ensure folder sizes get updated (#1977 )

Fix image selection buttons (#1972 )
Corrections (#1969 )
2026-11-15 13:35:55 -05:00 · 2026-02-13 15:00:42 -06:00 · 2026-02-12 18:17:43 -06:00 · 2026-02-12 15:21:56 -06:00 · 2026-02-12 13:14:18 -06:00 · 2026-02-12 08:54:18 -06:00
351 changed files with 15304 additions and 38009 deletions
@@ -1,39 +0,0 @@
-{
-  "name": "filebrowser",
-  "image": "mcr.microsoft.com/devcontainers/go:1.25-bookworm",
-  
-
-  "features": {
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "20"
-    },
-    "ghcr.io/devcontainers/features/docker-in-docker:2": {}
-  },
-
-  "containerEnv": {
-    "CGO_ENABLED": "1",
-    "FILEBROWSER_DEVMODE": "true"
-  },
-
-  "forwardPorts": [80],
-  "portsAttributes": {
-    "80": {
-      "label": "filebrowser app",
-      "onAutoForward": "notify"
-    }
-  },
-
-  "postCreateCommand": "make setup",
-
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "golang.go",
-        "Vue.volar",
-        "dbaeumer.vscode-eslint",
-        "esbenp.prettier-vscode",
-        "ms-azuretools.vscode-docker"
-      ]
-    }
-  }
-}
@@ -1,6 +1,4 @@
 backend/**.db
-**.crt
-**.key
 backend/tmp
 backend/dist
 backend/backend*
@@ -80,12 +80,6 @@ jobs:
            dockerfile: ./_docker/Dockerfile.playwright-no-config
          - name: settings
            dockerfile: ./_docker/Dockerfile.playwright-settings
-          - name: screenshots
-            dockerfile: ./_docker/Dockerfile.playwright-screenshots
-          - name: previews
-            dockerfile: ./_docker/Dockerfile.playwright-previews
-          - name: jwt
-            dockerfile: ./_docker/Dockerfile.playwright-jwt
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -14,7 +14,7 @@ jobs:
        with:
          go-version: 'stable'
      - working-directory: backend
-        run: go test -race -v ./... -timeout 30s
+        run: go test -race -v ./...
  lint-backend:
    runs-on: ubuntu-latest
    steps:
@@ -56,13 +56,4 @@ jobs:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - working-directory: frontend
-        run: npm i && npm run i18n:check
-  check-docs:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - run: make generate-docs
-      - run: git diff --exit-code
+        run: npm i && npm run i18n:check
@@ -27,7 +27,7 @@ jobs:
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/gtsteffaniak/playwright-base
-          tags: chromium
+          tags: latest
      - name: Build and push playwright-base
        uses: docker/build-push-action@v6
        with:
@@ -1,6 +1,4 @@
 *.db
-*.db.old
-*.sqlite
 *.bak
 *.log
 *.mjs
@@ -20,7 +18,6 @@ frontend/tsconfig.tsbuildinfo
 /frontend/test-results
 /frontend/playwright-files
 /frontend/screenshots
-/frontend/generated
 /frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
 /backend/vendor
@@ -2,270 +2,6 @@

 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).

-## v1.3.9
-
- **Security**:
- - [Critical] Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion GHSA-fwj3-42wh-8673
- - [Moderate] Stored XSS via SVG File in Public Share (Missing CSP Header) GHSA-mmpx-jh39-wrv6
-
- **BugFixes**:
- - Fix context menu items and adjusted when items show to more accurately reflect permissions.
-
-## v1.3.8
-
- **BugFixes**:
- - Quick download icon style after icon change.
- - Missing error popup for resource creatoin actions (upload/create)
- - EnforcedOtp login failure until restart (#2330)
- - Thumbnails for Folders only display sporadically (#2353)
- - Unwanted user scope change for users with non-default scopes (#2347)
- - Fix sidebar source info totals (#2321) (#2322) (#982)
- - Error uploading a large number of photos -- only 100 items get uploaded (#2348)
-
-## v1.3.7
-
- **Notes**:
- - creating/deleting password-based user requires reauthentication (#2112)
-
- **BugFixes**:
- - TOTP works for admin but fails for standard users on re-login until Docker is restarted (#2330)
- - No Loginfields shown if password authentification is set to false (#2331)
-
-## v1.3.6
-
- **BugFixes**:
- - file watcher not working for files and not respecting line count (#2314)
- - "source" type link shows up multiple times when adding sidebar links if user has multiple sources.
- - JWT ES256 results in error (#2188)
- - single file shares not loading editor text content (#2122)
-
-## v1.3.5
-
- **Notes**:
- - any password change or admin user property change for a password user requires reauthentication (#2112)
-
- **BugFixes**:
- - PWA icon fixes (#2292)
- - deny-rule'd folders visible in directory listings (regression from v1.2.4-stable) (#2295)
- - OTP and password requirement fixes (#2112) (#2263)
- - CLI not picking up config properly
- - Storage usage numbers on first load adjusted.
- - Some items in userDefaults are not setting defaults for new users properly #2278
- - Fix copy to clipboard and simplify code (#2281) (#2274)
- - Fix search shortcut `/` and pdf previews (#2307)
- - Special permissions bit not set when declared in createDirectoryPermission (#2283)
- - Execute permission altered after editing sh script with FB Quantum (#2309)
- - Source is red but working (#2289)
-
-## v1.3.4
-
- **New Features**:
- - Epub placementg url anchors to bookmark a specific location on the doc.
- - Add Requirement for Current Password When Changing Account Password (#2112)
- - Copy file path to clipborad through right click (#2204)
-
- **Notes**:
- - user scope editing has path picker and filesystem validation
-
- **BugFixes**:
- - Swiping media files doesn't respect Playback Queue (#2243)
- - Audio metadata and album thumbnails doesn't work (#2236)
- - Search spinner wouldn't show up sometimes while searching
- - The default landing page source should always be the first source in the sidebar, that wasn't always respected.
-
-## v1.3.3
-
- **New Features**:
- - Copy/paste files and folders (`CTRL+C`/`CTRL+V`) from other apps (win explorer, thunar, finder, etc) to upload them directly (#2197)
- - Caption font size can be adjusted in video settings
- - Ability to adjust the startup check method for sql database via `server.startupIntegrityCheck` (#2221)
- - Status bar for editor and markdown viewer (#2226)
-
- **Notes**:
- - `.fbx` 3d model files added to supported previews.
- - removed upx compression on docker image (#2193)
- - videos double tap to fast-forward and rewind added.
- - Adjust Image album swipe behavior (#2068)
-   - swipe animation for next/previous
-   - swipe down on image to close and go to parent folder.
-   - supports videos
- - chunked uploads will save to a temporary file at the destination and renamed on completion. Better upload pause handling (#2129)
- - The Icons in the UI were updated! (#2203)
-   - More supported icons in the Icon Picker tool.
-   - More file types have new icons across all the listings (such as `.md`, `.apk`, etc).
- - `.fbx` 3d model files added to supported previews.
- - removed upx compression on docker image (#2193)
- - chunked uploads will save to a temporary file at the destination and renamed on completion. Better upload pause handling (#2129)
- - deprecated `source.config.CreateUserDir`, now its always `true`. If a user directory doesn't exist it will get created empty.
- - `CTRL`+`Mouse Wheel` shortcut to change listing size. Also for change font size in editor (#2227)
-
- **BugFixes**:
- - Archives don't preserve file metadata (#2063)
- - Chunked upload setting fails: "0" does not disable chunking as expected (#2202)
- - Incorrect Chinese labels for Upload controls in Quantum UI (#2191)
- - Chunked download stops after first chunk, add message explaining (#2074)
- - Esc to Cancel and Enter to confirm popup (#2079)
- - Language-tagged subtitle files not detected for videos (#2199)
- - Unable to use proxy auth since 1.3.0-beta (#2173)
- - Updating setting on a LDAP user turns the "Login Method" to password. Thus preventing further logins. (#2179)
-
-## v1.3.2-beta
-
- **Security**:
- - Patched Username Enumeration via Authentication Timing Side-Channel  GHSA-7789-65hx-f26w
-
- **New Features**:
-  - Option in settings `userDefaults.preferEditorForMarkdown` to prefer editor first for Markdown files (#2136)
-  - Copy to clipboard button for code blocks in Markdown Viewer (#2160)
-  - Add "Last modified" filter in search dialog (#2157)
-
- **Notes**:
- - docs preview for text and pdf has a 2 second timeout. If it hangs for whatever reason, the maximum time would be 2 seconds. (#2105) (#2114)
- - Downloading multiple files streams the archive creation rather than using cacheDir -- thanks @janakoram (#2125) (#2130)
-   - `server.maxArchiveSizeGB` now defaults to 20 (GB) and only applies to archive/unarchive actions (not downloads).
-   - browser download progress bar will no longer show for archive downloads. this is the main drawback to the streaming approach.
-   - should allow for much higher parallel download support and lower cleanup maintenenance.
- - [docker] ffmpeg version upgraded to 8.1
- - remote ip in logs now prefers `X-Forwarded-For` if it exists, then `X-Real-IP`, then lastly the standard RemoteAddr. Useful when running behind a proxy to log the public IP of each request. (#2110)
- - changed loading spinner style to be more compatible with safari browsers.
-
- **BugFixes**:
- - Wrong username in share settings (#2147) (#2148)
- - [OnlyOffice] Error when saving a file under a user scope #2133
- - Cannot edit shared file in OnlyOffice #2143
- - PWA install button disappeared (#2086)
- - Deleting a root folder was possible #2128
- - PUT resource api errors if action against a folder (#2153) 
- - LDAP authentication issue if a password caontains @ symbol (#2154)
- - Share banner seems to be not working for custom urls (#2120)
-
-## v1.3.1-beta
-
- **Security**:
- - Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse) GHSA-r633-fcgp-m532
- - Patched Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info GHSA-525j-95gf-766f
-
- **New Features**:
-  - More user options for settings (#2072) (#2067):
-    - Option to disable thumbnails `userDefaults.preview.audio` and `userDefaults.preview.models` for Audio and 3D Models.
-    - Option to disable files in the Tree navigation `userDefaults.hideFilesInTree`
-    - Option to disable source files deletion when creating/extracting archives. `userDefaults.deleteAfterArchive`
-
- **Notes**:
- - Share icon does not show in share listing or for shares for other users.
- - File Size Analyzer tool max items increased from 100 to 200.
- - changed symlink detection logic.
-
- **BugFixes**:
- - 405 response code error on Webdav in 1.3.0-beta (#2054)
- - Motion Preview setting not saving when changed in profile settings.
- - Context menu on tools not working.
-
-## v1.3.0-beta
-
-Note: a potentially breaking change for docker users: \the default user is now "filebrowser" 1000:1000 instead of root.
-
- **New Features**:
- - New Sidebar Features
-   - Sidebar tree navigation (#2006) (#350)
-   - Source usage to be customized to show os-reported values rather than calculated. This can be changed per source by editing the source link in the sidebar. (#1266) (#982)
- - Archive/Unarchive actions in UI (#1252) (#335) (#1569) 
-   - new api to archive/unarchive files on the server
-   - requires `create` user permissions
-   - archiving actions respect `server.maxArchiveSize`
- - Added share icon to items that are shared (#1420)
- - Authentication enhancements
-   - LDAP login support with OIDC feature parity. (#591)
-   - userGroup for OIDC and LDAP, only users in a group will get access. (#1964)
-   - Add JWT token authentication support (#1364)
- - Enhanced thumbnail and item previews
-   - Added ability to show "motion preview" for folders with multiple child items that have previews. cycles through the first 4 images.
-   - support for reading embedded images from raw image or heic/heif files (#215)
-   - reorganized and simplified thumbnail settings in profile settings (#1968)
-   - removed `highQuality` thumbnail option which only affected gallery view. Now its always enabled.
-   - improved caching for unsupported images, the same file won't be attempted again with the same modtime.
-   - supports 3d model previews.
- - FileWatcher also supports watching directories
- - Support previews for 3D model files (STL, OBJ, 3MF, etc.) (#1273)
-   - supported formats via threejs: GLTF, GLB, OBJ, STL, PLY, DAE (Collada), 3MF, 3DS, USDZ, USD, USDA, USDC, AMF, VRML, WRL, VTK, VTP, PCD, XYZ, VOX, KMZ
-   - supports animations (for formats that contain them)
-   - supports embedded textures, external neighboring file textures, or textures in `/textures` subdirectory
- - Enhanced prompts
-   - All prompts have a taskbar with a close button
-   - Prompts can be freely moved by dragging taskbar
-   - Prompt styling has been updated
-   - Clicking outside of prompts no longer automatically closes them.
- - add webdav support (#209) -- thanks to @reddac for (#1764)
-   - see docs on how to use
-   - requires api an un-customized api token as password
-   - respects access rules
-   - requires download permission to view and modify/create/delete permission to modify.
-
- **Notes**:
- - Docker images default to `filebrowser` user instead of root
- - reorganized api routes
-   - consolidated tags for swagger to be more accurately grouped
-   - tools are all behind `/api/tools` routes
-   - `/api/raw` is deprecated (but functional). The `/api/resources/download` route will be used instead.
-   - `/api/preview` has been removed and replaced with `/api/resources/preview`
-   - `/api/onlyoffice` have been replaced with `/api/office`
-   - `/api/shares` has been moved to `/api/share/list`
-   - `/api/auth/tokens` has been moved to `/api/auth/token/list` and `/api/auth/token` added to get specific token info
-   - `PUT /api/token` has been moved to `POST /api/token`
-   - `/public/api/shareinfo` has been moved to `/public/api/share/info`
-   - `POST /resources/bulk/delete` api has been moved to `DELETE /resources/bulk` (#1984)
-
- **BugFixes**:
- - Long folder names get cut off at top navigation bar (#1934)
-
-## v1.2.2-stable
-
- **Security**:
- - Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse)
-
- **New Features**:
- - "Divider" option in sidebar links to add a text or divider between links ()
- - shares offer a "go to source Location" sidebar link and button when editing a share.
-
- **Notes**:
- - Share edit/delete permissions are scoped to the user's shares rather than global (#2050)
-
- **BugFixes**:
- - fixed the requirement that the database path needed to be set in the config file, now it loads `FILEBROWSER_DATABASE` value by default, fallback to config file property.
- - Error downloading zipped directory: no such file or directory (users with scope) #2015
-
-## v1.2.1-stable
-
- **BugFixes**:
- - startup icon generation order issue (#2019)
- - login button on shares not showing (#2028)
- - removed file watcher link in context menu for shares (#2025)
- - Direct download link for single-file shares generates incorrect URL (#2026)
- - Deleting files causes error V1.2.0 #2039
-
-## v1.2.7-beta
-
- **BugFixes**:
- - head > title > infinitely duplicating titles (#2016)
- - Proxy auth not working with Nginx, stuck at logo (#2013)
-
-## v1.2.6-beta
-
- **Security**:
- - resolves https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6
-
-## v1.2.5-beta
-
- **Notes**:
- - Dependency Updates for frontend and backend packages
- - Upgrade to go 1.26
- - file list prompt interaction behavior, single-click always selects, double-click navigates. (#1911)
-
- **BugFixes**:
- - .ssa and .ass subtitle files get their styling removed during conversion (#1933)
- - custom icons issue
- - new database message for noauth (#1935)
-
 ## v1.2.4-beta

 **Notes**:
@@ -17,7 +17,7 @@

 ## Pinned

-:loudspeaker: [New Announcement](https://github.com/gtsteffaniak/filebrowser/discussions/2048)
+:loudspeaker: [What's Coming Soon](https://github.com/gtsteffaniak/filebrowser/discussions/1622)

 :pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)

@@ -25,7 +25,7 @@

 FileBrowser Quantum provides an easy way to access and manage your files from the web. It has a modern responsive interface that has many advanced features to manage users, access, sharing, and file preview and editing.

-This version is called "Quantum" because it packs tons of advanced features into a tiny and easy-to-run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
+This version is called "Quantum" because it packs tons of advanced features into a tiny easy to run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.

 The goal for this repo is to become the best open-source self-hosted file browsing application that exists -- **all for free**. This repo will always be free and open-source.

