanSum time.Duration
+	for _, s := range validUserStats {
+		validMeanSum += s.mean
+	}
+	for _, s := range invalidUserStats {
+		invalidMeanSum += s.mean
+	}
+
+	validAvgMean := validMeanSum / time.Duration(len(validUserStats))
+	invalidAvgMean := invalidMeanSum / time.Duration(len(invalidUserStats))
+
+	t.Logf("\n=== Summary ===")
+	t.Logf("Valid users average: %.4fms", float64(validAvgMean.Microseconds())/1000.0)
+	t.Logf("Invalid users average: %.4fms", float64(invalidAvgMean.Microseconds())/1000.0)
+
+	// Calculate the percentage difference
+	diff := float64(validAvgMean - invalidAvgMean)
+	percentDiff := math.Abs(diff) / float64(validAvgMean) * 100.0
+	t.Logf("Difference: %.4fms (%.2f%%)", diff/1e6, percentDiff)
+
+	// Assert: The timing difference should be less than 20%
+	// Bcrypt's constant-time comparison should make both cases take similar time
+	// We allow 20% threshold to account for system noise and variability
+	threshold := 20.0 // percent
+	if percentDiff > threshold {
+		t.Errorf("TIMING ATTACK VULNERABILITY DETECTED: Valid vs invalid user timing differs by %.2f%% (threshold: %.2f%%)",
+			percentDiff, threshold)
+		t.Errorf("This difference could allow an attacker to enumerate valid usernames!")
+	} else {
+		t.Logf("✓ No timing attack vulnerability detected (difference: %.2f%% < threshold: %.2f%%)",
+			percentDiff, threshold)
+	}
+
+	// Additional check: Ensure no individual case is an obvious outlier
+	// Check if any single user's timing is significantly faster than bcrypt operations
+	allStats := append(validUserStats, invalidUserStats...)
+	var allMeansSum time.Duration
+	for _, s := range allStats {
+		allMeansSum += s.mean
+	}
+	overallMean := allMeansSum / time.Duration(len(allStats))
+
+	for _, tc := range testCases {
+		s := calculateStats(measurements[tc.username])
+		deviation := math.Abs(float64(s.mean-overallMean)) / float64(overallMean) * 100.0
+
+		// If any user is more than 30% faster/slower than average, it's suspicious
+		if deviation > 30.0 {
+			t.Errorf("OUTLIER DETECTED: %s deviates by %.2f%% from overall mean (%.4fms vs %.4fms)",
+				tc.username, deviation,
+				float64(s.mean.Microseconds())/1000.0,
+				float64(overallMean.Microseconds())/1000.0)
+		}
+	}
+}
+
+// TestJSONAuth_InvalidPasswordHashInitialized verifies that InvalidPasswordHash is properly set
+func TestJSONAuth_InvalidPasswordHashInitialized(t *testing.T) {
+	// This test ensures that the InvalidPasswordHash is initialized
+	// If it's empty, timing attacks would be possible because invalid users
+	// would skip bcrypt comparison entirely
+
+	// Use lower bcrypt cost for faster testing
+	originalCost := utils.BcryptCost
+	utils.BcryptCost = 4
+	t.Cleanup(func() {
+		utils.BcryptCost = originalCost
+	})
+
+	err := utils.SetInvalidPasswordHash()
+	if err != nil {
+		t.Fatalf("Failed to set invalid password hash: %v", err)
+	}
+
+	if utils.InvalidPasswordHash == "" {
+		t.Fatal("InvalidPasswordHash is not initialized - timing attack vulnerability exists!")
+	}
+
+	// Verify that the invalid hash can be used for password comparison
+	// This should fail (wrong password) but take the same time as a real bcrypt comparison
+	err = utils.CheckPwd("anypassword", utils.InvalidPasswordHash)
+	if err == nil {
+		t.Fatal("CheckPwd should fail with InvalidPasswordHash")
+	}
+
+	t.Log("✓ InvalidPasswordHash is properly initialized")
+}

backend/auth/jwt.go

@@ -0,0 +1,229 @@
+package auth
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"net/http"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// MethodJwtAuth is used to identify JWT external authentication.
+const MethodJwtAuth = "jwt"
+
+// JwtAuth is an external JWT implementation of an auther.
+// It verifies JWT tokens signed with a shared secret and extracts user identity.
+type JwtAuth struct {
+	Secret    string `json:"secret"`    // shared secret for verifying JWT signatures
+	Algorithm string `json:"algorithm"` // JWT signing algorithm (HS256, HS384, HS512, RS256, ES256, etc.)
+}
+
+// ExternalJwtClaims represents the expected claims in an external JWT token
+type ExternalJwtClaims struct {
+	jwt.RegisteredClaims
+	Username string                 `json:"sub"`                    // subject claim (username)
+	Email    string                 `json:"email,omitempty"`        // email claim
+	Name     string                 `json:"name,omitempty"`         // full name claim
+	Groups   []string               `json:"groups,omitempty"`       // groups claim
+	Custom   map[string]interface{} `json:"-"`                      // catch-all for custom claims
+}
+
+// Auth authenticates the user via an external JWT token.
+// The token is verified using the configured secret and algorithm.
+func (a JwtAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
+	// This should not be called directly - JWT auth is handled in middleware
+	// because we need access to the full config (header name, user identifier field, etc.)
+	return nil, fmt.Errorf("JWT auth must be handled in middleware")
+}
+
+// VerifyExternalJWT verifies an external JWT token and extracts the username claim
+func VerifyExternalJWT(tokenString string, secret string, algorithm string, userIdentifierField string) (string, map[string]interface{}, error) {
+	// Parse the token with the secret
+	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
+		// Verify the signing method matches what we expect
+		expectedMethod := jwt.GetSigningMethod(algorithm)
+		if expectedMethod == nil {
+			return nil, fmt.Errorf("unsupported signing algorithm: %s", algorithm)
+		}
+
+		if token.Method.Alg() != expectedMethod.Alg() {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+
+		return jwtVerificationKey(secret, token.Method, algorithm)
+	})
+
+	if err != nil {
+		logger.Debugf("JWT token verification failed: %v", err)
+		return "", nil, fmt.Errorf("invalid JWT token: %w", err)
+	}
+
+	if !token.Valid {
+		return "", nil, fmt.Errorf("JWT token is invalid")
+	}
+
+	// Extract claims
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok {
+		return "", nil, fmt.Errorf("failed to parse JWT claims")
+	}
+
+	// Check if token is expired
+	if err := claims.Valid(); err != nil {
+		logger.Debugf("JWT claims validation failed: %v", err)
+		return "", nil, fmt.Errorf("JWT token is expired or invalid: %w", err)
+	}
+
+	// Extract username from the configured field (default: "sub")
+	var username string
+	if userVal, ok := claims[userIdentifierField]; ok {
+		if userStr, ok := userVal.(string); ok {
+			username = userStr
+		}
+	}
+
+	if username == "" {
+		return "", nil, fmt.Errorf("JWT token missing required claim: %s", userIdentifierField)
+	}
+
+	// Convert claims to map for additional processing
+	claimsMap := make(map[string]interface{})
+	for k, v := range claims {
+		claimsMap[k] = v
+	}
+
+	logger.Debugf("Successfully verified JWT token for user: %s", username)
+	return username, claimsMap, nil
+}
+
+func jwtVerificationKey(secret string, method jwt.SigningMethod, algorithm string) (interface{}, error) {
+	switch method.(type) {
+	case *jwt.SigningMethodHMAC:
+		return []byte(secret), nil
+	case *jwt.SigningMethodRSA:
+		key, err := parsePublicKeyFromPEM(secret)
+		if err != nil {
+			return nil, err
+		}
+		rsaKey, ok := key.(*rsa.PublicKey)
+		if !ok {
+			return nil, fmt.Errorf("JWT secret must contain an RSA public key in PEM format for algorithm %s", algorithm)
+		}
+		return rsaKey, nil
+	case *jwt.SigningMethodECDSA:
+		key, err := parsePublicKeyFromPEM(secret)
+		if err != nil {
+			return nil, err
+		}
+		ecKey, ok := key.(*ecdsa.PublicKey)
+		if !ok {
+			return nil, fmt.Errorf("JWT secret must contain an ECDSA public key in PEM format for algorithm %s", algorithm)
+		}
+		if err := ecdsaCurveMatchesAlgorithm(algorithm, ecKey); err != nil {
+			return nil, err
+		}
+		return ecKey, nil
+	default:
+		return nil, fmt.Errorf("unsupported JWT signing method: %s", method.Alg())
+	}
+}
+
+func ecdsaCurveMatchesAlgorithm(algorithm string, pub *ecdsa.PublicKey) error {
+	var want elliptic.Curve
+	switch algorithm {
+	case "ES256":
+		want = elliptic.P256()
+	case "ES384":
+		want = elliptic.P384()
+	case "ES512":
+		want = elliptic.P521()
+	default:
+		return nil
+	}
+	if pub.Curve != want {
+		return fmt.Errorf("ECDSA public key curve does not match algorithm %s", algorithm)
+	}
+	return nil
+}
+
+func parsePublicKeyFromPEM(pemData string) (interface{}, error) {
+	rest := []byte(pemData)
+	var lastErr error
+	for len(rest) > 0 {
+		block, rem := pem.Decode(rest)
+		if block == nil {
+			break
+		}
+		rest = rem
+
+		var key interface{}
+		var err error
+		switch block.Type {
+		case "CERTIFICATE":
+			var cert *x509.Certificate
+			cert, err = x509.ParseCertificate(block.Bytes)
+			if err == nil {
+				key = cert.PublicKey
+			}
+		case "PUBLIC KEY":
+			key, err = x509.ParsePKIXPublicKey(block.Bytes)
+		case "RSA PUBLIC KEY":
+			key, err = x509.ParsePKCS1PublicKey(block.Bytes)
+		case "EC PUBLIC KEY":
+			key, err = x509.ParsePKIXPublicKey(block.Bytes)
+		default:
+			continue
+		}
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if key != nil {
+			return key, nil
+		}
+	}
+	if lastErr != nil {
+		return nil, fmt.Errorf("failed to parse JWT public key from PEM: %w", lastErr)
+	}
+	return nil, fmt.Errorf("no public key found in JWT secret (expected PEM: CERTIFICATE, PUBLIC KEY, RSA PUBLIC KEY, or EC PUBLIC KEY)")
+}
+
+// ExtractGroupsFromClaims extracts groups from JWT claims based on the configured groups claim field
+func ExtractGroupsFromClaims(claims map[string]interface{}, groupsClaimField string) []string {
+	var groups []string
+
+	if groupsVal, ok := claims[groupsClaimField]; ok {
+		switch v := groupsVal.(type) {
+		case []interface{}:
+			// Groups as array of interfaces
+			for _, g := range v {
+				if groupStr, ok := g.(string); ok {
+					groups = append(groups, groupStr)
+				}
+			}
+		case []string:
+			// Groups as array of strings
+			groups = v
+		case string:
+			// Single group as string
+			groups = []string{v}
+		default:
+			// Try to unmarshal as JSON array
+			if jsonBytes, err := json.Marshal(v); err == nil {
+				var groupsArray []string
+				if err := json.Unmarshal(jsonBytes, &groupsArray); err == nil {
+					groups = groupsArray
+				}
+			}
+		}
+	}
+
+	return groups
+}

backend/auth/jwt_test.go

@@ -0,0 +1,363 @@
+package auth_test
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+)
+
+func TestVerifyExternalJWT_ValidToken(t *testing.T) {
+	secret := "test-secret-key"
+	algorithm := "HS256"
+	username := "testuser"
+
+	// Create a valid JWT token
+	claims := jwt.MapClaims{
+		"sub":   username,
+		"email": "test@example.com",
+		"exp":   time.Now().Add(time.Hour).Unix(),
+		"iat":   time.Now().Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(secret))
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	// Verify the token
+	extractedUsername, extractedClaims, err := auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
+	if err != nil {
+		t.Fatalf("VerifyExternalJWT() failed: %v", err)
+	}
+
+	if extractedUsername != username {
+		t.Errorf("Expected username %s, got %s", username, extractedUsername)
+	}
+
+	if extractedClaims["email"] != "test@example.com" {
+		t.Errorf("Expected email test@example.com, got %v", extractedClaims["email"])
+	}
+}
+
+func TestVerifyExternalJWT_ExpiredToken(t *testing.T) {
+	secret := "test-secret-key"
+	algorithm := "HS256"
+
+	// Create an expired JWT token
+	claims := jwt.MapClaims{
+		"sub": "testuser",
+		"exp": time.Now().Add(-time.Hour).Unix(), // Expired 1 hour ago
+		"iat": time.Now().Add(-2 * time.Hour).Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(secret))
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	// Verify the token - should fail
+	_, _, err = auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
+	if err == nil {
+		t.Fatal("VerifyExternalJWT() should fail for expired token")
+	}
+}
+
+func TestVerifyExternalJWT_InvalidSignature(t *testing.T) {
+	secret := "test-secret-key"
+	wrongSecret := "wrong-secret-key"
+	algorithm := "HS256"
+
+	// Create a token with one secret
+	claims := jwt.MapClaims{
+		"sub": "testuser",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(secret))
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	// Try to verify with a different secret - should fail
+	_, _, err = auth.VerifyExternalJWT(tokenString, wrongSecret, algorithm, "sub")
+	if err == nil {
+		t.Fatal("VerifyExternalJWT() should fail for invalid signature")
+	}
+}
+
+func TestVerifyExternalJWT_MissingUsernameClaim(t *testing.T) {
+	secret := "test-secret-key"
+	algorithm := "HS256"
+
+	// Create a token without the 'sub' claim
+	claims := jwt.MapClaims{
+		"email": "test@example.com",
+		"exp":   time.Now().Add(time.Hour).Unix(),
+		"iat":   time.Now().Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(secret))
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	// Verify the token - should fail due to missing 'sub' claim
+	_, _, err = auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
+	if err == nil {
+		t.Fatal("VerifyExternalJWT() should fail for missing username claim")
+	}
+}
+
+func TestVerifyExternalJWT_CustomUserIdentifier(t *testing.T) {
+	secret := "test-secret-key"
+	algorithm := "HS256"
+	username := "testuser"
+
+	// Create a token with custom username field
+	claims := jwt.MapClaims{
+		"username": username,
+		"exp":      time.Now().Add(time.Hour).Unix(),
+		"iat":      time.Now().Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(secret))
+	if err != nil {
+		t.Fatalf("Failed to create test token: %v", err)
+	}
+
+	// Verify the token with custom user identifier field
+	extractedUsername, _, err := auth.VerifyExternalJWT(tokenString, secret, algorithm, "username")
+	if err != nil {
+		t.Fatalf("VerifyExternalJWT() failed: %v", err)
+	}
+
+	if extractedUsername != username {
+		t.Errorf("Expected username %s, got %s", username, extractedUsername)
+	}
+}
+
+func TestVerifyExternalJWT_ES256_PublicKeyPEM(t *testing.T) {
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+	pubDER, err := x509.MarshalPKIXPublicKey(&priv.PublicKey)
+	if err != nil {
+		t.Fatalf("MarshalPKIXPublicKey: %v", err)
+	}
+	pubPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubDER}))
+
+	username := "ec-user"
+	claims := jwt.MapClaims{
+		"sub": username,
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
+	tokenString, err := token.SignedString(priv)
+	if err != nil {
+		t.Fatalf("SignedString: %v", err)
+	}
+
+	got, _, err := auth.VerifyExternalJWT(tokenString, pubPEM, "ES256", "sub")
+	if err != nil {
+		t.Fatalf("VerifyExternalJWT: %v", err)
+	}
+	if got != username {
+		t.Errorf("username: got %q want %q", got, username)
+	}
+}
+
+func TestVerifyExternalJWT_RS256_PublicKeyPEM(t *testing.T) {
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+	pubDER, err := x509.MarshalPKIXPublicKey(&priv.PublicKey)
+	if err != nil {
+		t.Fatalf("MarshalPKIXPublicKey: %v", err)
+	}
+	pubPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubDER}))
+
+	username := "rsa-user"
+	claims := jwt.MapClaims{
+		"sub": username,
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	tokenString, err := token.SignedString(priv)
+	if err != nil {
+		t.Fatalf("SignedString: %v", err)
+	}
+
+	got, _, err := auth.VerifyExternalJWT(tokenString, pubPEM, "RS256", "sub")
+	if err != nil {
+		t.Fatalf("VerifyExternalJWT: %v", err)
+	}
+	if got != username {
+		t.Errorf("username: got %q want %q", got, username)
+	}
+}
+
+func TestVerifyExternalJWT_ES256_WrongCurveRejected(t *testing.T) {
+	p256Priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+	p384Priv, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+	verifyDER, err := x509.MarshalPKIXPublicKey(&p384Priv.PublicKey)
+	if err != nil {
+		t.Fatalf("MarshalPKIXPublicKey: %v", err)
+	}
+	verifyPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: verifyDER}))
+
+	claims := jwt.MapClaims{
+		"sub": "u",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
+	tokenString, err := token.SignedString(p256Priv)
+	if err != nil {
+		t.Fatalf("SignedString: %v", err)
+	}
+
+	_, _, err = auth.VerifyExternalJWT(tokenString, verifyPEM, "ES256", "sub")
+	if err == nil {
+		t.Fatal("expected error when PEM public key curve does not match algorithm")
+	}
+}
+
+func TestVerifyExternalJWT_CertificatePEM(t *testing.T) {
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+	tpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "jwt-test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &priv.PublicKey, priv)
+	if err != nil {
+		t.Fatalf("CreateCertificate: %v", err)
+	}
+	certPEM := string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER}))
+
+	username := "cert-user"
+	claims := jwt.MapClaims{
+		"sub": username,
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
+	tokenString, err := token.SignedString(priv)
+	if err != nil {
+		t.Fatalf("SignedString: %v", err)
+	}
+
+	got, _, err := auth.VerifyExternalJWT(tokenString, certPEM, "ES256", "sub")
+	if err != nil {
+		t.Fatalf("VerifyExternalJWT: %v", err)
+	}
+	if got != username {
+		t.Errorf("username: got %q want %q", got, username)
+	}
+}
+
+func TestExtractGroupsFromClaims_ArrayOfStrings(t *testing.T) {
+	claims := map[string]interface{}{
+		"groups": []string{"admin", "users"},
+	}
+
+	groups := auth.ExtractGroupsFromClaims(claims, "groups")
+
+	if len(groups) != 2 {
+		t.Fatalf("Expected 2 groups, got %d", len(groups))
+	}
+
+	if groups[0] != "admin" || groups[1] != "users" {
+		t.Errorf("Expected groups [admin, users], got %v", groups)
+	}
+}
+
+func TestExtractGroupsFromClaims_ArrayOfInterfaces(t *testing.T) {
+	claims := map[string]interface{}{
+		"groups": []interface{}{"admin", "users"},
+	}
+
+	groups := auth.ExtractGroupsFromClaims(claims, "groups")
+
+	if len(groups) != 2 {
+		t.Fatalf("Expected 2 groups, got %d", len(groups))
+	}
+
+	if groups[0] != "admin" || groups[1] != "users" {
+		t.Errorf("Expected groups [admin, users], got %v", groups)
+	}
+}
+
+func TestExtractGroupsFromClaims_SingleString(t *testing.T) {
+	claims := map[string]interface{}{
+		"groups": "admin",
+	}
+
+	groups := auth.ExtractGroupsFromClaims(claims, "groups")
+
+	if len(groups) != 1 {
+		t.Fatalf("Expected 1 group, got %d", len(groups))
+	}
+
+	if groups[0] != "admin" {
+		t.Errorf("Expected group admin, got %s", groups[0])
+	}
+}
+
+func TestExtractGroupsFromClaims_MissingClaim(t *testing.T) {
+	claims := map[string]interface{}{
+		"email": "test@example.com",
+	}
+
+	groups := auth.ExtractGroupsFromClaims(claims, "groups")
+
+	if len(groups) != 0 {
+		t.Fatalf("Expected 0 groups, got %d", len(groups))
+	}
+}
+
+func TestExtractGroupsFromClaims_CustomClaimName(t *testing.T) {
+	claims := map[string]interface{}{
+		"roles": []string{"admin", "editor"},
+	}
+
+	groups := auth.ExtractGroupsFromClaims(claims, "roles")
+
+	if len(groups) != 2 {
+		t.Fatalf("Expected 2 groups, got %d", len(groups))
+	}
+
+	if groups[0] != "admin" || groups[1] != "editor" {
+		t.Errorf("Expected groups [admin, editor], got %v", groups)
+	}
+}

backend/auth/totp.go

@@ -67,15 +67,17 @@ func GenerateOtpForUser(user *users.User, userStore *users.Storage) (string, err
 
 	secretText := key.Secret()
 	nonce := ""
+	secretToStore := secretText
 	if settings.Config.Auth.TotpSecret != "" {
 		// If an encryption key is provided, encrypt the secret.
-		secretText, nonce, err = encryptSecret(secretText, encryptionKey)
+		secretToStore, nonce, err = encryptSecret(secretText, encryptionKey)
 		if err != nil {
 			return "", fmt.Errorf("failed to encrypt TOTP secret: %w", err)
 		}
 	}
 	// set cache so verify can attempt to use it but not require it for user yet.
-	TotpCache.Set(user.Username, secretText+"||"+nonce)
+	TotpCache.Set(user.Username, secretToStore+"||"+nonce)
+	// Use the original base32 secret in the OTP URL, not the encrypted version
 	url := fmt.Sprintf("otpauth://totp/%v?secret=%v", "FileBrowser Quantum: "+user.Username, secretText)
 	return url, nil
 }
@@ -144,14 +146,14 @@ func decryptSecret(b64Ciphertext, b64Nonce string) (string, error) {
 }
 
 func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) error {
-	// get data from cache
 	cachedSecret, found := TotpCache.Get(user.Username)
 	if !found && user.TOTPSecret == "" {
 		return fmt.Errorf("OTP token not found in cache, please generate a new one")
 	}
+	useCache := found && user.TOTPSecret == ""
 	totpSecret := user.TOTPSecret // The encrypted or plaintext secret
 	totpNonce := user.TOTPNonce   // The nonce if encrypted, or empty if plaintext
-	if found {
+	if useCache {
 		splitSecret := strings.Split(cachedSecret, "||")
 		if len(splitSecret) < 2 {
 			return fmt.Errorf("invalid cached OTP token format")
@@ -171,9 +173,7 @@ func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) err
 		}
 		secretToValidate = decryptedSecret
 	}
-	// --- END: ADD THIS DECRYPTION LOGIC ---
 
-	// Validate the token using the (now plaintext) secret.
 	valid, err := totp.ValidateCustom(code, secretToValidate, time.Now().UTC(), totp.ValidateOpts{
 		Period:    TOTPPeriod,
 		Skew:      TOTPSkew,
@@ -181,12 +181,13 @@ func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) err
 		Algorithm: TOTPAlgorithm,
 	})
 	if err != nil {
-		logger.Errorf("error during TOTP validation: %v", err)
+		logger.Errorf("error during TOTP validation for user %s: %v", user.Username, err)
 	}
 	if !valid {
+		logger.Warningf("Invalid TOTP code for user %s", user.Username)
 		return fmt.Errorf("invalid OTP token")
 	}
-	if totpSecret != "" {
+	if totpSecret != "" || !user.OtpEnabled {
 		user.TOTPSecret = totpSecret // The encrypted or plaintext secret
 		user.TOTPNonce = totpNonce   // The nonce if encrypted, or empty if plaintext
 		user.OtpEnabled = true       // Enable OTP for the user
@@ -195,6 +196,7 @@ func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) err
 			logger.Error("error updating user with OTP token:", err)
 			return fmt.Errorf("error updating user with OTP token: %w", err)
 		}
+		TotpCache.Delete(user.Username)
 	} else {
 		return fmt.Errorf("opt secret is empty, cannot enable TOTP")
 	}

backend/auth/webauthn.go

@@ -0,0 +1,296 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"net/url"
+	"sync"
+	"time"
+
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/webauthn"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+type webAuthnSession struct {
+	SessionData *webauthn.SessionData
+	UserID      uint
+	ExpiresAt   time.Time
+}
+
+type WebAuthnService struct {
+	wa       *webauthn.WebAuthn
+	sessions sync.Map
+	stopCh   chan struct{}
+}
+
+var webAuthnInstance *WebAuthnService
+
+func InitWebAuthn() error {
+	cfg := &settings.Config.Auth.Methods.PasskeyAuth
+	if !cfg.Enabled {
+		webAuthnInstance = nil
+		return nil
+	}
+
+	waCfg, err := deriveWebAuthnConfig(cfg)
+	if err != nil {
+		return fmt.Errorf("webauthn config derivation failed: %w", err)
+	}
+
+	wa, err := webauthn.New(waCfg)
+	if err != nil {
+		return fmt.Errorf("failed to initialize WebAuthn: %w", err)
+	}
+
+	webAuthnInstance = &WebAuthnService{
+		wa:     wa,
+		stopCh: make(chan struct{}),
+	}
+	go webAuthnInstance.cleanupExpiredSessions()
+	return nil
+}
+
+func GetWebAuthn() *WebAuthnService {
+	return webAuthnInstance
+}
+
+func IsWebAuthnEnabled() bool {
+	return webAuthnInstance != nil
+}
+
+// ValidateOrigin checks if the given origin is in the configured whitelist.
+// Returns true if the origin is allowed, false otherwise.
+func (s *WebAuthnService) ValidateOrigin(origin string) bool {
+	for _, allowedOrigin := range s.wa.Config.RPOrigins {
+		if allowedOrigin == origin {
+			return true
+		}
+	}
+	return false
+}
+
+func generateSessionID() string {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return hex.EncodeToString([]byte(fmt.Sprintf("%d", time.Now().UnixNano())))
+	}
+	return hex.EncodeToString(b)
+}
+
+func (s *WebAuthnService) BeginMFALogin(username, password string, rpID string, userStore *users.Storage) (sessionID string, assertion *protocol.CredentialAssertion, err error) {
+	user, getErr := userStore.Get(username)
+	passwordHash := utils.InvalidPasswordHash
+	if getErr == nil {
+		passwordHash = user.Password
+	}
+	// Always run password check to prevent timing-based username enumeration
+	if err = utils.CheckPwd(password, passwordHash); err != nil {
+		return "", nil, errors.ErrUnauthorized
+	}
+	if getErr != nil {
+		return "", nil, errors.ErrUnauthorized
+	}
+
+	if !user.HasPasskeyMFA() {
+		return "", nil, errors.ErrPasskeyNoCredential
+	}
+
+	var opts []webauthn.LoginOption
+	if rpID != "" {
+		opts = append(opts, webauthn.WithLoginRelyingPartyID(rpID))
+	}
+	assertion, sessionData, err := s.wa.BeginLogin(user, opts...)
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to begin WebAuthn login: %w", err)
+	}
+
+	sessionID = generateSessionID()
+	s.sessions.Store(sessionID, &webAuthnSession{
+		SessionData: sessionData,
+		UserID:      user.ID,
+		ExpiresAt:   time.Now().Add(5 * time.Minute),
+	})
+
+	return sessionID, assertion, nil
+}
+
+func (s *WebAuthnService) FinishMFALogin(sessionID string, r *http.Request, userStore *users.Storage) (*users.User, error) {
+	sessionVal, ok := s.sessions.Load(sessionID)
+	if !ok {
+		return nil, errors.ErrPasskeyInvalidSession
+	}
+	sess, ok := sessionVal.(*webAuthnSession)
+	if !ok {
+		return nil, errors.ErrPasskeyInvalidSession
+	}
+	defer s.sessions.Delete(sessionID)
+
+	if time.Now().After(sess.ExpiresAt) {
+		return nil, errors.ErrPasskeyInvalidSession
+	}
+
+	user, err := userStore.Get(sess.UserID)
+	if err != nil {
+		return nil, fmt.Errorf("user not found: %w", err)
+	}
+
+	credential, err := s.wa.FinishLogin(user, *sess.SessionData, r)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %v", errors.ErrPasskeyVerification, err)
+	}
+
+	credB64 := base64.RawURLEncoding.EncodeToString(credential.ID)
+	for i := range user.PasskeyCredentials {
+		if user.PasskeyCredentials[i].ID == credB64 {
+			users.UpdateCredentialFromLibrary(&user.PasskeyCredentials[i], credential)
+			if err := userStore.Update(user, false, "PasskeyCredentials"); err != nil {
+				return nil, fmt.Errorf("failed to update credential: %w", err)
+			}
+			return user, nil
+		}
+	}
+
+	return user, nil
+}
+
+func (s *WebAuthnService) BeginRegistration(user *users.User, rpID string) (sessionID string, creation *protocol.CredentialCreation, err error) {
+	var opts []webauthn.RegistrationOption
+	if rpID != "" {
+		opts = append(opts, webauthn.WithRegistrationRelyingPartyID(rpID))
+	}
+	creation, sessionData, err := s.wa.BeginRegistration(user, opts...)
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to begin WebAuthn registration: %w", err)
+	}
+
+	sessionID = generateSessionID()
+	s.sessions.Store(sessionID, &webAuthnSession{
+		SessionData: sessionData,
+		UserID:      user.ID,
+		ExpiresAt:   time.Now().Add(5 * time.Minute),
+	})
+
+	return sessionID, creation, nil
+}
+
+func (s *WebAuthnService) FinishRegistration(user *users.User, sessionID string, credentialName string, r *http.Request) error {
+	sessionVal, ok := s.sessions.Load(sessionID)
+	if !ok {
+		return errors.ErrPasskeyInvalidSession
+	}
+	sess, ok := sessionVal.(*webAuthnSession)
+	if !ok {
+		return errors.ErrPasskeyInvalidSession
+	}
+	defer s.sessions.Delete(sessionID)
+
+	if time.Now().After(sess.ExpiresAt) {
+		return errors.ErrPasskeyInvalidSession
+	}
+
+	if sess.UserID != user.ID {
+		return errors.ErrUnauthorized
+	}
+
+	credential, err := s.wa.FinishRegistration(user, *sess.SessionData, r)
+	if err != nil {
+		return fmt.Errorf("failed to finish WebAuthn registration: %w", err)
+	}
+
+	credB64 := base64.RawURLEncoding.EncodeToString(credential.ID)
+	for _, c := range user.PasskeyCredentials {
+		if c.ID == credB64 {
+			return errors.ErrPasskeyExists
+		}
+	}
+
+	newCred := users.CredentialFromLibrary(credentialName, credential)
+	user.PasskeyCredentials = append(user.PasskeyCredentials, newCred)
+	return nil
+}
+
+func (s *WebAuthnService) DeleteCredential(user *users.User, credentialID string) error {
+	for i, c := range user.PasskeyCredentials {
+		if c.ID == credentialID {
+			user.PasskeyCredentials = append(user.PasskeyCredentials[:i], user.PasskeyCredentials[i+1:]...)
+			return nil
+		}
+	}
+	return errors.ErrPasskeyNoCredential
+}
+
+func (s *WebAuthnService) cleanupExpiredSessions() {
+	ticker := time.NewTicker(2 * time.Minute)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ticker.C:
+			now := time.Now()
+			s.sessions.Range(func(key, value interface{}) bool {
+				sess, ok := value.(*webAuthnSession)
+				if !ok {
+					s.sessions.Delete(key)
+					return true
+				}
+				if now.After(sess.ExpiresAt) {
+					s.sessions.Delete(key)
+				}
+				return true
+			})
+		case <-s.stopCh:
+			return
+		}
+	}
+}
+
+func deriveWebAuthnConfig(cfg *settings.PasskeyAuthConfig) (*webauthn.Config, error) {
+	rpID := cfg.RPID
+	if rpID == "" {
+		if settings.Config.Server.ExternalUrl != "" {
+			if u, err := url.Parse(settings.Config.Server.ExternalUrl); err == nil {
+				rpID = u.Hostname()
+			}
+		}
+		if rpID == "" {
+			rpID = "localhost"
+		}
+	}
+
+	displayName := cfg.RPDisplayName
+	if displayName == "" {
+		displayName = settings.Config.Frontend.Name
+	}
+	if displayName == "" {
+		displayName = "FileBrowser Quantum"
+	}
+
+	origins := cfg.RPOrigins
+	if len(origins) == 0 {
+		if settings.Config.Server.ExternalUrl != "" {
+			origins = append(origins, settings.Config.Server.ExternalUrl)
+		}
+		if settings.Config.Server.InternalUrl != "" && settings.Config.Server.InternalUrl != settings.Config.Server.ExternalUrl {
+			origins = append(origins, settings.Config.Server.InternalUrl)
+		}
+		if len(origins) == 0 {
+			origins = append(origins, "http://localhost")
+		}
+	}
+
+	return &webauthn.Config{
+		RPID:          rpID,
+		RPDisplayName: displayName,
+		RPOrigins:     origins,
+		AttestationPreference: protocol.PreferNoAttestation,
+		AuthenticatorSelection: protocol.AuthenticatorSelection{
+			UserVerification: protocol.VerificationPreferred,
+		},
+	}, nil
+}

backend/cmd/cli.go

@@ -23,7 +23,7 @@ var (
 )
 
 // return bool to indicate if the program should continue running
-func runCLI() bool {
+func runCLI() (bool, bool) {
 
 	generateYaml()
 
@@ -53,75 +53,101 @@ func runCLI() bool {
 	// Show help if requested
 	if help {
 		generalUsage()
-		return false
+		return false, false
 	}
 
 	// Create a new FlagSet for the 'set' subcommand
 	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
 	var user, dbConfig string
 	var asAdmin bool
-	var fsPath, indexPath, ruleCategory, value string
+	var sourceName, indexPath, ruleCategory, value string
 	var allow bool
 
 	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
 	setCmd.BoolVar(&asAdmin, "a", false, "Create a user as admin user, used in combination with -u")
 	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
-	setCmd.StringVar(&fsPath, "f", "", "Real filesystem path (e.g. /mnt/storage) for rule command")
+	setCmd.StringVar(&sourceName, "s", "", "source name to apply the rule to")
 	setCmd.StringVar(&indexPath, "p", "", "Index path (e.g. /secret) for rule command")
 	setCmd.StringVar(&ruleCategory, "r", "", "Rule category: 'user', 'group', or 'all' (for deny only)")
 	setCmd.StringVar(&value, "v", "", "Value: username or groupname (not required if ruleCategory is 'all')")
 	setCmd.BoolVar(&allow, "allow", false, "Allow access (default: false, which means deny)")
 
-	// Parse subcommand flags only if a subcommand is specified
+	storeCfg := configPath
+	cliSubcmd := ""
+	var setKind string
+
 	if len(os.Args) > 1 {
 		switch os.Args[1] {
-		case "setup":
-			createConfig(configPath)
-			return false
-		case "set":
-			if len(os.Args) < 3 {
-				fmt.Printf("error: missing subcommand for 'set'. Use 'set user' or 'set rule'\n")
-				os.Exit(1)
-			}
-			subcommand := os.Args[2]
-
-			// New pattern: subcommand-based (e.g., "set user" or "set rule")
-			// Parse flags starting from os.Args[3:] to skip the subcommand
-			err := setCmd.Parse(os.Args[3:])
-			if err != nil {
-				setCmd.PrintDefaults()
-				os.Exit(1)
-			}
-			switch subcommand {
-			case "-u":
-				err := setUser(dbConfig, asAdmin)
-				if err != nil {
-					fmt.Printf("error: %v\n", err)
-					os.Exit(1)
-				}
-				return false
-			case "rule":
-				err := setRule(dbConfig, fsPath, indexPath, ruleCategory, value, allow)
-				if err != nil {
-					fmt.Printf("error: %v\n", err)
-					os.Exit(1)
-				}
-				return false
-			default:
-				fmt.Printf("error: unknown subcommand '%s' for 'set'. Use 'set user' or 'set rule'\n", subcommand)
-				os.Exit(1)
-			}
-
 		case "version":
 			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
 	Version 	 : %v
 	Commit 		 : %v
 	Release Info 	 : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
-	`, version.Version, version.CommitSHA, version.Version)
-			return false
+`, version.Version, version.CommitSHA, version.Version)
+			return false, false
+		case "setup":
+			cliSubcmd = "setup"
+		case "set":
+			cliSubcmd = "set"
+			if len(os.Args) < 3 {
+				fmt.Printf("error: missing subcommand for 'set'. Use 'set user' or 'set rule'\n")
+				os.Exit(1)
+			}
+			setKind = os.Args[2]
+			var err error
+			// Handle old syntax: "set -u user,pass -c config.yaml"
+			if setKind == "-u" {
+				err = setCmd.Parse(os.Args[2:])
+			} else {
+				// New pattern: subcommand-based (e.g., "set user" or "set rule")
+				err = setCmd.Parse(os.Args[3:])
+			}
+			if err != nil {
+				setCmd.PrintDefaults()
+				os.Exit(1)
+			}
+			storeCfg = dbConfig
 		}
 	}
-	return true
+
+	switch cliSubcmd {
+	case "setup":
+		createConfig(configPath)
+		return false, false
+	case "set":
+		if setKind == "-u" {
+			dbExists := getStore(storeCfg)
+			logger.Debugf("setUser called with args: %v, config: %v, admin: %v", os.Args, dbConfig, asAdmin)
+			err := setUser(dbConfig, asAdmin)
+			if err != nil {
+				fmt.Printf("error: %v\n", err)
+				os.Exit(1)
+			}
+			return false, dbExists
+		}
+		switch setKind {
+		case "rule":
+			dbExists := getStore(storeCfg)
+			sourceInfo, ok := settings.Config.Server.NameToSource[sourceName] // backend source is path
+			if !ok {
+				fmt.Printf("error: invalid source name: %s\n", sourceName)
+				os.Exit(1)
+			}
+			err := setRule(dbConfig, sourceInfo.Path, indexPath, ruleCategory, value, allow)
+			if err != nil {
+				fmt.Printf("error: %v\n", err)
+				os.Exit(1)
+			}
+			return false, dbExists
+		default:
+			fmt.Printf("error: unknown subcommand '%s' for 'set'. Use 'set user' or 'set rule'\n", setKind)
+			os.Exit(1)
+		}
+		return false, false
+	default:
+		dbExists := getStore(storeCfg)
+		return true, dbExists
+	}
 }
 
 func setRule(dbConfig, fsPath, indexPath, ruleCategory, value string, allow bool) error {
@@ -138,10 +164,6 @@ func setRule(dbConfig, fsPath, indexPath, ruleCategory, value string, allow bool
 	if ruleCategory != "all" && value == "" {
 		return fmt.Errorf("value is required when ruleCategory is 'user' or 'group': use -v <username|groupname>")
 	}
-
-	// Initialize store and settings
-	_ = getStore(dbConfig) // ignore bool check
-
 	// Apply the rule based on allow flag and ruleCategory
 	var err error
 	if allow {
@@ -192,7 +214,6 @@ func setUser(dbConfig string, asAdmin bool) error {
 	}
 	username := userInfo[0]
 	password := userInfo[1]
-	_ = getStore(dbConfig) // ignore bool check
 	user, err := store.Users.Get(username)
 	if err != nil {
 		newUser := users.User{
@@ -205,7 +226,7 @@ func setUser(dbConfig string, asAdmin bool) error {
 		for _, source := range settings.Config.Server.SourceMap {
 			if source.Config.DefaultEnabled {
 				newUser.Scopes = append(newUser.Scopes, users.SourceScope{
-					Name:  source.Name,
+					Name:  source.Path,
 					Scope: source.Config.DefaultUserScope,
 				})
 			}
@@ -217,7 +238,7 @@ func setUser(dbConfig string, asAdmin bool) error {
 		} else {
 			logger.Infof("Creating non-admin user: %s\n", username)
 		}
-		newUser.Permissions = settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Permissions)
+		newUser.Permissions = settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Account.Permissions)
 		newUser.Permissions.Admin = asAdmin
 		err = storage.CreateUser(newUser, newUser.Permissions)
 		if err != nil {
@@ -238,7 +259,7 @@ func setUser(dbConfig string, asAdmin bool) error {
 	}
 	// Ensure version is set for existing users being updated
 	if user.Version == 0 {
-		user.Version = 1
+		user.Version = users.CurrentUserMigrationVersion
 	}
 	err = store.Users.Save(user, true, false)
 	if err != nil {
@@ -248,51 +269,6 @@ func setUser(dbConfig string, asAdmin bool) error {
 	return nil
 }
 
-// UserDefaults defines default settings for new users.
-type UserDefaults struct {
-	Permissions users.Permissions `yaml:"permissions"`
-}
-
-// Frontend defines settings related to the web interface.
-type Frontend struct {
-	Name string `yaml:"name,omitempty"`
-}
-
-// Source defines a directory to be served.
-type Source struct {
-	Name string `yaml:"name,omitempty"`
-	Path string `yaml:"path"`
-}
-
-// Server defines server-specific configurations.
-type Server struct {
-	Port     int         `yaml:"port"`
-	Database string      `yaml:"database"`
-	Sources  []Source    `yaml:"sources"`
-	Logging  []LogConfig `json:"logging"`
-}
-
-type LogConfig struct {
-	Levels    string `json:"levels"`    // separated list of log levels to enable. (eg. "info|warning|error|debug")
-	ApiLevels string `json:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
-	Output    string `json:"output"`    // output location. (eg. "stdout" or "path/to/file.log")
-	NoColors  bool   `json:"noColors"`  // disable colors in the output
-	Utc       bool   `json:"utc"`       // use UTC time in the output instead of local time
-}
-
-type Auth struct {
-	AdminUsername string `yaml:"adminUsername"`
-	AdminPassword string `yaml:"adminPassword"`
-}
-
-// Settings is the top-level configuration structure.
-type Settings struct {
-	Server       Server       `yaml:"server"`
-	Frontend     Frontend     `yaml:"frontend,omitempty"`
-	Auth         Auth         `yaml:"auth"`
-	UserDefaults UserDefaults `yaml:"userDefaults"`
-}
-
 // askQuestion displays a prompt and reads a line of input from the user.
 // It returns the defaultValue if the user's input is empty.
 func askQuestion(reader *bufio.Reader, prompt string, defaultValue string) string {
@@ -324,30 +300,9 @@ func askYesNoQuestion(reader *bufio.Reader, prompt string, defaultValue string)
 
 // createConfig orchestrates the configuration process by asking the user a series of questions.
 func createConfig(configpath string) {
-	// check if config file exists
-	if _, err := os.Stat("config.yaml"); err == nil {
-		fmt.Println("Config file 'config.yaml' already exists, skipping setup.")
-		return
-	}
 	reader := bufio.NewReader(os.Stdin)
-	config := Settings{
-		Server: Server{
-			Logging: []LogConfig{
-				{
-					Levels:    "info|warning|error",
-					ApiLevels: "info|warning|error",
-					Output:    "stdout",
-					NoColors:  false,
-					Utc:       false,
-				},
-			},
-			Sources: []Source{
-				{
-					Path: "",
-				},
-			},
-		},
-	}
+	config := settings.SetDefaults(false)
+	config.Server.Sources = []*settings.Source{{Path: "./"}}
 
 	fmt.Println("--- Starting Configuration Setup ---")
 	realPath := ""
@@ -414,8 +369,8 @@ func createConfig(configpath string) {
 	config.Auth.AdminPassword = askQuestion(reader, "What should the default admin password be?", "admin")
 
 	// 6. Ask boolean (Yes/No) questions using the helper
-	config.UserDefaults.Permissions.Modify = askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
-	config.UserDefaults.Permissions.Share = askYesNoQuestion(reader, "Should a new user be able to create shares by default?", "no")
+	config.UserDefaults.Account.Permissions.Modify = askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
+	config.UserDefaults.Account.Permissions.Share = askYesNoQuestion(reader, "Should a new user be able to create shares by default?", "no")
 
 	fmt.Println("--- 	Configuration Complete 	---")
 

backend/cmd/root.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"io/fs"
 	"os"
 	"os/signal"
 	"syscall"
@@ -11,6 +12,7 @@ import (
 	_ "net/http/pprof"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
@@ -18,6 +20,7 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
 	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
+	"github.com/gtsteffaniak/filebrowser/backend/icons"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
 	"github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
@@ -52,10 +55,14 @@ commands:
 }
 
 func StartFilebrowser() {
-	keepGoing := runCLI()
+	keepGoing, dbExists := runCLI()
 	if !keepGoing {
 		return
 	}
+	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
+	if !dbExists {
+		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
+	}
 	if !settings.Config.Server.DisableUpdateCheck {
 		info, _ := utils.CheckForUpdates()
 		if info.LatestVersion != "" {
@@ -74,11 +81,6 @@ func StartFilebrowser() {
 
 	done := make(chan struct{})             // Signals server has stopped
 	shutdownComplete := make(chan struct{}) // Signals shutdown process is complete
-	dbExists := getStore(configPath)
-	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
-	if !dbExists {
-		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
-	}
 
 	// Dev mode enables development features like template hot-reloading
 	_, err := os.Stat("http/dist")
@@ -87,6 +89,11 @@ func StartFilebrowser() {
 		settings.Env.EmbeddedFs = os.IsNotExist(err)
 	}
 
+	err = utils.SetInvalidPasswordHash()
+	if err != nil {
+		logger.Fatalf("Failed to set security hash: %v", err)
+	}
+
 	sourceList := []string{}
 	for path, source := range settings.Config.Server.SourceMap {
 		sourceList = append(sourceList, fmt.Sprintf("%v: %v", source.Name, path))
@@ -116,17 +123,23 @@ func StartFilebrowser() {
 	}
 
 	// Initialize shared index database before starting HTTP service
-	if err := indexing.InitializeIndexDB(); err != nil {
+	isNewDb, err := indexing.InitializeIndexDB()
+	if err != nil {
 		logger.Fatalf("Failed to initialize index database: %v", err)
 	}
 
 	// Set indexing storage for persistence
 	if store != nil && store.Indexing != nil {
 		indexing.SetIndexingStorage(store.Indexing)
+		if isNewDb {
+			if err := store.Indexing.ResetAllComplexities(); err != nil {
+				logger.Errorf("Failed to reset index complexities: %v", err)
+			}
+		}
 	}
 
 	for _, source := range settings.Config.Server.SourceMap {
-		go indexing.Initialize(source, false)
+		go indexing.Initialize(source, false, isNewDb)
 	}
 	validateUserInfo(!dbExists)
 	validateOfficeIntegration()
@@ -164,6 +177,9 @@ func StartFilebrowser() {
 		fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
 	}
 	<-shutdownComplete
+	if err := fileutils.ClearDirectoryContents(settings.DownloadCacheDir()); err != nil {
+		logger.Warningf("failed to clear download spool on shutdown: %v", err)
+	}
 	logger.Info("Shutdown complete.")
 }
 
@@ -175,11 +191,40 @@ func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.
 	numWorkers := settings.Config.Server.NumImageProcessors
 	ffmpeg.SetFFmpegPaths()
 
-	// setup disk cache
+	// Initialize asset filesystem before starting services
+	if settings.Env.EmbeddedFs {
+		embeddedAssets := fbhttp.GetEmbeddedAssets()
+		subAssets, err := fs.Sub(embeddedAssets, "embed")
+		if err != nil {
+			logger.Fatalf("Failed to create sub filesystem: %v", err)
+		}
+		fileutils.InitAssetFS(subAssets, true)
+	} else {
+		fileutils.InitAssetFS(nil, false)
+	}
+
+	// Start preview service
 	err := preview.StartPreviewGenerator(numWorkers, cacheDir)
 	if err != nil {
 		logger.Fatalf("Error starting preview service: %v", err)
 	}
+	logger.Debugf("MuPDF Enabled            : %v", settings.Env.MuPdfAvailable)
+	logger.Debugf("Media Enabled            : %v", settings.MediaEnabled())
+	logger.Debugf("Exiftool Enabled         : %v", settings.Config.Integrations.Media.ExiftoolPath != "")
+
+	// Generate PWA icons after preview service is initialized
+	if err := icons.GeneratePWAIcons(); err != nil {
+		logger.Warningf("Failed to generate PWA icons: %v", err)
+	}
+
+	// Initialize PWA manifest after icons are generated
+	icons.InitializePWAManifest()
+
+	// Initialize WebAuthn/Passkey service if enabled
+	if err := auth.InitWebAuthn(); err != nil {
+		logger.Fatalf("Failed to initialize WebAuthn: %v", err)
+	}
+
 	fbhttp.StartHttp(ctx, store, shutdownComplete)
 	return nil
 }

backend/cmd/user.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"reflect"
+	"strings"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
@@ -40,10 +41,15 @@ func validateUserInfo(newDB bool) {
 		if updateSidebarLinks(user) {
 			updateUser = true
 		}
+		if updateTokens(user) {
+			updateUser = true
+		}
+		if updateShowToolsInSidebar(user) {
+			updateUser = true
+		}
 		adminUser := settings.Config.Auth.AdminUsername
 		adminPass := settings.Config.Auth.AdminPassword
-		passwordEnabled := settings.Config.Auth.Methods.PasswordAuth.Enabled
-		if user.Username == adminUser && adminPass != "" && passwordEnabled {
+		if user.Username == adminUser && adminPass != "" && user.LoginMethod == users.LoginMethodPassword {
 			logger.Info("Resetting admin user to default username and password.")
 			user.Permissions.Admin = true
 			user.Password = settings.Config.Auth.AdminPassword
@@ -59,7 +65,11 @@ func validateUserInfo(newDB bool) {
 					logger.Fatalf("Unable to create automatic backup of database due to error: %v", err)
 				}
 			}
-			err := store.Users.Save(user, changePass, true)
+			fields := []string{"Scopes", "SidebarLinks", "Tokens", "Permissions", "Preview", "ShowFirstLogin", "LoginMethod", "Version", "ShowToolsInSidebar"}
+			if changePass {
+				fields = append(fields, "Password")
+			}
+			err := store.Users.Update(user, true, fields...)
 			if err != nil {
 				logger.Errorf("could not update user: %v", err)
 			}
@@ -71,10 +81,12 @@ func updateUserScopes(user *users.User) bool {
 	newScopes := []users.SourceScope{}
 	seen := make(map[string]struct{})
 
-	// Build map for existing scopes by Name
+	// Build map of existing scopes keyed by canonical source path (DB may use path or display name).
 	existing := make(map[string]users.SourceScope)
 	for _, s := range user.Scopes {
-		existing[s.Name] = s
+		if info, ok := users.ResolveSourceKey(s.Name); ok {
+			existing[info.Path] = s
+		}
 	}
 
 	// Preserve order by using Config.Server.Sources
@@ -90,7 +102,6 @@ func updateUserScopes(user *users.User) bool {
 		} else {
 			continue
 		}
-
 		newScopes = append(newScopes, users.SourceScope{
 			Name:  src.Path,
 			Scope: existingScope.Scope,
@@ -98,17 +109,30 @@ func updateUserScopes(user *users.User) bool {
 		seen[src.Path] = struct{}{}
 	}
 
-	// Preserve user-defined scopes not matching current sources, append to end
+	// Preserve explicit or legacy scopes not already merged (e.g. non-defaultEnabled sources, removed sources).
 	for _, s := range user.Scopes {
-		if _, ok := seen[s.Name]; !ok {
-			newScopes = append(newScopes, s)
+		if info, ok := users.ResolveSourceKey(s.Name); ok {
+			if _, already := seen[info.Path]; already {
+				continue
+			}
 		}
+		newScopes = append(newScopes, s)
 	}
 	changed := !reflect.DeepEqual(user.Scopes, newScopes)
 	user.Scopes = newScopes
 	return changed
 }
 
+// updateShowToolsInSidebar one-time defaults for legacy users (Version < CurrentUserMigrationVersion) from configured userDefaults.
+func updateShowToolsInSidebar(user *users.User) bool {
+	if user.Version >= 3 {
+		return false
+	}
+	user.ShowToolsInSidebar = true
+	user.Version = users.CurrentUserMigrationVersion
+	return true
+}
+
 func updateShowFirstLogin(user *users.User) bool {
 	if user.ShowFirstLogin && !settings.Env.IsFirstLoad {
 		user.ShowFirstLogin = false
@@ -119,11 +143,10 @@ func updateShowFirstLogin(user *users.User) bool {
 
 // func to convert legacy user with perm key to permissions
 func updatePermissions(user *users.User) bool {
-	if user.Version == 1 {
+	if user.Version >= 1 {
 		return false
 	}
 	updateUser := true
-	user.Permissions.Download = true
 	// if any keys are true, set the permissions to true
 	if user.Perm.Api {
 		user.Permissions.Api = true
@@ -165,7 +188,7 @@ func updatePermissions(user *users.User) bool {
 		user.Permissions.Delete = true
 		updateUser = true
 	}
-	user.Version = 1
+	user.Version = users.CurrentUserMigrationVersion
 	if updateUser {
 		createBackup = true
 	}
@@ -197,13 +220,13 @@ func updateSidebarLinks(user *users.User) bool {
 	validSourceLinksCount := 0
 
 	for _, link := range user.SidebarLinks {
-		if link.Category == "source" {
+		if strings.HasPrefix(link.Category, "source") {
 			sourceLinksCount++
-			// Check if this source still exists
-			if link.SourceName != "" {
-				if _, ok := settings.Config.Server.SourceMap[link.SourceName]; ok {
-					validSourceLinksCount++
-				}
+			if link.SourceName == "" {
+				continue
+			}
+			if _, ok := users.ResolveSourceKey(link.SourceName); ok {
+				validSourceLinksCount++
 			}
 		}
 	}
@@ -215,34 +238,46 @@ func updateSidebarLinks(user *users.User) bool {
 
 	// If user has source links but NONE are valid, rebuild from their scopes
 	if validSourceLinksCount == 0 {
-		logger.Infof("User %s has %d stale source links, rebuilding from scopes", user.Username, sourceLinksCount)
-
 		// Remove all existing source links
 		newLinks := []users.SidebarLink{}
 		for _, link := range user.SidebarLinks {
-			if link.Category != "source" {
+			if !strings.HasPrefix(link.Category, "source") {
 				newLinks = append(newLinks, link)
 			}
 		}
 
-		// Add new source links based on user's scopes
 		for _, scope := range user.Scopes {
-			if source, ok := settings.Config.Server.SourceMap[scope.Name]; ok {
-				// User has access to this source, add it to sidebar
-				newLinks = append(newLinks, users.SidebarLink{
-					Name:       source.Name,
-					Category:   "source",
-					Target:     "/",
-					Icon:       "",
-					SourceName: source.Path,
-				})
+			info, ok := users.ResolveSourceKey(scope.Name)
+			if !ok {
+				continue
 			}
+			newLinks = append(newLinks, users.SidebarLink{
+				Name:       info.Name,
+				Category:   "source",
+				Target:     "/",
+				Icon:       "",
+				SourceName: info.Path,
+			})
 		}
 
 		user.SidebarLinks = newLinks
 		return true
 	}
 
-	// User has at least one valid source link, no update needed
 	return false
 }
+
+func updateTokens(user *users.User) bool {
+	if user.Version >= 2 {
+		return false
+	}
+	if user.ApiKeys != nil {
+		user.Tokens = make(map[string]users.AuthToken)
+		for name, token := range user.ApiKeys {
+			token.Token = token.Key
+			user.Tokens[name] = token
+		}
+	}
+	user.Version = users.CurrentUserMigrationVersion
+	return true
+}

backend/cmd/user_test.go

@@ -25,6 +25,7 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 		"sourceA": &sourceA,
 		"sourceB": &sourceB,
 	}
+	settings.InitializeUserResolvers()
 
 	// ---------------------
 	// Test Cases Definition
@@ -156,7 +157,6 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 	sourceA = settings.Source{Path: "/pathA", Name: "sourceA", Config: settings.SourceConfig{
 		DefaultEnabled:   true,
 		DefaultUserScope: "/defaultA",
-		CreateUserDir:    true,
 	}}
 	sourceB = settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
 	settings.Config.Server.Sources = []*settings.Source{&sourceA, &sourceB}

backend/common/errors/errors.go

@@ -19,10 +19,17 @@ var (
 	ErrInvalidRequestParams = errors.New("invalid request params")
 	ErrSourceIsParent       = errors.New("source is parent")
 	ErrNoTotpProvided       = errors.New("OTP code is required for user")
-	ErrNoTotpConfigured     = errors.New("OTP is enforced, but user is not yet configured")
+	ErrNoTotpConfigured     = errors.New("OTP is enforced, but user is not configured")
 	ErrUnauthorized         = errors.New("user unauthorized")
 	ErrNotIndexed           = errors.New("directory or item excluded from indexing")
+	ErrNotViewable          = errors.New("directory or item is not viewable")
 	ErrWrongLoginMethod     = errors.New("user attempted to login with wrong login method")
 	ErrDownloadNotAllowed   = errors.New("downloads are not allowed for this share")
 	ErrUploadNotAllowed     = errors.New("upload permission not allowed for this share")
+	ErrPasskeyMFARequired   = errors.New("passkey MFA is required")
+	ErrPasskeyVerification  = errors.New("passkey verification failed")
+	ErrPasskeyNoCredential  = errors.New("no passkey credentials found for user")
+	ErrPasskeyExists        = errors.New("passkey credential already exists")
+	ErrPasskeyNotEnabled    = errors.New("passkey authentication is not enabled")
+	ErrPasskeyInvalidSession = errors.New("invalid or expired passkey session")
 )

backend/common/settings/apply_user_defaults_test.go

@@ -0,0 +1,216 @@
+package settings
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// TestApplyUserDefaults_copiesUserDefaultsOntoUser guards against drift between
+// [UserDefaults] and [ApplyUserDefaults] (regression for #2278-style bugs).
+func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
+	saved := Config
+	defer func() { Config = saved }()
+
+	dark := false
+	dlFalse := false
+	Config = Settings{
+		Server: Server{},
+		UserDefaults: UserDefaults{
+			Sidebar: UserDefaultsSidebar{
+				DisableQuickToggles:  true,
+				HideFileActions:      true,
+				DisableHideOnPreview: true,
+				Sticky:               false,
+				HideFiles:            true,
+				ShowTools:            boolPtr(true),
+			},
+			Listing: UserDefaultsListing{
+				DeleteWithoutConfirming: true,
+				DateFormat:              true,
+				ShowHidden:              true,
+				QuickDownload:           true,
+				ShowSelectMultiple:      true,
+				SingleClick:             true,
+				HideFileExt:             "",
+				ShowCopyPath:            false,
+				DeleteAfterArchive:      false,
+				ViewMode:                "list",
+				GallerySize:             7,
+			},
+			Preview: UserDefaultsPreview{
+				Image:              boolPtr(false),
+				Video:              boolPtr(false),
+				Audio:              boolPtr(false),
+				MotionVideoPreview: boolPtr(false),
+				Office:             boolPtr(false),
+				PopUp:              boolPtr(false),
+				DisablePreviewExt:  ".exe",
+				HighQuality:        boolPtr(true),
+				Folder:             boolPtr(false),
+				Models:             boolPtr(false),
+			},
+			FileViewer: UserDefaultsFileViewer{
+				EditorQuickSave:         true,
+				AutoplayMedia:           boolPtr(false),
+				DisableViewingExt:       ".bat",
+				DisableOnlyOfficeExt:    ".x",
+				PreferEditorForMarkdown: true,
+				DebugOffice:             true,
+				DefaultMediaPlayer:      true,
+			},
+			Search: UserDefaultsSearch{
+				DisableOptions: true,
+			},
+			UI: UserDefaultsUI{
+				DarkMode:    &dark,
+				ThemeColor:  "var(--red)",
+				CustomTheme: "Night",
+				Locale:      "de",
+			},
+			FileLoading: users.FileLoading{
+				MaxConcurrent:     3,
+				UploadChunkSize:   5,
+				DownloadChunkSize: 2,
+			},
+			Account: UserDefaultsAccount{
+				Permissions: UserDefaultsAccountPermissions{
+					Api:      true,
+					Admin:    true,
+					Modify:   true,
+					Share:    true,
+					Realtime: true,
+					Delete:   true,
+					Create:   true,
+					Download: &dlFalse,
+				},
+				LockPassword:               true,
+				DisableSettings:            true,
+				LoginMethod:                "password",
+				DisableUpdateNotifications: true,
+			},
+		},
+	}
+
+	u := &users.User{Username: "alice"}
+	ApplyUserDefaults(u)
+
+	want := users.User{
+		DisableSettings: true,
+		LockPassword:    true,
+		LoginMethod:     users.LoginMethodPassword,
+		Permissions: users.Permissions{
+			Api:      true,
+			Admin:    true,
+			Modify:   true,
+			Share:    true,
+			Realtime: true,
+			Delete:   true,
+			Create:   true,
+			Download: false,
+		},
+		NonAdminEditable: users.NonAdminEditable{
+			EditorQuickSave:            true,
+			HideSidebarFileActions:     true,
+			DisableQuickToggles:        true,
+			DisableSearchOptions:       true,
+			StickySidebar:              false,
+			HideFilesInTree:            true,
+			DarkMode:                   false,
+			Locale:                     "de",
+			ViewMode:                   "list",
+			SingleClick:                true,
+			ShowHidden:                 true,
+			DateFormat:                 true,
+			GallerySize:                7,
+			ThemeColor:                 "var(--red)",
+			QuickDownload:              true,
+			DisablePreviewExt:          ".exe",
+			DisableViewingExt:          ".bat",
+			DisableUpdateNotifications: true,
+			DisableOfficePreviewExt:    ".x", // deprecated: mapped to DisableOnlyOfficeExt
+			DisableOnlyOfficeExt:       ".x",
+			CustomTheme:                "Night",
+			ShowSelectMultiple:         true,
+			DebugOffice:                true,
+			DeleteWithoutConfirming:    true,
+			DeleteAfterArchive:         false,
+			PreferEditorForMarkdown:    true,
+			ShowToolsInSidebar:         true,
+			FileLoading: users.FileLoading{
+				MaxConcurrent:     3,
+				UploadChunkSize:   5,
+				DownloadChunkSize: 2,
+			},
+			Preview: users.Preview{
+				DisableHideSidebar: true,
+				Image:              false,
+				Video:              false,
+				Audio:              false,
+				MotionVideoPreview: false,
+				Office:             false,
+				PopUp:              false,
+				AutoplayMedia:      false,
+				DefaultMediaPlayer: true,
+				Folder:             false,
+				Models:             false,
+			},
+		},
+	}
+
+	if diff := cmp.Diff(want.Permissions, u.Permissions); diff != "" {
+		t.Fatalf("Permissions mismatch (-want +got):\n%s", diff)
+	}
+	if diff := cmp.Diff(want.NonAdminEditable, u.NonAdminEditable); diff != "" {
+		t.Fatalf("NonAdminEditable mismatch (-want +got):\n%s", diff)
+	}
+	if u.DisableSettings != want.DisableSettings {
+		t.Fatalf("DisableSettings: got %v want %v", u.DisableSettings, want.DisableSettings)
+	}
+	if u.LockPassword != want.LockPassword {
+		t.Fatalf("LockPassword: got %v want %v", u.LockPassword, want.LockPassword)
+	}
+	if u.LoginMethod != want.LoginMethod {
+		t.Fatalf("LoginMethod: got %q want %q", u.LoginMethod, want.LoginMethod)
+	}
+}
+
+func TestApplyUserDefaults_setsLoginMethodWhenEmpty(t *testing.T) {
+	saved := Config
+	defer func() { Config = saved }()
+
+	Config = Settings{
+		Server: Server{},
+		UserDefaults: UserDefaults{
+			Account: UserDefaultsAccount{
+				LoginMethod: "jwt",
+			},
+		},
+	}
+	u := &users.User{Username: "x"}
+	ApplyUserDefaults(u)
+	if u.LoginMethod != users.LoginMethodJwt {
+		t.Fatalf("LoginMethod: got %q want jwt", u.LoginMethod)
+	}
+}
+
+func TestApplyUserDefaults_preservesLoginMethodWhenAlreadySet(t *testing.T) {
+	saved := Config
+	defer func() { Config = saved }()
+
+	Config = Settings{
+		Server: Server{},
+		UserDefaults: UserDefaults{
+			Account: UserDefaultsAccount{
+				LoginMethod: "password",
+			},
+		},
+	}
+	u := &users.User{Username: "x", LoginMethod: users.LoginMethodProxy}
+	ApplyUserDefaults(u)
+	if u.LoginMethod != users.LoginMethodProxy {
+		t.Fatalf("LoginMethod: got %q want proxy", u.LoginMethod)
+	}
+}

backend/common/settings/auth.go

@@ -6,8 +6,11 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"strconv"
+	"strings"
 
 	"github.com/coreos/go-oidc/v3/oidc"
+	ldap "github.com/go-ldap/ldap/v3"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
@@ -29,6 +32,18 @@ func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error
 	return t.base.RoundTrip(reqCopy)
 }
 
+// AuthCommon contains fields shared across multiple authentication methods
+type AuthCommon struct {
+	Enabled           bool     `json:"enabled"`           // whether to enable this authentication method.
+	AdminGroup        string   `json:"adminGroup"`        // if set, users in this group will be granted admin privileges
+	UserGroups        []string `json:"userGroups"`        // if set, only users in these groups are allowed to log in. Blocks all other users even with valid credentials.
+	GroupsClaim       string   `json:"groupsClaim"`       // the JSON field name to read groups from. Default is "groups"
+	UserIdentifier    string   `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username" in oidc, "sub" in jwt. Other common values are "email" or "username", or "phone"
+	DisableVerifyTLS  bool     `json:"disableVerifyTLS"`  // disable TLS verification (insecure, for testing only)
+	LogoutRedirectUrl string   `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
+	CreateUser        bool     `json:"createUser"`        // deprecated: always true for supported authentication methods
+}
+
 type Auth struct {
 	TokenExpirationHours int          `json:"tokenExpirationHours"` // time in hours each web UI session token is valid for. Default is 2 hours.
 	Methods              LoginMethods `json:"methods"`
@@ -44,6 +59,9 @@ type LoginMethods struct {
 	NoAuth       bool               `json:"noauth"` // if set to true, overrides all other auth methods and disables authentication
 	PasswordAuth PasswordAuthConfig `json:"password" validate:"omitempty"`
 	OidcAuth     OidcConfig         `json:"oidc" validate:"omitempty"`
+	LdapAuth     LdapConfig         `json:"ldap" validate:"omitempty"`
+	JwtAuth      JwtAuthConfig      `json:"jwt" validate:"omitempty"`
+	PasskeyAuth  PasskeyAuthConfig  `json:"passkey" validate:"omitempty"`
 }
 
 type PasswordAuthConfig struct {
@@ -55,10 +73,8 @@ type PasswordAuthConfig struct {
 }
 
 type ProxyAuthConfig struct {
-	Enabled           bool   `json:"enabled"`
-	CreateUser        bool   `json:"createUser"`        // create user if not exists
-	Header            string `json:"header"`            // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
-	LogoutRedirectUrl string `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
+	AuthCommon `json:",inline"`
+	Header     string `json:"header"` // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
 }
 
 type Recaptcha struct {
@@ -69,19 +85,74 @@ type Recaptcha struct {
 
 // OpenID OAuth2.0
 type OidcConfig struct {
-	Enabled           bool                  `json:"enabled"`           // whether to enable OIDC authentication
-	ClientID          string                `json:"clientId"`          // secret: client id of the OIDC application
-	ClientSecret      string                `json:"clientSecret"`      // secret: client secret of the OIDC application
-	IssuerUrl         string                `json:"issuerUrl"`         // authorization URL of the OIDC provider
-	Scopes            string                `json:"scopes"`            // scopes to request from the OIDC provider
-	UserIdentifier    string                `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username", can also be "email" or "username", or "phone"
-	DisableVerifyTLS  bool                  `json:"disableVerifyTLS"`  // disable TLS verification for the OIDC provider. This is insecure and should only be used for testing.
-	LogoutRedirectUrl string                `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
-	CreateUser        bool                  `json:"createUser"`        // create user if not exists
-	AdminGroup        string                `json:"adminGroup"`        // if set, users in this group will be granted admin privileges.
-	GroupsClaim       string                `json:"groupsClaim"`       // the JSON field name to read groups from. Default is "groups"
-	Provider          *oidc.Provider        `json:"-"`                 // OIDC provider
-	Verifier          *oidc.IDTokenVerifier `json:"-"`                 // OIDC verifier
+	AuthCommon   `json:",inline"`
+	ClientID     string                `json:"clientId"`     // secret: client id of the OIDC application
+	ClientSecret string                `json:"clientSecret"` // secret: client secret of the OIDC application
+	IssuerUrl    string                `json:"issuerUrl"`    // authorization URL of the OIDC provider
+	Scopes       string                `json:"scopes"`       // scopes to request from the OIDC provider
+	Provider     *oidc.Provider        `json:"-"`            // OIDC provider
+	Verifier     *oidc.IDTokenVerifier `json:"-"`            // OIDC verifier
+}
+
+type LdapConfig struct {
+	AuthCommon   `json:",inline"`
+	Server       string `json:"server"`       // scheme://host:port of the LDAP server (e.g. ldap://localhost:389)
+	BaseDN       string `json:"baseDN"`       // LDAP search base DN (e.g. dc=ldap,dc=goauthentik,dc=io)
+	UserDN       string `json:"userDN"`       // Bind DN for service account (e.g. cn=admin,ou=users,dc=ldap,dc=goauthentik,dc=io)
+	UserPassword string `json:"userPassword"` // Bind password for service account
+	UserFilter   string `json:"userFilter"`   // Search filter for finding user by username. Default (&(cn=%s)(objectClass=user)); override e.g. (email=%s) or (sAMAccountName=%s) for other directories.
+	Port         int    `json:"-"`            // derived from server
+	Scheme       string `json:"-"`            // derived from server
+	Host         string `json:"-"`            // derived from server
+}
+
+// JwtAuthConfig configures external JWT token authentication
+// Similar to Grafana's JWT auth: verifies HS* tokens with a shared secret, or RS*/ES* with a PEM public key (or certificate)
+// The query parameter is hardcoded to "jwt" (e.g. ?jwt=<token>)
+type JwtAuthConfig struct {
+	AuthCommon `json:",inline"`
+	Header     string `json:"header"`    // HTTP header to look for JWT token (e.g. X-JWT-Assertion). Default is "X-JWT-Assertion"
+	Secret     string `json:"secret"`    // secret: Shared secret key/bytes for verifying JWT token signatures (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
+	Algorithm  string `json:"algorithm"` // JWT signing algorithm (HS256, HS384, HS512, RS256, ES256). Default is "HS256"
+}
+
+// PasskeyAuthConfig configures WebAuthn / Passkey authentication as a second factor.
+type PasskeyAuthConfig struct {
+	Enabled         bool     `json:"enabled"`         // whether to enable passkey MFA
+	RPDisplayName   string   `json:"rpDisplayName"`   // the Relying Party display name (defaults to frontend name)
+	RPID            string   `json:"rpId"`            // the Relying Party ID; if empty, auto-derived from base URL host
+	RPOrigins       []string `json:"rpOrigins"`       // allowed origins; if empty, auto-derived from base URL
+	LoginButtonText string   `json:"loginButtonText"` // custom text for the passkey login button
+}
+
+// ValidateLdapAuth checks LDAP config and sets defaults. Call when LDAP is enabled.
+func ValidateLdapAuth() error {
+	ldapCfg := &Config.Auth.Methods.LdapAuth
+	if ldapCfg.Server == "" {
+		return fmt.Errorf("LDAP server is required when LDAP is enabled")
+	}
+	scheme, host, port, err := parseLdapServer(ldapCfg.Server)
+	if err != nil {
+		return fmt.Errorf("LDAP server is invalid: %w", err)
+	}
+	ldapCfg.Server = fmt.Sprintf("%s://%s:%d", scheme, host, port)
+	ldapCfg.Scheme = scheme
+	ldapCfg.Host = host
+	ldapCfg.Port = port
+
+	if ldapCfg.BaseDN == "" {
+		return fmt.Errorf("LDAP baseDN is required when LDAP is enabled")
+	}
+	if ldapCfg.UserDN == "" {
+		return fmt.Errorf("LDAP userDN (bind DN) is required when LDAP is enabled")
+	}
+	if ldapCfg.UserFilter == "" {
+		ldapCfg.UserFilter = "(&(cn=%s)(objectClass=user))"
+	}
+	if err := verifyLdapConnection(); err != nil {
+		logger.Fatalf("LDAP connection check failed: %v", err)
+	}
+	return nil
 }
 