@@ -35,20 +35,20 @@ Ready to try it out? See [Getting Started Docs](https://filebrowserquantum.com/e

 FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:

-  1. ✅ Better source configuration - multiple sources, include/exclude rules, and [more](https://filebrowserquantum.com/en/docs/configuration/sources/)
-  2. ✅ Login support for OIDC, LDAP, JWT, password + 2FA, and proxy.
+  1. ✅ Add and configure multiple sources
+  2. ✅ Login support for OIDC, password + 2FA, and proxy.
  3. ✅ Beautiful, Responsive, and Customizable user interface.
  4. ✅ Streamlined configuration via `config.yaml` config file.
-  5. ✅ Ultra-efficient Sqlite [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing)
+  5. ✅ Ultra-efficient [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) and real-time updates
     - Real-time search results as you type.
     - Real-time monitoring and updates in the UI.
     - Search supports file and folder sizes, along with various filters.
  6. ✅ Better listing browsing
-     - Better thumbnail support including **office**, **video**, and **album artwork**, and **3D models**.
+     - Better thumbnail support including **office**, **video**, and **album artwork**
     - Faster and more responsive views with animations.
-     - Folder sizes are displayed and support thumbnails
+     - Folder sizes are displayed and support for thumbnails
     - Navigating remembers the last scroll position.
-  7. ✅ Highly configurable and [customizable sharing options](https://filebrowserquantum.com/en/docs/shares/options/)
+  7. ✅ Highly configurable and customizable sharing options
     - share expiration time
     - users who can access share (including anonymous)
     - styling and themes
@@ -59,10 +59,20 @@ FileBrowser Quantum is a massive fork of the file browser open-source project wi
     - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.

 Notable features that this fork *does not* have (removed):
+
+ - :construction: jobs are not supported yet.
 - ❌ shell commands are completely removed and will not be returned.

 FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.

+## System Requirements
+
+> [!WARNING]
+> Every file and directory in the source gets indexed (by default). This enables powerful features such as instant search, but large source filesystems can increase your system requirements. [See indexing wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) for more info.
+
+ - **Memory**: depends on configured source complexity. See [how much RAM does it require?](https://github.com/gtsteffaniak/filebrowser/discussions/787)
+ - **GPU**: Not currently used (planned)
+
 ## The UI

 The UI has a simple three-component navigation system:
@@ -94,45 +104,47 @@ Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Self hostable                 | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Has Stable Release?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
-webdav support                | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+webdav support                | :warning:* | ❌ | ✅ | ✅ | ❌ | ✅ |
 FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Dedicated docs site?          | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Docker image size             | 180 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
 Min. Memory Requirements      | 512 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
-has standalone binary         | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
+has standalone binary         | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
 price                         | free | free | free | free tier | free tier | $99+ |
 rich media preview            | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Advanced Search?              | ✅ | ❌ | ✅ | configurable | ✅ | ✅ |
-Indexed Search?               | ✅ | ❌ | ✅ | configurable | ✅ | ✅ |
-Content-aware search?         | ❌ | ❌ | ✅ | configurable | ✅ | ✅ |
-Custom job support            | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
+Advanced Search?              | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
+Indexed Search?               | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
+Content-aware search?         | ❌ | ❌ | ❌ | configurable | ✅ | ✅ |
+Custom job support            | :construction: | ✅ | ❌ | ✅ | ❌ | ✅ |
 Multiple users                | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Single sign-on support        | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-LDAP sign-on support          | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+Single sign-on support        | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
+LDAP sign-on support          | :construction: | ❌ | ❌ | ✅ | ❌ | ✅ |
 Long-live API key support     | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 API documentation page        | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Mobile App                    | ❌ | ❌ | ✅ | ✅ | ✅ | ❌ |
+Mobile App                    | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ |
 open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
-tags support                  | :construction: | ❌ | ✅ | ✅ | ❌ | ✅ |
+tags support                  | :construction: | ❌ | ❌ | ✅ | ❌ | ✅ |
 shareable web links?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Event-based notifications     | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Metrics                       | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
-file space quotas             | :construction: | ❌ | ✅ | ❌ | ✅ | ✅ |
+Event-based notifications     | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
+Metrics                       | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
+file space quotas             | :construction: | ❌ | ❌ | ❌ | ✅ | ✅ |
 text-based files editor       | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
-Themes                        | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-Branding support              | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-activity log                  | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
-Comments support              | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ |
-trash support                 | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
-Starred/pinned files          | ❌ | ❌ | ✅ | ❌ | ✅ | ✅ |
+Themes                        | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
+Branding support              | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
+activity log                  | :construction: | ❌ | ❌ | ✅ | ✅ | ✅ |
+Comments support              | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+trash support                 | :construction: | ❌ | ❌ | ✅ | ✅ | ✅ |
+Starred/pinned files          | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
 Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
 Share collections of files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can archive selected files    | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can browse archive files      | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Can convert documents         | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Can convert videos            | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
-Can convert photos            | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
+Can archive selected files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can browse archive files      | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can convert documents         | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can convert videos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
+Can convert photos            | :construction: | ❌ | ❌ | ❌ | ❌ | ❌ |
+
+*Accessing files from FileBrowser via WebDav is a newly introduced and experimental feature.
@@ -1,15 +1,17 @@
-FROM gtstef/ffmpeg:8.1-decode AS ffmpeg
+FROM gtstef/ffmpeg:8.0.1-decode AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION
 WORKDIR /app
 COPY ./backend ./
-RUN apk update && apk add --no-cache gcc musl-dev
+RUN apk update && apk add --no-cache gcc musl-dev upx
 ENV CGO_ENABLED=1
+ENV GOEXPERIMENT=greenteagc
 RUN go build -tags mupdf,musl -ldflags="-w -s \
  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
  -o filebrowser .
+RUN upx filebrowser

 FROM node:jod-slim AS nbuild
 WORKDIR /app
@@ -42,6 +44,7 @@ RUN [ "filebrowser", "version" ]
 RUN [ "ffmpeg", "-version" ]
 RUN [ "ffprobe", "-version" ]
 RUN [ "exiftool", "-ver" ]
+USER root
 # exposing default port for auto discovery.
 EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
@@ -1,5 +1,4 @@
 FROM node:22-slim
 WORKDIR /app/frontend
-
 RUN npm i @playwright/test oauth2-mock-server @types/node
-RUN npx playwright install --with-deps chromium
+RUN npx playwright install --with-deps firefox
@@ -14,9 +14,6 @@ COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
 RUN mkdir -p ./http/dist
 COPY [ "./backend/http/embed/", "./http/dist/"]

-# generate duplicate 1.1MB files
-RUN dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1MB.bin bs=1024 count=1126 && dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1mb.bin bs=1024 count=1126
-
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser set -u testuser1,testuser1
@@ -1,14 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-COPY [ "./_docker/src/jwt/", "./" ]
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-RUN apt update && apt install nginx -y
-RUN mv default.conf /etc/nginx/conf.d/default.conf
-RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,14 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-WORKDIR /app/frontend
-COPY [ "./frontend/", "./" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./_docker/src/screenshots/backend/*", "./"]
-
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-ENTRYPOINT [ "./filebrowser" ]
@@ -1,17 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/previews/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -1,15 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-WORKDIR /app/frontend
-COPY [ "./frontend/", "./" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./_docker/src/screenshots/backend/*", "./"]
-
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots
@@ -18,6 +18,5 @@ COPY [ "./backend/http/embed/", "./http/dist/"]
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser set -u testuser1,testuser1
-RUN ./filebrowser set rule -s access -p / -r user -v admin -allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded -r user -v admin -c config.yaml
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+RUN ./filebrowser set rule -f /tests/playwright-files -p / -r user -v admin -allow -c config.yaml
+RUN ./filebrowser set rule -f /tests/playwright-files -p /excluded -r user -v admin -c config.yaml
@@ -3,11 +3,13 @@ ARG VERSION
 ARG REVISION
 WORKDIR /app
 COPY ./backend ./
-RUN apk update && apk add
+RUN apk update && apk add upx
+ENV GOEXPERIMENT=greenteagc
 RUN go build -ldflags="-w -s \
  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
  -o filebrowser .
+RUN upx filebrowser

 FROM node:jod-slim AS nbuild
 WORKDIR /app
@@ -34,6 +36,7 @@ COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "
 COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
+USER root
 # exposing default port for auto discovery.
 EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
@@ -1,19 +1,4 @@
 services:
-  local-playwright:
-    container_name: local-playwright
-    ports:
-      - "8080:8080"
-    build:
-      dockerfile: ./_docker/Dockerfile.playwright-local
-      context: ../
-  local-playwright-screenshots:
-    container_name: local-playwright
-    volumes:
-      - ../frontend/generated:/app/frontend/generated
-    entrypoint: ["/bin/sh", "-c", "./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots && npx playwright test --project light-screenshots"]
-    build:
-      dockerfile: ./_docker/Dockerfile.playwright-local
-      context: ../
  nginx-proxy-auth:
    image: nginx
    container_name: nginx-proxy-auth
@@ -22,30 +7,11 @@ services:
    volumes:
      - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
      - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
-  nginx-proxy-jwt:
-    image: nginx
-    container_name: nginx-proxy-jwt
-    ports:
-      - "8081:8081"  # Admin user
-      - "8082:8082"  # Regular user
-      - "8083:8083"  # Wrong key
-      - "8084:8084"  # No user
-    volumes:
-      - ./src/jwt/backend/default.conf:/etc/nginx/conf.d/default.conf
-      - ./src/jwt/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
-  filebrowser-jwt:
-    hostname: filebrowser
-    volumes:
-      - '../frontend:/home/frontend'
-      - "./src/jwt/backend/config.yaml:/home/filebrowser/data/config.yaml"
-    build:
-      context: ../
-      dockerfile: ./_docker/Dockerfile.slim
  filebrowser:
    hostname: filebrowser
    volumes:
      - '../frontend:/home/frontend'
-      - "./src/proxy/backend/config.yaml:/home/filebrowser/data/config.yaml"
+      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
    build:
      context: ../
      dockerfile: ./_docker/Dockerfile.slim
@@ -8,11 +8,8 @@ userDefaults:
    image: true
    popup: true
    video: true
-    audio: true
-    models: true
    office: true
    highQuality: true
  permissions:
    download: true
-    create: true
-    share: true
+    create: true
@@ -1,48 +0,0 @@
-server:
-  port: 8080
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        createUserDir: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true
-auth:
-  methods:
-    password:
-      enabled: false
-    jwt:
-      enabled: true
-      secret: "test-jwt-secret-key-for-development-only-do-not-use-in-production"
-      algorithm: "HS256"
-      header: "X-JWT-Assertion"
-      userIdentifier: "sub"
-      groupsClaim: "mygroup"
-      adminGroup: "admin"
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
-  darkMode: true
-  disableSettings: false
-  singleClick: false
-  permissions:
-    admin: false
-    modify: true
-    share: true
-    api: false
-    download: true
-    create: true
@@ -1,66 +0,0 @@
-# Admin user (port 8081)
-server {
-    listen 8081;
-    server_name localhost 127.0.0.1;
-    
-    set $admin_token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RhZG1pbkBleGFtcGxlLmNvbSIsImV4cCI6MjA4NzU2NTc2NiwiZ3JvdXBzIjpbImFkbWluIl0sImlhdCI6MTc3MjIwNTc2NiwibmFtZSI6IlRlc3QgQWRtaW4iLCJuYmYiOjE3NzIyMDU3NjYsInN1YiI6InRlc3RhZG1pbiJ9.pxuKGyMmEe94m0xQ7y1QzcUZgU-lZSvqjoKUVoVd3F4";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $admin_token;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# Regular user (port 8082)
-server {
-    listen 8082;
-    server_name localhost 127.0.0.1;
-    
-    set $regular_token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20iLCJleHAiOjIwODc1NjU2OTIsImdyb3VwcyI6WyJteWdyb3VwIl0sImlhdCI6MTc3MjIwNTY5MiwibmFtZSI6IlRlc3QgVXNlciIsIm5iZiI6MTc3MjIwNTY5Miwic3ViIjoidGVzdHVzZXIifQ.X8fUYbhnZpgvP5CnGdms9eGo8yRLyNhRbj7xUSxEgl8";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $regular_token;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# Valid token but signed with different secret (port 8083)
-server {
-    listen 8083;
-    server_name localhost 127.0.0.1;
-    
-    # Valid JWT token structure, but signed with wrong secret - should fail signature verification
-    set $wrong_key "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RhZG1pbkBleGFtcGxlLmNvbSIsImV4cCI6MjA4NzU2NjAyMywiZ3JvdXBzIjpbImFkbWluIl0sImlhdCI6MTc3MjIwNjAyMywibmFtZSI6IlRlc3QgQWRtaW4iLCJuYmYiOjE3NzIyMDYwMjMsInN1YiI6InRlc3RhZG1pbiJ9.afBobbJ3VQ-fKnUebGr-gxFIqegyICi6E3EgkUSeFNw";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $wrong_key;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# No authentication (port 8084)
-server {
-    listen 8084;
-    server_name localhost 127.0.0.1;
-    
-    location / {
-        proxy_set_header X-JWT-Assertion "";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
@@ -1,101 +0,0 @@
-package main
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-)
-
-// Simple JWT generator without external dependencies
-func main() {
-	// Secret key - must match the one in your config file
-	secret := "wrong-key"
-
-	// Check if custom secret provided via command line
-	if len(os.Args) > 1 {
-		secret = os.Args[1]
-	}
-
-	// Create token claims with 10 year expiration
-	now := time.Now()
-	expiresAt := now.Add(10 * 365 * 24 * time.Hour) // 10 years
-
-	header := map[string]interface{}{
-		"alg": "HS256",
-		"typ": "JWT",
-	}
-
-	claims := map[string]interface{}{
-		"sub":    "testadmin",             // username (subject)
-		"email":  "testadmin@example.com", // email claim
-		"name":   "Test Admin",            // full name
-		"groups": []string{"admin"},       // groups - includes admin for testing
-		"iat":    now.Unix(),              // issued at
-		"exp":    expiresAt.Unix(),        // expires at
-		"nbf":    now.Unix(),              // not before
-	}
-
-	// Encode header
-	headerJSON, err := json.Marshal(header)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error encoding header: %v\n", err)
-		os.Exit(1)
-	}
-	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)
-
-	// Encode claims
-	claimsJSON, err := json.Marshal(claims)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error encoding claims: %v\n", err)
-		os.Exit(1)
-	}
-	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)
-
-	// Create signature
-	message := headerB64 + "." + claimsB64
-	h := hmac.New(sha256.New, []byte(secret))
-	h.Write([]byte(message))
-	signature := base64.RawURLEncoding.EncodeToString(h.Sum(nil))
-
-	// Combine to form complete JWT
-	tokenString := message + "." + signature
-
-	// Output the token
-	fmt.Println("=== JWT Token Generated ===")
-	fmt.Println()
-	fmt.Println("Token:")
-	fmt.Println(tokenString)
-	fmt.Println()
-	// Verify token can be decoded
-	parts := strings.Split(tokenString, ".")
-	if len(parts) == 3 {
-		fmt.Println("✓ Token structure is valid (3 parts)")
-	} else {
-		fmt.Fprintf(os.Stderr, "✗ Invalid token structure\n")
-		os.Exit(1)
-	}
-
-	// Save to file for easy access
-	filename := "test-jwt-token.txt"
-	if err := os.WriteFile(filename, []byte(tokenString), 0644); err != nil {
-		fmt.Fprintf(os.Stderr, "Warning: Could not write token to file: %v\n", err)
-	} else {
-		fmt.Printf("✓ Token saved to: %s\n", filename)
-		fmt.Println()
-	}
-
-	// Also save to shell script for easy sourcing
-	scriptContent := fmt.Sprintf("#!/bin/bash\n# Source this file to set JWT token as environment variable\n# Usage: source jwt-env.sh\nexport TEST_JWT_TOKEN=\"%s\"\necho \"JWT token loaded into TEST_JWT_TOKEN\"\n", tokenString)
-	if err := os.WriteFile("jwt-env.sh", []byte(scriptContent), 0755); err != nil {
-		fmt.Fprintf(os.Stderr, "Warning: Could not write shell script: %v\n", err)
-	} else {
-		fmt.Println("✓ Shell script saved to: jwt-env.sh")
-		fmt.Println("  Usage: source jwt-env.sh")
-		fmt.Println()
-	}
-}
@@ -1,3 +0,0 @@
-module test
-
-go 1.25.6
@@ -1,66 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/jwt-setup.ts",
-  timeout: 5000,
-  testDir: "./tests/playwright/jwt",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for different JWT test scenarios */
-  projects: [
-    {
-      name: "admin-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8081", // Admin user JWT
-      },
-    },
-    {
-      name: "regular-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8082", // Regular user JWT
-      },
-    },
-    {
-      name: "wrong-key",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8083", // Wrong secret key
-      },
-    },
-    {
-      name: "no-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8084", // No JWT token
-      },
-    },
-  ],
-});
@@ -1,35 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-
-auth:
-  methods:
-    noauth: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true
-
-userDefaults:
-  showHidden: true
-  preview:
-    image: true
-    popup: true
-    video: true
-    audio: true
-    office: true
-    models: true
-    highQuality: true
-  permissions:
-    download: true
-    create: true
@@ -1,54 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/previews-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/previews",
-  /* Run tests in files in parallel */
-  fullyParallel: true,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  workers: 10,
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    launchOptions: {
-      args: [
-        '--disable-gpu',
-        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
-        '--enable-webgl',
-        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
-        '--no-sandbox',  // Required for Docker
-      ],
-    },
-    storageState: "previews.json",
-    actionTimeout: 5000,
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "chromium",
-      use: { ...devices["Desktop Chrome"] },
-    },
-  ],
-});
@@ -11,14 +11,14 @@ import { defineConfig, devices } from "@playwright/test";
 */
 export default defineConfig({
  globalSetup: "./tests/playwright/proxy-setup.ts",
-  timeout: 10000,
+  timeout: 5000,
  testDir: "./tests/playwright/proxy",
  /* Run tests in files in parallel */
  fullyParallel: false,
  /* Fail the build on CI if you accidentally left test.only in the source code. */
  forbidOnly: false,
  /* Retry on CI only */
-  retries: 3,
+  retries: 2,
  /* Opt out of parallel tests on CI. */
  workers: 1, // required for now! todo parallel some tests
  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
@@ -1,10 +0,0 @@
-server:
-  port: 8080
-  baseURL:  "/files/"
-  logging:
-    - levels: "info|error|debug"
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright"
-      config:
-        defaultEnabled: true
@@ -1,65 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/screenshots-setup.ts",
-  timeout: 5000,
-  testDir: "./tests/playwright/screenshots",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 1,
-  /* Opt out of parallel tests on CI. */
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    launchOptions: {
-      args: [
-        '--disable-gpu',
-        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
-        '--enable-webgl',
-        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
-        '--no-sandbox',  // Required for Docker
-      ],
-    },
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://localhost:8080",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "dark-screenshots",
-      use: {
-        ...devices["Desktop Chrome"],
-        theme: 'dark',
-      },
-    },
-    {
-      name: "light-screenshots",
-      use: {
-        ...devices["Desktop Chrome"],
-        theme: 'light',
-      },
-    },
-  ],
-});
@@ -11,7 +11,7 @@ import { defineConfig, devices } from "@playwright/test";
 */
 export default defineConfig({
  globalSetup: "./tests/playwright/global-setup",
-  timeout: 5000,
+  timeout: 3000,
  testDir: "./tests/playwright/settings",
  /* Run tests in files in parallel */
  fullyParallel: false,
@@ -1,18 +1,14 @@
 package files