 // ValidateOidcAuth processes the OIDC callback and retrieves user identity
@@ -133,3 +204,105 @@ func validateOidcAuth() error {
 
 	return nil
 }
+
+func parseLdapServer(server string) (scheme, host string, port int, err error) {
+	parts := strings.Split(server, "://")
+	if len(parts) != 2 {
+		return "", "", 0, fmt.Errorf("invalid LDAP server: %s", server)
+	}
+	scheme = strings.ToLower(parts[0])
+	if scheme != "ldap" && scheme != "ldaps" {
+		return "", "", 0, fmt.Errorf("invalid LDAP scheme: %s", scheme)
+	}
+	hostParts := strings.Split(parts[1], ":")
+	host = strings.TrimSuffix(hostParts[0], "/")
+	if len(hostParts) > 1 && hostParts[1] != "" {
+		port, err = strconv.Atoi(strings.TrimSuffix(hostParts[1], "/"))
+		if err != nil || port == 0 {
+			return "", "", 0, fmt.Errorf("invalid LDAP port: %s", hostParts[1])
+		}
+	} else {
+		if scheme == "ldaps" {
+			port = 636
+		} else {
+			port = 389
+		}
+	}
+	return scheme, host, port, nil
+}
+
+// VerifyLdapConnection tests that the LDAP server is reachable, can bind (if credentials set), and responds to a search.
+func verifyLdapConnection() error {
+	if Config.Auth.Methods.LdapAuth.Server == "" {
+		return fmt.Errorf("LDAP server is required when LDAP is enabled")
+	}
+	if Config.Auth.Methods.LdapAuth.BaseDN == "" {
+		return fmt.Errorf("LDAP baseDN is required for connection verification")
+	}
+	var opts []ldap.DialOpt
+	scheme := Config.Auth.Methods.LdapAuth.Scheme
+	host := Config.Auth.Methods.LdapAuth.Host
+	port := Config.Auth.Methods.LdapAuth.Port
+	if Config.Auth.Methods.LdapAuth.DisableVerifyTLS && scheme == "ldaps" {
+		opts = append(opts, ldap.DialWithTLSConfig(&tls.Config{InsecureSkipVerify: true}))
+	}
+	fullURL := fmt.Sprintf("%s://%s:%d", scheme, host, port)
+	conn, err := ldap.DialURL(fullURL, opts...)
+	if err != nil {
+		return fmt.Errorf("LDAP connection failed (is the LDAP outpost running at %s? use port 389 for LDAP, 636 for LDAPS; this is not the HTTP port): %w", fullURL, err)
+	}
+	defer conn.Close()
+	if Config.Auth.Methods.LdapAuth.UserDN != "" && Config.Auth.Methods.LdapAuth.UserPassword != "" {
+		if err = conn.Bind(Config.Auth.Methods.LdapAuth.UserDN, Config.Auth.Methods.LdapAuth.UserPassword); err != nil {
+			return fmt.Errorf("LDAP bind failed (check userDN and userPassword): %w", err)
+		}
+		defer func() { _ = conn.Unbind() }()
+	}
+	// Dummy search to verify the server responds to LDAP search (same path that fails at login if misconfigured).
+	searchRequest := ldap.NewSearchRequest(
+		Config.Auth.Methods.LdapAuth.BaseDN,
+		ldap.ScopeBaseObject,
+		ldap.NeverDerefAliases,
+		0,
+		0,
+		false,
+		"(objectClass=*)",
+		[]string{"1.1"}, // no attributes
+		nil,
+	)
+	_, err = conn.Search(searchRequest)
+	if err != nil {
+		return fmt.Errorf("LDAP search test failed (server may require StartTLS or bind before search): %w", err)
+	}
+	return nil
+}
+
+// ValidateJwtAuth checks JWT config and sets defaults. Call when JWT auth is enabled.
+func ValidateJwtAuth() error {
+	jwtCfg := &Config.Auth.Methods.JwtAuth
+	if jwtCfg.Secret == "" {
+		return fmt.Errorf("JWT secret is required when JWT auth is enabled")
+	}
+	if jwtCfg.Header == "" {
+		jwtCfg.Header = "X-JWT-Assertion"
+	}
+	if jwtCfg.Algorithm == "" {
+		jwtCfg.Algorithm = "HS256"
+	}
+	if jwtCfg.GroupsClaim == "" {
+		jwtCfg.GroupsClaim = "groups"
+	}
+	if jwtCfg.UserIdentifier == "" {
+		jwtCfg.UserIdentifier = "sub"
+	}
+	// Validate algorithm
+	validAlgos := map[string]bool{
+		"HS256": true, "HS384": true, "HS512": true,
+		"RS256": true, "RS384": true, "RS512": true,
+		"ES256": true, "ES384": true, "ES512": true,
+	}
+	if !validAlgos[jwtCfg.Algorithm] {
+		return fmt.Errorf("unsupported JWT algorithm: %s. Supported: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512", jwtCfg.Algorithm)
+	}
+	return nil
+}

backend/common/settings/auth_ldap_test.go

@@ -0,0 +1,221 @@
+package settings
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestParseLdapServer(t *testing.T) {
+	tests := []struct {
+		name       string
+		server     string
+		wantScheme string
+		wantHost   string
+		wantPort   int
+		wantErr    bool
+	}{
+		{
+			name:       "ldap with host and port",
+			server:     "ldap://localhost:389",
+			wantScheme: "ldap",
+			wantHost:   "localhost",
+			wantPort:   389,
+			wantErr:    false,
+		},
+		{
+			name:       "ldaps with host and port",
+			server:     "ldaps://ldap.example.com:636",
+			wantScheme: "ldaps",
+			wantHost:   "ldap.example.com",
+			wantPort:   636,
+			wantErr:    false,
+		},
+		{
+			name:       "ldap with trailing slash",
+			server:     "ldap://host:389/",
+			wantScheme: "ldap",
+			wantHost:   "host",
+			wantPort:   389,
+			wantErr:    false,
+		},
+		{
+			name:       "ldap port not provided defaults to 389",
+			server:     "ldap://localhost",
+			wantScheme: "ldap",
+			wantHost:   "localhost",
+			wantPort:   389,
+			wantErr:    false,
+		},
+		{
+			name:       "ldaps port not provided defaults to 636",
+			server:     "ldaps://ldap.example.com",
+			wantScheme: "ldaps",
+			wantHost:   "ldap.example.com",
+			wantPort:   636,
+			wantErr:    false,
+		},
+		{
+			name:    "port provided but invalid returns error",
+			server:  "ldap://host:bad",
+			wantErr: true,
+		},
+		{
+			name:    "port provided but invalid (ldaps) returns error",
+			server:  "ldaps://host:xyz",
+			wantErr: true,
+		},
+		{
+			name:    "port zero returns error",
+			server:  "ldap://host:0",
+			wantErr: true,
+		},
+		{
+			name:    "empty server",
+			server:  "",
+			wantErr: true,
+		},
+		{
+			name:    "no scheme",
+			server:  "localhost:389",
+			wantErr: true,
+		},
+		{
+			name:    "invalid scheme",
+			server:  "http://localhost:389",
+			wantErr: true,
+		},
+		{
+			name:    "invalid scheme ftp",
+			server:  "ftp://localhost:389",
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotScheme, gotHost, gotPort, err := parseLdapServer(tt.server)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("parseLdapServer() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !tt.wantErr {
+				if gotScheme != tt.wantScheme {
+					t.Errorf("parseLdapServer() scheme = %v, want %v", gotScheme, tt.wantScheme)
+				}
+				if gotHost != tt.wantHost {
+					t.Errorf("parseLdapServer() host = %v, want %v", gotHost, tt.wantHost)
+				}
+				if gotPort != tt.wantPort {
+					t.Errorf("parseLdapServer() port = %v, want %v", gotPort, tt.wantPort)
+				}
+			}
+		})
+	}
+}
+
+func TestVerifyLdapConnection_ValidationOnly(t *testing.T) {
+	// Save and restore global config so we don't affect other tests
+	saved := Config.Auth.Methods.LdapAuth
+	defer func() { Config.Auth.Methods.LdapAuth = saved }()
+
+	t.Run("empty server returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "",
+			BaseDN:     "dc=test,dc=local",
+		}
+		err := verifyLdapConnection()
+		if err == nil {
+			t.Fatal("verifyLdapConnection() expected error for empty server")
+		}
+		if !strings.Contains(err.Error(), "LDAP server is required") {
+			t.Errorf("verifyLdapConnection() error = %v, want message containing 'LDAP server is required'", err)
+		}
+	})
+
+	t.Run("empty baseDN returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "ldap://localhost:389",
+			Scheme:     "ldap",
+			Host:       "localhost",
+			Port:       389,
+			BaseDN:     "",
+		}
+		err := verifyLdapConnection()
+		if err == nil {
+			t.Fatal("verifyLdapConnection() expected error for empty baseDN")
+		}
+		if !strings.Contains(err.Error(), "baseDN is required") {
+			t.Errorf("verifyLdapConnection() error = %v, want message containing 'baseDN is required'", err)
+		}
+	})
+}
+
+func TestValidateLdapAuth_ConfigValidation(t *testing.T) {
+	saved := Config.Auth.Methods.LdapAuth
+	defer func() { Config.Auth.Methods.LdapAuth = saved }()
+
+	t.Run("empty server returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "",
+			BaseDN:     "dc=test,dc=local",
+			UserDN:     "cn=admin,dc=test,dc=local",
+		}
+		err := ValidateLdapAuth()
+		if err == nil {
+			t.Fatal("ValidateLdapAuth() expected error for empty server")
+		}
+		if !strings.Contains(err.Error(), "server is required") {
+			t.Errorf("ValidateLdapAuth() error = %v", err)
+		}
+	})
+
+	t.Run("invalid server URL returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "not-a-valid-ldap-url",
+			BaseDN:     "dc=test,dc=local",
+			UserDN:     "cn=admin,dc=test,dc=local",
+		}
+		err := ValidateLdapAuth()
+		if err == nil {
+			t.Fatal("ValidateLdapAuth() expected error for invalid server URL")
+		}
+		if !strings.Contains(err.Error(), "invalid") {
+			t.Errorf("ValidateLdapAuth() error = %v", err)
+		}
+	})
+
+	t.Run("empty baseDN returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "ldap://localhost:389",
+			BaseDN:     "",
+			UserDN:     "cn=admin,dc=test,dc=local",
+		}
+		err := ValidateLdapAuth()
+		if err == nil {
+			t.Fatal("ValidateLdapAuth() expected error for empty baseDN")
+		}
+		if !strings.Contains(err.Error(), "baseDN is required") {
+			t.Errorf("ValidateLdapAuth() error = %v", err)
+		}
+	})
+
+	t.Run("empty userDN returns error", func(t *testing.T) {
+		Config.Auth.Methods.LdapAuth = LdapConfig{
+			AuthCommon: AuthCommon{Enabled: true},
+			Server:     "ldap://localhost:389",
+			BaseDN:     "dc=test,dc=local",
+			UserDN:     "",
+		}
+		err := ValidateLdapAuth()
+		if err == nil {
+			t.Fatal("ValidateLdapAuth() expected error for empty userDN")
+		}
+		if !strings.Contains(err.Error(), "userDN") {
+			t.Errorf("ValidateLdapAuth() error = %v", err)
+		}
+	})
+}

backend/common/settings/config.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"log"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"runtime"
 	"slices"
@@ -38,6 +39,8 @@ func Initialize(configFile string) {
 	setupLogging()
 	// setup logging first to ensure we log any errors
 	setupEnv()
+	// Migrate deprecated UserDefaults fields to new organized structure
+	migrateUserDefaults()
 	err = ValidateConfig(Config)
 	if err != nil {
 		errmsg := "The provided config file failed validation. "
@@ -50,12 +53,13 @@ func Initialize(configFile string) {
 	}
 	setupFs()
 	setupServer()
+	setupHttp()
 	setupAuth(false)
 	setupSources(false)
 	InitializeUserResolvers() // Initialize user package resolvers after sources are set up
 	setupUrls()
 	setupFrontend(false)
-	setupMedia()
+	setupMedia(false)
 }
 
 func setupServer() {
@@ -80,6 +84,15 @@ func setupEnv() {
 	}
 }
 
+func setupHttp() {
+	if len(Config.Http.TrustedHeadersArray) > 0 {
+		Config.Http.TrustedHeaders = make(map[string]bool)
+		for _, header := range Config.Http.TrustedHeadersArray {
+			Config.Http.TrustedHeaders[strings.ToLower(header)] = true
+		}
+	}
+}
+
 func setupFs() {
 	// Convert permission values (like 644, 755) to octal interpretation
 	filePermOctal, err := strconv.ParseUint(Config.Server.Filesystem.CreateFilePermission, 8, 32)
@@ -92,11 +105,15 @@ func setupFs() {
 		Config.Server.Filesystem.CreateDirectoryPermission = "755"
 		dirPermOctal, _ = strconv.ParseUint("755", 8, 32)
 	}
-	fileutils.SetFsPermissions(os.FileMode(filePermOctal), os.FileMode(dirPermOctal))
+	fileutils.SetFsPermissions(uint32(filePermOctal), uint32(dirPermOctal))
 
 	// Perform mandatory cache directory speed test
 	testCacheDirSpeed()
 
+	if err := PrepareDownloadSpoolDir(); err != nil {
+		logger.Fatalf("cacheDir failed to prepare download spool: %v", err)
+	}
+
 	logger.Infof("cache directory setup successfully: %v", Config.Server.CacheDir)
 
 }
@@ -280,42 +297,53 @@ func setupFrontend(generate bool) {
 	loadCustomFavicon()
 }
 
-func setupMedia() {
-	// If VideoPreview is not initialized, initialize with all types enabled
-	if Config.Integrations.Media.Convert.VideoPreview == nil {
-		Config.Integrations.Media.Convert.VideoPreview = make(map[VideoPreviewType]bool)
-		for _, t := range AllVideoPreviewTypes {
-			Config.Integrations.Media.Convert.VideoPreview[t] = true
-		}
-		return
+func setupMedia(generate bool) {
+	// Save user's explicit config before applying defaults
+	userImageConfig := make(map[ImagePreviewType]*bool)
+	for k, v := range Config.Integrations.Media.Convert.ImagePreview {
+		userImageConfig[k] = v
 	}
 
-	// If VideoPreview map is empty, it means user didn't configure any video preview settings
-	// In this case, enable all by default
-	if len(Config.Integrations.Media.Convert.VideoPreview) == 0 {
-		for _, t := range AllVideoPreviewTypes {
-			Config.Integrations.Media.Convert.VideoPreview[t] = true
-		}
-		return
+	// Re-initialize with defaults (gets wiped out during YAML unmarshal)
+	Config.Integrations.Media.Convert.ImagePreview = make(map[ImagePreviewType]*bool)
+	Config.Integrations.Media.Convert.ImagePreview[HEICImagePreview] = boolPtr(false) // HEIC defaults to disabled
+	Config.Integrations.Media.Convert.ImagePreview[JPEGImagePreview] = boolPtr(true)  // JPEG fallback defaults to enabled
+
+	// Apply user overrides (only for keys explicitly set in YAML)
+	for k, v := range userImageConfig {
+		Config.Integrations.Media.Convert.ImagePreview[k] = v
 	}
 
-	// User has explicitly configured some video preview settings
-	// Start with all enabled, then apply user overrides
-	userConfig := make(map[VideoPreviewType]bool)
+	// VideoPreview: Merge user config with defaults
+	// Save user's explicit config from YAML
+	userVideoConfig := make(map[VideoPreviewType]*bool)
 	for k, v := range Config.Integrations.Media.Convert.VideoPreview {
-		userConfig[k] = v
+		userVideoConfig[k] = v
 	}
 
-	// Reset to defaults (all enabled)
-	Config.Integrations.Media.Convert.VideoPreview = make(map[VideoPreviewType]bool)
+	// Re-initialize with defaults (all enabled)
+	Config.Integrations.Media.Convert.VideoPreview = make(map[VideoPreviewType]*bool)
 	for _, t := range AllVideoPreviewTypes {
-		Config.Integrations.Media.Convert.VideoPreview[t] = true
+		Config.Integrations.Media.Convert.VideoPreview[t] = boolPtr(true)
 	}
 
-	// Apply user overrides (only for explicitly set values)
-	for k, v := range userConfig {
+	// Apply user overrides (only for keys explicitly set in YAML)
+	for k, v := range userVideoConfig {
 		Config.Integrations.Media.Convert.VideoPreview[k] = v
 	}
+
+	// Resolve exiftool path once at startup: validate user path or discover via PATH
+	if Config.Integrations.Media.ExiftoolPath != "" && !generate {
+		if err := exec.Command(Config.Integrations.Media.ExiftoolPath, "-ver").Run(); err != nil {
+			logger.Warningf("exiftool path is invalid or not executable: %q (%v); disabling exiftool", Config.Integrations.Media.ExiftoolPath, err)
+			Config.Integrations.Media.ExiftoolPath = ""
+		}
+	}
+	if Config.Integrations.Media.ExiftoolPath == "" && !generate {
+		if path, err := exec.LookPath("exiftool"); err == nil && path != "" {
+			Config.Integrations.Media.ExiftoolPath = path
+		}
+	}
 }
 
 func setupSources(generate bool) {
@@ -338,11 +366,7 @@ func setupSources(generate bool) {
 			if name == "\\" {
 				name = strings.Split(realPath, ":")[0]
 			}
-			if generate {
-				source.Path = generatorPath // use placeholder path
-			} else {
-				source.Path = realPath // use absolute path
-			}
+			source.Path = realPath // use absolute path
 			if source.Name == "" {
 				_, ok := Config.Server.SourceMap[source.Path]
 				if ok {
@@ -351,6 +375,10 @@ func setupSources(generate bool) {
 					source.Name = name
 				}
 			}
+			if generate {
+				source.Path = generatorPath // use placeholder path
+				source.Name = "Source Name"
+			}
 			modifyExcludeInclude(source)
 			setConditionals(source)
 			if source.Config.DefaultUserScope == "" {
@@ -422,27 +450,45 @@ func setupAuth(generate bool) {
 	if Config.Auth.Methods.ProxyAuth.Enabled {
 		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "proxy")
 	}
-	if Config.Auth.Methods.OidcAuth.Enabled {
-		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "oidc")
-	}
 	if Config.Auth.Methods.NoAuth {
 		logger.Warning("Configured with no authentication, this is not recommended.")
 		Config.Auth.AuthMethods = []string{"disabled"}
 	}
 	if Config.Auth.Methods.OidcAuth.Enabled || generate {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "oidc")
 		err := validateOidcAuth()
 		if err != nil && !generate {
 			logger.Fatalf("Error validating OIDC auth: %v", err)
 		}
 		logger.Info("OIDC Auth configured successfully")
 	}
+	if Config.Auth.Methods.LdapAuth.Enabled || generate {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "ldap")
+		err := ValidateLdapAuth()
+		if err != nil && !generate {
+			logger.Fatalf("Error validating LDAP auth: %v", err)
+		}
+		logger.Info("LDAP Auth configured successfully")
+	}
+	if Config.Auth.Methods.JwtAuth.Enabled || generate {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "jwt")
+		err := ValidateJwtAuth()
+		if err != nil && !generate {
+			logger.Fatalf("Error validating JWT auth: %v", err)
+		}
+		logger.Info("JWT Auth configured successfully")
+	}
+	if Config.Auth.Methods.PasskeyAuth.Enabled || generate {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "passkey")
+		logger.Info("Passkey Auth configured successfully")
+	}
 
 	// use password auth as default if no auth methods are set
 	if len(Config.Auth.AuthMethods) == 0 {
 		Config.Auth.Methods.PasswordAuth.Enabled = true
 		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "password")
 	}
-	Config.UserDefaults.LoginMethod = Config.Auth.AuthMethods[0]
+	Config.UserDefaults.Account.LoginMethod = Config.Auth.AuthMethods[0]
 
 }
 
@@ -454,31 +500,324 @@ func setupLogging() {
 			},
 		}
 	}
-	for _, logConfig := range Config.Server.Logging {
+	for i := range Config.Server.Logging {
+		cfg := &Config.Server.Logging[i]
 		// Enable debug logging automatically in dev mode
-		levels := logConfig.Levels
+		levels := cfg.Levels
 		if os.Getenv("FILEBROWSER_DEVMODE") == "true" {
 			levels = "info|warning|error|debug"
 		}
-
-		logConfig := logger.JsonConfig{
-			Levels:     levels,
-			ApiLevels:  logConfig.ApiLevels,
-			Output:     logConfig.Output,
-			Utc:        logConfig.Utc,
-			NoColors:   logConfig.NoColors,
-			Json:       logConfig.Json,
-			Structured: false,
+		pattern := cfg.ApiFilter
+		if pattern == "" {
+			pattern = "^/health|^/favicon.ico|^/static|^/public/static"
 		}
-		err := logger.EnableCompatibilityMode(logConfig)
+		jsonCfg := logger.JsonConfig{
+			Levels:         levels,
+			ApiLevels:      cfg.ApiLevels,
+			Output:         cfg.Output,
+			Utc:            cfg.Utc,
+			NoColors:       cfg.NoColors,
+			Json:           cfg.Json,
+			Structured:     false,
+			ApiPathExclude: pattern,
+		}
+		err := logger.EnableCompatibilityMode(jsonCfg)
 		if err != nil {
 			log.Println("[ERROR] Failed to set up logger:", err)
 		}
 	}
 }
 
+// migrateUserDefaults migrates deprecated UserDefaults fields to the new organized structure.
+// This function maintains backwards compatibility by checking if new fields are unset and copying
+// values from old deprecated fields if found. Logs warnings when old fields are migrated.
+func migrateUserDefaults() {
+	ud := &Config.UserDefaults
+	hasOldFields := false
+
+	// Helper function to check if a bool pointer is unset (nil)
+	isUnsetBoolPtr := func(v *bool) bool {
+		return v == nil
+	}
+
+	// Helper function to check if a string is unset (empty)
+	isUnsetString := func(v string) bool {
+		return v == ""
+	}
+
+	// Helper function to check if an int is unset (zero)
+	isUnsetInt := func(v int) bool {
+		return v == 0
+	}
+
+	// Migrate Preview-related deprecated fields
+	if !ud.Sidebar.DisableHideOnPreview && ud.Preview.DisableHideSidebar {
+		ud.Sidebar.DisableHideOnPreview = ud.Preview.DisableHideSidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.disableHideSidebar' to 'sidebar.disableHideOnPreview'")
+	}
+
+	if !ud.FileViewer.DefaultMediaPlayer && ud.Preview.DefaultMediaPlayer {
+		ud.FileViewer.DefaultMediaPlayer = ud.Preview.DefaultMediaPlayer
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.defaultMediaPlayer' to 'fileViewer.defaultMediaPlayer'")
+	}
+
+	if isUnsetBoolPtr(ud.FileViewer.AutoplayMedia) && ud.Preview.AutoplayMedia {
+		autoplay := ud.Preview.AutoplayMedia
+		ud.FileViewer.AutoplayMedia = &autoplay
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.autoplayMedia' to 'fileViewer.autoplayMedia'")
+	}
+
+	if isUnsetString(ud.Preview.DisablePreviewExt) && !isUnsetString(ud.DisablePreviewExt) {
+		ud.Preview.DisablePreviewExt = ud.DisablePreviewExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disablePreviewExt' to 'preview.disablePreviewExt'")
+	}
+
+	// Migrate Sidebar fields
+	if !ud.Sidebar.DisableQuickToggles && ud.DisableQuickToggles {
+		ud.Sidebar.DisableQuickToggles = ud.DisableQuickToggles
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableQuickToggles' to 'sidebar.disableQuickToggles'")
+	}
+
+	if !ud.Sidebar.HideFileActions && ud.HideSidebarFileActions {
+		ud.Sidebar.HideFileActions = ud.HideSidebarFileActions
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideSidebarFileActions' to 'sidebar.hideFileActions'")
+	}
+
+	if !ud.Sidebar.Sticky && ud.StickySidebar {
+		ud.Sidebar.Sticky = ud.StickySidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'stickySidebar' to 'sidebar.sticky'")
+	}
+
+	if isUnsetString(ud.Listing.ViewMode) && !isUnsetString(ud.ViewMode) {
+		ud.Listing.ViewMode = ud.ViewMode
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'viewMode' to 'sidebar.viewMode'")
+	}
+
+	if isUnsetInt(ud.Listing.GallerySize) && !isUnsetInt(ud.GallerySize) {
+		ud.Listing.GallerySize = ud.GallerySize
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'gallerySize' to 'sidebar.gallerySize'")
+	}
+
+	if !ud.Sidebar.HideFiles && ud.HideFilesInTree {
+		ud.Sidebar.HideFiles = ud.HideFilesInTree
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideFilesInTree' to 'sidebar.hideFiles'")
+	}
+
+	if isUnsetBoolPtr(ud.Sidebar.ShowTools) && ud.ShowToolsInSidebar != nil {
+		ud.Sidebar.ShowTools = ud.ShowToolsInSidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showToolsInSidebar' to 'sidebar.showTools'")
+	}
+
+	// Migrate Listing fields
+	if !ud.Listing.DeleteWithoutConfirming && ud.DeleteWithoutConfirming {
+		ud.Listing.DeleteWithoutConfirming = ud.DeleteWithoutConfirming
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'deleteWithoutConfirming' to 'listing.deleteWithoutConfirming'")
+	}
+
+	if !ud.Listing.DateFormat && ud.DateFormat {
+		ud.Listing.DateFormat = ud.DateFormat
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'dateFormat' to 'listing.dateFormat'")
+	}
+
+	if !ud.Listing.ShowHidden && ud.ShowHidden {
+		ud.Listing.ShowHidden = ud.ShowHidden
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showHidden' to 'listing.showHidden'")
+	}
+
+	if !ud.Listing.QuickDownload && ud.QuickDownload {
+		ud.Listing.QuickDownload = ud.QuickDownload
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'quickDownload' to 'listing.quickDownload'")
+	}
+
+	if !ud.Listing.ShowSelectMultiple && ud.ShowSelectMultiple {
+		ud.Listing.ShowSelectMultiple = ud.ShowSelectMultiple
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showSelectMultiple' to 'listing.showSelectMultiple'")
+	}
+
+	if !ud.Listing.SingleClick && ud.SingleClick {
+		ud.Listing.SingleClick = ud.SingleClick
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'singleClick' to 'listing.singleClick'")
+	}
+
+	if isUnsetString(ud.Listing.HideFileExt) && !isUnsetString(ud.HideFileExt) {
+		ud.Listing.HideFileExt = ud.HideFileExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideFileExt' to 'listing.hideFileExt'")
+	}
+
+	if !ud.Listing.ShowCopyPath && ud.ShowCopyPath {
+		ud.Listing.ShowCopyPath = ud.ShowCopyPath
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showCopyPath' to 'listing.showCopyPath'")
+	}
+
+	if !ud.Listing.DeleteAfterArchive && ud.DeleteAfterArchive {
+		ud.Listing.DeleteAfterArchive = ud.DeleteAfterArchive
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'deleteAfterArchive' to 'listing.deleteAfterArchive'")
+	}
+
+	// Migrate FileViewer fields
+	if !ud.FileViewer.EditorQuickSave && ud.EditorQuickSave {
+		ud.FileViewer.EditorQuickSave = ud.EditorQuickSave
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'editorQuickSave' to 'fileViewer.editorQuickSave'")
+	}
+
+	if isUnsetString(ud.FileViewer.DisableViewingExt) && !isUnsetString(ud.DisableViewingExt) {
+		ud.FileViewer.DisableViewingExt = ud.DisableViewingExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableViewingExt' to 'fileViewer.disableViewingExt'")
+	}
+
+	if isUnsetString(ud.FileViewer.DisableOnlyOfficeExt) && !isUnsetString(ud.DisableOnlyOfficeExt) {
+		ud.FileViewer.DisableOnlyOfficeExt = ud.DisableOnlyOfficeExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableOnlyOfficeExt' to 'fileViewer.disableOnlyOfficeExt'")
+	}
+
+	if !ud.FileViewer.PreferEditorForMarkdown && ud.PreferEditorForMarkdown {
+		ud.FileViewer.PreferEditorForMarkdown = ud.PreferEditorForMarkdown
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preferEditorForMarkdown' to 'fileViewer.preferEditorForMarkdown'")
+	}
+
+	if !ud.FileViewer.DebugOffice && ud.DebugOffice {
+		ud.FileViewer.DebugOffice = ud.DebugOffice
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'debugOffice' to 'fileViewer.debugOffice'")
+	}
+
+	// Migrate Search fields
+	if !ud.Search.DisableOptions && ud.DisableSearchOptions {
+		ud.Search.DisableOptions = ud.DisableSearchOptions
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableSearchOptions' to 'search.disableOptions'")
+	}
+
+	// Migrate UI fields
+	if isUnsetBoolPtr(ud.UI.DarkMode) && ud.DarkMode != nil {
+		ud.UI.DarkMode = ud.DarkMode
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'darkMode' to 'ui.darkMode'")
+	}
+
+	if isUnsetString(ud.UI.ThemeColor) && !isUnsetString(ud.ThemeColor) {
+		ud.UI.ThemeColor = ud.ThemeColor
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'themeColor' to 'ui.themeColor'")
+	}
+
+	if isUnsetString(ud.UI.CustomTheme) && !isUnsetString(ud.CustomTheme) {
+		ud.UI.CustomTheme = ud.CustomTheme
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'customTheme' to 'ui.customTheme'")
+	}
+
+	if isUnsetString(ud.UI.Locale) && !isUnsetString(ud.Locale) {
+		ud.UI.Locale = ud.Locale
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'locale' to 'ui.locale'")
+	}
+
+	// Migrate Account fields
+	if !ud.Account.LockPassword && ud.LockPassword {
+		ud.Account.LockPassword = ud.LockPassword
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'lockPassword' to 'account.lockPassword'")
+	}
+
+	if !ud.Account.DisableSettings && ud.DisableSettings {
+		ud.Account.DisableSettings = ud.DisableSettings
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableSettings' to 'account.disableSettings'")
+	}
+
+	if isUnsetString(ud.Account.LoginMethod) && !isUnsetString(ud.LoginMethod) {
+		ud.Account.LoginMethod = ud.LoginMethod
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'loginMethod' to 'account.loginMethod'")
+	}
+
+	if !ud.Account.DisableUpdateNotifications && ud.DisableUpdateNotifications {
+		ud.Account.DisableUpdateNotifications = ud.DisableUpdateNotifications
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableUpdateNotifications' to 'account.disableUpdateNotifications'")
+	}
+
+	// Migrate Account Permissions fields
+	if !ud.Account.Permissions.Api && ud.Permissions.Api {
+		ud.Account.Permissions.Api = ud.Permissions.Api
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.api' to 'account.permissions.api'")
+	}
+
+	if !ud.Account.Permissions.Admin && ud.Permissions.Admin {
+		ud.Account.Permissions.Admin = ud.Permissions.Admin
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.admin' to 'account.permissions.admin'")
+	}
+
+	if !ud.Account.Permissions.Modify && ud.Permissions.Modify {
+		ud.Account.Permissions.Modify = ud.Permissions.Modify
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.modify' to 'account.permissions.modify'")
+	}
+
+	if !ud.Account.Permissions.Share && ud.Permissions.Share {
+		ud.Account.Permissions.Share = ud.Permissions.Share
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.share' to 'account.permissions.share'")
+	}
+
+	if !ud.Account.Permissions.Realtime && ud.Permissions.Realtime {
+		ud.Account.Permissions.Realtime = ud.Permissions.Realtime
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.realtime' to 'account.permissions.realtime'")
+	}
+
+	if !ud.Account.Permissions.Delete && ud.Permissions.Delete {
+		ud.Account.Permissions.Delete = ud.Permissions.Delete
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.delete' to 'account.permissions.delete'")
+	}
+
+	if !ud.Account.Permissions.Create && ud.Permissions.Create {
+		ud.Account.Permissions.Create = ud.Permissions.Create
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.create' to 'account.permissions.create'")
+	}
+
+	if isUnsetBoolPtr(ud.Account.Permissions.Download) && ud.Permissions.Download != nil {
+		ud.Account.Permissions.Download = ud.Permissions.Download
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.download' to 'account.permissions.download'")
+	}
+
+	if hasOldFields {
+		logger.Warning("userDefaults: Please update your configuration to use the new organized structure. See documentation for details.")
+	}
+}
+
 func loadConfigWithDefaults(configFile string, generate bool) error {
-	Config = setDefaults(generate)
+	Config = SetDefaults(generate)
 
 	// Check if config file exists
 	if _, err := os.Stat(configFile); err != nil {
@@ -624,9 +963,14 @@ func loadEnvConfig() {
 		logger.Info("Using ReCaptcha Secret from FILEBROWSER_RECAPTCHA_SECRET environment variable")
 	}
 
+	ldapUserPassword := os.Getenv("FILEBROWSER_LDAP_USER_PASSWORD")
+	if ldapUserPassword != "" {
+		Config.Auth.Methods.LdapAuth.UserPassword = ldapUserPassword
+		logger.Info("Using LDAP bind password from FILEBROWSER_LDAP_USER_PASSWORD environment variable")
+	}
 }
 
-func setDefaults(generate bool) Settings {
+func SetDefaults(generate bool) Settings {
 	// get number of CPUs available
 	numCpus := 4 // default to 4 CPUs if runtime.NumCPU() fails or is not available
 	cpus := runtime.NumCPU()
@@ -636,14 +980,9 @@ func setDefaults(generate bool) Settings {
 	database := os.Getenv("FILEBROWSER_DATABASE")
 	if database == "" {
 		database = "database.db"
-	} else {
-		// check if database file exists
-		if _, err := os.Stat(database); os.IsNotExist(err) {
-			database = "database.db"
-		}
 	}
 	if _, err := os.Stat(database); os.IsNotExist(err) {
-		logger.Warning("database file could not be found. If this is unexpected, the default path is `./database.db`, but it can be configured in the config file under `server.database`.")
+		logger.Warning("database file could not be found. If this is unexpected, please set the FILEBROWSER_DATABASE environment variable to the correct path.")
 	}
 	s := Settings{
 		Server: Server{
@@ -653,13 +992,14 @@ func setDefaults(generate bool) Settings {
 			Database:           database,
 			SourceMap:          map[string]*Source{},
 			NameToSource:       map[string]*Source{},
-			MaxArchiveSizeGB:   50,
 			CacheDir:           "tmp",
+			MaxArchiveSizeGB:   20,
 			IndexSqlConfig: IndexSqlConfig{
-				WalMode:      false,
-				BatchSize:    1000,
-				CacheSizeMB:  32,
-				DisableReuse: false,
+				WalMode:               false,
+				BatchSize:             1000,
+				CacheSizeMB:           32,
+				DisableReuse:          false,
+				StartupIntegrityCheck: IndexStartupIntegrityQuickCheck,
 			},
 			Filesystem: Filesystem{
 				CreateFilePermission:      "644",
@@ -680,57 +1020,96 @@ func setDefaults(generate bool) Settings {
 		Frontend: Frontend{
 			Name: "FileBrowser Quantum",
 		},
-
 		UserDefaults: UserDefaults{
-			DisableOnlyOfficeExt: ".md .txt .pdf .html .xml",
-			StickySidebar:        true,
-			LockPassword:         false,
-			ShowHidden:           false,
-			DarkMode:             boolPtr(true),
-			DisableSettings:      false,
-			ViewMode:             "normal",
-			Locale:               "en",
-			GallerySize:          3,
-			ThemeColor:           "var(--blue)",
-			Permissions: UserDefaultsPermissions{
-				Modify:   false,
-				Share:    false,
-				Admin:    false,
-				Api:      false,
-				Download: boolPtr(true), // defaults to true
+			// New organized structure
+			Sidebar: UserDefaultsSidebar{
+				DisableQuickToggles:  false,
+				HideFileActions:      false,
+				DisableHideOnPreview: false,
+				Sticky:               true,
+				HideFiles:            false,
+				ShowTools:            boolPtr(true),
+			},
+			Listing: UserDefaultsListing{
+				DeleteWithoutConfirming: false,
+				DateFormat:              false,
+				ShowHidden:              false,
+				QuickDownload:           false,
+				ShowSelectMultiple:      false,
+				SingleClick:             false,
+				HideFileExt:             "",
+				ShowCopyPath:            false,
+				DeleteAfterArchive:      true,
+				ViewMode:                "normal",
+				GallerySize:             3,
 			},
 			Preview: UserDefaultsPreview{
-				HighQuality:        boolPtr(true),
 				Image:              boolPtr(true),
 				Video:              boolPtr(true),
+				Audio:              boolPtr(true),
 				MotionVideoPreview: boolPtr(true),
 				Office:             boolPtr(true),
 				PopUp:              boolPtr(true),
-				AutoplayMedia:      boolPtr(true),
+				DisablePreviewExt:  "",
+				HighQuality:        boolPtr(true),
 				Folder:             boolPtr(true),
+				Models:             boolPtr(true),
+			},
+			FileViewer: UserDefaultsFileViewer{
+				EditorQuickSave:         false,
+				AutoplayMedia:           boolPtr(true),
+				DisableViewingExt:       "",
+				DisableOnlyOfficeExt:    ".md .txt .pdf .html .xml",
+				PreferEditorForMarkdown: false,
+				DebugOffice:             false,
+				DefaultMediaPlayer:      false,
+			},
+			Search: UserDefaultsSearch{
+				DisableOptions: false,
+			},
+			UI: UserDefaultsUI{
+				DarkMode:    boolPtr(true),
+				ThemeColor:  "var(--blue)",
+				CustomTheme: "",
+				Locale:      "en",
 			},
 			FileLoading: users.FileLoading{
-				MaxConcurrent:   10,
-				UploadChunkSize: 10, // 10MB
+				MaxConcurrent:     10,
+				UploadChunkSize:   10, // 10MB
+				DownloadChunkSize: 0,  // 0MB, default to no chunking
+			},
+			Account: UserDefaultsAccount{
+				Permissions: UserDefaultsAccountPermissions{
+					Api:      false,
+					Admin:    false,
+					Modify:   false,
+					Share:    false,
+					Realtime: false,
+					Delete:   false,
+					Create:   false,
+					Download: boolPtr(true), // defaults to true
+				},
+				LockPassword:               false,
+				DisableSettings:            false,
+				LoginMethod:                "",
+				DisableUpdateNotifications: false,
 			},
 		},
 	}
-	// Initialize ImagePreview map with all supported types set to false by default
-	s.Integrations.Media.Convert.ImagePreview = make(map[ImagePreviewType]bool)
-	for _, t := range AllImagePreviewTypes {
-		s.Integrations.Media.Convert.ImagePreview[t] = false
-	}
-
-	// Initialize VideoPreview map with all supported types set to true by default
-	s.Integrations.Media.Convert.VideoPreview = make(map[VideoPreviewType]bool)
+	// Initialize ImagePreview map with defaults
+	s.Integrations.Media.Convert.ImagePreview = make(map[ImagePreviewType]*bool)
+	s.Integrations.Media.Convert.ImagePreview[HEICImagePreview] = boolPtr(false) // HEIC defaults to disabled
+	s.Integrations.Media.Convert.ImagePreview[JPEGImagePreview] = boolPtr(true)  // JPEG fallback defaults to enabled
+	// Initialize VideoPreview map with defaults (all enabled)
+	s.Integrations.Media.Convert.VideoPreview = make(map[VideoPreviewType]*bool)
 	for _, t := range AllVideoPreviewTypes {
-		s.Integrations.Media.Convert.VideoPreview[t] = true
+		s.Integrations.Media.Convert.VideoPreview[t] = boolPtr(true)
 	}
 	return s
 }
 
 // validateCustomImage validates a custom image file path and returns the absolute path or error
-func validateCustomImage(configPath, imageName string, maxSize int64, allowedFormats []string) (absolutePath string, err error) {
+func validateCustomImage(configPath, imageName string, allowedFormats []string) (absolutePath string, err error) {
 	// Get absolute path
 	absolutePath, err = filepath.Abs(configPath)
 	if err != nil {
@@ -738,16 +1117,11 @@ func validateCustomImage(configPath, imageName string, maxSize int64, allowedFor
 	}
 
 	// Check if file exists
-	stat, err := os.Stat(absolutePath)
+	_, err = os.Stat(absolutePath)
 	if err != nil {
 		return "", fmt.Errorf("could not access file: %w", err)
 	}
 
-	// Check file size
-	if stat.Size() > maxSize {
-		return "", fmt.Errorf("file too large (%d bytes), maximum allowed is %d bytes", stat.Size(), maxSize)
-	}
-
 	// Validate file format
 	ext := strings.ToLower(filepath.Ext(absolutePath))
 	validFormat := false
@@ -766,8 +1140,7 @@ func validateCustomImage(configPath, imageName string, maxSize int64, allowedFor
 
 func loadCustomFavicon() {
 	const imageName = "favicon"
-	const maxSize = 1024 * 1024 // 1MB
-	allowedFormats := []string{".ico", ".png", ".svg"}
+	allowedFormats := []string{".ico", ".png", ".svg", ".jpg", ".jpeg", ".gif", ".webp"}
 
 	// Set default embedded favicon path
 	Env.FaviconEmbeddedPath = "img/icons/favicon.svg"
@@ -780,7 +1153,7 @@ func loadCustomFavicon() {
 	}
 
 	// Validate custom favicon
-	validatedPath, err := validateCustomImage(Config.Frontend.Favicon, imageName, maxSize, allowedFormats)
+	validatedPath, err := validateCustomImage(Config.Frontend.Favicon, imageName, allowedFormats)
 	if err != nil {
 		logger.Warningf("Custom favicon validation failed: %v, using default", err)
 		Config.Frontend.Favicon = ""
@@ -794,20 +1167,34 @@ func loadCustomFavicon() {
 	Env.FaviconPath = validatedPath
 	Env.FaviconIsCustom = true
 	logger.Infof("Using custom favicon: %s", Env.FaviconPath)
+	// PWA and platform PNGs are generated at server startup from this path (SVG uses a raster
+	// sidecar next to the .svg when present; see icons.GeneratePWAIcons).
+}
+
+// PWAIconsCacheDir is where startup icon generation writes PNGs (under the server cache dir).
+func PWAIconsCacheDir() string {
+	return filepath.Join(Config.Server.CacheDir, "icons")
+}
+
+// Where transient archives for multi-request (Range) downloads are stored to support chunked downloads.
+func DownloadCacheDir() string {
+	return filepath.Join(Config.Server.CacheDir, "downloads")
+}
+
+// PrepareDownloadSpoolDir creates the download spool directory and removes any leftover dl-archive-*
+func PrepareDownloadSpoolDir() error {
+	if err := os.MkdirAll(DownloadCacheDir(), fileutils.PermDir); err != nil {
+		return err
+	}
+	return fileutils.ClearDirectoryContents(DownloadCacheDir())
 }
 
 func loadLoginIcon() {
 	const imageName = "login icon"
-	const maxSize = 1024 * 1024 // 1MB
 	allowedFormats := []string{".svg", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".ico"}
 
-	// Set default embedded icon path based on dark mode preference
-	isDarkMode := Config.UserDefaults.DarkMode != nil && *Config.UserDefaults.DarkMode
-	if isDarkMode {
-		Env.LoginIconEmbeddedPath = "img/icons/favicon.svg" // Dark mode: dark background
-	} else {
-		Env.LoginIconEmbeddedPath = "img/icons/favicon-light.svg" // Light mode: light background
-	}
+	// Set default embedded icon path - just use favicon.svg (light/dark handled by CSS)
+	Env.LoginIconEmbeddedPath = "img/icons/favicon.svg"
 
 	// Check if a custom login icon path is configured
 	if Config.Frontend.LoginIcon == "" {
@@ -817,7 +1204,7 @@ func loadLoginIcon() {
 	}
 
 	// Validate custom login icon
-	validatedPath, err := validateCustomImage(Config.Frontend.LoginIcon, imageName, maxSize, allowedFormats)
+	validatedPath, err := validateCustomImage(Config.Frontend.LoginIcon, imageName, allowedFormats)
 	if err != nil {
 		logger.Warningf("Custom login icon validation failed: %v, using default", err)
 		Env.LoginIconPath = Env.LoginIconEmbeddedPath
@@ -853,26 +1240,7 @@ func setConditionals(config *Source) {
 		IgnoreAllZeroSizeFolders: false,
 		IgnoreAllSymlinks:        false,
 		IndexingDisabled:         false,
-	}
-
-	// backwards compatibility
-	if config.Config.Conditionals.Hidden {
-		logger.Warning("source.conditionals.hidden is deprecated, use source.rules instead")
-		resolved.IgnoreAllHidden = true
-	}
-	// Backwards compatibility: if old format fields are set, treat as global rules
-	if config.Config.Conditionals.IgnoreHidden {
-		logger.Warning("source.conditionals.ignoreHidden is deprecated, use source.rules instead")
-		resolved.IgnoreAllHidden = true
-	}
-	if config.Config.DisableIndexing {
-		logger.Warning("source.disableIndexing is deprecated, use source.rules instead")
-		resolved.IndexingDisabled = true
-	}
-
-	if config.Config.Conditionals.ZeroSizeFolders {
-		logger.Warning("source.conditionals.zeroSizeFolders is deprecated, use source.rules instead")
-		resolved.IgnoreAllZeroSizeFolders = true
+		NoRules:                  len(rules) == 0,
 	}
 
 	// Process all rules and infer global flags from root-level rules

backend/common/settings/configFunctions.go

@@ -1,11 +1,25 @@
 package settings
 
 func CanConvertImage(ext string) bool {
-	return MediaEnabled() && Config.Integrations.Media.Convert.ImagePreview[ImagePreviewType(ext)]
+	if !MediaEnabled() {
+		return false
+	}
+	val := Config.Integrations.Media.Convert.ImagePreview[ImagePreviewType(ext)]
+	if val == nil {
+		return false // Extension not in the configured list
+	}
+	return *val
 }
 
 func CanConvertVideo(ext string) bool {
-	return MediaEnabled() && Config.Integrations.Media.Convert.VideoPreview[VideoPreviewType(ext)]
+	if !MediaEnabled() {
+		return false
+	}
+	val := Config.Integrations.Media.Convert.VideoPreview[VideoPreviewType(ext)]
+	if val == nil {
+		return false // Extension not in the configured list
+	}
+	return *val
 }
 
 func MediaEnabled() bool {

backend/common/settings/config_test.go

@@ -35,7 +35,7 @@ func Test_setDefaults(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := setDefaults(true); !reflect.DeepEqual(got, tt.want) {
+			if got := SetDefaults(true); !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("setDefaults() = %v, want %v", got, tt.want)
 			}
 		})
@@ -54,7 +54,7 @@ func TestConfigLoadChanged(t *testing.T) {
 		t.Fatalf("failed to write test config: %v", err)
 	}
 
-	defaultConfig := setDefaults(true)
+	defaultConfig := SetDefaults(true)
 	err = loadConfigWithDefaults(configFile, true)
 	if err != nil {
 		t.Fatalf("error loading config file: %v", err)
@@ -77,7 +77,7 @@ func TestConfigLoadEnvVars(t *testing.T) {
 		t.Fatalf("failed to write test config: %v", err)
 	}
 
-	defaultConfig := setDefaults(true)
+	defaultConfig := SetDefaults(true)
 	expectedKey := "MYKEY"
 	// mock environment variables
 	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
@@ -106,7 +106,7 @@ func TestConfigLoadSpecificValues(t *testing.T) {
 		t.Fatalf("failed to write test config: %v", err)
 	}
 
-	defaultConfig := setDefaults(true)
+	defaultConfig := SetDefaults(true)
 	err = loadConfigWithDefaults(configFile, true)
 	if err != nil {
 		t.Fatalf("error loading config file: %v", err)

backend/common/settings/generator.go

@@ -14,6 +14,7 @@ import (
 	"sort"
 	"strings"
 
+	"golang.org/x/tools/go/packages"
 	"gopkg.in/yaml.v3"
 )
 
@@ -111,74 +112,93 @@ func CollectCommentsAndSecrets(srcPath string) (CommentsMap, SecretFieldsMap, De
 	return comments, secrets, deprecated, nil
 }
 
-// parseDirectoryComments parses a single directory for comments, secrets, and deprecated fields
+// parseDirectoryComments parses a single directory for comments, secrets, and deprecated fields.
 func parseDirectoryComments(dir string) (CommentsMap, SecretFieldsMap, DeprecatedFieldsMap, error) {
-	fset := token.NewFileSet()
-	pkgs, err := parser.ParseDir(fset, dir, nil, parser.ParseComments)
+	absDir, err := filepath.Abs(dir)
 	if err != nil {
 		return nil, nil, nil, err
 	}
 
+	var files []*ast.File
+	cfg := &packages.Config{
+		Mode: packages.NeedSyntax | packages.NeedFiles,
+		Dir:  absDir,
+		ParseFile: func(fset *token.FileSet, filename string, src []byte) (*ast.File, error) {
+			return parser.ParseFile(fset, filename, src, parser.ParseComments)
+		},
+	}
+	pkgs, err := packages.Load(cfg, ".")
+	if err == nil && len(pkgs) > 0 {
+		for _, pkg := range pkgs {
+			files = append(files, pkg.Syntax...)
+		}
+	}
+	if len(files) == 0 {
+		// Fallback for directories outside a module (e.g. test temp dirs): parse .go files directly
+		files, err = parseDirGoFiles(absDir)
+		if err != nil || len(files) == 0 {
+			return nil, nil, nil, err
+		}
+	}
+
 	comments := make(CommentsMap)
 	secrets := make(SecretFieldsMap)
 	deprecated := make(DeprecatedFieldsMap)
 
-	for _, pkg := range pkgs {
-		for _, file := range pkg.Files {
-			for _, decl := range file.Decls {
-				gen, ok := decl.(*ast.GenDecl)
-				if !ok || gen.Tok != token.TYPE {
+	for _, file := range files {
+		for _, decl := range file.Decls {
+			gen, ok := decl.(*ast.GenDecl)
+			if !ok || gen.Tok != token.TYPE {
+				continue
+			}
+			for _, spec := range gen.Specs {
+				ts, ok := spec.(*ast.TypeSpec)
+				if !ok {
 					continue
 				}
-				for _, spec := range gen.Specs {
-					ts, ok := spec.(*ast.TypeSpec)
-					if !ok {
+				st, ok := ts.Type.(*ast.StructType)
+				if !ok {
+					continue
+				}
+				typeName := ts.Name.Name
+				commentMap := make(map[string]string)
+				secretMap := make(map[string]bool)
+				deprecatedMap := make(map[string]bool)
+				comments[typeName] = commentMap
+				secrets[typeName] = secretMap
+				deprecated[typeName] = deprecatedMap
+
+				for _, field := range st.Fields.List {
+					if len(field.Names) == 0 {
 						continue
 					}
-					st, ok := ts.Type.(*ast.StructType)
-					if !ok {
-						continue
+					name := field.Names[0].Name
+					var parts []string
+					var fullComment string
+
+					if field.Doc != nil {
+						docText := strings.TrimSpace(field.Doc.Text())
+						parts = append(parts, docText)
+						fullComment += docText + " "
+					}
+					if field.Comment != nil {
+						commentText := strings.TrimSpace(field.Comment.Text())
+						parts = append(parts, commentText)
+						fullComment += commentText
 					}
-					typeName := ts.Name.Name
-					commentMap := make(map[string]string)
-					secretMap := make(map[string]bool)
-					deprecatedMap := make(map[string]bool)
-					comments[typeName] = commentMap
-					secrets[typeName] = secretMap
-					deprecated[typeName] = deprecatedMap
 
-					for _, field := range st.Fields.List {
-						if len(field.Names) == 0 {
-							continue
-						}
-						name := field.Names[0].Name
-						var parts []string
-						var fullComment string
+					if len(parts) > 0 {
+						commentMap[name] = strings.Join(parts, " : ")
+					}
 
-						if field.Doc != nil {
-							docText := strings.TrimSpace(field.Doc.Text())
-							parts = append(parts, docText)
-							fullComment += docText + " "
-						}
-						if field.Comment != nil {
-							commentText := strings.TrimSpace(field.Comment.Text())
-							parts = append(parts, commentText)
-							fullComment += commentText
-						}
+					// Check if field should be treated as secret
+					if strings.Contains(strings.ToLower(fullComment), "secret:") {
+						secretMap[name] = true
+					}
 
-						if len(parts) > 0 {
-							commentMap[name] = strings.Join(parts, " : ")
-						}
-
-						// Check if field should be treated as secret
-						if strings.Contains(strings.ToLower(fullComment), "secret:") {
-							secretMap[name] = true
-						}
-
-						// Check if field should be treated as deprecated
-						if strings.Contains(strings.ToLower(fullComment), "deprecated:") {
-							deprecatedMap[name] = true
-						}
+					// Check if field should be treated as deprecated
+					if strings.Contains(strings.ToLower(fullComment), "deprecated:") {
+						deprecatedMap[name] = true
 					}
 				}
 			}
@@ -187,6 +207,29 @@ func parseDirectoryComments(dir string) (CommentsMap, SecretFieldsMap, Deprecate
 	return comments, secrets, deprecated, nil
 }
 
+// parseDirGoFiles parses all .go files in dir and returns their ASTs. Used when the directory
+// is not inside a Go module (e.g. test temp dirs) so packages.Load would fail.
+func parseDirGoFiles(dir string) ([]*ast.File, error) {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, err
+	}
+	fset := token.NewFileSet()
+	var files []*ast.File
+	for _, e := range entries {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".go") {
+			continue
+		}
+		path := filepath.Join(dir, e.Name())
+		f, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
+		if err != nil {
+			return nil, err
+		}
+		files = append(files, f)
+	}
+	return files, nil
+}
+
 // PathToTypeField represents a mapping from YAML path to Go type and field info
 type PathToTypeField struct {
 	TypeName  string
@@ -243,7 +286,7 @@ func buildPathMapRecursive(structType reflect.Type, structValue reflect.Value, c
 		fieldType := field.Type
 
 		// Handle pointers
-		if fieldType.Kind() == reflect.Ptr {
+		if fieldType.Kind() == reflect.Pointer {
 			if fieldValue.IsNil() {
 				// Skip nil pointers
 				continue
@@ -436,7 +479,7 @@ func CollectCommentsFromEmbeddedYaml(yamlContent string) (CommentsMap, SecretFie
 // parseDefaultsFromEmbeddedYaml creates a default config by parsing the embedded YAML template
 func parseDefaultsFromEmbeddedYaml(embeddedYaml string) (*Settings, error) {
 	// Start with baseline defaults from setDefaults to ensure all fields are initialized
-	defaultConfig := setDefaults(true)
+	defaultConfig := SetDefaults(true)
 	defaultConfig.Server.Sources = []*Source{{Path: "."}}
 
 	// Parse the embedded YAML to overlay the documented defaults
@@ -473,7 +516,7 @@ func BuildNode(v reflect.Value, comm CommentsMap) (*yaml.Node, error) {
 // buildNodeWithDefaults constructs a yaml.Node for any Go value, skipping fields that match defaults, redacting secrets, and filtering deprecated fields
 func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.Value, secrets SecretFieldsMap, deprecated DeprecatedFieldsMap) (*yaml.Node, error) {
 	// Dereference pointers
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		if v.IsNil() {
 			return &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!null", Value: "null"}, nil
 		}
@@ -518,6 +561,130 @@ func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.V
 
 			currentField := v.Field(i)
 
+			// Check if this is an inline/embedded field
+			yamlTag := sf.Tag.Get("yaml")
+			jsonTag := sf.Tag.Get("json")
+			isInline := strings.Contains(yamlTag, ",inline") || strings.Contains(jsonTag, ",inline") || sf.Anonymous
+
+			// If field is inline, merge its content directly into parent
+			if isInline && sf.Type.Kind() == reflect.Struct {
+				// Get the embedded struct's fields and add them directly to this level
+				embeddedType := sf.Type
+				embeddedValue := currentField
+				embeddedTypeName := embeddedType.Name()
+
+				for j := 0; j < embeddedType.NumField(); j++ {
+					embeddedField := embeddedType.Field(j)
+
+					// Skip unexported fields
+					if embeddedField.PkgPath != "" {
+						continue
+					}
+					if embeddedYamlTag := embeddedField.Tag.Get("yaml"); embeddedYamlTag == "-" {
+						continue
+					}
+					if embeddedJsonTag := embeddedField.Tag.Get("json"); embeddedJsonTag == "-" {
+						continue
+					}
+
+					// Skip deprecated fields
+					if len(deprecated) > 0 && deprecated[embeddedTypeName][embeddedField.Name] {
+						continue
+					}
+
+					embeddedFieldValue := embeddedValue.Field(j)
+
+					// If we have defaults, compare and skip if values match
+					if defaults.IsValid() && i < defaults.NumField() {
+						defaultInlineField := defaults.Field(i)
+						if defaultInlineField.Kind() == reflect.Struct && j < defaultInlineField.NumField() {
+							defaultEmbeddedField := defaultInlineField.Field(j)
+							embeddedCurrentValue := embeddedFieldValue.Interface()
+							embeddedDefaultValue := defaultEmbeddedField.Interface()
+
+							if reflect.DeepEqual(embeddedCurrentValue, embeddedDefaultValue) {
+								continue
+							}
+						}
+					}
+
+					// Determine key name for embedded field
+					embeddedYamlTag := embeddedField.Tag.Get("yaml")
+					embeddedJsonTag := embeddedField.Tag.Get("json")
+					var embeddedKeyName string
+					if embeddedYamlTag != "" && embeddedYamlTag != "-" {
+						embeddedKeyName = strings.Split(embeddedYamlTag, ",")[0]
+					} else if embeddedJsonTag != "" && embeddedJsonTag != "-" {
+						embeddedKeyName = strings.Split(embeddedJsonTag, ",")[0]
+					} else {
+						embeddedKeyName = embeddedField.Name
+					}
+
+					keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: embeddedKeyName}
+
+					// Attach comments for embedded field
+					var parts []string
+					var comment string
+					if cm := comm[embeddedTypeName][embeddedField.Name]; cm != "" {
+						comment = cm
+					}
+
+					if comment != "" {
+						parts = append(parts, comment)
+					}
+					if len(comm) > 0 {
+						if vt := embeddedField.Tag.Get("validate"); vt != "" {
+							parts = append(parts, fmt.Sprintf(" validate:%s", vt))
+						}
+					}
+
+					if len(parts) > 0 {
+						keyNode.LineComment = strings.Join(parts, " ")
+					}
+
+					// Build value node for embedded field
+					var valNode *yaml.Node
+					var err error
+					generateConfig := os.Getenv("FILEBROWSER_GENERATE_CONFIG") == "true"
+					if secrets[embeddedTypeName][embeddedField.Name] && !generateConfig {
+						fieldValue := embeddedFieldValue.Interface()
+						if str, ok := fieldValue.(string); ok && str == "" {
+							valNode = &yaml.Node{
+								Kind:  yaml.ScalarNode,
+								Tag:   "!!str",
+								Value: "",
+								Style: yaml.DoubleQuotedStyle,
+							}
+						} else {
+							valNode = &yaml.Node{
+								Kind:  yaml.ScalarNode,
+								Tag:   "!!str",
+								Value: "**hidden**",
+								Style: yaml.DoubleQuotedStyle,
+							}
+						}
+					} else {
+						var defaultEmbeddedField reflect.Value
+						if defaults.IsValid() && i < defaults.NumField() {
+							defaultInlineField := defaults.Field(i)
+							if defaultInlineField.Kind() == reflect.Struct && j < defaultInlineField.NumField() {
+								defaultEmbeddedField = defaultInlineField.Field(j)
+							}
+						}
+
+						valNode, err = buildNodeWithDefaults(embeddedFieldValue, comm, defaultEmbeddedField, secrets, deprecated)
+						if err != nil {
+							return nil, err
+						}
+					}
+
+					mapNode.Content = append(mapNode.Content, keyNode, valNode)
+				}
+
+				// Skip adding the embedded struct itself as a field
+				continue
+			}
+
 			// If we have defaults, compare and skip if values match
 			if defaults.IsValid() && i < defaults.NumField() {
 				defaultField := defaults.Field(i)
@@ -532,8 +699,6 @@ func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.V
 			}
 
 			// determine key: yaml tag > json tag > field name
-			yamlTag := sf.Tag.Get("yaml")
-			jsonTag := sf.Tag.Get("json")
 			var keyName string
 			if yamlTag != "" && yamlTag != "-" {
 				keyName = strings.Split(yamlTag, ",")[0]
@@ -625,7 +790,7 @@ func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.V
 		elemType := v.Type().Elem()
 		// Check if element is a struct or pointer to struct
 		isStructSlice := elemType.Kind() == reflect.Struct ||
-			(elemType.Kind() == reflect.Ptr && elemType.Elem().Kind() == reflect.Struct)
+			(elemType.Kind() == reflect.Pointer && elemType.Elem().Kind() == reflect.Struct)
 		if !isStructSlice {
 			seq.Style = yaml.FlowStyle
 		}
@@ -649,11 +814,6 @@ func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.V
 		}
 		mapNode := &yaml.Node{Kind: yaml.MappingNode}
 
-		// Special handling for ImagePreview maps - show all supported types
-		if isImagePreviewMap(v) {
-			return buildImagePreviewMap(v, comm, secrets, deprecated)
-		}
-
 		// Get and sort map keys alphabetically for consistent output
 		mapKeys := v.MapKeys()
 		keyStrings := make([]string, len(mapKeys))
@@ -707,36 +867,21 @@ func GenerateYaml() {
 		{
 			Path: ".",
 			Config: SourceConfig{
-				Conditionals: ConditionalFilter{
-					ItemRules: []ConditionalRule{
-						{}, // Add empty sample rule to show all fields in generated YAML
-					},
+				Rules: []ConditionalRule{
+					{}, // Add empty sample rule to show all fields in generated YAML
 				},
 			},
 		},
 	}
 
 	setupLogging()
+	setupFs()
 	setupAuth(true)
-
-	// Save original paths before setupSources modifies them (for YAML generation)
-	originalPaths := make(map[*Source]string)
-	for _, source := range Config.Server.Sources {
-		originalPaths[source] = source.Path
-	}
-
 	setupSources(true)
 	setupUrls()
-	setupMedia()
+	setupMedia(true)
 	setupFrontend(true)
 
-	// Restore original paths so the YAML output has the correct paths, not the placeholder
-	for _, source := range Config.Server.Sources {
-		if originalPath, ok := originalPaths[source]; ok {
-			source.Path = originalPath
-		}
-	}
-
 	output := "../frontend/public/config.generated.yaml" // "output YAML file"
 
 	// Generate YAML with comments enabled, full config, and deprecated fields filtered
@@ -850,7 +995,7 @@ func GenerateConfigYamlWithEmbedded(config *Settings, showComments bool, showFul
 
 // identifySecretFieldsByReflection identifies secret fields by known field names
 func identifySecretFieldsByReflection(v reflect.Value, typeName string, secrets SecretFieldsMap) {
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		if v.IsNil() {
 			return
 		}
@@ -885,9 +1030,9 @@ func identifySecretFieldsByReflection(v reflect.Value, typeName string, secrets
 
 		// Recursively check nested structs
 		fieldValue := v.Field(i)
-		if fieldValue.Kind() == reflect.Struct || (fieldValue.Kind() == reflect.Ptr && !fieldValue.IsNil() && fieldValue.Elem().Kind() == reflect.Struct) {
+		if fieldValue.Kind() == reflect.Struct || (fieldValue.Kind() == reflect.Pointer && !fieldValue.IsNil() && fieldValue.Elem().Kind() == reflect.Struct) {
 			nestedTypeName := field.Type.Name()
-			if field.Type.Kind() == reflect.Ptr {
+			if field.Type.Kind() == reflect.Pointer {
 				nestedTypeName = field.Type.Elem().Name()
 			}
 			identifySecretFieldsByReflection(fieldValue, nestedTypeName, secrets)
@@ -897,7 +1042,7 @@ func identifySecretFieldsByReflection(v reflect.Value, typeName string, secrets
 
 // identifyDeprecatedFieldsByReflection identifies deprecated fields by known field names
 func identifyDeprecatedFieldsByReflection(v reflect.Value, typeName string, deprecated DeprecatedFieldsMap) {
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		if v.IsNil() {
 			return
 		}
@@ -927,9 +1072,9 @@ func identifyDeprecatedFieldsByReflection(v reflect.Value, typeName string, depr
 
 		// Recursively check nested structs
 		fieldValue := v.Field(i)
-		if fieldValue.Kind() == reflect.Struct || (fieldValue.Kind() == reflect.Ptr && !fieldValue.IsNil() && fieldValue.Elem().Kind() == reflect.Struct) {
+		if fieldValue.Kind() == reflect.Struct || (fieldValue.Kind() == reflect.Pointer && !fieldValue.IsNil() && fieldValue.Elem().Kind() == reflect.Struct) {
 			nestedTypeName := field.Type.Name()
-			if field.Type.Kind() == reflect.Ptr {
+			if field.Type.Kind() == reflect.Pointer {
 				nestedTypeName = field.Type.Elem().Name()
 			}
 			identifyDeprecatedFieldsByReflection(fieldValue, nestedTypeName, deprecated)
@@ -963,7 +1108,7 @@ func GenerateConfigYamlWithEmptyMaps(config *Settings, showFull bool) (string, e
 		}
 		if err != nil || readErr != nil {
 			// Fallback to setDefaults
-			defaultConfigValue := setDefaults(true)
+			defaultConfigValue := SetDefaults(true)
 			defaultConfigValue.Server.Sources = []*Source{{Path: "."}}
 			defaultConfig = &defaultConfigValue
 		}
@@ -1056,7 +1201,7 @@ func GenerateConfigYamlWithSource(config *Settings, showComments bool, showFull
 		}
 		if err != nil || readErr != nil {
 			// Fallback to setDefaults
-			defaultConfigValue := setDefaults(true)
+			defaultConfigValue := SetDefaults(true)
 			defaultConfigValue.Server.Sources = []*Source{{Path: "."}}
 			defaultConfig = &defaultConfigValue
 		}
@@ -1136,53 +1281,3 @@ func AlignComments(input string) string {
 
 	return strings.Join(outputLines, "\n")
 }
-
-// isImagePreviewMap checks if the given map is an ImagePreview map
-func isImagePreviewMap(v reflect.Value) bool {
-	if v.Kind() != reflect.Map {
-		return false
-	}
-
-	// Check if the map key type is ImagePreviewType
-	keyType := v.Type().Key()
-	return keyType.Name() == "ImagePreviewType"
-}
-
-// buildImagePreviewMap builds a YAML node for ImagePreview maps, showing all supported types
-func buildImagePreviewMap(v reflect.Value, comm CommentsMap, secrets SecretFieldsMap, deprecated DeprecatedFieldsMap) (*yaml.Node, error) {
-	mapNode := &yaml.Node{Kind: yaml.MappingNode}
-
-	// Get all supported image preview types from the global slice
-	for _, imageType := range AllImagePreviewTypes {
-		typeName := string(imageType)
-
-		// Create key node
-		keyNode := &yaml.Node{
-			Kind:  yaml.ScalarNode,
-			Value: typeName,
-		}
-
-		// Get the value from the map, defaulting to false if not present
-		var value bool
-		if v.Len() > 0 {
-			// Look for the key in the map
-			for _, mapKey := range v.MapKeys() {
-				if mapKey.String() == typeName {
-					value = v.MapIndex(mapKey).Bool()
-					break
-				}
-			}
-		}
-
-		// Create value node
-		valNode := &yaml.Node{
-			Kind:  yaml.ScalarNode,
-			Tag:   "!!bool",
-			Value: fmt.Sprintf("%t", value),
-		}
-
-		mapNode.Content = append(mapNode.Content, keyNode, valNode)
-	}
-
-	return mapNode, nil
-}

backend/common/settings/migration_test.go

@@ -0,0 +1,221 @@
+package settings
+
+import (
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// TestMigrateUserDefaults_OldToNew verifies that deprecated fields are correctly migrated to new fields
+func TestMigrateUserDefaults_OldToNew(t *testing.T) {
+	// Setup: Create UserDefaults with old fields set
+	Config.UserDefaults = UserDefaults{
+		// Old deprecated fields
+		DarkMode:                   boolPtr(true),
+		DisableQuickToggles:        true,
+		HideSidebarFileActions:     true,
+		StickySidebar:              true,
+		SingleClick:                true,
+		HideFilesInTree:            true,
+		ShowToolsInSidebar:         boolPtr(false),
+		DeleteWithoutConfirming:    true,
+		DateFormat:                 true,
+		ShowHidden:                 true,
+		QuickDownload:              true,
+		ShowSelectMultiple:         true,
+		HideFileExt:                ".tmp",
+		ShowCopyPath:               true,
+		DeleteAfterArchive:         true,
+		DisablePreviewExt:          ".exe",
+		EditorQuickSave:            true,
+		DisableViewingExt:          ".bin",
+		DisableOnlyOfficeExt:       ".md",
+		PreferEditorForMarkdown:    true,
+		DebugOffice:                true,
+		DisableSearchOptions:       true,
+		ThemeColor:                 "var(--red)",
+		CustomTheme:                "dark",
+		Locale:                     "de",
+		LockPassword:               true,
+		DisableSettings:            true,
+		LoginMethod:                "oidc",
+		DisableUpdateNotifications: true,
+		Permissions: UserDefaultsPermissions{
+			Api:      true,
+			Admin:    true,
+			Modify:   true,
+			Share:    true,
+			Realtime: true,
+			Delete:   true,
+			Create:   true,
+			Download: boolPtr(false),
+		},
+		Preview: UserDefaultsPreview{
+			Image:              boolPtr(true),
+			Video:              boolPtr(true),
+			Audio:              boolPtr(true),
+			MotionVideoPreview: boolPtr(true),
+			Office:             boolPtr(true),
+			PopUp:              boolPtr(true),
+			HighQuality:        boolPtr(true),
+			Folder:             boolPtr(true),
+			Models:             boolPtr(true),
+			// Deprecated fields that should be migrated
+			DisableHideSidebar: true,
+			AutoplayMedia:      true,
+			DefaultMediaPlayer: true,
+		},
+		FileLoading: users.FileLoading{
+			MaxConcurrent:   5,
+			UploadChunkSize: 20,
+		},
+	}
+
+	// Execute: Run migration
+	migrateUserDefaults()
+
+	// Verify: Check that new fields are populated from old fields
+	ud := &Config.UserDefaults
+
+	// Sidebar fields
+	if !ud.Sidebar.DisableQuickToggles {
+		t.Error("sidebar.disableQuickToggles should be true")
+	}
+	if !ud.Sidebar.HideFileActions {
+		t.Error("sidebar.hideFileActions should be true")
+	}
+	if !ud.Sidebar.Sticky {
+		t.Error("sidebar.sticky should be true")
+	}
+	if !ud.Sidebar.HideFiles {
+		t.Error("sidebar.hideFiles should be true")
+	}
+	if ud.Sidebar.ShowTools == nil || *ud.Sidebar.ShowTools != false {
+		t.Error("sidebar.showTools should be false")
+	}
+	if !ud.Sidebar.DisableHideOnPreview {
+		t.Error("sidebar.disableHideOnPreview should be true")
+	}
+
+	// Listing fields
+	if !ud.Listing.DeleteWithoutConfirming {
+		t.Error("listing.deleteWithoutConfirming should be true")
+	}
+	if !ud.Listing.DateFormat {
+		t.Error("listing.dateFormat should be true")
+	}
+	if !ud.Listing.ShowHidden {
+		t.Error("listing.showHidden should be true")
+	}
+	if !ud.Listing.QuickDownload {
+		t.Error("listing.quickDownload should be true")
+	}
+	if !ud.Listing.ShowSelectMultiple {
+		t.Error("listing.showSelectMultiple should be true")
+	}
+	if !ud.Listing.SingleClick {
+		t.Error("listing.singleClick should be true")
+	}
+	if ud.Listing.HideFileExt != ".tmp" {
+		t.Errorf("listing.hideFileExt should be '.tmp', got '%s'", ud.Listing.HideFileExt)
+	}
+	if !ud.Listing.ShowCopyPath {
+		t.Error("listing.showCopyPath should be true")
+	}
+	if !ud.Listing.DeleteAfterArchive {
+		t.Error("listing.deleteAfterArchive should be true")
+	}
+
+	// Preview fields
+	if ud.Preview.Image == nil || *ud.Preview.Image != true {
+		t.Error("preview.image should be true")
+	}
+	if ud.Preview.Video == nil || *ud.Preview.Video != true {
+		t.Error("preview.video should be true")
+	}
+	if ud.Preview.Audio == nil || *ud.Preview.Audio != true {
+		t.Error("preview.audio should be true")
+	}
+	if ud.Preview.DisablePreviewExt != ".exe" {
+		t.Errorf("preview.disablePreviewExt should be '.exe', got '%s'", ud.Preview.DisablePreviewExt)
+	}
+
+	// FileViewer fields
+	if !ud.FileViewer.EditorQuickSave {
+		t.Error("fileViewer.editorQuickSave should be true")
+	}
+	if ud.FileViewer.AutoplayMedia == nil || *ud.FileViewer.AutoplayMedia != true {
+		t.Error("fileViewer.autoplayMedia should be true")
+	}
+	if ud.FileViewer.DisableViewingExt != ".bin" {
+		t.Errorf("fileViewer.disableViewingExt should be '.bin', got '%s'", ud.FileViewer.DisableViewingExt)
+	}
+	if ud.FileViewer.DisableOnlyOfficeExt != ".md" {
+		t.Errorf("fileViewer.disableOnlyOfficeExt should be '.md', got '%s'", ud.FileViewer.DisableOnlyOfficeExt)
+	}
+	if !ud.FileViewer.PreferEditorForMarkdown {
+		t.Error("fileViewer.preferEditorForMarkdown should be true")
+	}
+	if !ud.FileViewer.DebugOffice {
+		t.Error("fileViewer.debugOffice should be true")
+	}
+
+	// Search fields
+	if !ud.Search.DisableOptions {
+		t.Error("search.disableOptions should be true")
+	}
+
+	// UI fields
+	if ud.UI.DarkMode == nil || *ud.UI.DarkMode != true {
+		t.Error("ui.darkMode should be true")
+	}
+	if ud.UI.ThemeColor != "var(--red)" {
+		t.Errorf("ui.themeColor should be 'var(--red)', got '%s'", ud.UI.ThemeColor)
+	}
+	if ud.UI.CustomTheme != "dark" {
+		t.Errorf("ui.customTheme should be 'dark', got '%s'", ud.UI.CustomTheme)
+	}
+	if ud.UI.Locale != "de" {
+		t.Errorf("ui.locale should be 'de', got '%s'", ud.UI.Locale)
+	}
+
+	// Account fields
+	if !ud.Account.LockPassword {
+		t.Error("account.lockPassword should be true")
+	}
+	if !ud.Account.DisableSettings {
+		t.Error("account.disableSettings should be true")
+	}
+	if ud.Account.LoginMethod != "oidc" {
+		t.Errorf("account.loginMethod should be 'oidc', got '%s'", ud.Account.LoginMethod)
+	}
+	if !ud.Account.DisableUpdateNotifications {
+		t.Error("account.disableUpdateNotifications should be true")
+	}
+
+	// Account Permissions
+	if !ud.Account.Permissions.Api {
+		t.Error("account.permissions.api should be true")
+	}
+	if !ud.Account.Permissions.Admin {
+		t.Error("account.permissions.admin should be true")
+	}
+	if !ud.Account.Permissions.Modify {
+		t.Error("account.permissions.modify should be true")
+	}
+	if !ud.Account.Permissions.Share {
+		t.Error("account.permissions.share should be true")
+	}
+	if !ud.Account.Permissions.Realtime {
+		t.Error("account.permissions.realtime should be true")
+	}
+	if !ud.Account.Permissions.Delete {
+		t.Error("account.permissions.delete should be true")
+	}
+	if !ud.Account.Permissions.Create {
+		t.Error("account.permissions.create should be true")
+	}
+	if ud.Account.Permissions.Download == nil || *ud.Account.Permissions.Download != false {
+		t.Error("account.permissions.download should be false")
+	}
+}

backend/common/settings/settings.go

@@ -21,7 +21,7 @@ func boolValueOrDefault(ptr *bool, defaultValue bool) bool {
 }
 
 // ConvertPermissionsToUsers converts UserDefaultsPermissions to users.Permissions
-func ConvertPermissionsToUsers(p UserDefaultsPermissions) users.Permissions {
+func ConvertPermissionsToUsers(p UserDefaultsAccountPermissions) users.Permissions {
 	return users.Permissions{
 		Api:      p.Api,
 		Admin:    p.Admin,
@@ -57,57 +57,100 @@ func GetSettingsConfig(nameType string, Value string) string {
 
 func AdminPerms() users.Permissions {
 	return users.Permissions{
-		Modify: true,
-		Share:  true,
-		Admin:  true,
-		Api:    true,
+		Modify:   true,
+		Share:    true,
+		Admin:    true,
+		Api:      true,
+		Download: true,
+		Delete:   true,
+		Create:   true,
+		Realtime: false,
 	}
 }
 
 // Apply applies the default options to a user.
+// Keep this in sync with [UserDefaults]: every user-facing field there should be copied
+// here (except DefaultScopes, which is wired through source config rather than this helper).
 func ApplyUserDefaults(u *users.User) {
-	u.StickySidebar = Config.UserDefaults.StickySidebar
-	u.DisableSettings = Config.UserDefaults.DisableSettings
+	d := Config.UserDefaults
 
-	// Handle DarkMode with default - dereference pointer from config
-	u.DarkMode = boolValueOrDefault(Config.UserDefaults.DarkMode, true)
+	// Account settings
+	u.DisableSettings = d.Account.DisableSettings
+	u.LockPassword = d.Account.LockPassword
+	u.DisableUpdateNotifications = d.Account.DisableUpdateNotifications
 
-	u.Locale = Config.UserDefaults.Locale
-	u.ViewMode = Config.UserDefaults.ViewMode
-	u.SingleClick = Config.UserDefaults.SingleClick
+	// Sidebar settings
+	u.DisableQuickToggles = d.Sidebar.DisableQuickToggles
+	u.HideSidebarFileActions = d.Sidebar.HideFileActions
+	u.StickySidebar = d.Sidebar.Sticky
+	u.HideFilesInTree = d.Sidebar.HideFiles
+	u.ShowToolsInSidebar = boolValueOrDefault(d.Sidebar.ShowTools, true)
 
-	// Handle Permissions - convert from pointer-based defaults to regular bools
-	u.Permissions.Api = Config.UserDefaults.Permissions.Api
-	u.Permissions.Admin = Config.UserDefaults.Permissions.Admin
-	u.Permissions.Modify = Config.UserDefaults.Permissions.Modify
-	u.Permissions.Share = Config.UserDefaults.Permissions.Share
-	u.Permissions.Realtime = Config.UserDefaults.Permissions.Realtime
-	u.Permissions.Delete = Config.UserDefaults.Permissions.Delete
-	u.Permissions.Create = Config.UserDefaults.Permissions.Create
-	u.Permissions.Download = boolValueOrDefault(Config.UserDefaults.Permissions.Download, true)
+	// Listing settings
+	u.DeleteWithoutConfirming = d.Listing.DeleteWithoutConfirming
+	u.DateFormat = d.Listing.DateFormat
+	u.ShowHidden = d.Listing.ShowHidden
+	u.QuickDownload = d.Listing.QuickDownload
+	u.ShowSelectMultiple = d.Listing.ShowSelectMultiple
+	u.SingleClick = d.Listing.SingleClick
+	u.HideFileExt = d.Listing.HideFileExt
+	u.ShowCopyPath = d.Listing.ShowCopyPath
+	u.DeleteAfterArchive = d.Listing.DeleteAfterArchive
+	u.ViewMode = d.Listing.ViewMode
+	u.GallerySize = d.Listing.GallerySize
 