 import (
-	"errors"
-	"fmt"
 	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
-	"sync"
 	"testing"
 	"time"

 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	liberrors "github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	dbsql "github.com/gtsteffaniak/filebrowser/backend/database/sql"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
@@ -90,111 +86,6 @@ func Test_GetRealPath(t *testing.T) {
 	}
 }

-// Regression: PUT / save must not os.Chmod to PermFile for existing files, or +x (and other mode bits) are lost (#2309).
-func TestWriteFilePreservesExecutableBit(t *testing.T) {
-	cacheDir := t.TempDir()
-	originalCache := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = cacheDir
-	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
-
-	fileutils.SetFsPermissions(0o644, 0o755)
-
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_writefile_exec", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	root := t.TempDir()
-	scriptName := "backupscript.sh"
-	scriptAbs := filepath.Join(root, scriptName)
-	if err := os.WriteFile(scriptAbs, []byte("#!/bin/sh\necho hi\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	sourceName := "test_writefile_exec"
-	indexing.Initialize(&settings.Source{
-		Name: sourceName,
-		Path: root,
-	}, false, false)
-
-	idx := indexing.GetIndex(sourceName)
-	if idx == nil {
-		t.Fatal("Failed to get test index")
-	}
-	stopPoll := startScannerStatusPoll(t, idx, 1)
-	defer stopPoll()
-	waitForScannerReady(t, idx)
-
-	indexPath := "/" + scriptName
-	if err := WriteFile(sourceName, indexPath, strings.NewReader("#!/bin/sh\necho bye\n")); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-
-	st, err := os.Stat(scriptAbs)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if st.Mode()&0o111 == 0 {
-		t.Fatalf("executable bits cleared after save: mode=%v", st.Mode())
-	}
-
-	indexing.StopAllScanners()
-	time.Sleep(50 * time.Millisecond)
-	indexing.ClearTestIndices()
-}
-
-func TestWriteFileRejectsExistingDirectory(t *testing.T) {
-	cacheDir := t.TempDir()
-	originalCache := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = cacheDir
-	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
-
-	fileutils.SetFsPermissions(0o644, 0o755)
-
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_writefile_isdir", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	root := t.TempDir()
-	dirName := "folder"
-	if err := os.Mkdir(filepath.Join(root, dirName), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	sourceName := "test_writefile_isdir"
-	indexing.Initialize(&settings.Source{
-		Name: sourceName,
-		Path: root,
-	}, false, false)
-
-	idx := indexing.GetIndex(sourceName)
-	if idx == nil {
-		t.Fatal("Failed to get test index")
-	}
-	stopPoll := startScannerStatusPoll(t, idx, 1)
-	defer stopPoll()
-	waitForScannerReady(t, idx)
-
-	err := WriteFile(sourceName, "/"+dirName, strings.NewReader("file content"))
-	if err == nil {
-		t.Fatal("expected error when path is an existing directory")
-	}
-	if !errors.Is(err, liberrors.ErrIsDirectory) {
-		t.Fatalf("expected ErrIsDirectory, got: %v", err)
-	}
-
-	indexing.StopAllScanners()
-	time.Sleep(50 * time.Millisecond)
-	indexing.ClearTestIndices()
-}
-
 func TestSortItems(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -518,218 +409,3 @@ func TestOverrideFileToDirectory(t *testing.T) {
 		t.Error("Directory 'Test Object' should have been added to Folders")
 	}
 }
-
-// TestDeleteFilesRootProtection tests that DeleteFiles refuses to delete
-// the source root directory itself, preventing catastrophic data loss.
-// This is a regression test for the safety guard added to prevent accidental
-// deletion of the entire source directory.
-func TestDeleteFilesRootProtection(t *testing.T) {
-	// Use a temporary directory for cache
-	tmpDir := t.TempDir()
-	originalCacheDir := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = tmpDir
-	defer func() {
-		settings.Config.Server.CacheDir = originalCacheDir
-	}()
-
-	// Ensure fileutils permissions are set
-	if fileutils.PermDir == 0 {
-		fileutils.SetFsPermissions(0644, 0755)
-	}
-
-	// Initialize the database
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_root_protection", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	// Create a real temporary directory to use as source root
-	realTmpDir := t.TempDir()
-
-	// Initialize the index with a real path
-	indexing.Initialize(&settings.Source{
-		Name: "test_root_protection",
-		Path: realTmpDir,
-	}, false, false) // false for mock mode (real path), false for isNewDb
-
-	// Wait for scanner to be ready
-	idx := indexing.GetIndex("test_root_protection")
-	if idx == nil {
-		t.Fatal("Failed to get test index")
-	}
-
-	// Wait for scanner to finish
-	for i := 0; i < 50; i++ {
-		time.Sleep(10 * time.Millisecond)
-		status := idx.GetScannerStatus()
-		if status["status"] == "ready" || status["status"] == "unavailable" {
-			break
-		}
-	}
-
-	// Test: Attempting to delete the root directory should return an error
-	err := DeleteFiles("test_root_protection", realTmpDir, true)
-	if err == nil {
-		t.Error("DeleteFiles should return an error when trying to delete root directory")
-	}
-
-	// Verify the error message contains expected text
-	expectedErrMsg := "refusing to delete source root directory"
-	if err != nil && !strings.Contains(err.Error(), expectedErrMsg) {
-		t.Errorf("Expected error message to contain '%s', got: %v", expectedErrMsg, err.Error())
-	}
-
-	// Test with trailing slash - should still be blocked
-	err = DeleteFiles("test_root_protection", realTmpDir+"/", true)
-	if err == nil {
-		t.Error("DeleteFiles should return an error for root directory with trailing slash")
-	}
-
-	// Test with cleaned path variations
-	err = DeleteFiles("test_root_protection", realTmpDir+"/.", true)
-	if err == nil {
-		t.Error("DeleteFiles should return an error for root directory with /. suffix")
-	}
-}
-
-// TestDeleteFilesSubfolderWithRootName tests that deleting a subfolder
-// with the same name as the root directory works correctly and doesn't
-// accidentally delete the root.
-// Regression test for path handling bug where /srv/srv could be mistaken for /srv.
-func TestDeleteFilesSubfolderWithRootName(t *testing.T) {
-	for iter := 1; iter <= raceStressIterations; iter++ {
-		iter := iter
-		t.Run(fmt.Sprintf("stress-iter-%d", iter), func(t *testing.T) {
-			runDeleteFilesSubfolderWithRaceStress(t, iter)
-		})
-	}
-}
-
-const (
-	raceStressIterations   = 3
-	raceStatusPollInterval = 5 * time.Millisecond
-	waitStatusMaxTries     = 100
-	waitStatusSleep        = 50 * time.Millisecond
-)
-
-func runDeleteFilesSubfolderWithRaceStress(t *testing.T, iter int) {
-	t.Helper()
-	start := time.Now()
-	t.Logf("iteration %d: start", iter)
-
-	cacheDir := t.TempDir()
-	originalCache := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = cacheDir
-	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
-
-	if fileutils.PermDir == 0 {
-		fileutils.SetFsPermissions(0644, 0755)
-	}
-
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_subfolder_rootname", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	realTmpDir := t.TempDir()
-	subfolderName := filepath.Base(realTmpDir)
-	subfolderPath := filepath.Join(realTmpDir, subfolderName)
-
-	if err := os.Mkdir(subfolderPath, 0755); err != nil {
-		t.Fatalf("Failed to create subfolder: %v", err)
-	}
-
-	testFile := filepath.Join(subfolderPath, "test.txt")
-	if err := os.WriteFile(testFile, []byte("test content"), 0644); err != nil {
-		t.Fatalf("Failed to create test file: %v", err)
-	}
-
-	sourceName := fmt.Sprintf("test_subfolder_rootname-%d", iter)
-	indexing.Initialize(&settings.Source{
-		Name: sourceName,
-		Path: realTmpDir,
-	}, false, false)
-
-	idx := indexing.GetIndex(sourceName)
-	if idx == nil {
-		t.Fatalf("Failed to get test index for %s", sourceName)
-	}
-
-	stopPolling := startScannerStatusPoll(t, idx, iter)
-	defer stopPolling()
-
-	waitForScannerReady(t, idx)
-
-	err := DeleteFiles(sourceName, subfolderPath, true)
-	stopPolling()
-
-	t.Logf("iteration %d: DeleteFiles finished in %s (err=%v)", iter, time.Since(start), err)
-
-	if err != nil {
-		t.Fatalf("DeleteFiles should succeed for subfolder with root-like name, got error: %v", err)
-	}
-
-	if _, err := os.Stat(subfolderPath); !os.IsNotExist(err) {
-		t.Fatal("Subfolder should have been deleted")
-	}
-
-	if _, err := os.Stat(realTmpDir); os.IsNotExist(err) {
-		t.Fatal("Root directory should NOT have been deleted")
-	}
-
-	indexing.StopAllScanners()
-	// Give scanners time to finish their cleanup (defer blocks in tryAcquireAndScan)
-	time.Sleep(100 * time.Millisecond)
-	indexing.ClearTestIndices()
-	t.Logf("iteration %d: cleaned scanners and indices", iter)
-}
-
-func waitForScannerReady(t *testing.T, idx *indexing.Index) {
-	t.Helper()
-	// Give the scanners a moment to initialize, but don't wait for full "ready" status
-	// The initial scan can take longer than the test timeout, but DeleteFiles will work
-	// as long as the scanners are initialized and running
-	time.Sleep(500 * time.Millisecond)
-	
-	// Verify scanners exist
-	status := idx.GetScannerStatus()
-	if totalScanners, ok := status["totalScanners"].(int); !ok || totalScanners == 0 {
-		t.Fatal("No scanners were created")
-	}
-	t.Log("Scanners initialized, proceeding with delete operation")
-}
-
-func startScannerStatusPoll(t *testing.T, idx *indexing.Index, iter int) func() {
-	t.Helper()
-	stop := make(chan struct{})
-	done := make(chan struct{})
-	var once sync.Once
-
-	go func() {
-		ticker := time.NewTicker(raceStatusPollInterval)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-stop:
-				close(done)
-				return
-			case <-ticker.C:
-				idx.GetScannerStatus()
-			}
-		}
-	}()
-
-	return func() {
-		once.Do(func() {
-			close(stop)
-			<-done
-			t.Logf("iteration %d: poll watcher stopped", iter)
-		})
-	}
-}
@@ -25,39 +25,6 @@ import (
 	"github.com/gtsteffaniak/go-logger/logger"
 )

-// CheckPermissionsFunc allows tests to override CheckPermissions behavior
-var CheckPermissionsFunc = checkPermissionsImpl
-
-// addMetadataToChildren runs concurrent ffmpeg/tag extraction for audio/video children.
-// Each goroutine is registered on wg. Caller must invoke wg.Wait() after scheduling.
-func addMetadataToChildren(response *iteminfo.ExtendedFileInfo, opts utils.FileOptions, wg *sync.WaitGroup) {
-	sharedFFmpegService := ffmpeg.NewFFmpegService(10, false, "")
-	if sharedFFmpegService == nil {
-		return
-	}
-	for i := range response.Files {
-		fileItem := &response.Files[i]
-		isItemAudio := strings.HasPrefix(fileItem.Type, "audio")
-		isItemVideo := strings.HasPrefix(fileItem.Type, "video")
-		if !isItemAudio && !isItemVideo {
-			continue
-		}
-		isAudio := isItemAudio
-		wg.Go(func() {
-			fullPath := response.RealPath + "/" + fileItem.Name
-			if isAudio {
-				if err := extractAudioMetadata(context.Background(), fileItem, fullPath, opts.AlbumArt, opts.Metadata, sharedFFmpegService); err != nil {
-					logger.Debugf("failed to extract metadata for file: %s, error: %v", fileItem.Name, err)
-				}
-			} else {
-				if err := extractVideoMetadata(context.Background(), fileItem, fullPath, sharedFFmpegService); err != nil {
-					logger.Debugf("failed to extract video metadata for file: %s, error: %v", fileItem.Name, err)
-				}
-			}
-		})
-	}
-}
-
 // processDirectoryMetadata extracts metadata for audio/video files in directories
 func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts utils.FileOptions) {
 	metadataCount := 0
@@ -69,8 +36,11 @@ func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing
 			metadataCount++
 		}
 	}
+	// Process files concurrently using goroutines
 	var wg sync.WaitGroup
+	var mu sync.Mutex // Protects processedCount

+	// Refresh directory to update folder sizes
 	wg.Go(func() {
 		indexPath := idx.MakeIndexPath(response.Path, true)
 		err := idx.RefreshDirectory(indexPath, false)
@@ -79,9 +49,54 @@ func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing
 		}
 	})

-	if opts.Metadata && metadataCount > 0 {
-		addMetadataToChildren(response, opts, &wg)
+	// Set hasMetadata flag if there are files with potential metadata
+	if metadataCount > 0 {
+		response.HasMetadata = true
 	}
+
+	// Only process metadata if explicitly requested
+	if opts.Metadata && metadataCount > 0 {
+		processedCount := 0
+
+		// Create a single shared FFmpegService instance for all files to coordinate concurrency
+		sharedFFmpegService := ffmpeg.NewFFmpegService(10, false, "")
+		if sharedFFmpegService != nil {
+
+			for i := range response.Files {
+				fileItem := &response.Files[i]
+				isItemAudio := strings.HasPrefix(fileItem.Type, "audio")
+				isItemVideo := strings.HasPrefix(fileItem.Type, "video")
+
+				if isItemAudio || isItemVideo {
+					wg.Go(func() {
+						// Extract metadata for audio files (without album art for performance)
+						if isItemAudio {
+							err := extractAudioMetadata(context.Background(), fileItem, response.RealPath+"/"+fileItem.Name, opts.AlbumArt, opts.Metadata, sharedFFmpegService)
+							if err != nil {
+								logger.Debugf("failed to extract metadata for file: %s, error: %v", fileItem.Name, err)
+							} else {
+								mu.Lock()
+								processedCount++
+								mu.Unlock()
+							}
+						} else {
+							// Extract duration for video files
+							err := extractVideoMetadata(context.Background(), fileItem, response.RealPath+"/"+fileItem.Name, sharedFFmpegService)
+							if err != nil {
+								logger.Debugf("failed to extract video metadata for file: %s, error: %v", fileItem.Name, err)
+							} else {
+								mu.Lock()
+								processedCount++
+								mu.Unlock()
+							}
+						}
+					})
+				}
+			}
+
+		}
+	}
+	// Wait for all goroutines to complete
 	wg.Wait()
 }