-	// Handle Preview - convert from pointer-based defaults to regular bools
-	u.Preview.DisableHideSidebar = Config.UserDefaults.Preview.DisableHideSidebar
-	u.Preview.HighQuality = boolValueOrDefault(Config.UserDefaults.Preview.HighQuality, true)
-	u.Preview.Image = boolValueOrDefault(Config.UserDefaults.Preview.Image, true)
-	u.Preview.Video = boolValueOrDefault(Config.UserDefaults.Preview.Video, true)
-	u.Preview.MotionVideoPreview = boolValueOrDefault(Config.UserDefaults.Preview.MotionVideoPreview, true)
-	u.Preview.Office = boolValueOrDefault(Config.UserDefaults.Preview.Office, true)
-	u.Preview.PopUp = boolValueOrDefault(Config.UserDefaults.Preview.PopUp, true)
-	u.Preview.AutoplayMedia = boolValueOrDefault(Config.UserDefaults.Preview.AutoplayMedia, true)
-	u.Preview.DefaultMediaPlayer = Config.UserDefaults.Preview.DefaultMediaPlayer
-	u.Preview.Folder = boolValueOrDefault(Config.UserDefaults.Preview.Folder, true)
+	// Preview settings
+	u.Preview.DisableHideSidebar = d.Sidebar.DisableHideOnPreview
+	u.Preview.Image = boolValueOrDefault(d.Preview.Image, true)
+	u.Preview.Video = boolValueOrDefault(d.Preview.Video, true)
+	u.Preview.Audio = boolValueOrDefault(d.Preview.Audio, true)
+	u.Preview.MotionVideoPreview = boolValueOrDefault(d.Preview.MotionVideoPreview, true)
+	u.Preview.Office = boolValueOrDefault(d.Preview.Office, true)
+	u.Preview.PopUp = boolValueOrDefault(d.Preview.PopUp, true)
+	u.Preview.Folder = boolValueOrDefault(d.Preview.Folder, true)
+	u.Preview.Models = boolValueOrDefault(d.Preview.Models, true)
+	u.DisablePreviewExt = d.Preview.DisablePreviewExt
+
+	// FileViewer settings
+	u.EditorQuickSave = d.FileViewer.EditorQuickSave
+	u.Preview.AutoplayMedia = boolValueOrDefault(d.FileViewer.AutoplayMedia, true)
+	u.Preview.DefaultMediaPlayer = d.FileViewer.DefaultMediaPlayer
+	u.DisableViewingExt = d.FileViewer.DisableViewingExt
+	u.DisableOnlyOfficeExt = d.FileViewer.DisableOnlyOfficeExt
+	u.DisableOfficePreviewExt = d.FileViewer.DisableOnlyOfficeExt // deprecated field, map to same source
+	u.PreferEditorForMarkdown = d.FileViewer.PreferEditorForMarkdown
+	u.DebugOffice = d.FileViewer.DebugOffice
+
+	// Search settings
+	u.DisableSearchOptions = d.Search.DisableOptions
+
+	// UI settings
+	u.DarkMode = boolValueOrDefault(d.UI.DarkMode, true)
+	u.ThemeColor = d.UI.ThemeColor
+	u.CustomTheme = d.UI.CustomTheme
+	u.Locale = d.UI.Locale
+
+	// FileLoading settings
+	u.FileLoading = d.FileLoading
+
+	if u.Username == "anonymous" {
+		return
+	}
+
+	// Permissions
+	u.Permissions.Api = d.Account.Permissions.Api
+	u.Permissions.Admin = d.Account.Permissions.Admin
+	u.Permissions.Modify = d.Account.Permissions.Modify
+	u.Permissions.Share = d.Account.Permissions.Share
+	u.Permissions.Realtime = d.Account.Permissions.Realtime
+	u.Permissions.Delete = d.Account.Permissions.Delete
+	u.Permissions.Create = d.Account.Permissions.Create
+	u.Permissions.Download = boolValueOrDefault(d.Account.Permissions.Download, true)
+
+	if u.LoginMethod == "" && d.Account.LoginMethod != "" {
+		u.LoginMethod = users.LoginMethod(d.Account.LoginMethod)
+	}
 
-	u.ShowHidden = Config.UserDefaults.ShowHidden
-	u.DateFormat = Config.UserDefaults.DateFormat
-	u.DisableViewingExt = Config.UserDefaults.DisableViewingExt
-	u.ThemeColor = Config.UserDefaults.ThemeColor
-	u.GallerySize = Config.UserDefaults.GallerySize
-	u.QuickDownload = Config.UserDefaults.QuickDownload
-	u.LockPassword = Config.UserDefaults.LockPassword
-	u.DisableOnlyOfficeExt = Config.UserDefaults.DisableOnlyOfficeExt
-	u.FileLoading = Config.UserDefaults.FileLoading
-	u.DisableOfficePreviewExt = Config.UserDefaults.DisableOfficePreviewExt
 	if len(u.Scopes) == 0 {
 		for _, source := range Config.Server.Sources {
 			if source.Config.DefaultEnabled {
@@ -115,7 +158,16 @@ func ApplyUserDefaults(u *users.User) {
 					Name:  source.Path, // backend name is path
 					Scope: source.Config.DefaultUserScope,
 				})
+				u.SidebarLinks = append(u.SidebarLinks, users.SidebarLink{
+					Name:       source.Name,
+					Category:   "source",
+					Target:     "/",
+					Icon:       "",
+					SourceName: source.Path,
+				})
 			}
 		}
 	}
+
+	u.Version = users.CurrentUserMigrationVersion
 }

backend/common/settings/storage.go

@@ -37,12 +37,12 @@ func (s *Storage) Save(set *Settings) error {
 		return errors.ErrEmptyKey
 	}
 
-	if set.UserDefaults.Locale == "" {
-		set.UserDefaults.Locale = "en"
+	if set.UserDefaults.UI.Locale == "" {
+		set.UserDefaults.UI.Locale = "en"
 	}
 
-	if set.UserDefaults.ViewMode == "" {
-		set.UserDefaults.ViewMode = "normal"
+	if set.UserDefaults.Listing.ViewMode == "" {
+		set.UserDefaults.Listing.ViewMode = "normal"
 	}
 
 	err := s.back.Save(set)

backend/common/settings/structs.go

@@ -20,6 +20,14 @@ type Settings struct {
 	Frontend     Frontend     `json:"frontend"`
 	UserDefaults UserDefaults `json:"userDefaults"`
 	Integrations Integrations `json:"integrations"`
+	Http         Http         `json:"http"`
+}
+type Http struct {
+	TrustedHeadersArray []string `json:"trustedHeaders"`   // list of headers to trust, useful when behind a reverse proxy.
+	DisableRateLimit    bool     `json:"disableRateLimit"` // turns off built-in auth route rate limiting and failed-login lockout (default false).
+
+	// internal map of trusted headers
+	TrustedHeaders map[string]bool `json:"-"`
 }
 
 type Environment struct {
@@ -58,10 +66,10 @@ type Server struct {
 	InternalUrl                  string         `json:"internalUrl"`     // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
 	CacheDir                     string         `json:"cacheDir"`        // path to the cache directory, used for thumbnails and other cached files
 	CacheDirCleanup              bool           `json:"cacheDirCleanup"` // whether to automatically cleanup the cache directory. Note: docker must also mount a persistent volume to persist the cache (default: false)
-	MaxArchiveSizeGB             int64          `json:"maxArchiveSize"`  // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
+	MaxArchiveSizeGB             int64          `json:"maxArchiveSize"`  // maximum archive/unarchive size in GB. 0 means no limit. (default: 20)
 	Filesystem                   Filesystem     `json:"filesystem"`      // filesystem settings
 	IndexSqlConfig               IndexSqlConfig `json:"indexSqlConfig"`  // Index database SQL configuration
-
+	DisableWebDAV                bool           `json:"disableWebDAV"`   // disable webdav support (default: false)
 	// not exposed to config
 	SourceMap    map[string]*Source `json:"-" validate:"omitempty"` // uses realpath as key
 	NameToSource map[string]*Source `json:"-" validate:"omitempty"` // uses name as key
@@ -72,11 +80,22 @@ type Filesystem struct {
 	CreateDirectoryPermission string `json:"createDirectoryPermission" validate:"required,file_permission"` // Unix permissions like 755, 2755, 1777 (default: 755)
 }
 
+// Index SQL startup integrity modes (IndexSqlConfig.StartupIntegrityCheck).
+const (
+	// IndexStartupIntegrityQuickCheck runs PRAGMA quick_check (default). Slower on very large DBs but thorough.
+	IndexStartupIntegrityQuickCheck = "quickCheck"
+	// IndexStartupIntegrityProbe verifies sqlite_master and optionally one row read only; fast for large indexes.
+	IndexStartupIntegrityProbe = "probe"
+	// IndexStartupIntegrityOff skips startup checks beyond sql.Open Ping; least safe, fastest boot.
+	IndexStartupIntegrityOff = "off"
+)
+
 type IndexSqlConfig struct {
-	BatchSize    int  `json:"batchSize"`    // number of items to batch in a single transaction, typically 500-5000. higher = faster but could use more memory.
-	CacheSizeMB  int  `json:"cacheSizeMB"`  // size of the SQLite cache in MB
-	WalMode      bool `json:"walMode"`      // enable the more complex WAL journaling mode. Slower, more memory usage, but better for deployments with constant user activity.
-	DisableReuse bool `json:"disableReuse"` // enable to always create a new indexing database on startup.
+	BatchSize             int    `json:"batchSize"`                                                                       // number of items to batch in a single transaction, typically 500-5000. higher = faster but could use more memory.
+	CacheSizeMB           int    `json:"cacheSizeMB"`                                                                     // size of the SQLite cache in MB
+	WalMode               bool   `json:"walMode"`                                                                         // enable the more complex WAL journaling mode. Slower, more memory usage, but better for deployments with constant user activity.
+	DisableReuse          bool   `json:"disableReuse"`                                                                    // enable to always create a new indexing database on startup.
+	StartupIntegrityCheck string `json:"startupIntegrityCheck,omitempty" validate:"omitempty,oneof=quickCheck probe off"` // the method used to check the integrity of the index database on startup (default: quickCheck)
 }
 
 type Integrations struct {
@@ -98,17 +117,19 @@ type Media struct {
 	Convert                  FfmpegConvert `json:"convert"`                  // config for ffmpeg conversion settings
 	Debug                    bool          `json:"debug"`                    // output ffmpeg stdout for media integration -- careful can produces lots of output!
 	ExtractEmbeddedSubtitles bool          `json:"extractEmbeddedSubtitles"` // extract embedded subtitles from media files
+	ExiftoolPath             string        `json:"exiftoolPath"`             // path to exiftool executable
 }
 
 type FfmpegConvert struct {
-	ImagePreview map[ImagePreviewType]bool `json:"imagePreview"` // supported image preview formats. defaults to false for all types unless explicitly enabled.
-	VideoPreview map[VideoPreviewType]bool `json:"videoPreview"` // supported video preview formats. defaults to true for all types unless explicitly disabled.
+	ImagePreview map[ImagePreviewType]*bool `json:"imagePreview"` // supported image preview formats. defaults vary by type (see individual type docs)
+	VideoPreview map[VideoPreviewType]*bool `json:"videoPreview"` // supported video preview formats. defaults to true for all types unless explicitly disabled.
 }
 
 type ImagePreviewType string
 
 const (
 	HEICImagePreview ImagePreviewType = "heic"
+	JPEGImagePreview ImagePreviewType = "jpeg" // only used as fallback for JPEG formats that can't otherwise be decoded
 	//RAWImagePreview  ImagePreviewType = "raw"
 )
 
@@ -119,6 +140,7 @@ func (i ImagePreviewType) String() string {
 // AllImagePreviewTypes contains all supported image preview types.
 var AllImagePreviewTypes = []ImagePreviewType{
 	HEICImagePreview,
+	JPEGImagePreview,
 	//RAWImagePreview,
 }
 
@@ -177,9 +199,9 @@ type LogConfig struct {
 	Output    string `json:"output" yaml:"output"`       // output location. (eg. "stdout" or "path/to/file.log")
 	NoColors  bool   `json:"noColors" yaml:"noColors"`   // disable colors in the output
 	Json      bool   `json:"json" yaml:"json"`           // output in json format
-	Utc       bool   `json:"utc" yaml:"utc"`             // use UTC time in the output instead of local time
+	Utc       bool   `json:"utc" yaml:"utc"`             // use UTC time in the output instead of local time.
+	ApiFilter string `json:"apiFilter" yaml:"apiFilter"` // regex filter that excludes matching full api paths from being logged. (eg. '/user\?id\=self') Defaults to '^/health|^/favicon.ico|^/static|^/public/static'
 }
-
 type Source struct {
 	Path   string       `json:"path" validate:"required"` // file system path. (Can be relative)
 	Name   string       `json:"name"`                     // display name
@@ -189,9 +211,9 @@ type Source struct {
 type SourceConfig struct {
 	DenyByDefault    bool              `json:"denyByDefault,omitempty"`           // deny access unless an "allow" access rule was specifically created.
 	Private          bool              `json:"private"`                           // designate as source as private -- currently just means no sharing permitted.
+	ReadOnly         bool              `json:"readOnly,omitempty"`                // read-only source, changes from the UI, webdav, and API will be disabled.
 	Disabled         bool              `json:"disabled,omitempty"`                // disable the source, this is useful so you don't need to remove it from the config file
 	IndexingInterval uint32            `json:"indexingIntervalMinutes,omitempty"` // deprecated: create a rule with indexingIntervalMinutes to set the indexing interval for this source
-	DisableIndexing  bool              `json:"disableIndexing,omitempty"`         // deprecated: use indexingDisabled instead to disable the indexing of this source
 	Conditionals     ConditionalFilter `json:"conditionals"`                      // deprecated: use source.rules instead
 	Rules            []ConditionalRule `json:"rules"`                             // list of item rules to apply to specific paths
 	DefaultUserScope string            `json:"defaultUserScope"`                  // defaults to root of index "/" should match folders under path
@@ -254,6 +276,7 @@ type ResolvedRulesConfig struct {
 	IgnoreAllZeroSizeFolders bool // Excludes all folders with 0 size
 	IgnoreAllSymlinks        bool // Excludes all symbolic links
 	IndexingDisabled         bool // Excludes all files and folders from indexing
+	NoRules                  bool // No rules are configured
 }
 
 type Frontend struct {
@@ -263,9 +286,11 @@ type Frontend struct {
 	ExternalLinks         []ExternalLink `json:"externalLinks"`
 	DisableNavButtons     bool           `json:"disableNavButtons"` // disable the nav buttons in the sidebar
 	Styling               StylingConfig  `json:"styling"`
-	Favicon               string         `json:"favicon"`     // path to a favicon to use for the frontend
-	Description           string         `json:"description"` // description that shows up in html head meta description
-	LoginIcon             string         `json:"loginIcon"`   // path to an image file for the login page icon
+	Favicon               string         `json:"favicon"`             // path to a favicon to use for the frontend
+	Description           string         `json:"description"`         // description that shows up in html head meta description
+	LoginIcon             string         `json:"loginIcon"`           // path to an image file for the login page icon
+	LoginButtonText       string         `json:"loginButtonText"`     // text to display on the login button
+	OIDCLoginButtonText   string         `json:"oidcLoginButtonText"` // text to display on the OIDC login button
 }
 
 type StylingConfig struct {
@@ -291,22 +316,99 @@ type ExternalLink struct {
 	Url   string `json:"url" validate:"required"`  // the url to link to
 }
 
-// UserDefaultsPreview holds preview settings with pointer types for defaults
-type UserDefaultsPreview struct {
-	DisableHideSidebar bool  `json:"disableHideSidebar"` // keep sidebar open when previewing files
-	HighQuality        *bool `json:"highQuality"`        // use high quality thumbnails
-	Image              *bool `json:"image"`              // show thumbnails for image files
-	Video              *bool `json:"video"`              // show thumbnails for video files
-	MotionVideoPreview *bool `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
-	Office             *bool `json:"office"`             // show thumbnails for office files
-	PopUp              *bool `json:"popup"`              // show larger popup preview when hovering over thumbnail
-	AutoplayMedia      *bool `json:"autoplayMedia"`      // autoplay media files in preview
-	DefaultMediaPlayer bool  `json:"defaultMediaPlayer"` // disable the styled feature-rich media player for browser default
-	Folder             *bool `json:"folder"`             // show thumbnails for folders that have previewable contents
-}
-
 // UserDefaultsPermissions holds permission settings with pointer types for defaults
 type UserDefaultsPermissions struct {
+	Api      bool  `json:"api"`      // deprecated: use account.permissions.api instead. allow api access
+	Admin    bool  `json:"admin"`    // deprecated: use account.permissions.admin instead. allow admin access
+	Modify   bool  `json:"modify"`   // deprecated: use account.permissions.modify instead. allow modifying files
+	Share    bool  `json:"share"`    // deprecated: use account.permissions.share instead. allow sharing files
+	Realtime bool  `json:"realtime"` // deprecated: use account.permissions.realtime instead. allow realtime updates
+	Delete   bool  `json:"delete"`   // deprecated: use account.permissions.delete instead. allow deleting files
+	Create   bool  `json:"create"`   // deprecated: use account.permissions.create instead. allow creating or uploading files
+	Download *bool `json:"download"` // deprecated: use account.permissions.download instead. allow downloading files
+}
+
+// New organized structures for UserDefaults
+
+// UserDefaultsSidebar holds sidebar-related settings
+type UserDefaultsSidebar struct {
+	DisableQuickToggles  bool  `json:"disableQuickToggles"`  // disable the quick toggles in the sidebar
+	HideFileActions      bool  `json:"hideFileActions"`      // hide the file actions in the sidebar
+	DisableHideOnPreview bool  `json:"disableHideOnPreview"` // keep sidebar open when previewing files (was preview.disableHideSidebar)
+	Sticky               bool  `json:"sticky"`               // keep sidebar open when navigating
+	HideFiles            bool  `json:"hideFiles"`            // hide files in the sidebar tree navigation, when true, will show only directories
+	ShowTools            *bool `json:"showTools"`            // show sidebar links with category "tool"; default is true
+}
+
+// UserDefaultsListing holds file listing display settings
+type UserDefaultsListing struct {
+	DeleteWithoutConfirming bool   `json:"deleteWithoutConfirming"` // delete files without confirmation
+	DateFormat              bool   `json:"dateFormat"`              // when false, the date is relative, when true, the date is an exact timestamp
+	ShowHidden              bool   `json:"showHidden"`              // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	QuickDownload           bool   `json:"quickDownload"`           // show icon to download in one click
+	ShowSelectMultiple      bool   `json:"showSelectMultiple"`      // show select multiple files on desktop
+	SingleClick             bool   `json:"singleClick"`             // open directory on single click, also enables middle click to open in new tab
+	HideFileExt             string `json:"hideFileExt"`             // space separated list of file extensions to hide in UI
+	ShowCopyPath            bool   `json:"showCopyPath"`            // show copy path button in the context menu
+	DeleteAfterArchive      bool   `json:"deleteAfterArchive"`      // delete source files after successful creation/extraction of archives
+	ViewMode                string `json:"viewMode"`                // view mode to use: eg. normal, list, grid, or compact
+	GallerySize             int    `json:"gallerySize"`             // 0-9 - the size of the gallery thumbnails
+}
+
+// UserDefaultsPreview holds preview-related settings
+type UserDefaultsPreview struct {
+	Image              *bool  `json:"image"`              // show thumbnails for image files
+	Video              *bool  `json:"video"`              // show thumbnails for video files
+	Audio              *bool  `json:"audio"`              // show thumbnails for audio files
+	MotionVideoPreview *bool  `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
+	Office             *bool  `json:"office"`             // show thumbnails for office files
+	PopUp              *bool  `json:"popup"`              // show larger popup preview when hovering over thumbnail
+	DisablePreviewExt  string `json:"disablePreviewExt"`  // comma separated list of file extensions to disable preview for
+	HighQuality        *bool  `json:"highQuality"`        // high quality preview thumbnails
+	Folder             *bool  `json:"folder"`             // show thumbnails for folders that have previewable contents
+	Models             *bool  `json:"models"`             // show live thumbnails for 3D models files
+	// deprecated fields
+	DisableHideSidebar bool `json:"disableHideSidebar"` // deprecated: use sidebar.disableHideOnPreview instead. disable the hide sidebar preview for previews and editors
+	DefaultMediaPlayer bool `json:"defaultMediaPlayer"` // deprecated: use fileViewer.defaultMediaPlayer instead. disable the styled feature-rich media player for browser default
+	AutoplayMedia      bool `json:"autoplayMedia"`      // deprecated: use fileViewer.autoplayMedia instead. autoplay media files in preview
+}
+
+// UserDefaultsFileViewer holds file viewer/editor settings
+type UserDefaultsFileViewer struct {
+	EditorQuickSave         bool   `json:"editorQuickSave"`         // show quick save button in editor
+	AutoplayMedia           *bool  `json:"autoplayMedia"`           // autoplay media files in preview
+	DisableViewingExt       string `json:"disableViewingExt"`       // comma separated list of file extensions to disable viewing for
+	DisableOnlyOfficeExt    string `json:"disableOnlyOfficeExt"`    // list of file extensions to disable onlyoffice editor for
+	PreferEditorForMarkdown bool   `json:"preferEditorForMarkdown"` // prefer editor first for markdown files instead of the Markdown Viewer
+	DebugOffice             bool   `json:"debugOffice"`             // debug onlyoffice editor
+	DefaultMediaPlayer      bool   `json:"defaultMediaPlayer"`      // disable the styled feature-rich media player for browser default
+}
+
+// UserDefaultsSearch holds search-related settings
+type UserDefaultsSearch struct {
+	DisableOptions bool `json:"disableOptions"` // disable the search options in the search bar
+}
+
+// UserDefaultsUI holds UI/appearance settings
+type UserDefaultsUI struct {
+	DarkMode    *bool  `json:"darkMode"`    // should dark mode be enabled
+	ThemeColor  string `json:"themeColor"`  // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+	CustomTheme string `json:"customTheme"` // Name of theme to use chosen from custom themes config
+	Locale      string `json:"locale"`      // language to use: eg. de, en, or fr
+
+}
+
+// UserDefaultsAccount holds account/security settings
+type UserDefaultsAccount struct {
+	Permissions                UserDefaultsAccountPermissions `json:"permissions"`
+	LockPassword               bool                           `json:"lockPassword"`               // disable the user from changing their password
+	DisableSettings            bool                           `json:"disableSettings"`            // disable the user from viewing the settings page
+	LoginMethod                string                         `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
+	DisableUpdateNotifications bool                           `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
+}
+
+// UserDefaultsAccountPermissions holds permission settings
+type UserDefaultsAccountPermissions struct {
 	Api      bool  `json:"api"`      // allow api access
 	Admin    bool  `json:"admin"`    // allow admin access
 	Modify   bool  `json:"modify"`   // allow modifying files
@@ -317,38 +419,51 @@ type UserDefaultsPermissions struct {
 	Download *bool `json:"download"` // allow downloading files
 }
 
-// UserDefaults is a type that holds the default values
-// for some fields on User.
+// UserDefaults is a type that holds the default values for some fields on User.
 type UserDefaults struct {
-	EditorQuickSave            bool                    `json:"editorQuickSave"`           // show quick save button in editor
-	HideSidebarFileActions     bool                    `json:"hideSidebarFileActions"`    // hide the file actions in the sidebar
-	DisableQuickToggles        bool                    `json:"disableQuickToggles"`       // disable the quick toggles in the sidebar
-	DisableSearchOptions       bool                    `json:"disableSearchOptions"`      // disable the search options in the search bar
-	StickySidebar              bool                    `json:"stickySidebar"`             // keep sidebar open when navigating
-	DarkMode                   *bool                   `json:"darkMode"`                  // should dark mode be enabled
-	Locale                     string                  `json:"locale"`                    // language to use: eg. de, en, or fr
-	ViewMode                   string                  `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
-	SingleClick                bool                    `json:"singleClick"`               // open directory on single click, also enables middle click to open in new tab
-	ShowHidden                 bool                    `json:"showHidden"`                // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-	DateFormat                 bool                    `json:"dateFormat"`                // when false, the date is relative, when true, the date is an exact timestamp
-	GallerySize                int                     `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
-	ThemeColor                 string                  `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-	QuickDownload              bool                    `json:"quickDownload"`             // show icon to download in one click
-	DisablePreviewExt          string                  `json:"disablePreviewExt"`         // space separated list of file extensions to disable preview for
-	DisableViewingExt          string                  `json:"disableViewingExt"`         // space separated list of file extensions to disable viewing for
-	LockPassword               bool                    `json:"lockPassword"`              // disable the user from changing their password
-	DisableSettings            bool                    `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
-	Preview                    UserDefaultsPreview     `json:"preview"`
+	// New organized structure
+	Sidebar     UserDefaultsSidebar    `json:"sidebar,omitempty"`
+	Listing     UserDefaultsListing    `json:"listing,omitempty"`
+	Preview     UserDefaultsPreview    `json:"preview,omitempty"`
+	FileViewer  UserDefaultsFileViewer `json:"fileViewer,omitempty"`
+	Search      UserDefaultsSearch     `json:"search,omitempty"`
+	UI          UserDefaultsUI         `json:"ui,omitempty"`
+	FileLoading users.FileLoading      `json:"fileLoading,omitempty"`
+	Account     UserDefaultsAccount    `json:"account,omitempty"`
+
+	// Deprecated fields - kept for backwards compatibility
+	EditorQuickSave            bool                    `json:"editorQuickSave,omitempty"`        // deprecated: use fileViewer.editorQuickSave instead
+	HideSidebarFileActions     bool                    `json:"hideSidebarFileActions,omitempty"` // deprecated: use sidebar.hideSidebarFileActions instead
+	DisableQuickToggles        bool                    `json:"disableQuickToggles,omitempty"`    // deprecated: use sidebar.disableQuickToggles instead
+	DisableSearchOptions       bool                    `json:"disableSearchOptions,omitempty"`   // deprecated: use search.disableOptions instead
+	StickySidebar              bool                    `json:"stickySidebar,omitempty"`          // deprecated: use sidebar.stickySidebar instead
+	HideFilesInTree            bool                    `json:"hideFilesInTree,omitempty"`        // deprecated: use sidebar.hideFilesInTree instead
+	DarkMode                   *bool                   `json:"darkMode,omitempty"`               // deprecated: use sidebar.darkMode instead
+	Locale                     string                  `json:"locale,omitempty"`                 // deprecated: use ui.locale instead
+	ViewMode                   string                  `json:"viewMode,omitempty"`               // deprecated: use sidebar.viewMode instead
+	SingleClick                bool                    `json:"singleClick,omitempty"`            // deprecated: use sidebar.singleClick instead
+	ShowHidden                 bool                    `json:"showHidden,omitempty"`             // deprecated: use listing.showHidden instead
+	HideFileExt                string                  `json:"hideFileExt,omitempty"`            // deprecated: use listing.hideFileExt instead
+	DateFormat                 bool                    `json:"dateFormat,omitempty"`             // deprecated: use listing.dateFormat instead
+	GallerySize                int                     `json:"gallerySize,omitempty"`            // deprecated: use sidebar.gallerySize instead
+	ThemeColor                 string                  `json:"themeColor,omitempty"`             // deprecated: use ui.themeColor instead
+	QuickDownload              bool                    `json:"quickDownload,omitempty"`          // deprecated: use listing.quickDownload instead
+	DisablePreviewExt          string                  `json:"disablePreviewExt,omitempty"`      // deprecated: use preview.disablePreviewExt instead
+	DisableViewingExt          string                  `json:"disableViewingExt,omitempty"`      // deprecated: use fileViewer.disableViewingExt instead
+	LockPassword               bool                    `json:"lockPassword,omitempty"`           // deprecated: use account.lockPassword instead
+	DisableSettings            bool                    `json:"disableSettings,omitempty"`        // deprecated: use account.disableSettings instead
 	DefaultScopes              []users.SourceScope     `json:"-"`
-	Permissions                UserDefaultsPermissions `json:"permissions"`
-	LoginMethod                string                  `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
-	DisableUpdateNotifications bool                    `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
-	DeleteWithoutConfirming    bool                    `json:"deleteWithoutConfirming"`    // delete files without confirmation
-	FileLoading                users.FileLoading       `json:"fileLoading"`                // upload and download settings
-	DisableOfficePreviewExt    string                  `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
-	DisableOnlyOfficeExt       string                  `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
-	CustomTheme                string                  `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
-	ShowSelectMultiple         bool                    `json:"showSelectMultiple"`         // show select multiple files on desktop
-	DebugOffice                bool                    `json:"debugOffice"`                // debug onlyoffice editor
-	DefaultLandingPage         string                  `json:"defaultLandingPage"`         // deprecated: determined by sidebar link order since 1.1.0
+	Permissions                UserDefaultsPermissions `json:"permissions,omitempty"`                // deprecated: use account.permissions instead
+	LoginMethod                string                  `json:"loginMethod,omitempty"`                // deprecated: use account.loginMethod instead
+	DisableUpdateNotifications bool                    `json:"disableUpdateNotifications,omitempty"` // deprecated: use account.disableUpdateNotifications instead
+	DeleteWithoutConfirming    bool                    `json:"deleteWithoutConfirming,omitempty"`    // deprecated: use listing.deleteWithoutConfirming instead
+	DeleteAfterArchive         bool                    `json:"deleteAfterArchive,omitempty"`         // deprecated: use listing.deleteAfterArchive instead
+	DisableOfficePreviewExt    string                  `json:"disableOfficePreviewExt,omitempty"`    // deprecated: use disablePreviewExt instead
+	DisableOnlyOfficeExt       string                  `json:"disableOnlyOfficeExt,omitempty"`       // deprecated: use fileViewer.disableOnlyOfficeExt instead
+	CustomTheme                string                  `json:"customTheme,omitempty"`                // deprecated: use ui.customTheme instead
+	ShowSelectMultiple         bool                    `json:"showSelectMultiple,omitempty"`         // deprecated: use listing.showSelectMultiple instead
+	ShowToolsInSidebar         *bool                   `json:"showToolsInSidebar,omitempty"`         // deprecated: use sidebar.showToolsInSidebar instead
+	DebugOffice                bool                    `json:"debugOffice,omitempty"`                // deprecated: use fileViewer.debugOffice instead
+	PreferEditorForMarkdown    bool                    `json:"preferEditorForMarkdown,omitempty"`    // deprecated: use fileViewer.preferEditorForMarkdown instead
+	ShowCopyPath               bool                    `json:"showCopyPath,omitempty"`               // deprecated: use listing.showCopyPath instead
 }

backend/common/settings/video_preview_test.go

@@ -26,7 +26,7 @@ integrations:
 		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
 			// All video formats should be enabled by default
 			for _, format := range AllVideoPreviewTypes {
-				if !config.Integrations.Media.Convert.VideoPreview[format] {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
 					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
 				}
 			}
@@ -52,7 +52,7 @@ integrations:
 		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
 			// All video formats should be enabled by default
 			for _, format := range AllVideoPreviewTypes {
-				if !config.Integrations.Media.Convert.VideoPreview[format] {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
 					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
 				}
 			}
@@ -81,16 +81,16 @@ integrations:
 `
 		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
 			// Check explicitly set formats
-			if !config.Integrations.Media.Convert.VideoPreview[MP4VideoPreview] {
+			if !*config.Integrations.Media.Convert.VideoPreview[MP4VideoPreview] {
 				t.Error("Expected mp4 to be enabled")
 			}
-			if config.Integrations.Media.Convert.VideoPreview[WebMVideoPreview] {
+			if *config.Integrations.Media.Convert.VideoPreview[WebMVideoPreview] {
 				t.Error("Expected webm to be disabled")
 			}
-			if config.Integrations.Media.Convert.VideoPreview[MKVVideoPreview] {
+			if *config.Integrations.Media.Convert.VideoPreview[MKVVideoPreview] {
 				t.Error("Expected mkv to be disabled")
 			}
-			if config.Integrations.Media.Convert.VideoPreview[WMVVideoPreview] {
+			if *config.Integrations.Media.Convert.VideoPreview[WMVVideoPreview] {
 				t.Error("Expected wmv to be disabled")
 			}
 
@@ -100,7 +100,7 @@ integrations:
 				M4VVideoPreview, ThreeGPVideoPreview, TSVideoPreview, VOBVideoPreview,
 			}
 			for _, format := range unmentionedFormats {
-				if !config.Integrations.Media.Convert.VideoPreview[format] {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
 					t.Errorf("Expected %s to be enabled (not mentioned in config), but it was disabled", format)
 				}
 			}
@@ -155,13 +155,13 @@ integrations:
 			}
 
 			for _, format := range expectedEnabled {
-				if !config.Integrations.Media.Convert.VideoPreview[format] {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
 					t.Errorf("Expected %s to be enabled, but it was disabled", format)
 				}
 			}
 
 			for _, format := range expectedDisabled {
-				if config.Integrations.Media.Convert.VideoPreview[format] {
+				if *config.Integrations.Media.Convert.VideoPreview[format] {
 					t.Errorf("Expected %s to be disabled, but it was enabled", format)
 				}
 			}
@@ -182,7 +182,7 @@ integrations:
 		testVideoPreviewConfig(t, config, func(t *testing.T, config *Settings) {
 			// All video formats should be enabled by default
 			for _, format := range AllVideoPreviewTypes {
-				if !config.Integrations.Media.Convert.VideoPreview[format] {
+				if !*config.Integrations.Media.Convert.VideoPreview[format] {
 					t.Errorf("Expected %s to be enabled by default, but it was disabled", format)
 				}
 			}
@@ -217,7 +217,7 @@ integrations:
 			for category, formats := range categories {
 				t.Run(category, func(t *testing.T) {
 					for _, format := range formats {
-						if !config.Integrations.Media.Convert.VideoPreview[format] {
+						if !*config.Integrations.Media.Convert.VideoPreview[format] {
 							t.Errorf("Expected %s (%s) to be enabled by default, but it was disabled", format, category)
 						}
 					}

backend/common/utils/crypto.go

@@ -0,0 +1,74 @@
+package utils
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+func randomBytes(n int) ([]byte, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return nil, err
+	}
+	return b, nil
+}
+
+// RandomHex returns a hex-encoded string from byteLen bytes of crypto/rand (length 2*byteLen).
+func RandomHex(byteLen int) (string, error) {
+	b, err := randomBytes(byteLen)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+var BcryptCost = bcrypt.DefaultCost
+var InvalidPasswordHash = ""
+
+// HashPwd hashes a password.
+func HashPwd(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), BcryptCost)
+	return string(bytes), err
+}
+
+// CheckPwd checks if a password is correct.
+func CheckPwd(password, hash string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+}
+
+func SetInvalidPasswordHash() error {
+	passwordHash, err := HashPwd(InsecureRandomIdentifier(16))
+	if err != nil {
+		return err
+	}
+	InvalidPasswordHash = passwordHash
+	return nil
+}
+
+func HashSHA256(data string) string {
+	bytes := sha256.Sum256([]byte(data))
+	return hex.EncodeToString(bytes[:])
+}
+
+func GenerateKey() string {
+	b := make([]byte, 64)
+	_, err := rand.Read(b)
+	if err != nil {
+		return ""
+	}
+	return string(b)
+}
+
+// CSPNonce returns a base64-encoded random value suitable for Content-Security-Policy nonces
+// and matching HTML nonce="" attributes (cryptographically random, URL/header safe characters).
+func CSPNonce() (string, error) {
+	b, err := randomBytes(16)
+	if err != nil {
+		return "", err
+	}
+	return base64.StdEncoding.EncodeToString(b), nil
+}

backend/common/utils/file.go

@@ -52,24 +52,60 @@ type FileOptions struct {
 	IsDir                    bool
 	Expand                   bool
 	Content                  bool
-	Recursive                bool // whether to recursively index directories
-	Metadata                 bool // whether to get metadata
-	ExtractEmbeddedSubtitles bool // whether to extract embedded subtitles from media files
-	AlbumArt                 bool // whether to get album art from media files
-	ShowHidden               bool // whether to show hidden files (true = show, false = hide)
-	FollowSymlinks           bool // whether to follow symlinks
+	Recursive                bool   // whether to recursively index directories
+	Metadata                 bool   // whether to get metadata
+	ExtractEmbeddedSubtitles bool   // whether to extract embedded subtitles from media files
+	AlbumArt                 bool   // whether to get album art from media files
+	ShowHidden               bool   // whether to show hidden files (true = show, false = hide)
+	HideFileExt              string // Hide files based on extensions (eg: '.lrc' or '.srt')
+	FollowSymlinks           bool   // whether to follow symlinks
+	Only                     string // whether to only get files or folders
+	SkipExtendedAttrs        bool   // whether to skip extended attributes
+	ShowSharedAttr           bool   // whether to show share attributes
 }
 
 // SanitizeUserPath prevents path traversal attacks by cleaning and validating user input.
 // Rule 1: Do Not Use User Input in File Paths (without validation)
 func SanitizeUserPath(userPath string) (string, error) {
-	// Clean resolves . and .. segments
 	clean := filepath.Clean(userPath)
 
-	// Reject absolute paths or attempts to escape scope
-	if strings.HasPrefix(clean, "..") {
-		return "", fmt.Errorf("invalid path")
+	// Split the path into segments to check for path traversal attempts
+	// We check if ".." appears as a complete path segment (not just in a filename)
+	segments := strings.Split(clean, string(filepath.Separator))
+
+	for _, segment := range segments {
+		// Check if any segment is exactly ".." (path traversal attempt)
+		// This catches any ".." that filepath.Clean couldn't resolve (i.e., escape attempts)
+		if segment == ".." {
+			return "", fmt.Errorf("invalid path: path traversal detected")
+		}
+	}
+
+	if clean == "." {
+		return "", fmt.Errorf("invalid path: path must standard index path")
 	}
 
 	return clean, nil
 }
+
+// HideFileByExt will check if a filename matches any of the hidden extensions
+func HideFileByExt(filename, hideExt string) bool {
+	if hideExt == "" {
+		return false
+	}
+	exts := strings.Fields(hideExt)
+	nameLower := strings.ToLower(filename)
+	for _, ext := range exts {
+		ext = strings.TrimSpace(ext)
+		if ext == "" {
+			continue
+		}
+		if !strings.HasPrefix(ext, ".") {
+			ext = "." + ext
+		}
+		if strings.HasSuffix(nameLower, strings.ToLower(ext)) {
+			return true
+		}
+	}
+	return false
+}

backend/common/utils/main.go

@@ -2,9 +2,6 @@ package utils
 
 import (
 	"cmp"
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/hex"
 	"fmt"
 	math "math/rand"
 	"os"
@@ -23,15 +20,6 @@ func CheckErr(source string, err error) {
 	}
 }
 
-func GenerateKey() string {
-	b := make([]byte, 64)
-	_, err := rand.Read(b)
-	if err != nil {
-		return ""
-	}
-	return string(b)
-}
-
 // CapitalizeFirst returns the input string with the first letter capitalized.
 func CapitalizeFirst(s string) string {
 	if len(s) == 0 {
@@ -92,11 +80,6 @@ func GetParentDirectoryPath(path string) string {
 	return path[:lastSlash]
 }
 
-func HashSHA256(data string) string {
-	bytes := sha256.Sum256([]byte(data))
-	return hex.EncodeToString(bytes[:])
-}
-
 func GetLastComponent(path string) string {
 	if path == "" {
 		return ""

backend/common/utils/media.go

@@ -0,0 +1,43 @@
+package utils
+
+import (
+	"errors"
+	"os"
+)
+
+type SubtitleTrack struct {
+	Name     string `json:"name"`            // filename for external, or descriptive name for embedded
+	Language string `json:"language"`        // language code
+	Title    string `json:"title,omitempty"` // title/description
+	Index    *int   `json:"index,omitempty"` // stream index for embedded subtitles (nil for external)
+	Codec    string `json:"codec,omitempty"` // codec name for embedded subtitles
+	Embedded bool   `json:"embedded"`        // true for embedded subtitles, false for external files
+}
+
+func GetSubtitleSidecarContent(subtitlePath string) (string, error) {
+	// validate the size is not too large
+	info, err := os.Stat(subtitlePath)
+	if err != nil {
+		return "", err
+	}
+	if info.Size() > 1024*1024*50 { // 50MB
+		return "", errors.New("subtitle file is too large")
+	}
+
+	// First check if it's a text file using the consolidated validation logic
+	isText, err := IsTextFile(subtitlePath)
+	if err != nil {
+		return "", err
+	}
+	if !isText {
+		// Not a text file, return empty string (no error, just not text)
+		return "", nil
+	}
+
+	// read the file content
+	content, err := os.ReadFile(subtitlePath)
+	if err != nil {
+		return "", err
+	}
+	return string(content), nil
+}

backend/common/utils/textfile.go

@@ -1,148 +1,65 @@
 package utils
 
 import (
-	"io"
 	"os"
-	"unicode"
 	"unicode/utf8"
 )
 
-// IsTextFile checks if a file is likely a text file by examining its content.
-// It returns true if the file appears to be a valid text file, false otherwise.
-// This function performs various heuristics to detect text files:
+// IsTextFile checks if a file is viewable/editable as text (like with cat or a text editor).
+// It returns true if the file appears to be text, false if it's likely binary.
+// This function uses simple heuristics:
 // - Valid UTF-8 encoding
-// - Limited null bytes
-// - Limited non-printable characters
+// - Not full of null bytes (which indicate binary data)
 func IsTextFile(realPath string) (bool, error) {
-	const headerSize = 4096
-	// Thresholds for detecting binary-like content (these can be tuned)
-	const maxNullBytesInHeaderAbs = 10    // Max absolute null bytes in header
-	const maxNullByteRatioInHeader = 0.1  // Max 10% null bytes in header
-	const maxNullByteRatioInFile = 0.05   // Max 5% null bytes in the entire file
-	const maxNonPrintableRuneRatio = 0.05 // Max 5% non-printable runes in the entire file
-
-	// Open file
-	f, err := os.Open(realPath)
-	if err != nil {
-		return false, err
-	}
-	defer f.Close()
-
-	// Read header
-	headerBytes := make([]byte, headerSize)
-	n, err := f.Read(headerBytes)
-	if err != nil && err != io.EOF {
-		return false, err
-	}
-	actualHeader := headerBytes[:n]
-
-	// --- Start of heuristic checks ---
-
-	if n > 0 {
-		// Trim header to last complete UTF-8 rune to avoid false negatives
-		// when the header read cuts off in the middle of a multi-byte sequence.
-		// We decode runes from the end until we find a valid one, trimming
-		// any incomplete sequences at the end.
-		trimmedHeader := actualHeader
-		for len(trimmedHeader) > 0 {
-			lastRune, size := utf8.DecodeLastRune(trimmedHeader)
-			if lastRune != utf8.RuneError {
-				// Found a valid complete rune
-				break
-			}
-			// RuneError occurred - this could be an incomplete sequence or invalid byte
-			// Trim the last byte and try again
-			if size == 1 && len(trimmedHeader) > 0 {
-				trimmedHeader = trimmedHeader[:len(trimmedHeader)-1]
-			} else {
-				// Shouldn't happen, but break to avoid infinite loop
-				break
-			}
-		}
-
-		// 1. Basic Check: Is the header valid UTF-8?
-		// If not, it's unlikely an editable UTF-8 text file.
-		// Use trimmed header to avoid false negatives from truncated sequences
-		if len(trimmedHeader) > 0 && !utf8.Valid(trimmedHeader) {
-			return false, nil // Not an error, just not the text file we want
-		}
-
-		// 2. Check for excessive null bytes in the header
-		nullCountInHeader := 0
-		for _, b := range actualHeader {
-			if b == 0x00 {
-				nullCountInHeader++
-			}
-		}
-		// Reject if too many nulls absolutely or relatively in the header
-		if nullCountInHeader > 0 { // Only perform check if there are any nulls
-			if nullCountInHeader > maxNullBytesInHeaderAbs ||
-				(float64(nullCountInHeader)/float64(n) > maxNullByteRatioInHeader) {
-				return false, nil // Too many nulls in header
-			}
-		}
-
-		// 3. Check for other non-text ASCII control characters in the header
-		// (C0 controls excluding \t, \n, \r)
-		for _, b := range actualHeader {
-			if b < 0x20 && b != '\t' && b != '\n' && b != '\r' {
-				return false, nil // Found problematic control character
-			}
-		}
-	}
-
-	// Now read the full file (original logic)
+	const sampleSize = 8192       // Read first 8KB to check
+	const maxNullByteRatio = 0.05 // Reject if more than 5% null bytes
+	// Read sample from file
 	content, err := os.ReadFile(realPath)
 	if err != nil {
 		return false, err
 	}
-	// Handle empty file (empty files are considered text)
+	// Empty files are considered text
 	if len(content) == 0 {
 		return true, nil
 	}
+	// Use sample for large files to avoid reading entire file into memory
+	sample := content
+	if len(content) > sampleSize {
+		sample = content[:sampleSize]
+	}
+	// Check 1: Count null bytes - binary files typically have many nulls
+	nullCount := 0
+	for _, b := range sample {
+		if b == 0x00 {
+			nullCount++
+		}
+	}
 
-	stringContent := string(content)
+	if nullCount > 0 {
+		nullRatio := float64(nullCount) / float64(len(sample))
+		if nullRatio > maxNullByteRatio {
+			return false, nil
+		}
+	}
 
-	// 4. Final UTF-8 validation for the entire file
-	// (This is crucial as the header might be fine, but the rest of the file isn't)
-	if !utf8.ValidString(stringContent) {
+	// Check 2: Validate UTF-8 encoding
+	// Trim sample to last complete UTF-8 rune to avoid false negatives
+	trimmedSample := sample
+	for len(trimmedSample) > 0 {
+		lastRune, size := utf8.DecodeLastRune(trimmedSample)
+		if lastRune != utf8.RuneError {
+			break
+		}
+		if size == 1 {
+			trimmedSample = trimmedSample[:len(trimmedSample)-1]
+		} else {
+			break
+		}
+	}
+
+	if len(trimmedSample) > 0 && !utf8.Valid(trimmedSample) {
 		return false, nil
 	}
 
-	// 5. Check for excessive null bytes in the entire file content
-	if len(content) > 0 { // Check only for non-empty files
-		totalNullCount := 0
-		for _, b := range content {
-			if b == 0x00 {
-				totalNullCount++
-			}
-		}
-		if float64(totalNullCount)/float64(len(content)) > maxNullByteRatioInFile {
-			return false, nil // Too many nulls in the entire file
-		}
-	}
-
-	// 6. Check for excessive non-printable runes in the entire file content
-	// (Excluding tab, newline, carriage return, which are common in text files)
-	if len(stringContent) > 0 { // Check only for non-empty strings
-		nonPrintableRuneCount := 0
-		totalRuneCount := 0
-		for _, r := range stringContent {
-			totalRuneCount++
-			// unicode.IsPrint includes letters, numbers, punctuation, symbols, and spaces.
-			// It excludes control characters. We explicitly allow \t, \n, \r.
-			if !unicode.IsPrint(r) && r != '\t' && r != '\n' && r != '\r' {
-				nonPrintableRuneCount++
-			}
-		}
-
-		if totalRuneCount > 0 { // Avoid division by zero
-			if float64(nonPrintableRuneCount)/float64(totalRuneCount) > maxNonPrintableRuneRatio {
-				return false, nil // Too many non-printable runes
-			}
-		}
-	}
-
-	// The file has passed all checks and is considered editable text.
 	return true, nil
 }

backend/config.media.yaml

@@ -1,11 +1,10 @@
-server:
-  logging:
-    - levels: "info|warning|error"
-  sources:
-    - path: "/srv"
 userDefaults:
   preview:
     image: true
-    popup: true
     video: true
-    highQuality: true
+    audio: true
+    motionVideoPreview: true
+    office: true
+    popup: true
+    folder: true
+    models: true

backend/config.playwright.yaml

@@ -28,7 +28,6 @@ userDefaults:
   disableSettings: false                  # disable the user from viewing the settings page
   preview:
     disableHideSidebar: true             # disable the hide sidebar preview for previews and editors
-    highQuality: true                    # generate high quality thumbnail preview images
     image: true                          # show thumbnail preview image for image files
     video: true                          # show thumbnail preview image for video files
     motionVideoPreview: true             # show multiple frames for videos in thumbnail preview when hovering
@@ -50,7 +49,6 @@ userDefaults:
   deleteWithoutConfirming: false          # delete files without confirmation
   disableOnlyOfficeExt: ".md .txt .pdf"   # list of file extensions to disable onlyoffice editor for
   showSelectMultiple: false               # show select multiple files on desktop
-  defaultLandingPage: ""                  # default landing page to use if no redirect is specified: eg. /files/mysource/mysubpath, /settings, etc.
 
 #office:
 #  url: "http://localhost:9052"

backend/config.yaml

@@ -5,47 +5,84 @@ server:
     - levels: "info|warning|error"
   sources:
     - path: "/srv"
+auth:
+  key: "change-me-to-a-random-string"
+  totpSecret: "change-me-to-another-random-string"
+  methods:
+    password:
+      enabled: true
+      minLength: 5
+      signup: false
+    passkey:
+      enabled: false
 userDefaults:
-  editorQuickSave: false                  # show quick save button in editor
-  hideSidebarFileActions: false           # hide the file actions in the sidebar
-  disableQuickToggles: false              # disable the quick toggles in the sidebar
-  disableSearchOptions: false             # disable the search options in the search bar
-  stickySidebar: true                     # keep sidebar open when navigating
-  darkMode: true                          # should dark mode be enabled (defaults to true if not set)
-  viewMode: "normal"                      # view mode to use: eg. normal, list, grid, or compact
-  singleClick: false                      # open directory on single click, also enables middle click to open in new tab
-  showHidden: false                       # show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-  dateFormat: false                       # when false, the date is relative, when true, the date is an exact timestamp
-  gallerySize: 3                          # 0-9 - the size of the gallery thumbnails
-  themeColor: "var(--blue)"               # theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-  quickDownload: false                    # show icon to download in one click
-  disablePreviewExt: ""                   # space separated list of file extensions to disable preview for
-  disableViewingExt: ""                   # space separated list of file extensions to disable viewing for
-  lockPassword: false                     # disable the user from changing their password
-  disableSettings: false                  # disable the user from viewing the settings page
+  sidebar:
+    disableQuickToggles: false            # disable the quick toggles in the sidebar
+    hideFileActions: false                # hide the file actions in the sidebar
+    disableHideOnPreview: false           # keep sidebar open when previewing files
+    sticky: true                          # keep sidebar open when navigating
+    hideFiles: false                      # hide files in the sidebar tree navigation, when true, will show only directories
+    showTools: true                       # show sidebar links of category "tool"; when false they stay in the list but are hidden in the UI
+
+  listing:
+    deleteWithoutConfirming: false        # delete files without confirmation
+    dateFormat: false                     # when false, the date is relative, when true, the date is an exact timestamp
+    showHidden: false                     # show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+    quickDownload: false                  # show icon to download in one click
+    showSelectMultiple: false             # show select multiple files on desktop
+    singleClick: false                    # open directory on single click, also enables middle click to open in new tab
+    hideFileExt: ""                       # space separated list of file extensions to hide in UI
+    showCopyPath: false                   # show copy path button in the context menu
+    deleteAfterArchive: true              # delete source files after successful creation/extraction of archives
+    viewMode: "normal"                    # view mode to use: eg. normal, list, grid, or compact
+    gallerySize: 3                        # 0-9 - the size of the gallery thumbnails
+
   preview:
-    disableHideSidebar: false             # disable the hide sidebar preview for previews and editors
-    highQuality: true                     # generate high quality thumbnail preview images (defaults to true if not set)
     image: true                           # show thumbnail preview image for image files (defaults to true if not set)
     video: true                           # show thumbnail preview image for video files (defaults to true if not set)
+    audio: true                           # show thumbnail preview image for audio files (defaults to true if not set)
     motionVideoPreview: true              # show multiple frames for videos in thumbnail preview when hovering (defaults to true if not set)
     office: true                          # show thumbnail preview image for office files (defaults to true if not set)
     popup: true                           # show larger popup preview when hovering over thumbnail (defaults to true if not set)
-    autoplayMedia: true                   # autoplay media files in preview (defaults to true if not set)
-    defaultMediaPlayer: false             # disable html5 media player and use the default media player
+    disablePreviewExt: ""                 # space separated list of file extensions to disable preview for
+    highQuality: true                     # high quality preview thumbnails
     folder: true                          # show thumbnail preview image for folder files (defaults to true if not set)
-  permissions:
-    api: false                            # allow api access
-    admin: false                          # allow admin access
-    modify: false                         # allow modifying files
-    share: false                          # allow sharing files
-    realtime: false                       # allow realtime updates
-    delete: false                         # allow deleting files
-    create: false                         # allow creating or uploading files
-    download: true                        # allow downloading files (defaults to true if not set)
-  disableUpdateNotifications: false       # disable update notifications banner for admin users
-  deleteWithoutConfirming: false          # delete files without confirmation
-  disableOnlyOfficeExt: ".md .txt .pdf .html .xml"   # list of file extensions to disable onlyoffice editor for
-  customTheme: ""                         # Name of theme to use chosen from custom themes config.
-  showSelectMultiple: false               # show select multiple files on desktop
-  debugOffice: false                      # debug onlyoffice editor
+    models: true                          # show live thumbnail preview for 3D Models files (defaults to true if not set)
+
+  fileViewer:
+    editorQuickSave: false                # show quick save button in editor
+    autoplayMedia: true                   # autoplay media files in preview (defaults to true if not set)
+    disableViewingExt: ""                 # space separated list of file extensions to disable viewing for
+    disableOnlyOfficeExt: ".md .txt .pdf .html .xml"  # list of file extensions to disable onlyoffice editor for
+    preferEditorForMarkdown: false        # prefer editor first for markdown files instead of the Markdown Viewer
+    debugOffice: false                    # debug onlyoffice editor
+    defaultMediaPlayer: false             # disable html5 media player and use the default media player
+
+  search:
+    disableOptions: false                 # disable the search options in the search bar
+
+  ui:
+    darkMode: true                        # should dark mode be enabled (defaults to true if not set)
+    themeColor: "var(--blue)"             # theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+    customTheme: ""                       # Name of theme to use chosen from custom themes config
+    locale: "en"                          # language to use: eg. de, en, or fr
+
+  fileLoading:
+    maxConcurrentUpload: 10               # maximum number of concurrent uploads
+    uploadChunkSizeMb: 10                 # upload chunk size in MB
+    downloadChunkSizeMb: 0                # download chunk size in MB (0 = no chunking)
+
+  account:
+    permissions:
+      api: false                          # allow api access
+      admin: false                        # allow admin access
+      modify: false                       # allow modifying files
+      share: false                        # allow sharing files
+      realtime: false                     # allow realtime updates
+      delete: false                       # allow deleting files
+      create: false                       # allow creating or uploading files
+      download: true                      # allow downloading files (defaults to true if not set)
+    lockPassword: false                   # disable the user from changing their password
+    disableSettings: false                # disable the user from viewing the settings page
+    loginMethod: "password"               # login method to use: eg. password, proxy, oidc
+    disableUpdateNotifications: false     # disable update notifications banner for admin users

backend/database/access/access.go

@@ -37,8 +37,10 @@ type SourceRuleMap map[string]RuleMap
 type StringSet map[string]struct{}
 
 type dbStorage struct {
-	AllRules SourceRuleMap `json:"all_rules"`
-	Groups   GroupMap      `json:"groups"`
+	AllRules      SourceRuleMap       `json:"all_rules"`
+	Groups        GroupMap            `json:"groups"`
+	RevokedTokens map[string]struct{} `json:"revoked_tokens"` // set of revoked token hashes
+	HashedTokens  map[string]uint     `json:"hashed_tokens"`  // maps token hash → user ID
 }
 
 // RuleSet groups users and groups for allow/deny lists.
@@ -72,21 +74,26 @@ type GroupMap map[string]StringSet
 
 // Storage manages access rules and group membership.
 type Storage struct {
-	mux      sync.RWMutex
-	AllRules SourceRuleMap  // AllRules[sourcePath][indexPath] - in-memory authoritative state
-	Groups   GroupMap       // key: group name, value: set of usernames - in-memory authoritative state
-	DB       *storm.DB      // Optional: DB for persistence
-	Users    *users.Storage // Reference to users storage
+	mux           sync.RWMutex
+	AllRules      SourceRuleMap       // AllRules[sourcePath][indexPath] - in-memory authoritative state
+	Groups        GroupMap            // key: group name, value: set of usernames - in-memory authoritative state
+	RevokedTokens map[string]struct{} // set of revoked token hashes - in-memory authoritative state
+	HashedTokens  map[string]uint     // maps token hash → user ID - in-memory authoritative state
+	DB            *storm.DB           // Optional: DB for persistence
+	Users         *users.Storage      // Reference to users storage
 }
 
 // SaveToDB persists all rules to the DB if DB is set.
+// IMPORTANT: Caller must hold s.mux lock (either read or write).
 func (s *Storage) SaveToDB() error {
 	if s.DB == nil {
 		return nil
 	}
 	data, err := json.Marshal(&dbStorage{
-		AllRules: s.AllRules,
-		Groups:   s.Groups,
+		AllRules:      s.AllRules,
+		Groups:        s.Groups,
+		RevokedTokens: s.RevokedTokens,
+		HashedTokens:  s.HashedTokens,
 	})
 	if err != nil {
 		return err
@@ -97,6 +104,8 @@ func (s *Storage) SaveToDB() error {
 // Flush persists the current in-memory state to the backing store.
 // Call during graceful shutdown to ensure DB matches memory.
 func (s *Storage) Flush() error {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
 	return s.SaveToDB()
 }
 
@@ -123,6 +132,18 @@ func (s *Storage) LoadFromDB() error {
 	if s.Groups == nil {
 		s.Groups = make(GroupMap)
 	}
+	s.RevokedTokens = storage.RevokedTokens
+	if s.RevokedTokens == nil {
+		s.RevokedTokens = make(map[string]struct{})
+	}
+	s.HashedTokens = storage.HashedTokens
+	if s.HashedTokens == nil {
+		s.HashedTokens = make(map[string]uint)
+	}
+	s.HashedTokens = storage.HashedTokens
+	if s.HashedTokens == nil {
+		s.HashedTokens = make(map[string]uint)
+	}
 	s.mux.Unlock()
 	return nil
 }
@@ -136,10 +157,12 @@ func (s *Storage) LoadFromDB() error {
 //	if err != nil { /* handle error */ }
 func NewStorage(db *storm.DB, usersStore *users.Storage) *Storage {
 	var s = &Storage{
-		AllRules: make(SourceRuleMap),
-		Groups:   make(GroupMap),
-		DB:       db,
-		Users:    usersStore,
+		AllRules:      make(SourceRuleMap),
+		Groups:        make(GroupMap),
+		RevokedTokens: make(map[string]struct{}),
+		HashedTokens:  make(map[string]uint),
+		DB:            db,
+		Users:         usersStore,
 	}
 	return s
 }
@@ -1236,3 +1259,63 @@ func (s *Storage) UpdateRulePath(sourcePath, oldPath, newPath string) error {
 	logger.Debugf("access rule path updated: source=%s, fromPath=%s, toPath=%s", sourcePath, oldPath, newPath)
 	return s.SaveToDB()
 }
+
+// RevokeToken adds a token hash to the revoked list and persists to DB.
+func (s *Storage) RevokeToken(tokenHash string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	tokenHash = utils.HashSHA256(tokenHash)
+	s.RevokedTokens[tokenHash] = struct{}{}
+	// Also remove from HashedTokens to prevent future lookups
+	delete(s.HashedTokens, tokenHash)
+	return s.SaveToDB()
+}
+
+// IsTokenRevoked checks if a token hash is in the revoked list (memory-only read).
+func (s *Storage) IsTokenRevoked(tokenHash string) bool {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	tokenHash = utils.HashSHA256(tokenHash)
+	_, exists := s.RevokedTokens[tokenHash]
+	return exists
+}
+
+// AddHashedToken adds a token hash to user ID mapping.
+func (s *Storage) AddApiToken(tokenString string, userID uint) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	tokenHash := utils.HashSHA256(tokenString)
+	s.HashedTokens[tokenHash] = userID
+	return s.SaveToDB()
+}
+
+// GetUserIDFromToken retrieves the user ID for a given token string (memory-only read).
+func (s *Storage) GetUserIDFromToken(tokenString string) (uint, bool) {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	tokenHash := utils.HashSHA256(tokenString)
+	userID, exists := s.HashedTokens[tokenHash]
+	return userID, exists
+}
+
+// GetRevokedTokens returns a copy of all revoked token hashes.
+func (s *Storage) GetRevokedTokens() map[string]struct{} {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	// Return a copy to prevent external modification
+	result := make(map[string]struct{}, len(s.RevokedTokens))
+	for k := range s.RevokedTokens {
+		result[k] = struct{}{}
+	}
+	return result
+}
+
+// RemoveApiToken removes a token hash mapping (used when deleting API keys).
+func (s *Storage) RemoveApiToken(tokenString string) error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	tokenHash := utils.HashSHA256(tokenString)
+	delete(s.HashedTokens, tokenHash)
+	return s.SaveToDB()
+}

backend/database/access/helper.go

@@ -7,7 +7,7 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )
 
-func (s *Storage) CheckChildItemAccess(response *iteminfo.ExtendedFileInfo, index *indexing.Index, username string) error {
+func (s *Storage) CheckChildItemAccess(response *iteminfo.FileInfo, index *indexing.Index, username string) error {
 
 	// Collect all item names to check
 	allItemNames := make([]string, 0, len(response.Folders)+len(response.Files))

backend/database/dbindex/indexing.go

@@ -1,4 +1,4 @@
-package indexing
+package dbindex
 
 import (
 	"time"
@@ -17,6 +17,11 @@ type IndexInfo struct {
 	NumDirs    uint64 `json:"numDirs"`
 	NumFiles   uint64 `json:"numFiles"`
 
+	// Disk usage (cached from periodic GetIndexInfo / partition probes; aligns with ReducedIndex Stats)
+	UsedAsIndexed uint64 `json:"used"`
+	UsedDisk      uint64 `json:"usedAlt"`
+	DiskTotal     uint64 `json:"total"`
+
 	// Scanner information - map of scanner path to scanner stats
 	Scanners map[string]*PersistedScannerInfo `json:"scanners"`
 }
@@ -31,4 +36,5 @@ type PersistedScannerInfo struct {
 	QuickScanTime   int       `json:"quickScanTime"`
 	FullScanTime    int       `json:"fullScanTime"`
 	LastScanned     time.Time `json:"lastScanned"`
+	FullScanCounter int       `json:"fullScanCounter"` // 0-4: position in 1 full + 4 quick cycle before next executeScan
 }

backend/database/dbindex/storage.go

@@ -1,4 +1,4 @@
-package indexing
+package dbindex
 
 import (
 	"sync"
@@ -167,3 +167,37 @@ func (s *Storage) Flush() error {
 	}
 	return nil
 }
+
+// ResetAllComplexities sets the complexity to 0 for all indexes and their scanners.
+// This should be called when the index database is recreated (either fresh start or after corruption).
+func (s *Storage) ResetAllComplexities() error {
+	// Get all indexes from storage
+	infos, err := s.All()
+	if err != nil {
+		return err
+	}
+
+	// Reset complexity for each index
+	for _, info := range infos {
+		if info == nil {
+			continue
+		}
+
+		// Reset index-level complexity
+		info.Complexity = 0
+
+		// Reset scanner-level complexities
+		for _, scanner := range info.Scanners {
+			if scanner != nil {
+				scanner.Complexity = 0
+			}
+		}
+
+		// Save the updated info
+		if err := s.Save(info); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

backend/database/share/extended.go

@@ -2,10 +2,13 @@ package share
 
 import (
 	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 // IsSingleFileShare determines if this share is for a single file (not a directory).
@@ -144,10 +147,73 @@ func (l *Link) HasReachedUserLimit(username string) bool {
 	return count >= l.DownloadsLimit
 }
 
-func (l *Link) GetSourceName() (string, error) {
+func (l *Link) GetSourceName() string {
 	sourceInfo, ok := settings.Config.Server.SourceMap[l.Source]
 	if !ok {
-		return "", fmt.Errorf("source not found")
+		return ""
 	}
-	return sourceInfo.Name, nil
+	return sourceInfo.Name
+}
+
+func (l *Link) UserCanEdit(user *users.User) bool {
+	return l.UserID == user.ID || user.Permissions.Admin
+}
+
+func (l *Link) SourceURL(user *users.User) string {
+	sourceName := l.GetSourceName()
+	// get user scope path from share
+	userScope, err := user.GetScopeForSourceName(sourceName)
+	if err != nil {
+		return ""
+	}
+	if !strings.HasPrefix(l.Path, userScope) {
+		return ""
+	}
+	scopedPath := strings.TrimPrefix(l.Path, userScope)
+	return "/" + filepath.Join("files", sourceName, scopedPath)
+}
+
+func (l *Link) BannerURL() string {
+	_, _, err := l.GetShareImagePartsHelper(true)
+	if err == nil {
+		return fmt.Sprintf("%s%spublic/api/share/image?banner=true&hash=%s", settings.Config.Server.ExternalUrl, settings.Config.Server.BaseURL, l.Hash)
+	}
+	return l.Banner
+}
+
+func (l *Link) FaviconURL() string {
+	_, _, err := l.GetShareImagePartsHelper(false)
+	if err == nil {
+		return fmt.Sprintf("%s%spublic/api/share/image?favicon=true&hash=%s", settings.Config.Server.ExternalUrl, settings.Config.Server.BaseURL, l.Hash)
+	}
+	return l.Favicon
+}
+
+func (l *Link) GetShareImagePartsHelper(isBanner bool) (string, string, error) {
+	// Get the asset query string from share
+	var assetQueryString string
+	if isBanner {
+		assetQueryString = l.Banner
+	} else {
+		assetQueryString = l.Favicon
+	}
+
+	if assetQueryString == "" {
+		return "", "", fmt.Errorf("asset not configured for this share")
+	}
+
+	// Parse the query string to extract source and path
+	assetParams, err := url.ParseQuery(assetQueryString)
+	if err != nil {
+		return "", "", fmt.Errorf("invalid asset configuration: %v", err)
+	}
+
+	sourceName := assetParams.Get("source")
+	assetPath := assetParams.Get("path")
+
+	if sourceName == "" || assetPath == "" {
+		return "", "", fmt.Errorf("source or path not found in asset configuration")
+	}
+
+	return sourceName, assetPath, nil
 }

backend/database/share/share.go

@@ -43,8 +43,11 @@ type CommonShare struct {
 	AllowReplacements        bool                `json:"allowReplacements,omitempty"` // allow replacements of files
 	SidebarLinks             []users.SidebarLink `json:"sidebarLinks"`                // customizable sidebar links
 	HasPassword              bool                `json:"hasPassword,omitempty"`
-	ShowHidden               bool                `json:"showHidden,omitempty"`         // show hidden files in share (true = show, false = hide)
-	DisableLoginOption       bool                `json:"disableLoginOption,omitempty"` // disable login option in share (true = hide, false = show)
+	ShowHidden               bool                `json:"showHidden,omitempty"`  // show hidden files in share (true = show, false = hide)
+	HideFileExt              string              `json:"hideFileExt,omitempty"` // show hidden files based on extensions in shares
+	DisableLoginOption       bool                `json:"disableLoginOption"`    // disable login option in share (true = hide, false = show)
+	SourceURL                string              `json:"sourceURL,omitempty"`
+	CanEditShare             bool                `json:"canEditShare,omitempty"`
 }
 type CreateBody struct {
 	CommonShare

backend/database/share/storage.go

@@ -56,86 +56,179 @@ func (c *crudBackend) DeleteByID(id any) error {
 
 // Storage is a share storage using generics.
 type Storage struct {
-	Generic    *crud.Storage[Link]
-	back       StorageBackend
-	shareCache map[string]*Link
-	mu         sync.RWMutex
-	users      *users.Storage
+	Generic     *crud.Storage[Link]
+	back        StorageBackend
+	shareByHash map[string]*Link             // key: link hash
+	shareByPath map[string]map[string]string // key: pathKey(Source, Path), value: set of hashes (hash -> "")
+	mu          sync.RWMutex
+	users       *users.Storage
 }
 
-// NewStorage creates a share links storage from a backend.
+// pathKey returns the cache key for shareByPath (source + path).
+func pathKey(source, path string) string {
+	return source + ":" + path
+}
+
+// setCacheLocked updates both shareByHash and shareByPath for the given link.
+// Caller must hold s.mu.
+func (s *Storage) setCacheLocked(link *Link) {
+	if link == nil {
+		return
+	}
+	adjustedPath := utils.AddTrailingSlashIfNotExists(link.Path)
+	adjustedSource := utils.AddTrailingSlashIfNotExists(link.Source)
+	s.shareByHash[link.Hash] = link
+	key := pathKey(adjustedSource, adjustedPath)
+	if s.shareByPath[key] == nil {
+		s.shareByPath[key] = make(map[string]string)
+	}
+	s.shareByPath[key][link.Hash] = ""
+}
+
+// setCache updates both caches for the given link. It acquires s.mu.
+func (s *Storage) setCache(link *Link) {
+	s.mu.Lock()
+	s.setCacheLocked(link)
+	s.mu.Unlock()
+}
+
+// deleteFromCacheLocked removes the link (by hash) from both caches.
+// Caller must hold s.mu.
+func (s *Storage) deleteFromCacheLocked(hash string) {
+	link, ok := s.shareByHash[hash]
+	if !ok {
+		return
+	}
+	adjustedPath := utils.AddTrailingSlashIfNotExists(link.Path)
+	adjustedSource := utils.AddTrailingSlashIfNotExists(link.Source)
+	key := pathKey(adjustedSource, adjustedPath)
+	if inner, ok := s.shareByPath[key]; ok {
+		delete(inner, hash)
+		if len(inner) == 0 {
+			delete(s.shareByPath, key)
+		}
+	}
+	delete(s.shareByHash, hash)
+}
+
+// deleteFromCache removes the link (by hash) from both caches. It acquires s.mu.
+func (s *Storage) deleteFromCache(hash string) {
+	s.mu.Lock()
+	s.deleteFromCacheLocked(hash)
+	s.mu.Unlock()
+}
+
+// setCacheAfterMove updates both caches when a link's Source or Path changed. It acquires s.mu.
+func (s *Storage) setCacheAfterMove(link *Link, oldSource, oldPath string) {
+	s.mu.Lock()
+	if link == nil {
+		return
+	}
+	adjustedOldPath := utils.AddTrailingSlashIfNotExists(oldPath)
+	adjustedOldSource := utils.AddTrailingSlashIfNotExists(oldSource)
+	oldKey := pathKey(adjustedOldSource, adjustedOldPath)
+	if inner, ok := s.shareByPath[oldKey]; ok {
+		delete(inner, link.Hash)
+		if len(inner) == 0 {
+			delete(s.shareByPath, oldKey)
+		}
+	}
+	s.setCacheLocked(link)
+	s.mu.Unlock()
+}
+
+// NewStorage creates a share links storage from a backend and populates the
+// in-memory cache from the database so all reads can be served from cache.
 func NewStorage(back StorageBackend, usersStore *users.Storage) *Storage {
-	return &Storage{
-		Generic:    crud.NewStorage[Link](&crudBackend{back: back}),
-		back:       back,
-		shareCache: make(map[string]*Link),
-		users:      usersStore,
+	s := &Storage{
+		Generic:     crud.NewStorage[Link](&crudBackend{back: back}),
+		back:        back,
+		shareByHash: make(map[string]*Link),
+		shareByPath: make(map[string]map[string]string),
+		users:       usersStore,
 	}
+	s.loadShareCache()
+	return s
 }
 
-// All wraps StorageBackend.All and handles expiry.
-func (s *Storage) All() ([]*Link, error) {
+// loadShareCache fills shareByHash and shareByPath from the backend and removes expired links from the DB.
+// Call once at startup so all reads can be served from cache.
+func (s *Storage) loadShareCache() {
 	links, err := s.back.All()
-	if err != nil {
-		return nil, err
+	if err != nil && err != errors.ErrNotExist {
+		return
 	}
-	filtered, err := s.filterExpired(links)
-	if err != nil {
-		return nil, err
+	if links == nil {
+		links = []*Link{}
 	}
-
 	s.mu.Lock()
-	for i, l := range filtered {
-		if l == nil {
+	for _, link := range links {
+		if link == nil {
 			continue
 		}
-		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
-			filtered[i] = existing
-		} else {
-			s.shareCache[l.Hash] = l
+		if link.Expire != 0 && link.Expire <= time.Now().Unix() && !link.KeepAfterExpiration {
+			_ = s.back.Delete(link.Hash)
+			continue
 		}
+		link.InitUserDownloads()
+		s.setCacheLocked(link)
 	}
 	s.mu.Unlock()
-	return filtered, nil
 }
 
-// FindByUserID wraps StorageBackend.FindByUserID and handles expiry.
-func (s *Storage) FindByUserID(id uint) ([]*Link, error) {
-	links, err := s.back.FindByUserID(id)
-	if err != nil {
-		return nil, err
-	}
-	filtered, err := s.filterExpired(links)
-	if err != nil {
-		return nil, err
-	}
+// LoadShareCacheFromDB repopulates the in-memory cache from the database.
+// Call at startup (e.g. from InitializeDb) to ensure shares are loaded after the store is ready.
+func (s *Storage) LoadShareCacheFromDB() {
+	s.loadShareCache()
+}
 
+// All returns all non-expired shares from the cache (populated at startup and by writes).
+func (s *Storage) All() ([]*Link, error) {
 	s.mu.Lock()
-	for i, l := range filtered {
+	result := make([]*Link, 0, len(s.shareByHash))
+	for _, l := range s.shareByHash {
 		if l == nil {
 			continue
 		}
-		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
-			filtered[i] = existing
-		} else {
-			s.shareCache[l.Hash] = l
+		if l.Expire != 0 && l.Expire <= time.Now().Unix() && !l.KeepAfterExpiration {
+			_ = s.back.Delete(l.Hash)
+			s.deleteFromCacheLocked(l.Hash)
+			continue
 		}
+		result = append(result, l)
 	}
 	s.mu.Unlock()
-	return filtered, nil
+	return result, nil
+}
+
+// FindByUserID returns non-expired shares for the user from the cache.
+func (s *Storage) FindByUserID(id uint) ([]*Link, error) {
+	s.mu.Lock()
+	result := make([]*Link, 0)
+	for _, l := range s.shareByHash {
+		if l == nil || l.UserID != id {
+			continue
+		}
+		if l.Expire != 0 && l.Expire <= time.Now().Unix() && !l.KeepAfterExpiration {
+			_ = s.back.Delete(l.Hash)
+			s.deleteFromCacheLocked(l.Hash)
+			continue
+		}
+		result = append(result, l)
+	}
+	s.mu.Unlock()
+	return result, nil
 }
 
 // GetByHash wraps StorageBackend.GetByHash and handles expiry.
 func (s *Storage) GetByHash(hash string) (*Link, error) {
 	// return stable in-memory pointer if available
 	s.mu.RLock()
-	if link, ok := s.shareCache[hash]; ok && link != nil {
+	if link, ok := s.shareByHash[hash]; ok && link != nil {
 		s.mu.RUnlock()
 		if link.Expire != 0 && link.Expire <= time.Now().Unix() {
 			_ = s.back.Delete(hash)
-			s.mu.Lock()
-			delete(s.shareCache, hash)
-			s.mu.Unlock()
+			s.deleteFromCache(hash)
 			return nil, errors.ErrNotExist
 		}
 		return link, nil
@@ -154,9 +247,7 @@ func (s *Storage) GetByHash(hash string) (*Link, error) {
 	// Initialize UserDownloads map
 	link.InitUserDownloads()
 
-	s.mu.Lock()
-	s.shareCache[hash] = link
-	s.mu.Unlock()
+	s.setCache(link)
 	return link, nil
 }
 
@@ -164,68 +255,74 @@ func (s *Storage) GetByHash(hash string) (*Link, error) {
 func (s *Storage) GetPermanent(path, source string, id uint) (*Link, error) {
 	l, err := s.back.GetPermanent(path, source, id)
 	if err == nil && l != nil {
-		s.mu.Lock()
-
-		s.shareCache[l.Hash] = l
-		s.mu.Unlock()
+		s.setCache(l)
 	}
 	return l, err
 }
 