@@ -101,41 +116,35 @@ func finalizeResponse(response *iteminfo.ExtendedFileInfo, info *iteminfo.FileIn
 	}
 }

-// CheckPermissions validates user access and returns the resolved index path and user scope
-func CheckPermissions(opts utils.FileOptions, access *access.Storage, user *users.User) (string, string, error) {
-	return CheckPermissionsFunc(opts, access, user)
-}
-
-// checkPermissionsImpl is the actual implementation of CheckPermissions
-func checkPermissionsImpl(opts utils.FileOptions, access *access.Storage, user *users.User) (string, string, error) {
+func FileInfoFaster(opts utils.FileOptions, access *access.Storage, user *users.User) (*iteminfo.ExtendedFileInfo, error) {
+	response := &iteminfo.ExtendedFileInfo{}
 	if access == nil {
-		return "", "", fmt.Errorf("access not provided")
+		return response, fmt.Errorf("access not provided")
 	}
 	if user == nil {
-		return "", "", fmt.Errorf("user not provided")
+		return response, fmt.Errorf("user not provided")
 	}
 	if opts.Path == "" {
-		return "", "", fmt.Errorf("path not provided")
+		return response, fmt.Errorf("path not provided")
 	}
 	if opts.Source == "" {
-		return "", "", fmt.Errorf("source not provided")
+		return response, fmt.Errorf("source not provided")
 	}
-
 	// Get index
 	idx := indexing.GetIndex(opts.Source)
 	if idx == nil {
-		return "", "", fmt.Errorf("could not get index: %v ", opts.Source)
+		return response, fmt.Errorf("could not get index: %v ", opts.Source)
 	}

 	// Resolve user scope
 	userScope, scopeErr := user.GetScopeForSourcePath(idx.Path)
 	if scopeErr != nil || userScope == "" {
-		return "", "", fmt.Errorf("user has no access to source: %v", opts.Source)
+		return response, fmt.Errorf("user has no access to source: %v", opts.Source)
 	}

 	safePath, err := utils.SanitizeUserPath(opts.Path)
 	if err != nil {
-		return "", "", errors.ErrAccessDenied
+		return response, errors.ErrAccessDenied
 	}

 	// Combine scope + sanitized path
@@ -143,124 +152,49 @@ func checkPermissionsImpl(opts utils.FileOptions, access *access.Storage, user *
 	// Layer 1: USER ACCESS CONTROL
 	// Quick check: Does THIS user have permission?
 	if !access.Permitted(idx.Path, indexPath, user.Username) {
-		return "", "", errors.ErrAccessDenied
-	}
-	return indexPath, userScope, nil
-}
-
-type Items struct {
-	Files   []string `json:"files,omitempty"`
-	Folders []string `json:"folders,omitempty"`
-}
-
-func GetDirItems(opts utils.FileOptions, access *access.Storage, user *users.User) (Items, error) {
-	items := Items{}
-	indexPath, _, err := CheckPermissions(opts, access, user)
-	if err != nil {
-		return items, err
-	}
-	// Get index
-	idx := indexing.GetIndex(opts.Source)
-	if idx == nil {
-		return items, fmt.Errorf("could not get index: %v ", opts.Source)
+		return response, errors.ErrAccessDenied
 	}

-	info, err := idx.GetFileInfo(indexing.FileInfoRequest{
-		IndexPath:         indexPath,
-		FollowSymlinks:    opts.FollowSymlinks,
-		ShowHidden:        opts.ShowHidden,
-		Expand:            true,
-		SkipExtendedAttrs: true,
-	})
-	if err != nil {
-		return items, err // Path excluded by index rules OR doesn't exist
-	}
-	if info.Type != "directory" {
-		return items, fmt.Errorf("path is not a directory: %v ", indexPath)
-	}
-	if err := access.CheckChildItemAccess(info, idx, user.Username); err != nil {
-		return items, err
-	}
-	if opts.Only == "files" || opts.Only == "" {
-		for _, file := range info.Files {
-			items.Files = append(items.Files, file.Name)
-		}
-	}
-	if opts.Only == "folders" || opts.Only == "" {
-		for _, folder := range info.Folders {
-			items.Folders = append(items.Folders, folder.Name)
-		}
-	}
-	return items, nil
-}
-
-// FileInfoFasterFunc is a variable that can be mocked in tests
-var FileInfoFasterFunc = fileInfoFasterImpl
-
-func FileInfoFaster(opts utils.FileOptions, access *access.Storage, user *users.User, share *share.Storage) (*iteminfo.ExtendedFileInfo, error) {
-	return FileInfoFasterFunc(opts, access, user, share)
-}
-
-// fileInfoFasterImpl is the actual implementation of FileInfoFaster
-func fileInfoFasterImpl(opts utils.FileOptions, access *access.Storage, user *users.User, share *share.Storage) (*iteminfo.ExtendedFileInfo, error) {
-	response := &iteminfo.ExtendedFileInfo{}
-	indexPath, userScope, err := CheckPermissions(opts, access, user)
-	if err != nil {
-		return response, err
-	}
-	// Get index
-	idx := indexing.GetIndex(opts.Source)
-	if idx == nil {
-		return response, fmt.Errorf("could not get index: %v ", opts.Source)
-	}
 	// Layer 2: INDEX RULES (global)
 	// Get file info using unified entry point (applies IsViewable/ShouldSkip)
 	info, err := idx.GetFileInfo(indexing.FileInfoRequest{
-		IndexPath:         indexPath,
-		FollowSymlinks:    opts.FollowSymlinks,
-		ShowHidden:        opts.ShowHidden,
-		Expand:            opts.Expand,
-		SkipExtendedAttrs: opts.SkipExtendedAttrs,
+		IndexPath:      indexPath,
+		FollowSymlinks: opts.FollowSymlinks,
+		ShowHidden:     opts.ShowHidden,
+		Expand:         opts.Expand,
+		IsRoutineScan:  false, // API call
 	})
 	if err != nil {
 		return response, err // Path excluded by index rules OR doesn't exist
 	}

-	// otherwise response keeps unfiltered Folders/Files while CheckChildItemAccess only mutates info.
-	if info.Type == "directory" {
-		if err := access.CheckChildItemAccess(info, idx, user.Username); err != nil {
-			return response, err
-		}
-	}
-
 	// Build response
 	response.FileInfo = *info
 	response.RealPath = filepath.Join(idx.Path, indexPath)
 	response.Source = opts.Source
-	if share != nil && user.Permissions.Share && opts.ShowSharedAttr {
-		for i := range response.Files {
-			file := &response.Files[i]
-			file.IsShared = share.IsShared(response.Path+file.Name, idx.Path, user.ID)
+
+	// Layer 3: FILTER CHILDREN (user access)
+	// Remove child items THIS user can't access
+	if info.Type == "directory" {
+		if err := access.CheckChildItemAccess(response, idx, user.Username); err != nil {
+			return response, err
 		}
-		for i := range response.Folders {
-			folder := &response.Folders[i]
-			folder.IsShared = share.IsShared(response.Path+folder.Name, idx.Path, user.ID)
-		}
-		response.IsShared = share.IsShared(response.Path, idx.Path, user.ID)
-	}
-	defer finalizeResponse(response, info, response.RealPath, user, userScope)
-	if opts.SkipExtendedAttrs {
-		return response, nil
 	}
+
 	// Process directory metadata if requested
 	if info.Type == "directory" {
 		processDirectoryMetadata(response, idx, opts)
 	}
+
 	// Process single file content/metadata
 	isAudioVideo := strings.HasPrefix(info.Type, "audio") || strings.HasPrefix(info.Type, "video")
 	if opts.Content || opts.Metadata || isAudioVideo {
 		processContent(response, idx, opts)
 	}
+
+	// Finalize response (OnlyOffice ID, scope stripping)
+	finalizeResponse(response, info, response.RealPath, user, userScope)
+
 	return response, nil
 }

@@ -271,13 +205,9 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 	if isFolder {
 		return
 	}
-	if isVideo && !opts.Metadata {
-		return
-	}
-	if isAudio && !(opts.Metadata || opts.AlbumArt) {
-		return
-	}
+
 	if isVideo {
+		// Extract duration for video
 		extItem := &iteminfo.ExtendedItemInfo{
 			ItemInfo: info.ItemInfo,
 		}
@@ -288,6 +218,7 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 			info.Metadata = extItem.Metadata
 		}

+		// Handle subtitles if requested
 		parentPath := filepath.Dir(info.Path)
 		parentInfo, exists := idx.GetMetadataInfo(parentPath, true, false)
 		if exists {
@@ -297,12 +228,12 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 			subtitles := ffmpeg.DetectEmbeddedSubtitles(info.RealPath, info.ModTime)
 			info.Subtitles = append(info.Subtitles, subtitles...)
 		}
+
 		return
 	}

-	// Audio: run tag/album-art extraction when full metadata or preview (AlbumArt) is requested.
-	// Preview uses AlbumArt without Metadata so we do not load arbitrary files as text content.
 	if isAudio {
+		// Create an ExtendedItemInfo to hold the metadata
 		extItem := &iteminfo.ExtendedItemInfo{
 			ItemInfo: info.ItemInfo,
 		}
@@ -310,7 +241,9 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 		if err != nil {
 			logger.Debugf("failed to extract audio metadata for file: "+info.RealPath, info.Name, err)
 		} else {
+			// Copy metadata to ExtendedFileInfo
 			info.Metadata = extItem.Metadata
+			info.HasMetadata = true
 			info.HasPreview = extItem.Metadata != nil && len(extItem.Metadata.AlbumArt) > 0
 		}
 		return
@@ -439,11 +372,6 @@ func DeleteFiles(source, absPath string, isDir bool) error {
 	if index == nil {
 		return fmt.Errorf("could not get index: %v ", source)
 	}
-	// Safety guard: never allow deletion of the source root directory itself
-	cleanAbs := filepath.Clean(absPath)
-	if cleanAbs == filepath.Clean(index.Path) {
-		return fmt.Errorf("refusing to delete source root directory: %s", absPath)
-	}

 	if !index.Config.DisableIndexing {
 		indexPath := index.MakeIndexPath(absPath, isDir)
@@ -761,21 +689,22 @@ func WriteFile(source, path string, in io.Reader) error {
 	if err != nil {
 		return err
 	}
-	applyDefaultFilePerm := false
 	var stat os.FileInfo
-	stat, err = os.Stat(realPath)
-	if err != nil {
-		if !os.IsNotExist(err) {
-			return fmt.Errorf("stat file: %w", err)
+	// Check if the destination exists and is a directory
+	if stat, err = os.Stat(realPath); err == nil {
+		if stat.IsDir() {
+			// If it's a directory and we're trying to create a file, remove the directory first
+			err = os.RemoveAll(realPath)
+			if err != nil {
+				return fmt.Errorf("could not remove existing directory to create file: %v", err)
+			}
 		}
-		applyDefaultFilePerm = true
-	} else if stat.IsDir() {
-		return fmt.Errorf("%w: %q", errors.ErrIsDirectory, path)
+		// If file exists, its permissions will be preserved (O_TRUNC doesn't change permissions)
 	}

 	// Open the file for writing (create if it doesn't exist, truncate if it does)
-	// For new files: permissions are set to fileutils.PermFile (subject to umask, then Chmod bypasses umask)
-	// For existing regular files: do not Chmod so saves preserve mode and special bits
+	// For new files: permissions are set to fileutils.PermFile (subject to umask, which is usually acceptable)
+	// For existing files: permissions are preserved automatically (O_TRUNC doesn't change them)
 	file, err := os.OpenFile(realPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileutils.PermFile)
 	if err != nil {
 		return err
@@ -788,11 +717,11 @@ func WriteFile(source, path string, in io.Reader) error {
 		return err
 	}

-	if applyDefaultFilePerm {
-		err = os.Chmod(realPath, fileutils.PermFile)
-		if err != nil {
-			logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", realPath, err)
-		}
+	// Explicitly set file permissions to bypass umask
+	err = os.Chmod(realPath, fileutils.PermFile)
+	if err != nil {
+		// Handle chmod error gracefully
+		logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", realPath, err)
 	}

 	// Refresh the file itself
@@ -108,6 +108,7 @@ var types = map[string]string{
 	".chrt":      "application/vnd.kde.kchart",
 	".class":     "application/java",
 	".com":       ContentTextHeaderValue,
+	".conf":      ContentTextHeaderValue,
 	".cpio":      "application/x-cpio",
 	".cpp":       "text/x-c",
 	".cpt":       "application/mac-compactpro",
@@ -148,11 +149,7 @@ var types = map[string]string{
 	".es":        "application/x-esrehber",
 	".etx":       "text/x-setext",
 	".evy":       "application/envoy",
-	".exe":       "application/x-msdownload",
-	".dll":       "application/x-msdownload",
-	".bat":       "application/x-msdos-program",
-	".cmd":       "application/x-msdos-program",
-	".msi":       "application/x-msdownload",
+	".exe":       "application/octet-stream",
 	".f77":       "text/x-fortran",
 	".f90":       "text/x-fortran",
 	".f":         "text/x-fortran",
@@ -228,6 +225,7 @@ var types = map[string]string{
 	".js":        ContentJavascriptHeaderValue,
 	".mjs":       ContentJavascriptHeaderValue,
 	".json":      ContentJSONHeaderValue,
+	".vue":       ContentJavascriptHeaderValue,
 	".jut":       "image/jutvision",
 	".kar":       "audio/midi",
 	".karbon":    "application/vnd.kde.karbon",
@@ -245,8 +243,8 @@ var types = map[string]string{
 	".la":        "audio/nspaudio",
 	".lam":       "audio/x-liveaudio",
 	".latex":     "application/x-latex",
-	".lha":       "application/x-lzh-compressed",
-	".lhx":       "application/x-lzh-compressed",
+	".lha":       "application/lha",
+	".lhx":       "application/octet-stream",
 	".list":      ContentTextHeaderValue,
 	".lma":       "audio/nspaudio",
 	".log":       ContentTextHeaderValue,
@@ -259,6 +257,7 @@ var types = map[string]string{
 	".m1v":       "video/mpeg",
 	".m2a":       "audio/mpeg",
 	".m2v":       "video/mpeg",
+	".m3u":       "audio/x-mpegurl",
 	".m":         "text/x-m",
 	".man":       "application/x-troff-man",
 	".manifest":  "text/cache-manifest",
@@ -308,6 +307,7 @@ var types = map[string]string{
 	".ncm":       "application/vndnokiaconfiguration-message",
 	".nif":       "image/x-niff",
 	".niff":      "image/x-niff",
+	".nix":       "application/x-mix-transfer",
 	".nsc":       "application/x-conference",
 	".nvd":       "application/x-navidoc",
 	".o":         "application/octet-stream",
@@ -343,14 +343,15 @@ var types = map[string]string{
 	".p7m":       "application/pkcs7-mime",
 	".p7r":       "application/x-pkcs7-certreqresp",
 	".p7s":       "application/pkcs7-signature",
+	".p":         "text/x-pascal",
 	".part":      "application/pro_eng",
+	".pas":       "text/pascal",
 	".pbm":       "image/x-portable-bitmap",
 	".pcl":       "application/vndhp-pcl",
 	".pct":       "image/x-pict",
 	".pcx":       "image/x-pcx",
 	".pdb":       "chemical/x-pdb",
 	".pdf":       "application/pdf",
-	".pdfa":      "application/pdf",
 	".pfunk":     "audio/make",
 	".pgm":       "image/x-portable-graymap",
 	".pic":       "image/pict",
@@ -374,7 +375,7 @@ var types = map[string]string{
 	".pre":       "application/x-freelance",
 	".prt":       "application/pro_eng",
 	".ps":        "application/postscript",
-	".psd":       "image/vnd.adobe.photoshop",
+	".psd":       "application/octet-stream",
 	".pvu":       "paleovu/x-pv",
 	".pwz":       "application/vndms-powerpoint",
 	".py":        "text/x-scriptphyton",
@@ -442,11 +443,9 @@ var types = map[string]string{
 	".sprite":    "application/x-sprite",
 	".spx":       "audio/ogg",
 	".src":       "application/x-wais-source",
-	".srt":       "text/subtitle-srt",
-	".ass":       "text/subtitle-ass",
-	".vtt":       "text/subtitle-vtt",
-	".ssa":       "text/subtitle-ssa",
+	".srt":       "text/plain",
 	".sbv":       "text/plain",
+	".ssa":       "text/plain",
 	".ssi":       "text/x-server-parsed-html",
 	".ssm":       "application/streamingmedia",
 	".sst":       "application/vndms-pkicertstore",
@@ -598,105 +597,11 @@ var types = map[string]string{
 	".ogx":       "application/ogg",
 	".m4v":       "video/mp4",
 	".mkv":       "video/x-matroska",
-	".webm":      "video/webm",
-	".weba":      "audio/webm",
 	".caf":       "audio/x-caf",
-	".m3u":       "text/x-mpegurl", // .m3u and .m3u8 are playlist files - They contain paths, we set it as text to allow edition.
-	".m3u8":      "text/x-mpegURL",
-	".pls":       "text/x-scpls",
-	".xspf":      "application/xspf+xml",
+	".m3u8":      "application/x-mpegURL",
 	".mpd":       "application/dash+xml",
 	".webp":      "image/webp",
 	".epub":      "application/epub+zip",
-	".db":        "application/x-db",
-	".db2":       "application/x-db",
-	".db3":       "application/x-db",
-	".sql":       "application/sql",
-	".sqlite":    "application/vnd.sqlite3",
-	".sqlite3":   "application/vnd.sqlite3",
-	".yaml":      "application/yaml",
-	".app":       "application/x-application",
-	".geojson":   "application/geo+json",
-	".sketch":    "application/x-sketch",
-	".bak":       "application/backup",
-	".backup":    "application/backup",
-	".xfc":       "application/x-xcf",
-	".vue":       "text/vue",
-	".conf":      "text/config-file",
-	".ini":       "text/ini",
-	".ps1":       "application/x-powershell",
-	".ps2":       "application/x-powershell",
-	".ps3":       "application/x-powershell",
-	".dart":      "application/vnd.dart",
-	".flutter":   "text/flutter",
-	".tsx":       "text/x-typescript",
-	".ts":        "text/x-typescript",
-	".php":       "application/x-php",
-	".php2":      "application/x-php",
-	".php3":      "application/x-php",
-	".phtml":     "application/x-php",
-	".p":         "text/x-pascal",
-	".pas":       "text/x-pascal",
-	".zig":       "text/x-zig",
-	".ex":        "text/x-elixir",
-	".exs":       "text/x-elixir",
-	".json5":     "application/json5",
-	".pmx":       "model/x-pmx",
-	".nix":       "text/nix-lang",
-	".cjs":       "text/javascript",
-	".torrent":   "application/x-bittorrent",
-	".tmp":       "text/tmp",
-	".temp":      "text/tmp",
-	// the ones below are some from: https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types
-	".adp":       "audio/adpcm",
-	".mp4a":      "audio/mp4",
-	".mp2a":      "audio/mpeg",
-	".m3a":       "audio/mpeg",
-	".sil":       "audio/silk",
-	".uva":       "audio/vnd.dece.audio",
-	".uvva":      "audio/vnd.dece.audio",
-	".eol":       "audio/vnd.digital-winds",
-	".dra":       "audio/vnd.dra",
-	".dts":       "audio/vnd.dts",
-	".dtshd":     "audio/vnd.dts.hd",
-	".lvp":       "audio/vnd.lucent.voice",
-	".pya":       "audio/vnd.ms-playready.media.pya",
-	".rip":       "audio/vnd.rip",
-	".mka":       "audio/x-matroska",
-	".h261":      "video/h261",
-	".h263":      "video/h263",
-	".h264":      "video/h264",
-	".jpgv":      "video/jpeg",
-	".jpm":       "video/jpm",
-	".jpgm":      "video/jpm",
-	".mj2":       "video/mj2",
-	".mjp2":      "video/mj2",
-	".m2t":       "video/mp2t",
-	".m2ts":      "video/mp2t",
-	".mts":       "video/mp2t",
-	".mp4v":      "video/mp4",
-	".mpg4":      "video/mp4",
-	".uvh":       "video/vnd.dece.hd",
-	".uvvh":      "video/vnd.dece.hd",
-	".uvm":       "video/vnd.dece.mobile",
-	".uvvm":      "video/vnd.dece.mobile",
-	".uvp":       "video/vnd.dece.pd",
-	".uvvp":      "video/vnd.dece.pd",
-	".uvs":       "video/vnd.dece.sd",
-	".uvvs":      "video/vnd.dece.sd",
-	".uvv":       "video/vnd.dece.video",
-	".uvvv":      "video/vnd.dece.video",
-	".dvb":       "video/vnd.dvb.file",
-	".fvt":       "video/vnd.fvt",
-	".mxu":       "video/vnd.mpegurl",
-	".pyv":       "video/vnd.ms-playready.media.pyv",
-	".uvu":       "video/vnd.uvvu.mp4",
-	".uvvu":      "video/vnd.uvvu.mp4",
-	".f4v":       "video/x-f4v",
-	".mk3d":      "video/x-matroska",
-	".mks":       "video/x-matroska",
-	".vob":       "video/x-ms-vob",
-	".smv":       "video/x-smv",
 }

 //nolint:gochecknoinits
@@ -19,7 +19,7 @@ func MakeUserDir(fullPath string) error {
 	return nil
 }

-func MakeUserDirs(u *users.User, createDir bool) error {
+func MakeUserDirs(u *users.User, disableScopeChange bool) error {
 	cleanedUserName := users.CleanUsername(u.Username)
 	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
 		return fmt.Errorf("MakeUserDirs: invalid user for home dir creation: [%s]", u.Username)
@@ -27,31 +27,48 @@ func MakeUserDirs(u *users.User, createDir bool) error {
 	for i, scope := range u.Scopes {
 		source, ok := settings.Config.Server.SourceMap[scope.Name]
 		if !ok {
-			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
+			logger.Errorf("MakeUserDirs: source not found: %s", scope.Name)
+			continue
 		}
-		fullPath := filepath.Join(source.Path, scope.Scope)
-		parentDir := filepath.Dir(fullPath)
-		if createDir {
-			if source.Config.CreateUserDir && filepath.Base(scope.Scope) != cleanedUserName {
-				scope.Scope = utils.JoinPathAsUnix(scope.Scope, cleanedUserName)
-				fullPath = filepath.Join(fullPath, cleanedUserName)
-			}
+		// create directory and append user name
+		if filepath.Base(scope.Scope) != cleanedUserName && source.Config.CreateUserDir && !disableScopeChange {
+			fullPath := filepath.Join(source.Path, scope.Scope, cleanedUserName)
+			parentDir := filepath.Join(source.Path, scope.Scope)
+			// If parent directory doesn't exist and createUserDir is enabled, create it
 			if !Exists(parentDir) {
 				if err := MakeUserDir(parentDir); err != nil {
 					logger.Errorf("MakeUserDirs: failed to create parent scope directory: %s - %v", scope.Scope, err)
 					continue
 				}
 			}
+			// Use JoinPathAsUnix to ensure scope remains in Unix format (forward slashes)
+			scope.Scope = utils.JoinPathAsUnix(scope.Scope, cleanedUserName)
 			err := MakeUserDir(fullPath)
 			if err != nil {
-				return fmt.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
+				logger.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
+				// Continue to next scope even if this one failed
+			}
+		} else if filepath.Base(scope.Scope) == cleanedUserName && source.Config.CreateUserDir {
+			// create directory exactly as specified
+			fullPath := filepath.Join(source.Path, scope.Scope)
+			parentDir := filepath.Dir(fullPath)
+			if !Exists(parentDir) {
+				logger.Errorf("MakeUserDirs: scope folder does not exist: %s", parentDir)
+				continue
+			}
+			err := MakeUserDir(fullPath)
+			if err != nil {
+				logger.Errorf("create user: failed to create user home dir: %s", err)
+				// Continue to next scope even if this one failed
 			}
 		} else {
-			if !Exists(fullPath) {
-				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", fullPath)
+			// just assigning scope to path provided, so just check that it exists
+			path := filepath.Join(source.Path, scope.Scope)
+			if !Exists(path) {
+				logger.Errorf("MakeUserDirs: scope folder does not exist: %s", path)
+				continue
 			}
 		}
-
 		u.Scopes[i] = scope
 	}
 	return nil
@@ -12,45 +12,9 @@ import (
 var PermFile os.FileMode
 var PermDir os.FileMode

-// SetFsPermissions sets create modes from Unix chmod(2)-style values (for example
-// values produced by strconv.ParseUint(s, 8, 32)). setuid, setgid, and sticky
-// bits must be converted for Go's os.FileMode; a plain cast from Unix octal is
-// incorrect for those bits.
-func SetFsPermissions(unixFileMode, unixDirMode uint32) {
-	PermFile = unixModeToFileMode(unixFileMode)
-	PermDir = unixModeToFileMode(unixDirMode)
-}
-
-// EffectiveDirPerm returns [PermDir] if [SetFsPermissions] was called, otherwise 0o755. On Unix,
-// [os.Mkdir] with perm 0 fails with permission denied, so use this (or [PermFile]) for creates when
-// the process has not set globals yet.
-func EffectiveDirPerm() os.FileMode {
-	if PermDir == 0 {
-		return 0o755
-	}
-	return PermDir
-}
-
-// EffectiveFilePerm returns [PermFile] if set, otherwise 0o644.
-func EffectiveFilePerm() os.FileMode {
-	if PermFile == 0 {
-		return 0o644
-	}
-	return PermFile
-}
-
-func unixModeToFileMode(u uint32) os.FileMode {
-	m := os.FileMode(u & 0777)
-	if u&0o4000 != 0 {
-		m |= os.ModeSetuid
-	}
-	if u&0o2000 != 0 {
-		m |= os.ModeSetgid
-	}
-	if u&0o1000 != 0 {
-		m |= os.ModeSticky
-	}
-	return m
+func SetFsPermissions(PermFileOctal os.FileMode, PermDirOctal os.FileMode) {
+	PermFile = PermFileOctal
+	PermDir = PermDirOctal
 }

 // MoveFile moves a file from src to dst.
@@ -1,22 +1,6 @@
 package fileutils

-import (
-	"os"
-	"testing"
-)
-
-func TestUnixModeToFileMode_setgid(t *testing.T) {
-	m := unixModeToFileMode(0o2770)
-	if got := m.Perm(); got != 0o770 {
-		t.Fatalf("Perm() = %#o, want 0770", got)
-	}
-	if m&os.ModeSetgid == 0 {
-		t.Fatal("expected ModeSetgid")
-	}
-	if m&os.ModeSetuid != 0 || m&os.ModeSticky != 0 {
-		t.Fatalf("unexpected special bits: %#o", m)
-	}
-}
+import "testing"

 func TestCommonPrefix(t *testing.T) {
 	testCases := map[string]struct {
@@ -29,16 +29,3 @@ func GetFreeSpace(path string) (uint64, error) {
 	free := uint64(stat.Bavail) * uint64(stat.Bsize)
 	return free, nil
 }
-
-// GetPartitionUsed returns the used space for Unix systems (total - free)
-func GetPartitionUsed(path string) (uint64, error) {
-	var stat syscall.Statfs_t
-	err := syscall.Statfs(path, &stat)
-	if err != nil {
-		return 0, err
-	}
-	total := uint64(stat.Blocks) * uint64(stat.Bsize)
-	free := uint64(stat.Bavail) * uint64(stat.Bsize)
-	used := total - free
-	return used, nil
-}
@@ -33,18 +33,3 @@ func GetFreeSpace(path string) (uint64, error) {
 	}
 	return freeBytes, nil
 }
-
-// GetPartitionUsed returns the used space for Windows systems (total - free)
-func GetPartitionUsed(path string) (uint64, error) {
-	pathPtr, err := windows.UTF16PtrFromString(path)
-	if err != nil {
-		return 0, err
-	}
-	var freeBytes, totalBytes, totalFreeBytes uint64
-	err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytes, &totalBytes, &totalFreeBytes)
-	if err != nil {
-		return 0, err
-	}
-	used := totalBytes - freeBytes
-	return used, nil
-}
@@ -1,65 +1,34 @@
 package auth

 import (
-	"fmt"
 	"net/http"
-	"time"
+	"sync"

-	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

+var (
+	revokedApiKeyList map[string]struct{}
+	revokeMu          sync.Mutex
+)
+
+func init() {
+	revokedApiKeyList = make(map[string]struct{})
+}
+
 // Auther is the authentication interface.
 type Auther interface {
 	// Auth is called to authenticate a request.
 	Auth(r *http.Request, userStore *users.Storage) (*users.User, error)
 }

-const FB_ISSUER = "FileBrowser Quantum" // don't change
-
-// IsRevokedApiToken checks if a token is in the revoked list.
-func IsRevokedApiToken(accessStore *access.Storage, token string) bool {
-	if accessStore == nil {
-		return false
-	}
-	return accessStore.IsTokenRevoked(token)
+func IsRevokedApiKey(key string) bool {
+	_, exists := revokedApiKeyList[key]
+	return exists
 }

-// RevokeApiToken adds a token to the revoked list.
-func RevokeApiToken(accessStore *access.Storage, token string) error {
-	if accessStore == nil {
-		return fmt.Errorf("access storage not available")
-	}
-	return accessStore.RevokeToken(token)
-}
-
-func MakeSignedTokenAPI(user *users.User, name string, duration time.Duration, perms users.Permissions, minimal bool) (string, users.AuthToken, error) {
-	if _, ok := user.Tokens[name]; ok {
-		return "", users.AuthToken{}, fmt.Errorf("key already exists with same name %v ", name)
-	}
-	now := time.Now()
-	expires := now.Add(duration)
-	// Create minimal token with only JWT standard claims
-	claim := users.AuthToken{
-		MinimalAuthToken: users.MinimalAuthToken{
-			RegisteredClaims: jwt.RegisteredClaims{
-				IssuedAt:  jwt.NewNumericDate(now),
-				ExpiresAt: jwt.NewNumericDate(expires),
-				Issuer:    FB_ISSUER,
-			},
-		},
-	}
-	if !minimal {
-		claim.Permissions = perms
-		claim.BelongsTo = user.ID
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claim)
-	tokenString, err := token.SignedString([]byte(settings.Config.Auth.Key))
-	if err != nil {
-		return "", users.AuthToken{}, err
-	}
-	return tokenString, claim, nil
-
+func RevokeAPIKey(key string) {
+	revokeMu.Lock()
+	defer revokeMu.Unlock()
+	revokedApiKeyList[key] = struct{}{}
 }
@@ -9,14 +9,12 @@ import (
 	"strings"

 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

 // JSONAuth is a json implementation of an Auther.
 type JSONAuth struct {
-	ReCaptcha  *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
-	DisableOtp bool       `json:"disableOtp" yaml:"disableOtp"`
+	ReCaptcha *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
 }

 // Auth authenticates the user via a json in content body.
@@ -24,12 +22,12 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 	username := r.URL.Query().Get("username")
 	recaptcha := r.URL.Query().Get("recaptcha")
 	password := r.Header.Get("X-Password")
-	totpCode := r.Header.Get("X-Secret")
 	// URL-decode password to support special characters in headers
 	password, err := url.QueryUnescape(password)
 	if err != nil {
 		return nil, fmt.Errorf("invalid password encoding: %v", err)
 	}
+	totpCode := r.Header.Get("X-Secret")

 	// If ReCaptcha is enabled, check the code.
 	if auther.ReCaptcha != nil && len(auther.ReCaptcha.Secret) > 0 {
@@ -44,22 +42,17 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 		}
 	}