-// Gets wraps StorageBackend.Gets and handles expiry.
+// Gets returns shares for the given path, source, and user from the cache.
 func (s *Storage) Gets(sourcePath, source string, id uint) ([]*Link, error) {
-	links, err := s.back.Gets(sourcePath, source, id)
-	if err != nil {
-		return nil, err
-	}
-	filtered, err := s.filterExpired(links)
-	if err != nil {
-		return nil, err
-	}
 	s.mu.Lock()
-	for i, l := range filtered {
-		if l == nil {
+	adjustedPath := utils.AddTrailingSlashIfNotExists(sourcePath)
+	adjustedSource := utils.AddTrailingSlashIfNotExists(source)
+	key := pathKey(adjustedSource, adjustedPath)
+	hashes := s.shareByPath[key]
+	result := make([]*Link, 0, len(hashes))
+	for h := range hashes {
+		l := s.shareByHash[h]
+		if l == nil || l.UserID != id {
 			continue
 		}
-		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
-			filtered[i] = existing
-		} else {
-			s.shareCache[l.Hash] = l
+		if l.Expire != 0 && l.Expire <= time.Now().Unix() && !l.KeepAfterExpiration {
+			_ = s.back.Delete(l.Hash)
+			s.deleteFromCacheLocked(l.Hash)
+			continue
 		}
+		result = append(result, l)
 	}
 	s.mu.Unlock()
-	return filtered, nil
+	return result, nil
 }
 
-// GetBySourcePath wraps StorageBackend.GetBySourcePath and handles expiry.
+// GetBySourcePath returns shares for the given path and source from the cache.
 func (s *Storage) GetBySourcePath(path, source string) ([]*Link, error) {
-	links, err := s.back.GetBySourcePath(path, source)
-	if err != nil {
-		return nil, err
-	}
-	filtered, err := s.filterExpired(links)
-	if err != nil {
-		return nil, err
-	}
 	s.mu.Lock()
-	for i, l := range filtered {
+	adjustedPath := utils.AddTrailingSlashIfNotExists(path)
+	adjustedSource := utils.AddTrailingSlashIfNotExists(source)
+	key := pathKey(adjustedSource, adjustedPath)
+	hashes := s.shareByPath[key]
+	result := make([]*Link, 0, len(hashes))
+	for h := range hashes {
+		l := s.shareByHash[h]
 		if l == nil {
 			continue
 		}
-		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
-			filtered[i] = existing
-		} else {
-			s.shareCache[l.Hash] = l
+		if l.Expire != 0 && l.Expire <= time.Now().Unix() && !l.KeepAfterExpiration {
+			_ = s.back.Delete(l.Hash)
+			s.deleteFromCacheLocked(l.Hash)
+			continue
 		}
+		result = append(result, l)
 	}
 	s.mu.Unlock()
-	return filtered, nil
+	return result, nil
+}
+
+// IsShared returns whether the given path and source have any shares in the cache.
+func (s *Storage) IsShared(path, source string, id uint) bool {
+	links, _ := s.GetBySourcePath(path, source)
+	for _, l := range links {
+		if l.UserID == id {
+			return true
+		}
+	}
+	return len(links) > 0
 }
 
 // UpdateShares updates all shares that match oldSource and oldPath to point to newSource and newPath.
 // Handles both exact matches and subdirectories, regardless of trailing slashes.
 func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (int, error) {
-	links, err := s.back.All()
+	links, err := s.All()
 	if err != nil && err != errors.ErrNotExist {
 		logger.Error("failed to list shares", "error", err)
 		return 0, err
@@ -247,7 +344,6 @@ func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (i
 			continue
 		}
 
-		oldFullPath := l.Path
 		l.Source = newSource
 		l.Path = newPath
 
@@ -256,22 +352,9 @@ func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (i
 			return updated, err
 		}
 
-		s.mu.Lock()
-		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
-			existing.Source = l.Source
-			existing.Path = l.Path
-		} else {
-			s.shareCache[l.Hash] = l
-		}
-		s.mu.Unlock()
-
-		logger.Info("share updated", "hash", l.Hash, "fromPath", oldFullPath, "toPath", l.Path)
+		s.setCacheAfterMove(l, oldSource, oldPath)
 		updated++
 	}
-
-	if updated == 0 {
-		logger.Warning("no matching shares to update for provided source/path")
-	}
 	return updated, nil
 }
 
@@ -290,11 +373,7 @@ func (s *Storage) UpdateSharePath(hash, newPath string) error {
 		return err
 	}
 
-	s.mu.Lock()
-	if existing, ok := s.shareCache[hash]; ok && existing != nil {
-		existing.Path = newPath
-	}
-	s.mu.Unlock()
+	s.setCacheAfterMove(link, link.Source, oldPath)
 
 	logger.Debug("share path updated", "hash", hash, "fromPath", oldPath, "toPath", newPath)
 	return nil
@@ -305,9 +384,7 @@ func (s *Storage) Save(l *Link) error {
 	if err := s.back.Save(l); err != nil {
 		return err
 	}
-	s.mu.Lock()
-	s.shareCache[l.Hash] = l
-	s.mu.Unlock()
+	s.setCache(l)
 	return nil
 }
 
@@ -316,47 +393,16 @@ func (s *Storage) Delete(hash string) error {
 	if err := s.back.Delete(hash); err != nil {
 		return err
 	}
-	s.mu.Lock()
-	delete(s.shareCache, hash)
-	s.mu.Unlock()
+	s.deleteFromCache(hash)
 	return nil
 }
 
-// Flush persists the current in-memory state of all shares to the backing store.
-// Call during graceful shutdown to ensure DB matches memory.
+// Flush is a no-op: every share write (Save, Delete, UpdateShares, UpdateSharePath) already
+// updates the database, so the cache and DB stay in sync without flushing.
 func (s *Storage) Flush() error {
-	s.mu.RLock()
-	links := make([]*Link, 0, len(s.shareCache))
-	for _, l := range s.shareCache {
-		if l != nil {
-			links = append(links, l)
-		}
-	}
-	s.mu.RUnlock()
-	for _, l := range links {
-		if err := s.back.Save(l); err != nil {
-			return err
-		}
-	}
 	return nil
 }
 
-// filterExpired removes expired links and deletes them from storage.
-func (s *Storage) filterExpired(links []*Link) ([]*Link, error) {
-	var filtered []*Link
-	for _, link := range links {
-		if link.Expire != 0 && link.Expire <= time.Now().Unix() && !link.KeepAfterExpiration {
-			_ = s.back.Delete(link.Hash)
-			s.mu.Lock()
-			delete(s.shareCache, link.Hash)
-			s.mu.Unlock()
-			continue
-		}
-		filtered = append(filtered, link)
-	}
-	return filtered, nil
-}
-
 // GetCommonShareByHash retrieves only the CommonShare attributes for a given hash
 func (s *Storage) GetCommonShareByHash(hash string) (*CommonShare, error) {
 	return s.back.GetCommonShareByHash(hash)

backend/database/sql/index.go

@@ -2,11 +2,14 @@ package sql
 
 import (
 	"database/sql"
+	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
@@ -41,7 +44,7 @@ func createIndexDB(name string, journalMode string, lockingMode string, batchSiz
 		BatchSize:           batchSize,
 		CacheSizeKB:         cacheSizeKB,      // From config, converted to KB
 		SoftHeapLimitBytes:  16 * 1024 * 1024, // 16MB soft heap limit (reduced to minimize memory pressure)
-		CacheSpillThreshold: 200,              // Spill dirty pages to disk when cache exceeds 200 pages (~800KB) - more aggressive
+		CacheSpillThreshold: 2000,             // Spill dirty pages to disk when cache exceeds 2000 pages (~8MB)
 		MmapSize:            0,                // Disable mmap to prevent additional OS page cache usage
 		Synchronous:         "OFF",            // No sync for maximum performance - safe since DB can be rebuilt
 		TempStore:           "FILE",           // FILE instead of MEMORY to reduce memory usage
@@ -61,39 +64,123 @@ func createIndexDB(name string, journalMode string, lockingMode string, batchSiz
 // batchSize: number of items per batch transaction
 // cacheSizeMB: cache size in megabytes
 // disableReuse: true to delete and recreate DB on startup, false to reuse existing (default)
-func NewIndexDB(name string, journalMode string, batchSize int, cacheSizeMB int, disableReuse bool) (*IndexDB, error) {
+// Returns the IndexDB and a boolean indicating if the database is new (true) or reused (false)
+func NewIndexDB(name string, journalMode string, batchSize int, cacheSizeMB int, disableReuse bool) (*IndexDB, bool, error) {
+	isNewDb := disableReuse // If disableReuse is true, we're creating fresh
+
+	// Check if database file exists (only if reuse is enabled)
+	if !disableReuse {
+		// Database files are stored in sql subdirectory (see sqlite.go:207)
+		dbPath := filepath.Join(settings.Config.Server.CacheDir, "sql", fmt.Sprintf("index_%s.db", name))
+		_, err := os.Stat(dbPath)
+		if os.IsNotExist(err) {
+			// Database file doesn't exist, so this is a new database
+			isNewDb = true
+		} else if err != nil {
+			// Some other error occurred
+			logger.Warningf("Error checking database file: %v", err)
+			isNewDb = true
+		}
+	}
+
 	idxDB, err := createIndexDB(name, journalMode, "", batchSize, cacheSizeMB, disableReuse)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	// For persistent databases, check integrity on startup
 	// If corrupted, delete and recreate the database
 	if !disableReuse {
-		if err := idxDB.checkIntegrityAndRecreateIfNeeded(); err != nil {
-			// Database was recreated, need to create a new connection
+		mode := normalizeStartupIntegrityMode(settings.Config.Server.IndexSqlConfig.StartupIntegrityCheck)
+		if err := idxDB.runStartupIntegrityCheck(mode); err != nil {
+			// Database was recreated due to corruption
+			logger.Warningf("[DB_INIT] SQLite database was found with issues which could be due to a dirty shutdown, recreating: tmp/index_%s.db", name)
+			isNewDb = true
 			idxDB.Close()
 
 			// Recreate the database connection
 			idxDB, err = createIndexDB(name, journalMode, "", batchSize, cacheSizeMB, disableReuse)
 			if err != nil {
-				return nil, err
+				return nil, false, err
 			}
 		}
 	}
 
 	if err := idxDB.CreateIndexTable(); err != nil {
 		idxDB.Close()
-		return nil, err
+		return nil, false, err
 	}
 	go idxDB.startPeriodicCleanup()
-	return idxDB, nil
+	return idxDB, isNewDb, nil
+}
+
+func normalizeStartupIntegrityMode(m string) string {
+	switch m {
+	case "", settings.IndexStartupIntegrityQuickCheck:
+		return settings.IndexStartupIntegrityQuickCheck
+	case settings.IndexStartupIntegrityProbe:
+		return settings.IndexStartupIntegrityProbe
+	case settings.IndexStartupIntegrityOff:
+		return settings.IndexStartupIntegrityOff
+	default:
+		logger.Warningf("[DB_INIT] unknown indexSqlConfig.startupIntegrityCheck %q, using %s", m, settings.IndexStartupIntegrityQuickCheck)
+		return settings.IndexStartupIntegrityQuickCheck
+	}
+}
+
+// runStartupIntegrityCheck runs the configured startup check (quick_check, probe, or off).
+func (db *IndexDB) runStartupIntegrityCheck(mode string) error {
+	switch mode {
+	case settings.IndexStartupIntegrityOff:
+		logger.Debugf("[DB_INTEGRITY] startup integrity skipped (startupIntegrityCheck=off)")
+		return nil
+	case settings.IndexStartupIntegrityProbe:
+		return db.checkAccessibilityProbe()
+	default:
+		// quickCheck (including normalized default)
+		return db.checkIntegrityAndRecreateIfNeeded()
+	}
+}
+
+// checkAccessibilityProbe verifies the DB file is readable: sqlite_master and optionally one row from index_items.
+// If index_items is absent (brand-new file), succeeds so CreateIndexTable can create it.
+func (db *IndexDB) checkAccessibilityProbe() error {
+	start := time.Now()
+	defer func() {
+		logger.Debugf("[DB_INTEGRITY] startup probe completed in %v", time.Since(start))
+	}()
+
+	var n int
+	err := db.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'index_items'`).Scan(&n)
+	if err != nil {
+		logger.Warningf("[DB_INTEGRITY] probe: cannot read sqlite_master: %v", err)
+		return db.deleteCorruptedDatabase()
+	}
+	if n == 0 {
+		logger.Debugf("[DB_INTEGRITY] probe: index_items not present yet (new database), skipping row read")
+		return nil
+	}
+
+	var dummy int
+	err = db.QueryRow(`SELECT 1 FROM index_items LIMIT 1`).Scan(&dummy)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil
+	}
+	if err != nil {
+		logger.Warningf("[DB_INTEGRITY] probe: cannot read index_items: %v", err)
+		return db.deleteCorruptedDatabase()
+	}
+	return nil
 }
 
 // checkIntegrityAndRecreateIfNeeded checks database integrity.
 // If corruption is detected, deletes the database file and returns an error to trigger recreation.
 // Returns nil if integrity is OK, error if database needs to be recreated.
 func (db *IndexDB) checkIntegrityAndRecreateIfNeeded() error {
+	start := time.Now()
+	defer func() {
+		logger.Debugf("[DB_INTEGRITY] PRAGMA quick_check completed in %v", time.Since(start))
+	}()
 	// Quick integrity check
 	var result string
 	err := db.QueryRow("PRAGMA quick_check").Scan(&result)
@@ -211,28 +298,70 @@ func (db *IndexDB) InsertItem(source, path string, info *iteminfo.FileInfo) erro
 	return err
 }
 
+// dbTransientOpAttempts is how many times to run a bulk DB op that may hit SQLITE_BUSY before giving up.
+const dbTransientOpAttempts = 2
+
+const dbTransientRetryBackoff = 50 * time.Millisecond
+
 // BulkInsertItems inserts multiple items in a single transaction for a specific source.
 // Database errors (busy/locked) are treated as soft failures - the filesystem is the source of truth.
 // Returns nil on success or soft failure (busy/locked), error only on hard failures.
+// Transient busy/locked errors retry once before giving up (see dbTransientOpAttempts).
 func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) error {
+	if len(items) == 0 {
+		return nil
+	}
 
 	startTime := time.Now()
+	for attempt := 1; attempt <= dbTransientOpAttempts; attempt++ {
+		ok, transient, err := db.attemptBulkInsert(source, items)
+		if err != nil {
+			return err
+		}
+		if ok {
+			if attempt > 1 {
+				logger.Infof("[DB_TX] BulkInsertItems: succeeded on retry (%d items, attempt %d, %v)",
+					len(items), attempt, time.Since(startTime))
+			}
+			return nil
+		}
+		if transient && attempt < dbTransientOpAttempts {
+			logger.Warningf("[DB_TX] BulkInsertItems: transient DB error (attempt %d/%d, %d items), retrying after %v",
+				attempt, dbTransientOpAttempts, len(items), dbTransientRetryBackoff)
+			time.Sleep(dbTransientRetryBackoff)
+			continue
+		}
+		if transient {
+			logger.Warningf("[DB_TX] BulkInsertItems: still failing after %d attempts (%d items, %v) — batch dropped",
+				dbTransientOpAttempts, len(items), time.Since(startTime))
+		}
+		return nil
+	}
+	return nil // defensive if dbTransientOpAttempts is ever 0 and loop never runs
+}
 
+// attemptBulkInsert runs one transactional bulk insert.
+// Returns success=true when committed; transient=true when SQLITE_BUSY-like errors allow a retry (mutex released).
+func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo) (success bool, transient bool, err error) {
 	tx, err := db.BeginTransaction()
 	if err != nil {
-		// Soft failure: DB is busy or locked, skip this update
 		if isBusyError(err) || isTransactionError(err) {
-			db.mu.Unlock() // Release mutex on error
-			logger.Debugf("[DB_TX] BulkInsertItems: BeginTransaction failed (DB busy/locked), skipping - took %v", time.Since(startTime))
-			return nil // Non-fatal: filesystem will be used as fallback
+			db.mu.Unlock()
+			logger.Debugf("[DB_TX] BulkInsertItems: BeginTransaction failed (DB busy/locked): %v", err)
+			return false, true, nil
 		}
-		db.mu.Unlock() // Release mutex on error
-		return err     // Hard failure: something is wrong with the DB
+		db.mu.Unlock()
+		return false, false, err
 	}
-	defer db.mu.Unlock() // Ensure mutex is always released
 
-	// Always update all fields including last_updated, even if nothing changed
-	// This ensures last_updated stays current for stale entry detection
+	committed := false
+	defer func() {
+		if !committed {
+			_ = tx.Rollback()
+		}
+		db.mu.Unlock()
+	}()
+
 	stmt, err := tx.Prepare(`
 	INSERT INTO index_items (source, path, parent_path, name, size, mod_time, type, is_dir, is_hidden, has_preview, last_updated)
 	VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -249,14 +378,12 @@ func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) er
 	`)
 	if err != nil {
 		if isBusyError(err) || isTransactionError(err) {
-			// With EXCLUSIVE locking and mutex, this shouldn't happen.
-			// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
-			logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Prepare: %v", err)
-			return nil
+			logger.Debugf("[DB_TX] BulkInsertItems: Prepare busy/locked: %v", err)
+			return false, true, nil
 		}
-		return err
+		return false, false, err
 	}
-	defer stmt.Close() // Ensure statement is always closed
+	defer stmt.Close()
 
 	nowUnix := time.Now().Unix()
 	for _, info := range items {
@@ -276,28 +403,23 @@ func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) er
 		)
 		if err != nil {
 			if isBusyError(err) || isTransactionError(err) {
-				// With EXCLUSIVE locking and mutex, this shouldn't happen.
-				// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
-				logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Exec: %v", err)
-				return nil
+				logger.Debugf("[DB_TX] BulkInsertItems: Exec busy/locked during insert: %v", err)
+				return false, true, nil
 			}
 			logger.Errorf("[DB] BulkInsertItems: Exec failed for path=%s, source=%s, error=%v", info.Path, source, err)
-			return err
+			return false, false, err
 		}
 	}
 
-	// Try to commit
 	if err := tx.Commit(); err != nil {
 		if isBusyError(err) || isTransactionError(err) {
-			// With EXCLUSIVE locking and mutex, this shouldn't happen.
-			// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
-			logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Commit: %v", err)
-			return nil
+			logger.Debugf("[DB_TX] BulkInsertItems: Commit busy/locked: %v", err)
+			return false, true, nil
 		}
-		return err
+		return false, false, err
 	}
-
-	return nil
+	committed = true
+	return true, false, nil
 }
 
 // isBusyError checks if an error is SQLITE_BUSY (error code 5)
@@ -387,51 +509,6 @@ func (db *IndexDB) GetItemsByPaths(source string, paths []string) (map[string]*i
 	return result, nil
 }
 
-// GetHasPreviewBatch retrieves hasPreview status for multiple directory paths in a single query.
-// This is optimized for the N+1 query pattern in GetDirInfo where we need hasPreview for all subdirectories.
-// Returns map[path]hasPreview. Missing paths in the result indicate they're not in the database yet.
-func (db *IndexDB) GetHasPreviewBatch(source string, paths []string) (map[string]bool, error) {
-	if len(paths) == 0 {
-		return make(map[string]bool), nil
-	}
-
-	// Build query with IN clause - only select path and has_preview for efficiency
-	placeholders := make([]string, len(paths))
-	args := make([]interface{}, len(paths)+1)
-	args[0] = source
-	for i, path := range paths {
-		placeholders[i] = "?"
-		args[i+1] = path
-	}
-
-	query := fmt.Sprintf(`
-	SELECT path, has_preview
-	FROM index_items WHERE source = ? AND path IN (%s) AND is_dir = 1
-	`, strings.Join(placeholders, ","))
-
-	rows, err := db.Query(query, args...)
-	if err != nil {
-		// Soft failure: DB is busy or locked, return empty map
-		if isBusyError(err) || isTransactionError(err) {
-			return make(map[string]bool), nil
-		}
-		return nil, err
-	}
-	defer rows.Close()
-
-	result := make(map[string]bool)
-	for rows.Next() {
-		var path string
-		var hasPreview bool
-		if err := rows.Scan(&path, &hasPreview); err != nil {
-			return nil, err
-		}
-		result[path] = hasPreview
-	}
-
-	return result, nil
-}
-
 // GetDirectoryChildren retrieves all children of a directory for a specific source.
 func (db *IndexDB) GetDirectoryChildren(source, dirPath string) ([]*iteminfo.FileInfo, error) {
 	query := `
@@ -519,7 +596,7 @@ func (db *IndexDB) ExplainQueryPlan(query string, args ...interface{}) (string,
 		if err := rows.Scan(&id, &parent, &notused, &detail); err != nil {
 			return "", err
 		}
-		plan.WriteString(fmt.Sprintf("%d|%d|%s\n", id, parent, detail))
+		fmt.Fprintf(&plan, "%d|%d|%s\n", id, parent, detail)
 	}
 	return plan.String(), rows.Err()
 }
@@ -990,17 +1067,31 @@ func (db *IndexDB) UpdateFolderSizesIfChanged(source string, pathSizes map[strin
 		args = append(args, path)
 	}
 
-	result, err := db.Exec(query, args...)
-	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
-			logger.Debugf("[DB_TX] UpdateFolderSizesIfChanged: DB busy/locked, skipping update")
-			return 0, nil // Non-fatal: sizes will be synced on next scan
+	startTime := time.Now()
+	for attempt := 1; attempt <= dbTransientOpAttempts; attempt++ {
+		result, err := db.Exec(query, args...)
+		if err != nil {
+			if isBusyError(err) || isTransactionError(err) {
+				if attempt < dbTransientOpAttempts {
+					logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: busy/locked (attempt %d/%d), retrying after %v: %v",
+						attempt, dbTransientOpAttempts, dbTransientRetryBackoff, err)
+					time.Sleep(dbTransientRetryBackoff)
+					continue
+				}
+				logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: still busy after %d attempts (%d paths, %v) — skipped",
+					dbTransientOpAttempts, len(pathSizes), time.Since(startTime))
+				return 0, nil
+			}
+			return 0, err
 		}
-		return 0, err
+		n, _ := result.RowsAffected()
+		if attempt > 1 {
+			logger.Infof("[DB_TX] UpdateFolderSizesIfChanged: succeeded on retry (%d rows, attempt %d, %v)",
+				n, attempt, time.Since(startTime))
+		}
+		return n, nil
 	}
-
-	rowsAffected, _ := result.RowsAffected()
-	return rowsAffected, nil
+	return 0, nil // defensive: unreachable when dbTransientOpAttempts >= 1
 }
 
 // LoadFolderSizes loads all folder sizes for a source from the database
@@ -1176,23 +1267,6 @@ func (db *IndexDB) GetSizeGroupsForDuplicates(source string, minSize int64, path
 	return sizes, sizeCounts, rows.Err()
 }
 
-// GetTotalSize returns the sum of all file sizes in the index for a specific source (excluding directories).
-func (db *IndexDB) GetTotalSize(source string) (uint64, error) {
-	query := `SELECT COALESCE(SUM(size), 0) FROM index_items WHERE source = ? AND is_dir = 0`
-
-	var totalSize int64
-	err := db.QueryRow(query, source).Scan(&totalSize)
-	if err != nil {
-		// Soft failure: DB is busy or locked, return 0
-		if isBusyError(err) || isTransactionError(err) {
-			return 0, nil
-		}
-		return 0, err
-	}
-
-	return uint64(totalSize), nil
-}
-
 // Helper functions
 
 // getNextPathPrefix returns the lexicographically next string after the given prefix.
@@ -1250,6 +1324,7 @@ func scanItem(scanner interface{ Scan(...interface{}) error }) (*iteminfo.FileIn
 		return nil, err
 	}
 	info.ModTime = time.Unix(modTime, 0)
+	info.IsDir = isDir
 	return &info, nil
 }
 

backend/database/sql/index_startup_test.go

@@ -0,0 +1,129 @@
+package sql
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+)
+
+func TestMain(m *testing.M) {
+	if fileutils.PermDir == 0 {
+		fileutils.SetFsPermissions(0o644, 0o755)
+	}
+	os.Exit(m.Run())
+}
+
+func TestNormalizeStartupIntegrityMode(t *testing.T) {
+	tests := []struct {
+		in   string
+		want string
+	}{
+		{"", settings.IndexStartupIntegrityQuickCheck},
+		{"quickCheck", settings.IndexStartupIntegrityQuickCheck},
+		{"probe", settings.IndexStartupIntegrityProbe},
+		{"off", settings.IndexStartupIntegrityOff},
+		{"not-a-real-mode", settings.IndexStartupIntegrityQuickCheck},
+	}
+	for _, tt := range tests {
+		if got := normalizeStartupIntegrityMode(tt.in); got != tt.want {
+			t.Errorf("normalizeStartupIntegrityMode(%q) = %q, want %q", tt.in, got, tt.want)
+		}
+	}
+}
+
+// pushTestIndexConfig sets CacheDir and index SQL options for NewIndexDB; returned func restores prior values.
+func pushTestIndexConfig(t *testing.T, cacheDir string, idx settings.IndexSqlConfig) func() {
+	t.Helper()
+	prevDir := settings.Config.Server.CacheDir
+	prevIdx := settings.Config.Server.IndexSqlConfig
+	settings.Config.Server.CacheDir = cacheDir
+	settings.Config.Server.IndexSqlConfig = idx
+	return func() {
+		settings.Config.Server.CacheDir = prevDir
+		settings.Config.Server.IndexSqlConfig = prevIdx
+	}
+}
+
+func testIndexSQLConfig(mode string) settings.IndexSqlConfig {
+	return settings.IndexSqlConfig{
+		WalMode:               false,
+		BatchSize:             1000,
+		CacheSizeMB:           32,
+		DisableReuse:          false,
+		StartupIntegrityCheck: mode,
+	}
+}
+
+func TestNewIndexDB_StartupProbe_NewFile(t *testing.T) {
+	dir := t.TempDir()
+	pop := pushTestIndexConfig(t, dir, testIndexSQLConfig(settings.IndexStartupIntegrityProbe))
+	defer pop()
+
+	db, _, err := NewIndexDB("probe_new", "OFF", 1000, 32, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+}
+
+func TestNewIndexDB_StartupProbe_ReopenWithData(t *testing.T) {
+	dir := t.TempDir()
+	pop := pushTestIndexConfig(t, dir, testIndexSQLConfig(settings.IndexStartupIntegrityProbe))
+	defer pop()
+
+	db, _, err := NewIndexDB("probe_reopen", "OFF", 1000, 32, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	info := &iteminfo.FileInfo{
+		Path: "/a.txt",
+		ItemInfo: iteminfo.ItemInfo{
+			Name:    "a.txt",
+			Size:    12,
+			ModTime: time.Unix(1, 0),
+			Type:    "text/plain",
+			Hidden:  false,
+		},
+	}
+	if err = db.InsertItem("src1", "/a.txt", info); err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	var db2 *IndexDB
+	db2, _, err = NewIndexDB("probe_reopen", "OFF", 1000, 32, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db2.Close()
+}
+
+func TestNewIndexDB_StartupQuickCheckStillWorks(t *testing.T) {
+	dir := t.TempDir()
+	pop := pushTestIndexConfig(t, dir, testIndexSQLConfig(settings.IndexStartupIntegrityQuickCheck))
+	defer pop()
+
+	db, _, err := NewIndexDB("quick_default", "OFF", 1000, 32, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+}
+
+func TestNewIndexDB_StartupOff(t *testing.T) {
+	dir := t.TempDir()
+	pop := pushTestIndexConfig(t, dir, testIndexSQLConfig(settings.IndexStartupIntegrityOff))
+	defer pop()
+
+	db, _, err := NewIndexDB("off_mode", "OFF", 1000, 32, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+}

backend/database/sql/search.go

@@ -18,9 +18,27 @@ type SearchItem struct {
 	HasPreview bool
 }
 
+// appendNameGlobSQL adds AND (name GLOB ? OR ...) or AND (name GLOB ? AND ...) when joinAnd is true.
+func appendNameGlobSQL(query string, args []interface{}, patterns []string, joinAnd bool) (string, []interface{}) {
+	if len(patterns) == 0 {
+		return query, args
+	}
+	parts := make([]string, len(patterns))
+	for i := range patterns {
+		parts[i] = "name GLOB ?"
+		args = append(args, patterns[i])
+	}
+	join := " OR "
+	if joinAnd {
+		join = " AND "
+	}
+	return query + " AND (" + strings.Join(parts, join) + ")", args
+}
+
 // SearchItems queries the database for items matching the search criteria for a single source.
+// When nameGlobPatterns is non-empty (and largest is false), rows are restricted with SQLite name GLOB ... OR ....
 // Returns rows that can be iterated to scan search results.
-func (db *IndexDB) SearchItems(source string, scope string, largest bool) (*sql.Rows, error) {
+func (db *IndexDB) SearchItems(source string, scope string, largest bool, nameGlobPatterns []string, nameGlobPatternsAnd bool) (*sql.Rows, error) {
 	query := `
 		SELECT path, name, size, mod_time, type, is_dir, has_preview 
 		FROM index_items 
@@ -35,6 +53,10 @@ func (db *IndexDB) SearchItems(source string, scope string, largest bool) (*sql.
 		args = append(args, scope+"*")
 	}
 
+	if !largest && len(nameGlobPatterns) > 0 {
+		query, args = appendNameGlobSQL(query, args, nameGlobPatterns, nameGlobPatternsAnd)
+	}
+
 	if largest {
 		query += " ORDER BY size DESC"
 	}
@@ -43,8 +65,9 @@ func (db *IndexDB) SearchItems(source string, scope string, largest bool) (*sql.
 }
 
 // SearchItemsMultiSource queries the database for items matching the search criteria across multiple sources.
+// When nameGlobPatterns is non-empty (and largest is false), restricts rows with SQLite name GLOB ... OR ....
 // Returns rows that can be iterated to scan search results.
-func (db *IndexDB) SearchItemsMultiSource(sources []string, sourceScopes map[string]string, largest bool) (*sql.Rows, error) {
+func (db *IndexDB) SearchItemsMultiSource(sources []string, sourceScopes map[string]string, largest bool, nameGlobPatterns []string, nameGlobPatternsAnd bool) (*sql.Rows, error) {
 	if len(sources) == 0 {
 		return nil, fmt.Errorf("at least one source is required")
 	}
@@ -95,6 +118,10 @@ func (db *IndexDB) SearchItemsMultiSource(sources []string, sourceScopes map[str
 		query += " WHERE " + strings.Join(whereClauses, " AND ")
 	}
 
+	if !largest && len(nameGlobPatterns) > 0 {
+		query, args = appendNameGlobSQL(query, args, nameGlobPatterns, nameGlobPatternsAnd)
+	}
+
 	if largest {
 		query += " ORDER BY size DESC"
 	}

backend/database/sql/sqlite.go

@@ -247,12 +247,22 @@ func NewTempDB(id string, config ...*TempDBConfig) (*TempDB, error) {
 		db.SetMaxIdleConns(1)
 	}
 
+	// Calculate cache_size in pages (negative value) to ensure consistent unit handling
+	// SQLite's cache_size: positive = KB, negative = pages
+	// When using positive KB values, SQLite seems to have issues with cache_spill being less than cache_size
+	// So we convert to pages (negative) to ensure both cache_size and cache_spill use the same units
+	cacheSizeInPages := cfg.CacheSizeKB
+	if cfg.CacheSizeKB > 0 {
+		// Convert KB to pages: KB / 4 = pages, then negate to indicate pages
+		cacheSizeInPages = -(cfg.CacheSizeKB / 4)
+	}
+
 	basePragmas := []struct {
 		sql string
 		err string
 	}{
 		{fmt.Sprintf("PRAGMA journal_mode = %s;", cfg.JournalMode), "failed to set journal_mode"},
-		{fmt.Sprintf("PRAGMA cache_size = %d;", cfg.CacheSizeKB), "failed to set cache_size"},
+		{fmt.Sprintf("PRAGMA cache_size = %d;", cacheSizeInPages), "failed to set cache_size"},
 		{fmt.Sprintf("PRAGMA synchronous = %s;", cfg.Synchronous), "failed to set synchronous"},
 		{fmt.Sprintf("PRAGMA temp_store = %s;", cfg.TempStore), "failed to set temp_store"},
 		{fmt.Sprintf("PRAGMA locking_mode = %s;", cfg.LockingMode), "failed to set locking_mode"},
@@ -274,19 +284,7 @@ func NewTempDB(id string, config ...*TempDBConfig) (*TempDB, error) {
 		}{{fmt.Sprintf("PRAGMA hard_heap_limit = %d;", cfg.HardHeapLimitBytes), "failed to set hard_heap_limit"}}, basePragmas...)
 	}
 
-	// Cache spill threshold - triggers early spilling to reduce memory usage
-	if cfg.CacheSpillThreshold > 0 {
-		basePragmas = append(basePragmas, struct {
-			sql string
-			err string
-		}{fmt.Sprintf("PRAGMA cache_spill = %d;", cfg.CacheSpillThreshold), "failed to set cache_spill"})
-	} else {
-		// Enable cache_spill by default (value of 1 enables it)
-		basePragmas = append(basePragmas, struct {
-			sql string
-			err string
-		}{"PRAGMA cache_spill = 1;", "failed to set cache_spill"})
-	}
+	// Cache spill will be set later, after all other pragmas, to avoid interaction issues
 
 	// Page size must be set before any tables are created
 	if cfg.PageSize > 0 {
@@ -333,6 +331,32 @@ func NewTempDB(id string, config ...*TempDBConfig) (*TempDB, error) {
 		}
 	}
 
+	// Set cache_spill LAST, after all other pragmas are configured
+	// SQLite may adjust cache_spill based on internal constraints or formulas
+	if cfg.CacheSpillThreshold > 0 {
+		// Try setting cache_spill multiple times with different approaches
+		// Approach 1: Standard syntax
+		if _, err := db.Exec(fmt.Sprintf("PRAGMA cache_spill = %d;", cfg.CacheSpillThreshold)); err != nil {
+			logger.Warningf("[SQLITE_CONFIG] Failed to set cache_spill with standard syntax: %v", err)
+		}
+
+		// Immediately verify what value was actually set
+		var actualValue int64
+		if err := db.QueryRow("PRAGMA cache_spill").Scan(&actualValue); err == nil {
+			if actualValue != int64(cfg.CacheSpillThreshold) {
+				// SQLite adjusted our value - calculate what percentage it used
+				percentage := float64(actualValue) / float64(-cacheSizeInPages) * 100.0
+				logger.Warningf("[SQLITE_CONFIG] SQLite adjusted cache_spill from %d to %d pages (%.1f%% of cache_size). This may be due to internal constraints.",
+					cfg.CacheSpillThreshold, actualValue, percentage)
+			}
+		}
+	} else {
+		// Enable cache_spill with default behavior
+		if _, err := db.Exec("PRAGMA cache_spill = 1;"); err != nil {
+			logger.Warningf("[SQLITE_CONFIG] Failed to enable cache_spill: %v", err)
+		}
+	}
+
 	// Verify PRAGMA settings were applied correctly
 	if err := verifyPragmaSettings(db, cfg); err != nil {
 		logger.Warningf("Failed to verify PRAGMA settings: %v", err)
@@ -452,18 +476,39 @@ func verifyPragmaSettings(db *sql.DB, cfg *TempDBConfig) error {
 		cacheSizeKB = -cacheSize * 4 // pages * 4KB per page
 	}
 
+	// Expected cache_spill value in pages (cache_spill is always specified and returned in pages)
+	expectedCacheSpill := int64(cfg.CacheSpillThreshold)
+
+	// Convert numeric PRAGMA values to human-readable strings
+	tempStoreMap := map[string]string{"0": "DEFAULT", "1": "FILE", "2": "MEMORY"}
+	synchronousMap := map[string]string{"0": "OFF", "1": "NORMAL", "2": "FULL", "3": "EXTRA"}
+	autoVacuumMap := map[string]string{"0": "NONE", "1": "FULL", "2": "INCREMENTAL"}
+
+	tempStoreStr := tempStoreMap[tempStore]
+	if tempStoreStr == "" {
+		tempStoreStr = tempStore
+	}
+	synchronousStr := synchronousMap[synchronous]
+	if synchronousStr == "" {
+		synchronousStr = synchronous
+	}
+	autoVacuumStr := autoVacuumMap[autoVacuum]
+	if autoVacuumStr == "" {
+		autoVacuumStr = autoVacuum
+	}
+
 	// Log all settings
 	logger.Debugf("[SQLITE_CONFIG] Database PRAGMA settings verified:")
-	logger.Debugf("  cache_size: %d KB (configured: %d KB)", cacheSizeKB, cfg.CacheSizeKB)
-	logger.Debugf("  mmap_size: %d bytes (configured: %d bytes)", mmapSize, cfg.MmapSize)
-	logger.Debugf("  soft_heap_limit: %d bytes (configured: %d bytes)", softHeapLimit, cfg.SoftHeapLimitBytes)
-	logger.Debugf("  hard_heap_limit: %d bytes (configured: %d bytes)", hardHeapLimit, cfg.HardHeapLimitBytes)
-	logger.Debugf("  cache_spill: %d pages (configured: %d pages)", cacheSpill, cfg.CacheSpillThreshold)
-	logger.Debugf("  journal_mode: %s (configured: %s)", journalMode, cfg.JournalMode)
-	logger.Debugf("  synchronous: %s (configured: %s)", synchronous, cfg.Synchronous)
-	logger.Debugf("  temp_store: %s (configured: %s)", tempStore, cfg.TempStore)
-	logger.Debugf("  locking_mode: %s (configured: %s)", lockingMode, cfg.LockingMode)
-	logger.Debugf("  auto_vacuum: %s (configured: %s)", autoVacuum, cfg.AutoVacuum)
+	logger.Debugf("  cache_size      : %d KB", cacheSizeKB)
+	logger.Debugf("  mmap_size       : %d bytes", mmapSize)
+	logger.Debugf("  soft_heap_limit : %d bytes", softHeapLimit)
+	logger.Debugf("  hard_heap_limit : %d bytes", hardHeapLimit)
+	logger.Debugf("  cache_spill     : %d pages", cacheSpill)
+	logger.Debugf("  journal_mode    : %s", journalMode)
+	logger.Debugf("  synchronous     : %s", synchronousStr)
+	logger.Debugf("  temp_store      : %s", tempStoreStr)
+	logger.Debugf("  locking_mode    : %s", lockingMode)
+	logger.Debugf("  auto_vacuum     : %s", autoVacuumStr)
 