-	user, getErr := userStore.Get(username)
-	var passwordHash string
-	if getErr != nil {
-		passwordHash = utils.InvalidPasswordHash
-	} else {
-		passwordHash = user.Password
+	user, err := userStore.Get(username)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get user from store: %v", err)
 	}
-	// always run checkPwd to prevent timing attacks
-	err = utils.CheckPwd(password, passwordHash)
+	err = users.CheckPwd(password, user.Password)
 	if err != nil {
 		return nil, err
 	}
-	if getErr != nil {
-		return nil, fmt.Errorf("unable to get user from store: %v", err)
-	}
-	if user.TOTPSecret != "" && !auther.DisableOtp {
+
+	// check for OTP for password
+	if user.TOTPSecret != "" {
 		if totpCode == "" {
 			return nil, errors.ErrNoTotpProvided
 		}
@@ -1,375 +0,0 @@
-// Package auth_test contains timing attack tests for authentication.
-//
-// These tests verify that the JSON authentication implementation is protected
-// against timing attacks that could leak information about valid usernames.
-//
-// Timing Attack Background:
-// A timing attack is a side-channel attack where an attacker measures how long
-// authentication operations take to determine if a username exists in the system.
-// If authentication fails faster for non-existent users than for valid users
-// with wrong passwords, an attacker can enumerate valid usernames.
-//
-// Protection Mechanism:
-// The json.go Auth() implementation protects against timing attacks by:
-// 1. Always running the bcrypt password comparison, even for non-existent users
-// 2. Using utils.InvalidPasswordHash (a pre-computed bcrypt hash) when the user doesn't exist
-// 3. Ensuring both valid and invalid user authentication paths take similar time
-//
-// Test Coverage:
-// - TestJSONAuth_NoTimingAttack: Statistical analysis of timing differences
-// - TestJSONAuth_InvalidPasswordHashInitialized: Verifies protection is in place
-// - TestJSONAuth_ValidUserVsInvalidUserDirectComparison: Direct comparison test
-package auth_test
-
-import (
-	"fmt"
-	"math"
-	"net/http"
-	"net/url"
-	"testing"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-// mockUserBackend is a simple in-memory user storage for testing.
-type mockUserBackend struct {
-	usersByUsername map[string]*users.User
-	usersByID       map[uint]*users.User
-}
-
-func newMockUserBackend() *mockUserBackend {
-	return &mockUserBackend{
-		usersByUsername: make(map[string]*users.User),
-		usersByID:       make(map[uint]*users.User),
-	}
-}
-
-func (m *mockUserBackend) GetBy(id interface{}) (*users.User, error) {
-	switch v := id.(type) {
-	case string:
-		if user, ok := m.usersByUsername[v]; ok {
-			return user, nil
-		}
-		return nil, fmt.Errorf("user not found: %s", v)
-	case uint:
-		if user, ok := m.usersByID[v]; ok {
-			return user, nil
-		}
-		return nil, fmt.Errorf("user not found: %d", v)
-	default:
-		return nil, fmt.Errorf("invalid id type")
-	}
-}
-
-func (m *mockUserBackend) Gets() ([]*users.User, error) {
-	result := make([]*users.User, 0, len(m.usersByID))
-	for _, user := range m.usersByID {
-		result = append(result, user)
-	}
-	return result, nil
-}
-
-func (m *mockUserBackend) Save(u *users.User, changePass bool, disableScopeChange bool) error {
-	m.usersByUsername[u.Username] = u
-	m.usersByID[u.ID] = u
-	return nil
-}
-
-func (m *mockUserBackend) Update(u *users.User, adminActor bool, fields ...string) error {
-	m.usersByUsername[u.Username] = u
-	m.usersByID[u.ID] = u
-	return nil
-}
-
-func (m *mockUserBackend) DeleteByID(id uint) error {
-	if user, ok := m.usersByID[id]; ok {
-		delete(m.usersByUsername, user.Username)
-		delete(m.usersByID, id)
-		return nil
-	}
-	return fmt.Errorf("user not found: %d", id)
-}
-
-func (m *mockUserBackend) DeleteByUsername(username string) error {
-	if user, ok := m.usersByUsername[username]; ok {
-		delete(m.usersByID, user.ID)
-		delete(m.usersByUsername, username)
-		return nil
-	}
-	return fmt.Errorf("user not found: %s", username)
-}
-
-// setupTestUsers creates a user storage with 2 valid test users
-func setupTestUsers(t *testing.T) *users.Storage {
-	t.Helper()
-
-	// Reduce bcrypt cost for faster tests (default is 10, min is 4)
-	// This significantly speeds up password hashing during tests
-	originalCost := utils.BcryptCost
-	utils.BcryptCost = 4 // Minimum bcrypt cost for testing
-	t.Cleanup(func() {
-		utils.BcryptCost = originalCost // Restore original cost after test
-	})
-
-	// Initialize InvalidPasswordHash to prevent timing attacks
-	// This simulates the application startup initialization
-	err := utils.SetInvalidPasswordHash()
-	if err != nil {
-		t.Fatalf("Failed to set invalid password hash: %v", err)
-	}
-
-	backend := newMockUserBackend()
-	storage := users.NewStorage(backend)
-
-	// Create two valid users with hashed passwords
-	password1Hash, err := utils.HashPwd("password123")
-	if err != nil {
-		t.Fatalf("Failed to hash password: %v", err)
-	}
-
-	password2Hash, err := utils.HashPwd("securepass456")
-	if err != nil {
-		t.Fatalf("Failed to hash password: %v", err)
-	}
-
-	user1 := &users.User{
-		ID:       1,
-		Username: "admin",
-		NonAdminEditable: users.NonAdminEditable{
-			Password: password1Hash,
-		},
-		LoginMethod: users.LoginMethodPassword,
-	}
-
-	user2 := &users.User{
-		ID:       2,
-		Username: "testuser",
-		NonAdminEditable: users.NonAdminEditable{
-			Password: password2Hash,
-		},
-		LoginMethod: users.LoginMethodPassword,
-	}
-
-	err = storage.Save(user1, false, false)
-	if err != nil {
-		t.Fatalf("Failed to save user1: %v", err)
-	}
-
-	err = storage.Save(user2, false, false)
-	if err != nil {
-		t.Fatalf("Failed to save user2: %v", err)
-	}
-
-	return storage
-}
-
-// measureAuthTime measures the time taken to authenticate with given credentials
-func measureAuthTime(t *testing.T, auther auth.JSONAuth, userStore *users.Storage, username, password string) time.Duration {
-	t.Helper()
-
-	// Create a mock HTTP request
-	req, err := http.NewRequest("POST", "/api/auth/login?username="+url.QueryEscape(username), nil)
-	if err != nil {
-		t.Fatalf("Failed to create request: %v", err)
-	}
-	req.Header.Set("X-Password", url.QueryEscape(password))
-
-	start := time.Now()
-	_, _ = auther.Auth(req, userStore)
-	elapsed := time.Since(start)
-
-	return elapsed
-}
-
-// TestJSONAuth_NoTimingAttack tests that authentication timing does not leak user existence
-func TestJSONAuth_NoTimingAttack(t *testing.T) {
-	storage := setupTestUsers(t)
-	auther := auth.JSONAuth{}
-
-	// Test cases: mix of valid and invalid usernames
-	testCases := []struct {
-		username string
-		isValid  bool
-	}{
-		{"admin", true},
-		{"testuser", true},
-		{"nonexistent1", false},
-		{"invaliduser", false},
-		{"notauser", false},
-		{"fakeadmin", false},
-	}
-
-	// Number of samples per test case for statistical analysis
-	samplesPerCase := 5
-
-	// Collect timing measurements
-	measurements := make(map[string][]time.Duration)
-	for _, tc := range testCases {
-		measurements[tc.username] = make([]time.Duration, 0, samplesPerCase)
-	}
-
-	// Run multiple iterations to gather statistical data
-	for i := 0; i < samplesPerCase; i++ {
-		// Randomize order to avoid cache effects
-		for _, tc := range testCases {
-			elapsed := measureAuthTime(t, auther, storage, tc.username, "wrongpassword123")
-			measurements[tc.username] = append(measurements[tc.username], elapsed)
-		}
-	}
-
-	// Calculate statistics for each test case
-	type stats struct {
-		mean   time.Duration
-		stddev time.Duration
-		min    time.Duration
-		max    time.Duration
-	}
-
-	calculateStats := func(durations []time.Duration) stats {
-		if len(durations) == 0 {
-			return stats{}
-		}
-
-		// Calculate mean
-		var sum time.Duration
-		for _, d := range durations {
-			sum += d
-		}
-		mean := sum / time.Duration(len(durations))
-
-		// Calculate standard deviation
-		var variance float64
-		for _, d := range durations {
-			diff := float64(d - mean)
-			variance += diff * diff
-		}
-		variance /= float64(len(durations))
-		stddev := time.Duration(math.Sqrt(variance))
-
-		// Find min and max
-		min := durations[0]
-		max := durations[0]
-		for _, d := range durations {
-			if d < min {
-				min = d
-			}
-			if d > max {
-				max = d
-			}
-		}
-
-		return stats{mean: mean, stddev: stddev, min: min, max: max}
-	}
-
-	// Analyze results
-	validUserStats := make([]stats, 0)
-	invalidUserStats := make([]stats, 0)
-
-	t.Log("\n=== Timing Analysis Results ===")
-	for _, tc := range testCases {
-		s := calculateStats(measurements[tc.username])
-		t.Logf("%s (valid=%v): mean=%.4fms, stddev=%.4fms, min=%.4fms, max=%.4fms",
-			tc.username, tc.isValid,
-			float64(s.mean.Microseconds())/1000.0,
-			float64(s.stddev.Microseconds())/1000.0,
-			float64(s.min.Microseconds())/1000.0,
-			float64(s.max.Microseconds())/1000.0)
-
-		if tc.isValid {
-			validUserStats = append(validUserStats, s)
-		} else {
-			invalidUserStats = append(invalidUserStats, s)
-		}
-	}
-
-	// Calculate overall statistics for valid vs invalid users
-	var validMeanSum, invalidMeanSum time.Duration
-	for _, s := range validUserStats {
-		validMeanSum += s.mean
-	}
-	for _, s := range invalidUserStats {
-		invalidMeanSum += s.mean
-	}
-
-	validAvgMean := validMeanSum / time.Duration(len(validUserStats))
-	invalidAvgMean := invalidMeanSum / time.Duration(len(invalidUserStats))
-
-	t.Logf("\n=== Summary ===")
-	t.Logf("Valid users average: %.4fms", float64(validAvgMean.Microseconds())/1000.0)
-	t.Logf("Invalid users average: %.4fms", float64(invalidAvgMean.Microseconds())/1000.0)
-
-	// Calculate the percentage difference
-	diff := float64(validAvgMean - invalidAvgMean)
-	percentDiff := math.Abs(diff) / float64(validAvgMean) * 100.0
-	t.Logf("Difference: %.4fms (%.2f%%)", diff/1e6, percentDiff)
-
-	// Assert: The timing difference should be less than 20%
-	// Bcrypt's constant-time comparison should make both cases take similar time
-	// We allow 20% threshold to account for system noise and variability
-	threshold := 20.0 // percent
-	if percentDiff > threshold {
-		t.Errorf("TIMING ATTACK VULNERABILITY DETECTED: Valid vs invalid user timing differs by %.2f%% (threshold: %.2f%%)",
-			percentDiff, threshold)
-		t.Errorf("This difference could allow an attacker to enumerate valid usernames!")
-	} else {
-		t.Logf("✓ No timing attack vulnerability detected (difference: %.2f%% < threshold: %.2f%%)",
-			percentDiff, threshold)
-	}
-
-	// Additional check: Ensure no individual case is an obvious outlier
-	// Check if any single user's timing is significantly faster than bcrypt operations
-	allStats := append(validUserStats, invalidUserStats...)
-	var allMeansSum time.Duration
-	for _, s := range allStats {
-		allMeansSum += s.mean
-	}
-	overallMean := allMeansSum / time.Duration(len(allStats))
-
-	for _, tc := range testCases {
-		s := calculateStats(measurements[tc.username])
-		deviation := math.Abs(float64(s.mean-overallMean)) / float64(overallMean) * 100.0
-
-		// If any user is more than 30% faster/slower than average, it's suspicious
-		if deviation > 30.0 {
-			t.Errorf("OUTLIER DETECTED: %s deviates by %.2f%% from overall mean (%.4fms vs %.4fms)",
-				tc.username, deviation,
-				float64(s.mean.Microseconds())/1000.0,
-				float64(overallMean.Microseconds())/1000.0)
-		}
-	}
-}
-
-// TestJSONAuth_InvalidPasswordHashInitialized verifies that InvalidPasswordHash is properly set
-func TestJSONAuth_InvalidPasswordHashInitialized(t *testing.T) {
-	// This test ensures that the InvalidPasswordHash is initialized
-	// If it's empty, timing attacks would be possible because invalid users
-	// would skip bcrypt comparison entirely
-
-	// Use lower bcrypt cost for faster testing
-	originalCost := utils.BcryptCost
-	utils.BcryptCost = 4
-	t.Cleanup(func() {
-		utils.BcryptCost = originalCost
-	})
-
-	err := utils.SetInvalidPasswordHash()
-	if err != nil {
-		t.Fatalf("Failed to set invalid password hash: %v", err)
-	}
-
-	if utils.InvalidPasswordHash == "" {
-		t.Fatal("InvalidPasswordHash is not initialized - timing attack vulnerability exists!")
-	}
-
-	// Verify that the invalid hash can be used for password comparison
-	// This should fail (wrong password) but take the same time as a real bcrypt comparison
-	err = utils.CheckPwd("anypassword", utils.InvalidPasswordHash)
-	if err == nil {
-		t.Fatal("CheckPwd should fail with InvalidPasswordHash")
-	}
-
-	t.Log("✓ InvalidPasswordHash is properly initialized")
-}
@@ -1,229 +0,0 @@
-package auth
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"net/http"
-
-	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// MethodJwtAuth is used to identify JWT external authentication.
-const MethodJwtAuth = "jwt"
-
-// JwtAuth is an external JWT implementation of an auther.
-// It verifies JWT tokens signed with a shared secret and extracts user identity.
-type JwtAuth struct {
-	Secret    string `json:"secret"`    // shared secret for verifying JWT signatures
-	Algorithm string `json:"algorithm"` // JWT signing algorithm (HS256, HS384, HS512, RS256, ES256, etc.)
-}
-
-// ExternalJwtClaims represents the expected claims in an external JWT token
-type ExternalJwtClaims struct {
-	jwt.RegisteredClaims
-	Username string                 `json:"sub"`                    // subject claim (username)
-	Email    string                 `json:"email,omitempty"`        // email claim
-	Name     string                 `json:"name,omitempty"`         // full name claim
-	Groups   []string               `json:"groups,omitempty"`       // groups claim
-	Custom   map[string]interface{} `json:"-"`                      // catch-all for custom claims
-}
-
-// Auth authenticates the user via an external JWT token.
-// The token is verified using the configured secret and algorithm.
-func (a JwtAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
-	// This should not be called directly - JWT auth is handled in middleware
-	// because we need access to the full config (header name, user identifier field, etc.)
-	return nil, fmt.Errorf("JWT auth must be handled in middleware")
-}
-
-// VerifyExternalJWT verifies an external JWT token and extracts the username claim
-func VerifyExternalJWT(tokenString string, secret string, algorithm string, userIdentifierField string) (string, map[string]interface{}, error) {
-	// Parse the token with the secret
-	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
-		// Verify the signing method matches what we expect
-		expectedMethod := jwt.GetSigningMethod(algorithm)
-		if expectedMethod == nil {
-			return nil, fmt.Errorf("unsupported signing algorithm: %s", algorithm)
-		}
-
-		if token.Method.Alg() != expectedMethod.Alg() {
-			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
-		}
-
-		return jwtVerificationKey(secret, token.Method, algorithm)
-	})
-
-	if err != nil {
-		logger.Debugf("JWT token verification failed: %v", err)
-		return "", nil, fmt.Errorf("invalid JWT token: %w", err)
-	}
-
-	if !token.Valid {
-		return "", nil, fmt.Errorf("JWT token is invalid")
-	}
-
-	// Extract claims
-	claims, ok := token.Claims.(jwt.MapClaims)
-	if !ok {
-		return "", nil, fmt.Errorf("failed to parse JWT claims")
-	}
-
-	// Check if token is expired
-	if err := claims.Valid(); err != nil {
-		logger.Debugf("JWT claims validation failed: %v", err)
-		return "", nil, fmt.Errorf("JWT token is expired or invalid: %w", err)
-	}
-
-	// Extract username from the configured field (default: "sub")
-	var username string
-	if userVal, ok := claims[userIdentifierField]; ok {
-		if userStr, ok := userVal.(string); ok {
-			username = userStr
-		}
-	}
-
-	if username == "" {
-		return "", nil, fmt.Errorf("JWT token missing required claim: %s", userIdentifierField)
-	}
-
-	// Convert claims to map for additional processing
-	claimsMap := make(map[string]interface{})
-	for k, v := range claims {
-		claimsMap[k] = v
-	}
-
-	logger.Debugf("Successfully verified JWT token for user: %s", username)
-	return username, claimsMap, nil
-}
-
-func jwtVerificationKey(secret string, method jwt.SigningMethod, algorithm string) (interface{}, error) {
-	switch method.(type) {
-	case *jwt.SigningMethodHMAC:
-		return []byte(secret), nil
-	case *jwt.SigningMethodRSA:
-		key, err := parsePublicKeyFromPEM(secret)
-		if err != nil {
-			return nil, err
-		}
-		rsaKey, ok := key.(*rsa.PublicKey)
-		if !ok {
-			return nil, fmt.Errorf("JWT secret must contain an RSA public key in PEM format for algorithm %s", algorithm)
-		}
-		return rsaKey, nil
-	case *jwt.SigningMethodECDSA:
-		key, err := parsePublicKeyFromPEM(secret)
-		if err != nil {
-			return nil, err
-		}
-		ecKey, ok := key.(*ecdsa.PublicKey)
-		if !ok {
-			return nil, fmt.Errorf("JWT secret must contain an ECDSA public key in PEM format for algorithm %s", algorithm)
-		}
-		if err := ecdsaCurveMatchesAlgorithm(algorithm, ecKey); err != nil {
-			return nil, err
-		}
-		return ecKey, nil
-	default:
-		return nil, fmt.Errorf("unsupported JWT signing method: %s", method.Alg())
-	}
-}
-
-func ecdsaCurveMatchesAlgorithm(algorithm string, pub *ecdsa.PublicKey) error {
-	var want elliptic.Curve
-	switch algorithm {
-	case "ES256":
-		want = elliptic.P256()
-	case "ES384":
-		want = elliptic.P384()
-	case "ES512":
-		want = elliptic.P521()
-	default:
-		return nil
-	}
-	if pub.Curve != want {
-		return fmt.Errorf("ECDSA public key curve does not match algorithm %s", algorithm)
-	}
-	return nil
-}
-
-func parsePublicKeyFromPEM(pemData string) (interface{}, error) {
-	rest := []byte(pemData)
-	var lastErr error
-	for len(rest) > 0 {
-		block, rem := pem.Decode(rest)
-		if block == nil {
-			break
-		}
-		rest = rem
-
-		var key interface{}
-		var err error
-		switch block.Type {
-		case "CERTIFICATE":
-			var cert *x509.Certificate
-			cert, err = x509.ParseCertificate(block.Bytes)
-			if err == nil {
-				key = cert.PublicKey
-			}
-		case "PUBLIC KEY":
-			key, err = x509.ParsePKIXPublicKey(block.Bytes)
-		case "RSA PUBLIC KEY":
-			key, err = x509.ParsePKCS1PublicKey(block.Bytes)
-		case "EC PUBLIC KEY":
-			key, err = x509.ParsePKIXPublicKey(block.Bytes)
-		default:
-			continue
-		}
-		if err != nil {
-			lastErr = err
-			continue
-		}
-		if key != nil {
-			return key, nil
-		}
-	}
-	if lastErr != nil {
-		return nil, fmt.Errorf("failed to parse JWT public key from PEM: %w", lastErr)
-	}
-	return nil, fmt.Errorf("no public key found in JWT secret (expected PEM: CERTIFICATE, PUBLIC KEY, RSA PUBLIC KEY, or EC PUBLIC KEY)")
-}
-
-// ExtractGroupsFromClaims extracts groups from JWT claims based on the configured groups claim field
-func ExtractGroupsFromClaims(claims map[string]interface{}, groupsClaimField string) []string {
-	var groups []string
-
-	if groupsVal, ok := claims[groupsClaimField]; ok {
-		switch v := groupsVal.(type) {
-		case []interface{}:
-			// Groups as array of interfaces
-			for _, g := range v {
-				if groupStr, ok := g.(string); ok {
-					groups = append(groups, groupStr)
-				}
-			}
-		case []string:
-			// Groups as array of strings
-			groups = v
-		case string:
-			// Single group as string
-			groups = []string{v}
-		default:
-			// Try to unmarshal as JSON array
-			if jsonBytes, err := json.Marshal(v); err == nil {
-				var groupsArray []string
-				if err := json.Unmarshal(jsonBytes, &groupsArray); err == nil {
-					groups = groupsArray
-				}
-			}
-		}
-	}
-
-	return groups
-}
@@ -1,363 +0,0 @@
-package auth_test
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"math/big"
-	"testing"
-	"time"
-
-	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
-)
-
-func TestVerifyExternalJWT_ValidToken(t *testing.T) {
-	secret := "test-secret-key"
-	algorithm := "HS256"
-	username := "testuser"
-
-	// Create a valid JWT token
-	claims := jwt.MapClaims{
-		"sub":   username,
-		"email": "test@example.com",
-		"exp":   time.Now().Add(time.Hour).Unix(),
-		"iat":   time.Now().Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Verify the token
-	extractedUsername, extractedClaims, err := auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT() failed: %v", err)
-	}
-
-	if extractedUsername != username {
-		t.Errorf("Expected username %s, got %s", username, extractedUsername)
-	}
-
-	if extractedClaims["email"] != "test@example.com" {
-		t.Errorf("Expected email test@example.com, got %v", extractedClaims["email"])
-	}
-}
-
-func TestVerifyExternalJWT_ExpiredToken(t *testing.T) {
-	secret := "test-secret-key"
-	algorithm := "HS256"
-
-	// Create an expired JWT token
-	claims := jwt.MapClaims{
-		"sub": "testuser",
-		"exp": time.Now().Add(-time.Hour).Unix(), // Expired 1 hour ago
-		"iat": time.Now().Add(-2 * time.Hour).Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Verify the token - should fail
-	_, _, err = auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
-	if err == nil {
-		t.Fatal("VerifyExternalJWT() should fail for expired token")
-	}
-}
-
-func TestVerifyExternalJWT_InvalidSignature(t *testing.T) {
-	secret := "test-secret-key"
-	wrongSecret := "wrong-secret-key"
-	algorithm := "HS256"
-
-	// Create a token with one secret
-	claims := jwt.MapClaims{
-		"sub": "testuser",
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Try to verify with a different secret - should fail
-	_, _, err = auth.VerifyExternalJWT(tokenString, wrongSecret, algorithm, "sub")
-	if err == nil {
-		t.Fatal("VerifyExternalJWT() should fail for invalid signature")
-	}
-}
-
-func TestVerifyExternalJWT_MissingUsernameClaim(t *testing.T) {
-	secret := "test-secret-key"
-	algorithm := "HS256"
-
-	// Create a token without the 'sub' claim
-	claims := jwt.MapClaims{
-		"email": "test@example.com",
-		"exp":   time.Now().Add(time.Hour).Unix(),
-		"iat":   time.Now().Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Verify the token - should fail due to missing 'sub' claim
-	_, _, err = auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
-	if err == nil {
-		t.Fatal("VerifyExternalJWT() should fail for missing username claim")
-	}
-}
-
-func TestVerifyExternalJWT_CustomUserIdentifier(t *testing.T) {
-	secret := "test-secret-key"
-	algorithm := "HS256"
-	username := "testuser"
-
-	// Create a token with custom username field
-	claims := jwt.MapClaims{
-		"username": username,
-		"exp":      time.Now().Add(time.Hour).Unix(),
-		"iat":      time.Now().Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Verify the token with custom user identifier field
-	extractedUsername, _, err := auth.VerifyExternalJWT(tokenString, secret, algorithm, "username")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT() failed: %v", err)
-	}
-
-	if extractedUsername != username {
-		t.Errorf("Expected username %s, got %s", username, extractedUsername)
-	}
-}
-
-func TestVerifyExternalJWT_ES256_PublicKeyPEM(t *testing.T) {
-	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	pubDER, err := x509.MarshalPKIXPublicKey(&priv.PublicKey)
-	if err != nil {
-		t.Fatalf("MarshalPKIXPublicKey: %v", err)
-	}
-	pubPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubDER}))
-
-	username := "ec-user"
-	claims := jwt.MapClaims{
-		"sub": username,
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
-	tokenString, err := token.SignedString(priv)
-	if err != nil {
-		t.Fatalf("SignedString: %v", err)
-	}
-
-	got, _, err := auth.VerifyExternalJWT(tokenString, pubPEM, "ES256", "sub")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT: %v", err)
-	}
-	if got != username {
-		t.Errorf("username: got %q want %q", got, username)
-	}
-}
-
-func TestVerifyExternalJWT_RS256_PublicKeyPEM(t *testing.T) {
-	priv, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	pubDER, err := x509.MarshalPKIXPublicKey(&priv.PublicKey)
-	if err != nil {
-		t.Fatalf("MarshalPKIXPublicKey: %v", err)
-	}
-	pubPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubDER}))
-
-	username := "rsa-user"
-	claims := jwt.MapClaims{
-		"sub": username,
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
-	tokenString, err := token.SignedString(priv)
-	if err != nil {
-		t.Fatalf("SignedString: %v", err)
-	}
-
-	got, _, err := auth.VerifyExternalJWT(tokenString, pubPEM, "RS256", "sub")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT: %v", err)
-	}
-	if got != username {
-		t.Errorf("username: got %q want %q", got, username)
-	}
-}
-
-func TestVerifyExternalJWT_ES256_WrongCurveRejected(t *testing.T) {
-	p256Priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	p384Priv, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	verifyDER, err := x509.MarshalPKIXPublicKey(&p384Priv.PublicKey)
-	if err != nil {
-		t.Fatalf("MarshalPKIXPublicKey: %v", err)
-	}
-	verifyPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: verifyDER}))
-
-	claims := jwt.MapClaims{
-		"sub": "u",
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
-	tokenString, err := token.SignedString(p256Priv)
-	if err != nil {
-		t.Fatalf("SignedString: %v", err)
-	}
-
-	_, _, err = auth.VerifyExternalJWT(tokenString, verifyPEM, "ES256", "sub")
-	if err == nil {
-		t.Fatal("expected error when PEM public key curve does not match algorithm")
-	}
-}
-
-func TestVerifyExternalJWT_CertificatePEM(t *testing.T) {
-	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	tpl := &x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject:      pkix.Name{CommonName: "jwt-test"},
-		NotBefore:    time.Now().Add(-time.Hour),
-		NotAfter:     time.Now().Add(24 * time.Hour),
-	}
-	certDER, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &priv.PublicKey, priv)
-	if err != nil {
-		t.Fatalf("CreateCertificate: %v", err)
-	}
-	certPEM := string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER}))
-
-	username := "cert-user"
-	claims := jwt.MapClaims{
-		"sub": username,
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
-	tokenString, err := token.SignedString(priv)
-	if err != nil {
-		t.Fatalf("SignedString: %v", err)
-	}
-
-	got, _, err := auth.VerifyExternalJWT(tokenString, certPEM, "ES256", "sub")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT: %v", err)
-	}
-	if got != username {
-		t.Errorf("username: got %q want %q", got, username)
-	}
-}
-
-func TestExtractGroupsFromClaims_ArrayOfStrings(t *testing.T) {
-	claims := map[string]interface{}{
-		"groups": []string{"admin", "users"},
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "groups")
-
-	if len(groups) != 2 {
-		t.Fatalf("Expected 2 groups, got %d", len(groups))
-	}
-
-	if groups[0] != "admin" || groups[1] != "users" {
-		t.Errorf("Expected groups [admin, users], got %v", groups)
-	}
-}
-
-func TestExtractGroupsFromClaims_ArrayOfInterfaces(t *testing.T) {
-	claims := map[string]interface{}{
-		"groups": []interface{}{"admin", "users"},
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "groups")
-
-	if len(groups) != 2 {
-		t.Fatalf("Expected 2 groups, got %d", len(groups))
-	}
-
-	if groups[0] != "admin" || groups[1] != "users" {
-		t.Errorf("Expected groups [admin, users], got %v", groups)
-	}
-}
-
-func TestExtractGroupsFromClaims_SingleString(t *testing.T) {
-	claims := map[string]interface{}{
-		"groups": "admin",
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "groups")
-
-	if len(groups) != 1 {
-		t.Fatalf("Expected 1 group, got %d", len(groups))
-	}
-
-	if groups[0] != "admin" {
-		t.Errorf("Expected group admin, got %s", groups[0])
-	}
-}
-
-func TestExtractGroupsFromClaims_MissingClaim(t *testing.T) {
-	claims := map[string]interface{}{
-		"email": "test@example.com",
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "groups")
-
-	if len(groups) != 0 {
-		t.Fatalf("Expected 0 groups, got %d", len(groups))
-	}
-}
-
-func TestExtractGroupsFromClaims_CustomClaimName(t *testing.T) {
-	claims := map[string]interface{}{
-		"roles": []string{"admin", "editor"},
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "roles")
-
-	if len(groups) != 2 {
-		t.Fatalf("Expected 2 groups, got %d", len(groups))
-	}
-
-	if groups[0] != "admin" || groups[1] != "editor" {
-		t.Errorf("Expected groups [admin, editor], got %v", groups)
-	}
-}
@@ -146,14 +146,14 @@ func decryptSecret(b64Ciphertext, b64Nonce string) (string, error) {
 }

 func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) error {
+	// get data from cache
 	cachedSecret, found := TotpCache.Get(user.Username)
 	if !found && user.TOTPSecret == "" {
 		return fmt.Errorf("OTP token not found in cache, please generate a new one")
 	}
-	useCache := found && user.TOTPSecret == ""
 	totpSecret := user.TOTPSecret // The encrypted or plaintext secret
 	totpNonce := user.TOTPNonce   // The nonce if encrypted, or empty if plaintext
-	if useCache {
+	if found {
 		splitSecret := strings.Split(cachedSecret, "||")
 		if len(splitSecret) < 2 {
 			return fmt.Errorf("invalid cached OTP token format")
@@ -173,7 +173,9 @@ func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) err
 		}
 		secretToValidate = decryptedSecret
 	}
+	// --- END: ADD THIS DECRYPTION LOGIC ---

+	// Validate the token using the (now plaintext) secret.
 	valid, err := totp.ValidateCustom(code, secretToValidate, time.Now().UTC(), totp.ValidateOpts{
 		Period:    TOTPPeriod,
 		Skew:      TOTPSkew,
@@ -196,7 +198,6 @@ func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) err
 			logger.Error("error updating user with OTP token:", err)
 			return fmt.Errorf("error updating user with OTP token: %w", err)
 		}
-		TotpCache.Delete(user.Username)
 	} else {
 		return fmt.Errorf("opt secret is empty, cannot enable TOTP")
 	}
@@ -23,7 +23,7 @@ var (
 )

 // return bool to indicate if the program should continue running
-func runCLI() (bool, bool) {
+func runCLI() bool {

 	generateYaml()

@@ -53,100 +53,85 @@ func runCLI() (bool, bool) {
 	// Show help if requested
 	if help {
 		generalUsage()
-		return false, false
+		return false
 	}

 	// Create a new FlagSet for the 'set' subcommand
 	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
 	var user, dbConfig string
 	var asAdmin bool
-	var sourceName, indexPath, ruleCategory, value string
+	var fsPath, indexPath, ruleCategory, value string
 	var allow bool

 	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
 	setCmd.BoolVar(&asAdmin, "a", false, "Create a user as admin user, used in combination with -u")
 	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
-	setCmd.StringVar(&sourceName, "s", "", "source name to apply the rule to")
+	setCmd.StringVar(&fsPath, "f", "", "Real filesystem path (e.g. /mnt/storage) for rule command")
 	setCmd.StringVar(&indexPath, "p", "", "Index path (e.g. /secret) for rule command")
 	setCmd.StringVar(&ruleCategory, "r", "", "Rule category: 'user', 'group', or 'all' (for deny only)")
 	setCmd.StringVar(&value, "v", "", "Value: username or groupname (not required if ruleCategory is 'all')")
 	setCmd.BoolVar(&allow, "allow", false, "Allow access (default: false, which means deny)")