 	// Verify critical settings match
 	if cfg.CacheSizeKB != 0 {
@@ -484,6 +529,31 @@ func verifyPragmaSettings(db *sql.DB, cfg *TempDBConfig) error {
 	if cfg.HardHeapLimitBytes > 0 && hardHeapLimit != cfg.HardHeapLimitBytes {
 		logger.Warningf("[SQLITE_CONFIG] hard_heap_limit mismatch: got %d bytes, expected %d bytes", hardHeapLimit, cfg.HardHeapLimitBytes)
 	}
+	// Verify cache_spill matches expected value (accounting for unit conversion)
+	if cfg.CacheSpillThreshold > 0 && cacheSpill != expectedCacheSpill {
+		logger.Warningf("[SQLITE_CONFIG] cache_spill mismatch: got %d pages, expected %d pages (from threshold %d pages)", cacheSpill, expectedCacheSpill, cfg.CacheSpillThreshold)
+		// If cache_spill equals cache_size in pages, it means SQLite ignored our setting
+		var cacheSizePages int64
+		if cfg.CacheSizeKB > 0 {
+			cacheSizePages = int64(cfg.CacheSizeKB) / 4 // KB to pages
+		} else {
+			cacheSizePages = -int64(cfg.CacheSizeKB) // Already in pages (negative)
+		}
+		if cacheSpill == cacheSizePages {
+			logger.Warningf("[SQLITE_CONFIG] cache_spill equals cache_size (%d pages), indicating SQLite may have ignored our setting", cacheSizePages)
+		}
+	}
+
+	// Verify string-based PRAGMA settings match (using converted values)
+	if synchronousStr != cfg.Synchronous {
+		logger.Warningf("[SQLITE_CONFIG] synchronous mismatch: got %s, expected %s", synchronousStr, cfg.Synchronous)
+	}
+	if tempStoreStr != cfg.TempStore {
+		logger.Warningf("[SQLITE_CONFIG] temp_store mismatch: got %s, expected %s", tempStoreStr, cfg.TempStore)
+	}
+	if autoVacuumStr != cfg.AutoVacuum {
+		logger.Warningf("[SQLITE_CONFIG] auto_vacuum mismatch: got %s, expected %s", autoVacuumStr, cfg.AutoVacuum)
+	}
 
 	return nil
 }

backend/database/storage/bolt/bolt.go

@@ -6,7 +6,7 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/database/access"
-	"github.com/gtsteffaniak/filebrowser/backend/database/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/database/dbindex"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
@@ -19,7 +19,7 @@ type BoltStore struct {
 	Auth     *auth.Storage
 	Settings *settings.Storage
 	Access   *access.Storage
-	Indexing *indexing.Storage
+	Indexing *dbindex.Storage
 }
 
 // NewStorage creates a storage.Storage based on Bolt DB.
@@ -35,6 +35,6 @@ func NewStorage(db *storm.DB) (*BoltStore, error) {
 		Auth:     authStore,
 		Settings: settings.NewStorage(settingsBackend{db: db}),
 		Access:   access.NewStorage(db, userStore),
-		Indexing: indexing.NewStorage(indexingBackend{db: db}),
+		Indexing: dbindex.NewStorage(indexingBackend{db: db}),
 	}, nil
 }

backend/database/storage/bolt/indexing.go

@@ -5,15 +5,15 @@ import (
 	"github.com/asdine/storm/v3/q"
 
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/database/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/database/dbindex"
 )
 
 type indexingBackend struct {
 	db *storm.DB
 }
 
-func (s indexingBackend) All() ([]*indexing.IndexInfo, error) {
-	var v []*indexing.IndexInfo
+func (s indexingBackend) All() ([]*dbindex.IndexInfo, error) {
+	var v []*dbindex.IndexInfo
 	err := s.db.All(&v)
 	if err == storm.ErrNotFound {
 		return v, errors.ErrNotExist
@@ -22,8 +22,8 @@ func (s indexingBackend) All() ([]*indexing.IndexInfo, error) {
 	return v, err
 }
 
-func (s indexingBackend) GetByPath(path string) (*indexing.IndexInfo, error) {
-	var v indexing.IndexInfo
+func (s indexingBackend) GetByPath(path string) (*dbindex.IndexInfo, error) {
+	var v dbindex.IndexInfo
 	err := s.db.One("Path", path, &v)
 	if err == storm.ErrNotFound {
 		return nil, errors.ErrNotExist
@@ -32,8 +32,8 @@ func (s indexingBackend) GetByPath(path string) (*indexing.IndexInfo, error) {
 	return &v, err
 }
 
-func (s indexingBackend) GetBySource(source string) ([]*indexing.IndexInfo, error) {
-	var v []*indexing.IndexInfo
+func (s indexingBackend) GetBySource(source string) ([]*dbindex.IndexInfo, error) {
+	var v []*dbindex.IndexInfo
 	err := s.db.Select(q.Eq("Source", source)).Find(&v)
 	if err == storm.ErrNotFound {
 		return nil, errors.ErrNotExist
@@ -41,12 +41,12 @@ func (s indexingBackend) GetBySource(source string) ([]*indexing.IndexInfo, erro
 	return v, err
 }
 
-func (s indexingBackend) Save(info *indexing.IndexInfo) error {
+func (s indexingBackend) Save(info *dbindex.IndexInfo) error {
 	return s.db.Save(info)
 }
 
 func (s indexingBackend) Delete(path string) error {
-	err := s.db.DeleteStruct(&indexing.IndexInfo{Path: path})
+	err := s.db.DeleteStruct(&dbindex.IndexInfo{Path: path})
 	if err == storm.ErrNotFound {
 		return nil
 	}

backend/database/storage/bolt/users.go

@@ -9,7 +9,6 @@ import (
 	storm "github.com/asdine/storm/v3"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
@@ -75,11 +74,6 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 		return err
 	}
 
-	passwordUser := existingUser.LoginMethod == users.LoginMethodPassword
-	enforcedOtp := settings.Config.Auth.Methods.PasswordAuth.EnforcedOtp
-	if passwordUser && enforcedOtp && !user.OtpEnabled {
-		return errors.ErrNoTotpConfigured
-	}
 	if user.LoginMethod == "" {
 		user.LoginMethod = existingUser.LoginMethod
 	}
@@ -87,11 +81,21 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 	if err != nil {
 		return err
 	}
-
+	enforcedOtp := settings.Config.Auth.Methods.PasswordAuth.EnforcedOtp
 	if user.LoginMethod == "" {
 		user.LoginMethod = existingUser.LoginMethod
 	}
-
+	if user.TOTPNonce == "" {
+		user.TOTPNonce = existingUser.TOTPNonce
+	}
+	if user.TOTPSecret == "" {
+		user.TOTPSecret = existingUser.TOTPSecret
+	}
+	if user.LoginMethod == users.LoginMethodPassword && enforcedOtp && !user.OtpEnabled {
+		if slices.Contains(fields, "OtpEnabled") {
+			return errors.ErrNoTotpConfigured
+		}
+	}
 	if !slices.Contains(fields, "Password") {
 		user.Password = existingUser.Password
 	} else {
@@ -114,10 +118,16 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 		if err != nil {
 			return err
 		}
+		for _, scope := range adjustedScopes {
+			// ensure full path exists
+			if scope.Scope == "" {
+				return fmt.Errorf("scope name is required")
+			}
+		}
 		user.Scopes = adjustedScopes
-		err = files.MakeUserDirs(user, true)
+		err = files.MakeUserDirs(user, false)
 		if err != nil {
-			logger.Error(err.Error())
+			return err
 		}
 	}
 	// converting scopes to map of paths intead of names (names can change)
@@ -158,12 +168,6 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 		}
 	}
 
-	// last revoke api keys if needed.
-	if existingUser.Permissions.Api && !user.Permissions.Api && slices.Contains(fields, "Permissions") {
-		for _, key := range existingUser.ApiKeys {
-			auth.RevokeAPIKey(key.Key) // add to blacklist
-		}
-	}
 	return nil
 }
 
@@ -180,7 +184,7 @@ func (st usersBackend) Save(user *users.User, changePass, disableScopeChange boo
 		if err != nil {
 			return err
 		}
-		pass, err := users.HashPwd(user.Password)
+		pass, err := utils.HashPwd(user.Password)
 		if err != nil {
 			return err
 		}
@@ -193,7 +197,7 @@ func (st usersBackend) Save(user *users.User, changePass, disableScopeChange boo
 		return err
 	}
 	user.Scopes = adjustedScopes
-	err = files.MakeUserDirs(user, disableScopeChange)
+	err = files.MakeUserDirs(user, true)
 	if err != nil {
 		logger.Error(err.Error())
 	}
@@ -247,7 +251,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 	if len(fields) == 0 || fields[0] == "all" {
 		fields = []string{}
 		v := reflect.ValueOf(user)
-		if v.Kind() == reflect.Ptr {
+		if v.Kind() == reflect.Pointer {
 			v = v.Elem()
 		}
 		t := v.Type()
@@ -257,7 +261,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 			field := t.Field(i)
 			// which=all can't update password
 			switch strings.ToLower(field.Name) {
-			case "id", "username", "password", "apikeys", "totpsecret", "totpnonce":
+			case "id", "username", "password", "tokens", "totpsecret", "totpnonce":
 				// Skip these fields
 				continue
 			}
@@ -266,7 +270,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 			if field.Anonymous {
 				// Get the embedded struct type
 				embeddedType := field.Type
-				if embeddedType.Kind() == reflect.Ptr {
+				if embeddedType.Kind() == reflect.Pointer {
 					embeddedType = embeddedType.Elem()
 				}
 
@@ -299,7 +303,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 				if err != nil {
 					return nil, fmt.Errorf("password does not meet complexity requirements")
 				}
-				value, err := users.HashPwd(user.Password)
+				value, err := utils.HashPwd(user.Password)
 				if err != nil {
 					logger.Error(err.Error())
 				}

backend/database/storage/bolt/users_test.go

@@ -6,11 +6,12 @@ import (
 
 	"github.com/asdine/storm/v3"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
 func init() {
-	users.BcryptCost = 4 // bcrypt.MinCost for faster tests
+	utils.BcryptCost = 4 // bcrypt.MinCost for faster tests
 
 	// Initialize test source configuration
 	settings.Config.Server.SourceMap = map[string]*settings.Source{

backend/database/storage/storage.go

@@ -18,6 +18,7 @@ import (
 var userStore *users.Storage
 
 func InitializeDb(path string) (*bolt.BoltStore, bool, error) {
+	logger.Debugf("Initializing database: %v", path)
 	exists, err := dbExists(path)
 	if err != nil {
 		panic(err)
@@ -36,6 +37,8 @@ func InitializeDb(path string) (*bolt.BoltStore, bool, error) {
 	// Load access rules from DB on startup
 	// ignoring errors because
 	_ = store.Access.LoadFromDB()
+	// Load share cache from DB so shareByHash/shareByPath are populated at startup
+	store.Share.LoadShareCacheFromDB()
 	userStore = store.Users
 	err = bolt.Save(db, "version", 2)
 	if err != nil {
@@ -89,16 +92,10 @@ func quickSetup(store *bolt.BoltStore) {
 			settings.Config.Auth.AdminPassword = "admin"
 		}
 		user.Password = settings.Config.Auth.AdminPassword
-		user.Permissions.Admin = true
-		user.Scopes = []users.SourceScope{}
-		for _, val := range settings.Config.Server.Sources {
-			user.Scopes = append(user.Scopes, users.SourceScope{
-				Name:  val.Path, // backend name is path
-				Scope: "",
-			})
-		}
 		user.LockPassword = false
+		download := user.Permissions.Download
 		user.Permissions = settings.AdminPerms()
+		user.Permissions.Download = download
 		user.ShowFirstLogin = settings.Env.IsFirstLoad && user.Permissions.Admin
 		logger.Debugf("Creating user as admin: %v %v", user.Username, user.Password)
 		err = store.Users.Save(user, true, true)
@@ -115,7 +112,7 @@ func CreateUser(userInfo users.User, permissions users.Permissions) error {
 			return fmt.Errorf("password is required to create a password login user")
 		}
 	} else {
-		hashpass, err := users.HashPwd(userInfo.Username)
+		hashpass, err := utils.HashPwd(userInfo.Username)
 		if err != nil {
 			return err
 		}
@@ -127,6 +124,7 @@ func CreateUser(userInfo users.User, permissions users.Permissions) error {
 	}
 	settings.ApplyUserDefaults(newUser)
 	newUser.Permissions = permissions
+	newUser.Version = users.CurrentUserMigrationVersion
 	logger.Debugf("Creating user: %v %v", userInfo.Username, userInfo.Scopes)
 	// create new home directories
 	err := userStore.Save(newUser, true, false)

backend/database/users/conversions.go

@@ -5,6 +5,23 @@ import (
 	"strings"
 )
 
+// ResolveSourceKey maps a string that is either:
+//   - the configured source filesystem path (canonical Bolt / in-memory form for
+//     SourceScope.Name and source-type SidebarLink.SourceName), or
+//   - the source display name (JSON form from clients).
+//
+// Path is checked first so absolute paths are unambiguous. Used on write paths
+// (normalize to Path) and read paths (normalize API to display Name).
+func ResolveSourceKey(key string) (SourceInfo, bool) {
+	if sourceConfig == nil || key == "" {
+		return SourceInfo{}, false
+	}
+	if info, ok := sourceConfig.GetSourceByPath(key); ok {
+		return info, true
+	}
+	return sourceConfig.GetSourceByName(key)
+}
+
 // GetSourceNames returns all source names the user has access to (assumes backend-style scopes)
 func (u *User) GetSourceNames() []string {
 	if sourceConfig == nil {
@@ -24,10 +41,9 @@ func (u *User) GetSourceNames() []string {
 	return sources
 }
 
-// GetBackendScopes converts the user's scopes from frontend-style to backend-style
+// GetBackendScopes normalizes scopes for Bolt: SourceScope.Name is always the source filesystem path.
+// Incoming rows (API) may use display name or path; legacy rows may use either.
 func (u *User) GetBackendScopes() ([]SourceScope, error) {
-	// Only convert scopes if they are not empty
-	// Empty scopes during update should remain empty (not filled with defaults)
 	if len(u.Scopes) == 0 {
 		return []SourceScope{}, nil
 	}
@@ -37,24 +53,8 @@ func (u *User) GetBackendScopes() ([]SourceScope, error) {
 
 	newScopes := []SourceScope{}
 	for _, scope := range u.Scopes {
-		// First check if its already a path name and keep it
-		source, ok := sourceConfig.GetSourceByPath(scope.Name)
-		if ok {
-			if scope.Scope == "" {
-				scope.Scope = source.DefaultUserScope
-			}
-			scope.Scope = normalizeScope(scope.Scope)
-			newScopes = append(newScopes, SourceScope{
-				Name:  source.Path, // backend name is path
-				Scope: scope.Scope,
-			})
-			continue
-		}
-
-		// Check if its the name of a source and convert it to a path
-		source, ok = sourceConfig.GetSourceByName(scope.Name)
+		source, ok := ResolveSourceKey(scope.Name)
 		if !ok {
-			// source might no longer be configured
 			continue
 		}
 		if scope.Scope == "" {
@@ -62,15 +62,15 @@ func (u *User) GetBackendScopes() ([]SourceScope, error) {
 		}
 		scope.Scope = normalizeScope(scope.Scope)
 		newScopes = append(newScopes, SourceScope{
-			Name:  source.Path, // backend name is path
+			Name:  source.Path,
 			Scope: scope.Scope,
 		})
 	}
 	return newScopes, nil
 }
 
-// GetFrontendScopes converts the user's scopes from backend-style to frontend-style
-// Backend scopes use source paths, frontend scopes use source names
+// GetFrontendScopes converts scopes for JSON clients: SourceScope.Name is always the source display name.
+// Assumes Bolt stores paths (GetBackendScopes); unknown keys are omitted.
 func (u *User) GetFrontendScopes() []SourceScope {
 	if sourceConfig == nil {
 		return []SourceScope{}
@@ -78,19 +78,19 @@ func (u *User) GetFrontendScopes() []SourceScope {
 
 	newScopes := []SourceScope{}
 	for _, scope := range u.Scopes {
-		if source, ok := sourceConfig.GetSourceByPath(scope.Name); ok {
-			// Replace scope.Name with source.Name while keeping the same Scope value
-			newScopes = append(newScopes, SourceScope{
-				Name:  source.Name,
-				Scope: scope.Scope,
-			})
+		source, ok := ResolveSourceKey(scope.Name)
+		if !ok {
+			continue
 		}
+		newScopes = append(newScopes, SourceScope{
+			Name:  source.Name,
+			Scope: scope.Scope,
+		})
 	}
 	return newScopes
 }
 
-// GetBackendSidebarLinks converts the user's sidebar links from frontend-style to backend-style
-// Validates that sources exist and converts source names to paths
+// GetBackendSidebarLinks normalizes source links for Bolt: SourceName is the filesystem path.
 func (u *User) GetBackendSidebarLinks() ([]SidebarLink, error) {
 	if sourceConfig == nil {
 		return nil, fmt.Errorf("source config not initialized")
@@ -98,52 +98,27 @@ func (u *User) GetBackendSidebarLinks() ([]SidebarLink, error) {
 
 	newLinks := []SidebarLink{}
 	for _, link := range u.SidebarLinks {
-		// For source links, validate that the source exists using SourceName
-		if link.Category == "source" {
+		if strings.HasPrefix(link.Category, "source") {
 			if link.SourceName == "" {
 				return nil, fmt.Errorf("source link missing sourceName (link name: %v)", link.Name)
 			}
 			// Validate source exists
 			sourceInfo, ok := sourceConfig.GetSourceByName(link.SourceName)
-			if !ok {
+			sourceInfo2, ok2 := sourceConfig.GetSourceByPath(link.SourceName)
+			if !ok && !ok2 {
 				return nil, fmt.Errorf("source not found: %v (link name: %v)", link.SourceName, link.Name)
 			}
-			link.SourceName = sourceInfo.Path // if name changes keep link alive
+			if ok {
+				link.SourceName = sourceInfo.Path
+			} else {
+				link.SourceName = sourceInfo2.Path
+			}
 		}
-		// Store the link as-is with all fields preserved
 		newLinks = append(newLinks, link)
 	}
 	return newLinks, nil
 }
 
-// GetFrontendSidebarLinks converts the user's sidebar links from backend-style to frontend-style
-// Converts source paths to source names for the frontend
-func (u *User) GetFrontendSidebarLinks() []SidebarLink {
-	if sourceConfig == nil {
-		return []SidebarLink{}
-	}
-
-	newLinks := []SidebarLink{}
-	for _, link := range u.SidebarLinks {
-		// For source links, validate that the source still exists
-		if link.Category == "source" {
-			if link.SourceName == "" {
-				continue
-			}
-			// Check if source exists
-			sourceInfo, ok := sourceConfig.GetSourceByPath(link.SourceName)
-			if !ok {
-				continue
-			}
-			link.SourceName = sourceInfo.Name
-		}
-		// For share links, just pass through (shares are validated separately)
-		// For all other links, pass through as-is
-		newLinks = append(newLinks, link)
-	}
-	return newLinks
-}
-
 // normalizeScope ensures scope starts with / and doesn't end with / (except for root)
 func normalizeScope(scope string) string {
 	if !strings.HasPrefix(scope, "/") {

backend/database/users/password.go

@@ -1,18 +0,0 @@
-package users
-
-import (
-	"golang.org/x/crypto/bcrypt"
-)
-
-var BcryptCost = bcrypt.DefaultCost
-
-// HashPwd hashes a password.
-func HashPwd(password string) (string, error) {
-	bytes, err := bcrypt.GenerateFromPassword([]byte(password), BcryptCost)
-	return string(bytes), err
-}
-
-// CheckPwd checks if a password is correct.
-func CheckPwd(password, hash string) error {
-	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
-}

backend/database/users/storage.go

@@ -26,8 +26,8 @@ type Store interface {
 	Save(user *User, changePass bool, disableScopeChange bool) error
 	Delete(id interface{}) error
 	LastUpdate(id uint) int64
-	AddApiKey(username uint, name string, key AuthToken) error
-	DeleteApiKey(username uint, name string) error
+	AddApiToken(userID uint, name string, tokenString string, metadata AuthToken) error
+	DeleteApiToken(userID uint, name string) error
 }
 
 // crudBackend implements crud.CrudBackend[User] for users storage.
@@ -114,17 +114,18 @@ func (s *Storage) Update(user *User, adminIActor bool, fields ...string) error {
 	return nil
 }
 
-func (s *Storage) AddApiKey(userID uint, name string, key AuthToken) error {
+func (s *Storage) AddApiToken(userID uint, name string, tokenString string, metadata AuthToken) error {
 	user, err := s.Get(userID)
 	if err != nil {
 		return err
 	}
-	// Initialize the ApiKeys map if it is nil
-	if user.ApiKeys == nil {
-		user.ApiKeys = make(map[string]AuthToken)
+	// Initialize the TokenHashes map if it is nil
+	if user.Tokens == nil {
+		user.Tokens = make(map[string]AuthToken)
 	}
-	user.ApiKeys[name] = key
-	err = s.Update(user, true, "ApiKeys")
+	metadata.Token = tokenString
+	user.Tokens[name] = metadata
+	err = s.Update(user, true, "Tokens")
 	if err != nil {
 		return err
 	}
@@ -132,17 +133,17 @@ func (s *Storage) AddApiKey(userID uint, name string, key AuthToken) error {
 	return nil
 }
 
-func (s *Storage) DeleteApiKey(userID uint, name string) error {
+func (s *Storage) DeleteApiToken(userID uint, name string) error {
 	user, err := s.Get(userID)
 	if err != nil {
 		return err
 	}
-	// Initialize the ApiKeys map if it is nil
-	if user.ApiKeys == nil {
-		user.ApiKeys = make(map[string]AuthToken)
+	// Initialize the Tokens map if it is nil
+	if user.Tokens == nil {
+		user.Tokens = make(map[string]AuthToken)
 	}
-	delete(user.ApiKeys, name)
-	err = s.Update(user, true, "ApiKeys")
+	delete(user.Tokens, name)
+	err = s.Update(user, true, "Tokens")
 	if err != nil {
 		return err
 	}

backend/database/users/users.go

@@ -7,7 +7,8 @@ import (
 	jwt "github.com/golang-jwt/jwt/v4"
 )
 
-const ()
+// CurrentUserMigrationVersion is persisted for newly created accounts and after legacy migrations finish.
+const CurrentUserMigrationVersion = 3
 
 type LoginMethod string
 
@@ -15,13 +16,47 @@ const (
 	LoginMethodPassword LoginMethod = "password"
 	LoginMethodProxy    LoginMethod = "proxy"
 	LoginMethodOidc     LoginMethod = "oidc"
+	LoginMethodLdap     LoginMethod = "ldap"
+	LoginMethodJwt      LoginMethod = "jwt"
 )
 
+// WebAuthnCredentialFlags mirrors the boolean flags from authenticator data.
+type WebAuthnCredentialFlags struct {
+	UserPresent    bool `json:"userPresent"`
+	UserVerified   bool `json:"userVerified"`
+	BackupEligible bool `json:"backupEligible"`
+	BackupState    bool `json:"backupState"`
+}
+
+// WebAuthnCredential stores a single passkey credential in BoltDB-friendly format.
+type WebAuthnCredential struct {
+	ID                string                  `json:"id"`
+	PublicKey         string                  `json:"publicKey"`
+	AttestationType   string                  `json:"attestationType"`
+	AttestationFormat string                  `json:"attestationFormat"`
+	Transport         []string                `json:"transport"`
+	Flags             WebAuthnCredentialFlags `json:"flags"`
+	AAGUID            string                  `json:"aaguid"`
+	SignCount         uint32                  `json:"signCount"`
+	CloneWarning      bool                    `json:"cloneWarning"`
+	Name              string                  `json:"name"`
+	CreatedAt         int64                   `json:"createdAt"`
+	LastUsedAt        int64                   `json:"lastUsedAt"`
+	ClientDataJSON    string                  `json:"clientDataJSON"`
+	ClientDataHash    string                  `json:"clientDataHash"`
+	AuthenticatorData string                  `json:"authenticatorData"`
+	PublicKeyAlg      int64                   `json:"publicKeyAlg"`
+	AttestationObj    string                  `json:"attestationObj"`
+}
+
 type AuthToken struct {
 	MinimalAuthToken
-	Key         string      `json:"key,omitempty"`
+	Key         string      `json:"key,omitempty"` // for backward compatibility
+	Token       string      `json:"token,omitempty"`
 	Name        string      `json:"name,omitempty"`
 	BelongsTo   uint        `json:"belongsTo,omitempty"`
+	IssuedAt    int64       `json:"issuedAt,omitempty"`
+	ExpiresAt   int64       `json:"expiresAt,omitempty"`
 	Permissions Permissions `json:"Permissions,omitempty"`
 }
 
@@ -49,41 +84,43 @@ type Sorting struct {
 
 type Preview struct {
 	DisableHideSidebar bool `json:"disableHideSidebar"` // disable the hide sidebar preview for previews and editors
-	HighQuality        bool `json:"highQuality"`        // generate high quality thumbnail preview images
 	Image              bool `json:"image"`              // show thumbnail preview image for image files
 	Video              bool `json:"video"`              // show thumbnail preview image for video files
+	Audio              bool `json:"audio"`              // show thumbnail preview image for audio files
 	MotionVideoPreview bool `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
 	Office             bool `json:"office"`             // show thumbnail preview image for office files
 	PopUp              bool `json:"popup"`              // show larger popup preview when hovering over thumbnail
 	AutoplayMedia      bool `json:"autoplayMedia"`      // autoplay media files in preview
 	DefaultMediaPlayer bool `json:"defaultMediaPlayer"` // disable html5 media player and use the default media player
 	Folder             bool `json:"folder"`             // show thumbnail preview image for folder files
+	Models             bool `json:"models"`             // show live thumbnails for 3D models files
 }
 
-// User describes a user.
+// User describes a persisted account. Scopes and source sidebar links store filesystem paths in Name/SourceName;
+// JSON responses use display names only (see http prepForFrontend).
 type User struct {
 	NonAdminEditable
-	DisableSettings bool                 `json:"disableSettings"`
-	ID              uint                 `storm:"id,increment" json:"id"`
-	Username        string               `storm:"unique" json:"username"`
-	Scopes          []SourceScope        `json:"scopes"`
-	Scope           string               `json:"scope,omitempty"`
-	LockPassword    bool                 `json:"lockPassword"`
-	Permissions     Permissions          `json:"permissions"`
-	ApiKeys         map[string]AuthToken `json:"apiKeys,omitempty"`
-	TOTPSecret      string               `json:"totpSecret,omitempty"`
-	TOTPNonce       string               `json:"totpNonce,omitempty"`
-	LoginMethod     LoginMethod          `json:"loginMethod"`
-	OtpEnabled      bool                 `json:"otpEnabled"` // true if TOTP is enabled, false otherwise
+	DisableSettings      bool                  `json:"disableSettings"`
+	ID                   uint                  `storm:"id,increment" json:"id"`
+	Username             string                `storm:"unique" json:"username"`
+	Scopes               []SourceScope         `json:"scopes"`
+	Scope                string                `json:"scope,omitempty"`
+	LockPassword         bool                  `json:"lockPassword"`
+	Permissions          Permissions           `json:"permissions"`
+	ApiKeys              map[string]AuthToken  `json:"apiKeys,omitempty"` // deprecated: use Tokens instead
+	Tokens               map[string]AuthToken  `json:"tokens,omitempty"`
+	TOTPSecret           string                `json:"totpSecret,omitempty"`
+	TOTPNonce            string                `json:"totpNonce,omitempty"`
+	LoginMethod          LoginMethod           `json:"loginMethod"`
+	OtpEnabled           bool                  `json:"otpEnabled"` // true if TOTP is enabled, false otherwise
+	Version              int                   `json:"version"`
 	// legacy for migration purposes... og filebrowser has perm attribute
-	Perm           Permissions `json:"perm,omitzero"`
-	Version        int         `json:"version"`
-	ShowFirstLogin bool        `json:"showFirstLogin"`
+	Perm Permissions `json:"perm,omitzero"` // deprecated: use Permissions instead
 }
 
 type SourceScope struct {
-	Name  string `json:"name"`
-	Scope string `json:"scope"`
+	Name  string `json:"name"`  // Bolt: filesystem path; JSON API: display name after prepForFrontend
+	Scope string `json:"scope"` // index path within that source
 }
 
 // json tags must match variable name with smaller case first letter
@@ -102,6 +139,7 @@ type NonAdminEditable struct {
 	SingleClick                bool          `json:"singleClick"` // open directory on single click, also enables middle click to open in new tab
 	Sorting                    Sorting       `json:"sorting"`
 	ShowHidden                 bool          `json:"showHidden"`                 // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	HideFileExt                string        `json:"hideFileExt"`                // space separated list of file extensions to hide in UI and API
 	DateFormat                 bool          `json:"dateFormat"`                 // when false, the date is relative, when true, the date is an exact timestamp
 	GallerySize                int           `json:"gallerySize"`                // 0-9 - the size of the gallery thumbnails
 	ThemeColor                 string        `json:"themeColor"`                 // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
@@ -114,10 +152,16 @@ type NonAdminEditable struct {
 	DisableViewingExt          string        `json:"disableViewingExt"`          // space separated list of file extensions to disable viewing for
 	CustomTheme                string        `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
 	ShowSelectMultiple         bool          `json:"showSelectMultiple"`         // show select multiple files on desktop
+	ShowCopyPath               bool          `json:"showCopyPath"`               // show copy path action in the context menu
+	ShowToolsInSidebar         bool          `json:"showToolsInSidebar"`         // when false, sidebar hides links with category "tool" (default: true)
 	DebugOffice                bool          `json:"debugOffice"`                // debug onlyoffice editor
 	OtpEnabled                 bool          `json:"otpEnabled"`                 // allow non-admin users to disable their own OTP
-	DefaultLandingPage         string        `json:"defaultLandingPage"`         // deprecated: determined by sidebar link order instead
 	SidebarLinks               []SidebarLink `json:"sidebarLinks"`               // customizable sidebar links
+	HideFilesInTree            bool          `json:"hideFilesInTree"`            // hide files in the sidebar tree navigation, when true, will show only directories.
+	DeleteAfterArchive         bool          `json:"deleteAfterArchive"`         // delete source files after successful creation/extraction of archives
+	PreferEditorForMarkdown    bool          `json:"preferEditorForMarkdown"`    // prefer editor first for markdown files instead of the Markdown Viewer
+	ShowFirstLogin             bool                  `json:"showFirstLogin"`
+	PasskeyCredentials         []WebAuthnCredential  `json:"passkeyCredentials,omitempty"`
 }
 
 type FileLoading struct {
@@ -130,10 +174,10 @@ type FileLoading struct {
 // SidebarLink represents a customizable link in the sidebar.
 type SidebarLink struct {
 	Name       string `json:"name"`                 // Display name of the link
-	Category   string `json:"category"`             // Category type: "source", "share", "tool", "custom", etc.
+	Category   string `json:"category"`             // Category type: "source", "source-link", "share", "tool", "custom", etc.
 	Target     string `json:"target"`               // Target path/URL for the link (relative for source/share)
 	Icon       string `json:"icon"`                 // Material icon name
-	SourceName string `json:"sourceName,omitempty"` // Source identifier for source-type links
+	SourceName string `json:"sourceName,omitempty"` // Bolt: filesystem path. JSON out: display name (after prepForFrontend).
 }
 
 func CleanUsername(s string) string {
@@ -180,6 +224,11 @@ func SetSourceConfig(config *SourceConfigProvider) {
 	sourceConfig = config
 }
 
+// SourceConfigLoaded reports whether SetSourceConfig has been called (needed for ResolveSourceKey).
+func SourceConfigLoaded() bool {
+	return sourceConfig != nil
+}
+
 // GetScopeForSourcePath returns the scope for a given source path (backend-style)
 // This method works with backend-style scopes where Name is the source path
 func (u *User) GetScopeForSourcePath(sourcePath string) (string, error) {

backend/database/users/webauthn.go

@@ -0,0 +1,127 @@
+package users
+
+import (
+	"encoding/base64"
+	"fmt"
+	"time"
+
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/webauthn"
+)
+
+// WebAuthnID returns the user handle used by WebAuthn.
+func (u *User) WebAuthnID() []byte {
+	return []byte(fmt.Sprintf("%d", u.ID))
+}
+
+// WebAuthnName returns the human-readable name for the user.
+func (u *User) WebAuthnName() string {
+	return u.Username
+}
+
+// WebAuthnDisplayName returns the display name for the user.
+func (u *User) WebAuthnDisplayName() string {
+	return u.Username
+}
+
+// WebAuthnCredentials returns the stored credentials converted to the library's type.
+func (u *User) WebAuthnCredentials() []webauthn.Credential {
+	creds := make([]webauthn.Credential, len(u.PasskeyCredentials))
+	for i, c := range u.PasskeyCredentials {
+		creds[i] = *credentialToLibrary(&c)
+	}
+	return creds
+}
+
+// HasPasskeyMFA returns true if the user has at least one passkey credential configured.
+func (u *User) HasPasskeyMFA() bool {
+	return len(u.PasskeyCredentials) > 0
+}
+
+// credentialToLibrary converts our BoltDB-safe WebAuthnCredential to the library's Credential.
+func credentialToLibrary(c *WebAuthnCredential) *webauthn.Credential {
+	id, _ := base64.RawURLEncoding.DecodeString(c.ID)
+	pubKey, _ := base64.RawURLEncoding.DecodeString(c.PublicKey)
+	aaguid, _ := base64.RawURLEncoding.DecodeString(c.AAGUID)
+	cdj, _ := base64.RawURLEncoding.DecodeString(c.ClientDataJSON)
+	cdh, _ := base64.RawURLEncoding.DecodeString(c.ClientDataHash)
+	authData, _ := base64.RawURLEncoding.DecodeString(c.AuthenticatorData)
+	attObj, _ := base64.RawURLEncoding.DecodeString(c.AttestationObj)
+
+	transports := make([]protocol.AuthenticatorTransport, len(c.Transport))
+	for i, t := range c.Transport {
+		transports[i] = protocol.AuthenticatorTransport(t)
+	}
+
+	return &webauthn.Credential{
+		ID:                id,
+		PublicKey:         pubKey,
+		AttestationType:   c.AttestationType,
+		AttestationFormat: c.AttestationFormat,
+		Transport:         transports,
+		Flags: webauthn.CredentialFlags{
+			UserPresent:    c.Flags.UserPresent,
+			UserVerified:   c.Flags.UserVerified,
+			BackupEligible: c.Flags.BackupEligible,
+			BackupState:    c.Flags.BackupState,
+		},
+		Authenticator: webauthn.Authenticator{
+			AAGUID:       aaguid,
+			SignCount:    c.SignCount,
+			CloneWarning: c.CloneWarning,
+		},
+		Attestation: webauthn.CredentialAttestation{
+			ClientDataJSON:     cdj,
+			ClientDataHash:     cdh,
+			AuthenticatorData:  authData,
+			PublicKeyAlgorithm: c.PublicKeyAlg,
+			Object:             attObj,
+		},
+	}
+}
+
+// CredentialFromLibrary converts a library Credential to our BoltDB-safe format.
+func CredentialFromLibrary(name string, cred *webauthn.Credential) WebAuthnCredential {
+	transports := make([]string, len(cred.Transport))
+	for i, t := range cred.Transport {
+		transports[i] = string(t)
+	}
+
+	now := time.Now().Unix()
+
+	return WebAuthnCredential{
+		ID:                base64.RawURLEncoding.EncodeToString(cred.ID),
+		PublicKey:         base64.RawURLEncoding.EncodeToString(cred.PublicKey),
+		AttestationType:   cred.AttestationType,
+		AttestationFormat: cred.AttestationFormat,
+		Transport:         transports,
+		Flags: WebAuthnCredentialFlags{
+			UserPresent:    cred.Flags.UserPresent,
+			UserVerified:   cred.Flags.UserVerified,
+			BackupEligible: cred.Flags.BackupEligible,
+			BackupState:    cred.Flags.BackupState,
+		},
+		AAGUID:            base64.RawURLEncoding.EncodeToString(cred.Authenticator.AAGUID),
+		SignCount:         cred.Authenticator.SignCount,
+		CloneWarning:      cred.Authenticator.CloneWarning,
+		Name:              name,
+		CreatedAt:         now,
+		LastUsedAt:        now,
+		ClientDataJSON:    base64.RawURLEncoding.EncodeToString(cred.Attestation.ClientDataJSON),
+		ClientDataHash:    base64.RawURLEncoding.EncodeToString(cred.Attestation.ClientDataHash),
+		AuthenticatorData: base64.RawURLEncoding.EncodeToString(cred.Attestation.AuthenticatorData),
+		PublicKeyAlg:      cred.Attestation.PublicKeyAlgorithm,
+		AttestationObj:    base64.RawURLEncoding.EncodeToString(cred.Attestation.Object),
+	}
+}
+
+// UpdateCredentialFromLibrary updates an existing WebAuthnCredential from the library's Credential
+// (used after login to update sign count, flags, and last used time).
+func UpdateCredentialFromLibrary(c *WebAuthnCredential, cred *webauthn.Credential) {
+	c.SignCount = cred.Authenticator.SignCount
+	c.Flags.UserPresent = cred.Flags.UserPresent
+	c.Flags.UserVerified = cred.Flags.UserVerified
+	c.Flags.BackupEligible = cred.Flags.BackupEligible
+	c.Flags.BackupState = cred.Flags.BackupState
+	c.LastUsedAt = time.Now().Unix()
+}