-	storeCfg := configPath
-	cliSubcmd := ""
-	var setKind string
-
+	// Parse subcommand flags only if a subcommand is specified
 	if len(os.Args) > 1 {
 		switch os.Args[1] {
+		case "setup":
+			createConfig(configPath)
+			return false
+		case "set":
+			if len(os.Args) < 3 {
+				fmt.Printf("error: missing subcommand for 'set'. Use 'set user' or 'set rule'\n")
+				os.Exit(1)
+			}
+			subcommand := os.Args[2]
+
+			// Handle old syntax: "set -u user,pass -c config.yaml"
+			if subcommand == "-u" {
+				// Parse flags starting from os.Args[2:] to include the -u flag
+				err := setCmd.Parse(os.Args[2:])
+				if err != nil {
+					setCmd.PrintDefaults()
+					os.Exit(1)
+				}
+				logger.Debugf("setUser called with args: %v, config: %v, admin: %v", os.Args, dbConfig, asAdmin)
+				err = setUser(dbConfig, asAdmin)
+				if err != nil {
+					fmt.Printf("error: %v\n", err)
+					os.Exit(1)
+				}
+				return false
+			}
+
+			// New pattern: subcommand-based (e.g., "set user" or "set rule")
+			// Parse flags starting from os.Args[3:] to skip the subcommand
+			err := setCmd.Parse(os.Args[3:])
+			if err != nil {
+				setCmd.PrintDefaults()
+				os.Exit(1)
+			}
+			switch subcommand {
+			case "rule":
+				err := setRule(dbConfig, fsPath, indexPath, ruleCategory, value, allow)
+				if err != nil {
+					fmt.Printf("error: %v\n", err)
+					os.Exit(1)
+				}
+				return false
+			default:
+				fmt.Printf("error: unknown subcommand '%s' for 'set'. Use 'set user' or 'set rule'\n", subcommand)
+				os.Exit(1)
+			}
+
 		case "version":
 			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
 	Version 	 : %v
 	Commit 		 : %v
 	Release Info 	 : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
-`, version.Version, version.CommitSHA, version.Version)
-			return false, false
-		case "setup":
-			cliSubcmd = "setup"
-		case "set":
-			cliSubcmd = "set"
-			if len(os.Args) < 3 {
-				fmt.Printf("error: missing subcommand for 'set'. Use 'set user' or 'set rule'\n")
-				os.Exit(1)
-			}
-			setKind = os.Args[2]
-			var err error
-			// Handle old syntax: "set -u user,pass -c config.yaml"
-			if setKind == "-u" {
-				err = setCmd.Parse(os.Args[2:])
-			} else {
-				// New pattern: subcommand-based (e.g., "set user" or "set rule")
-				err = setCmd.Parse(os.Args[3:])
-			}
-			if err != nil {
-				setCmd.PrintDefaults()
-				os.Exit(1)
-			}
-			storeCfg = dbConfig
+	`, version.Version, version.CommitSHA, version.Version)
+			return false
 		}
 	}
-
-	dbExists := getStore(storeCfg)
-
-	switch cliSubcmd {
-	case "setup":
-		createConfig(configPath)
-		return false, dbExists
-	case "set":
-		if setKind == "-u" {
-			logger.Debugf("setUser called with args: %v, config: %v, admin: %v", os.Args, dbConfig, asAdmin)
-			err := setUser(dbConfig, asAdmin)
-			if err != nil {
-				fmt.Printf("error: %v\n", err)
-				os.Exit(1)
-			}
-			return false, dbExists
-		}
-		switch setKind {
-		case "rule":
-			sourceInfo, ok := settings.Config.Server.NameToSource[sourceName] // backend source is path
-			if !ok {
-				fmt.Printf("error: invalid source name: %s\n", sourceName)
-				os.Exit(1)
-			}
-			err := setRule(dbConfig, sourceInfo.Path, indexPath, ruleCategory, value, allow)
-			if err != nil {
-				fmt.Printf("error: %v\n", err)
-				os.Exit(1)
-			}
-			return false, dbExists
-		default:
-			fmt.Printf("error: unknown subcommand '%s' for 'set'. Use 'set user' or 'set rule'\n", setKind)
-			os.Exit(1)
-		}
-		return false, dbExists
-	default:
-		return true, dbExists
-	}
+	return true
 }

 func setRule(dbConfig, fsPath, indexPath, ruleCategory, value string, allow bool) error {
@@ -163,6 +148,10 @@ func setRule(dbConfig, fsPath, indexPath, ruleCategory, value string, allow bool
 	if ruleCategory != "all" && value == "" {
 		return fmt.Errorf("value is required when ruleCategory is 'user' or 'group': use -v <username|groupname>")
 	}
+
+	// Initialize store and settings
+	_ = getStore(dbConfig) // ignore bool check
+
 	// Apply the rule based on allow flag and ruleCategory
 	var err error
 	if allow {
@@ -213,6 +202,7 @@ func setUser(dbConfig string, asAdmin bool) error {
 	}
 	username := userInfo[0]
 	password := userInfo[1]
+	_ = getStore(dbConfig) // ignore bool check
 	user, err := store.Users.Get(username)
 	if err != nil {
 		newUser := users.User{
@@ -54,14 +54,10 @@ commands:
 }

 func StartFilebrowser() {
-	keepGoing, dbExists := runCLI()
+	keepGoing := runCLI()
 	if !keepGoing {
 		return
 	}
-	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
-	if !dbExists {
-		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
-	}
 	if !settings.Config.Server.DisableUpdateCheck {
 		info, _ := utils.CheckForUpdates()
 		if info.LatestVersion != "" {
@@ -80,6 +76,11 @@ func StartFilebrowser() {

 	done := make(chan struct{})             // Signals server has stopped
 	shutdownComplete := make(chan struct{}) // Signals shutdown process is complete
+	dbExists := getStore(configPath)
+	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
+	if !dbExists {
+		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
+	}

 	// Dev mode enables development features like template hot-reloading
 	_, err := os.Stat("http/dist")
@@ -88,11 +89,6 @@ func StartFilebrowser() {
 		settings.Env.EmbeddedFs = os.IsNotExist(err)
 	}

-	err = utils.SetInvalidPasswordHash()
-	if err != nil {
-		logger.Fatalf("Failed to set security hash: %v", err)
-	}
-
 	sourceList := []string{}
 	for path, source := range settings.Config.Server.SourceMap {
 		sourceList = append(sourceList, fmt.Sprintf("%v: %v", source.Name, path))
@@ -186,7 +182,7 @@ func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.
 	cacheDir := settings.Config.Server.CacheDir
 	numWorkers := settings.Config.Server.NumImageProcessors
 	ffmpeg.SetFFmpegPaths()
-
+	
 	// Initialize asset filesystem before starting services
 	if settings.Env.EmbeddedFs {
 		embeddedAssets := fbhttp.GetEmbeddedAssets()
@@ -198,7 +194,7 @@ func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.
 	} else {
 		fileutils.InitAssetFS(nil, false)
 	}
-
+	
 	// Start preview service
 	err := preview.StartPreviewGenerator(numWorkers, cacheDir)
 	if err != nil {
@@ -206,16 +202,12 @@ func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.
 	}
 	logger.Debugf("MuPDF Enabled            : %v", settings.Env.MuPdfAvailable)
 	logger.Debugf("Media Enabled            : %v", settings.MediaEnabled())
-	logger.Debugf("Exiftool Enabled         : %v", settings.Config.Integrations.Media.ExiftoolPath != "")
-
+	
 	// Generate PWA icons after preview service is initialized
 	if err := icons.GeneratePWAIcons(); err != nil {
 		logger.Warningf("Failed to generate PWA icons: %v", err)
 	}
-
-	// Initialize PWA manifest after icons are generated
-	icons.InitializePWAManifest()
-
+	
 	fbhttp.StartHttp(ctx, store, shutdownComplete)
 	return nil
 }
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"os"
 	"reflect"
-	"strings"

 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
@@ -41,12 +40,10 @@ func validateUserInfo(newDB bool) {
 		if updateSidebarLinks(user) {
 			updateUser = true
 		}
-		if updateTokens(user) {
-			updateUser = true
-		}
 		adminUser := settings.Config.Auth.AdminUsername
 		adminPass := settings.Config.Auth.AdminPassword
-		if user.Username == adminUser && adminPass != "" && user.LoginMethod == users.LoginMethodPassword {
+		passwordEnabled := settings.Config.Auth.Methods.PasswordAuth.Enabled
+		if user.Username == adminUser && adminPass != "" && passwordEnabled {
 			logger.Info("Resetting admin user to default username and password.")
 			user.Permissions.Admin = true
 			user.Password = settings.Config.Auth.AdminPassword
@@ -62,11 +59,7 @@ func validateUserInfo(newDB bool) {
 					logger.Fatalf("Unable to create automatic backup of database due to error: %v", err)
 				}
 			}
-			fields := []string{"Scopes", "SidebarLinks", "Tokens", "Permissions", "Preview", "ShowFirstLogin", "LoginMethod", "Version"}
-			if changePass {
-				fields = append(fields, "Password")
-			}
-			err := store.Users.Update(user, true, fields...)
+			err := store.Users.Save(user, changePass, true)
 			if err != nil {
 				logger.Errorf("could not update user: %v", err)
 			}
@@ -97,6 +90,7 @@ func updateUserScopes(user *users.User) bool {
 		} else {
 			continue
 		}
+
 		newScopes = append(newScopes, users.SourceScope{
 			Name:  src.Path,
 			Scope: existingScope.Scope,
@@ -125,7 +119,7 @@ func updateShowFirstLogin(user *users.User) bool {

 // func to convert legacy user with perm key to permissions
 func updatePermissions(user *users.User) bool {
-	if user.Version >= 1 {
+	if user.Version == 1 {
 		return false
 	}
 	updateUser := true
@@ -171,7 +165,7 @@ func updatePermissions(user *users.User) bool {
 		user.Permissions.Delete = true
 		updateUser = true
 	}
-	user.Version = 2
+	user.Version = 1
 	if updateUser {
 		createBackup = true
 	}
@@ -203,7 +197,7 @@ func updateSidebarLinks(user *users.User) bool {
 	validSourceLinksCount := 0

 	for _, link := range user.SidebarLinks {
-		if strings.HasPrefix(link.Category, "source") {
+		if link.Category == "source" {
 			sourceLinksCount++
 			// Check if this source still exists
 			if link.SourceName != "" {
@@ -226,7 +220,7 @@ func updateSidebarLinks(user *users.User) bool {
 		// Remove all existing source links
 		newLinks := []users.SidebarLink{}
 		for _, link := range user.SidebarLinks {
-			if !strings.HasPrefix(link.Category, "source") {
+			if link.Category != "source" {
 				newLinks = append(newLinks, link)
 			}
 		}
@@ -252,18 +246,3 @@ func updateSidebarLinks(user *users.User) bool {
 	// User has at least one valid source link, no update needed
 	return false
 }
-
-func updateTokens(user *users.User) bool {
-	if user.Version >= 2 {
-		return false
-	}
-	if user.ApiKeys != nil {
-		user.Tokens = make(map[string]users.AuthToken)
-		for name, token := range user.ApiKeys {
-			token.Token = token.Key
-			user.Tokens[name] = token
-		}
-	}
-	user.Version = 2
-	return true
-}
@@ -156,6 +156,7 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 	sourceA = settings.Source{Path: "/pathA", Name: "sourceA", Config: settings.SourceConfig{
 		DefaultEnabled:   true,
 		DefaultUserScope: "/defaultA",
+		CreateUserDir:    true,
 	}}
 	sourceB = settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
 	settings.Config.Server.Sources = []*settings.Source{&sourceA, &sourceB}
@@ -19,10 +19,9 @@ var (
 	ErrInvalidRequestParams = errors.New("invalid request params")
 	ErrSourceIsParent       = errors.New("source is parent")
 	ErrNoTotpProvided       = errors.New("OTP code is required for user")
-	ErrNoTotpConfigured     = errors.New("OTP is enforced, but user is not configured")
+	ErrNoTotpConfigured     = errors.New("OTP is enforced, but user is not yet configured")
 	ErrUnauthorized         = errors.New("user unauthorized")
 	ErrNotIndexed           = errors.New("directory or item excluded from indexing")
-	ErrNotViewable          = errors.New("directory or item is not viewable")
 	ErrWrongLoginMethod     = errors.New("user attempted to login with wrong login method")
 	ErrDownloadNotAllowed   = errors.New("downloads are not allowed for this share")
 	ErrUploadNotAllowed     = errors.New("upload permission not allowed for this share")
@@ -1,192 +0,0 @@
-package settings
-
-import (
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-// TestApplyUserDefaults_copiesUserDefaultsOntoUser guards against drift between
-// [UserDefaults] and [ApplyUserDefaults] (regression for #2278-style bugs).
-func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
-	saved := Config
-	defer func() { Config = saved }()
-
-	dark := false
-	dlFalse := false
-	Config = Settings{
-		Server: Server{},
-		UserDefaults: UserDefaults{
-			EditorQuickSave:            true,
-			HideSidebarFileActions:     true,
-			DisableQuickToggles:        true,
-			DisableSearchOptions:       true,
-			StickySidebar:              false,
-			HideFilesInTree:            true,
-			DarkMode:                   &dark,
-			Locale:                     "de",
-			ViewMode:                   "list",
-			SingleClick:                true,
-			ShowHidden:                 true,
-			DateFormat:                 true,
-			GallerySize:                7,
-			ThemeColor:                 "var(--red)",
-			QuickDownload:              true,
-			DisablePreviewExt:          ".exe",
-			DisableViewingExt:          ".bat",
-			DisableSettings:            true,
-			LockPassword:               true,
-			DisableUpdateNotifications: true,
-			DeleteWithoutConfirming:    true,
-			DeleteAfterArchive:         false,
-			DisableOfficePreviewExt:    "legacy",
-			DisableOnlyOfficeExt:       ".x",
-			CustomTheme:                "Night",
-			ShowSelectMultiple:         true,
-			DebugOffice:                true,
-			PreferEditorForMarkdown:    true,
-			LoginMethod:                "password",
-			FileLoading: users.FileLoading{
-				MaxConcurrent:     3,
-				UploadChunkSize:   5,
-				DownloadChunkSize: 2,
-			},
-			Permissions: UserDefaultsPermissions{
-				Api:      true,
-				Admin:    true,
-				Modify:   true,
-				Share:    true,
-				Realtime: true,
-				Delete:   true,
-				Create:   true,
-				Download: &dlFalse,
-			},
-			Preview: UserDefaultsPreview{
-				DisableHideSidebar: true,
-				Image:              boolPtr(false),
-				Video:              boolPtr(false),
-				Audio:              boolPtr(false),
-				MotionVideoPreview: boolPtr(false),
-				Office:             boolPtr(false),
-				PopUp:              boolPtr(false),
-				AutoplayMedia:      boolPtr(false),
-				DefaultMediaPlayer: true,
-				Folder:             boolPtr(false),
-				Models:             boolPtr(false),
-			},
-		},
-	}
-
-	u := &users.User{Username: "alice"}
-	ApplyUserDefaults(u)
-
-	want := users.User{
-		DisableSettings: true,
-		LockPassword:    true,
-		LoginMethod:     users.LoginMethodPassword,
-		Permissions: users.Permissions{
-			Api:      true,
-			Admin:    true,
-			Modify:   true,
-			Share:    true,
-			Realtime: true,
-			Delete:   true,
-			Create:   true,
-			Download: false,
-		},
-		NonAdminEditable: users.NonAdminEditable{
-			EditorQuickSave:            true,
-			HideSidebarFileActions:     true,
-			DisableQuickToggles:        true,
-			DisableSearchOptions:       true,
-			StickySidebar:              false,
-			HideFilesInTree:            true,
-			DarkMode:                   false,
-			Locale:                     "de",
-			ViewMode:                   "list",
-			SingleClick:                true,
-			ShowHidden:                 true,
-			DateFormat:                 true,
-			GallerySize:                7,
-			ThemeColor:                 "var(--red)",
-			QuickDownload:              true,
-			DisablePreviewExt:          ".exe",
-			DisableViewingExt:          ".bat",
-			DisableUpdateNotifications: true,
-			DisableOfficePreviewExt:    "legacy",
-			DisableOnlyOfficeExt:       ".x",
-			CustomTheme:                "Night",
-			ShowSelectMultiple:         true,
-			DebugOffice:                true,
-			DeleteWithoutConfirming:    true,
-			DeleteAfterArchive:         false,
-			PreferEditorForMarkdown:    true,
-			FileLoading: users.FileLoading{
-				MaxConcurrent:     3,
-				UploadChunkSize:   5,
-				DownloadChunkSize: 2,
-			},
-			Preview: users.Preview{
-				DisableHideSidebar: true,
-				Image:              false,
-				Video:              false,
-				Audio:              false,
-				MotionVideoPreview: false,
-				Office:             false,
-				PopUp:              false,
-				AutoplayMedia:      false,
-				DefaultMediaPlayer: true,
-				Folder:             false,
-				Models:             false,
-			},
-		},
-	}
-
-	if diff := cmp.Diff(want.Permissions, u.Permissions); diff != "" {
-		t.Fatalf("Permissions mismatch (-want +got):\n%s", diff)
-	}
-	if diff := cmp.Diff(want.NonAdminEditable, u.NonAdminEditable); diff != "" {
-		t.Fatalf("NonAdminEditable mismatch (-want +got):\n%s", diff)
-	}
-	if u.DisableSettings != want.DisableSettings {
-		t.Fatalf("DisableSettings: got %v want %v", u.DisableSettings, want.DisableSettings)
-	}
-	if u.LockPassword != want.LockPassword {
-		t.Fatalf("LockPassword: got %v want %v", u.LockPassword, want.LockPassword)
-	}
-	if u.LoginMethod != want.LoginMethod {
-		t.Fatalf("LoginMethod: got %q want %q", u.LoginMethod, want.LoginMethod)
-	}
-}
-
-func TestApplyUserDefaults_setsLoginMethodWhenEmpty(t *testing.T) {
-	saved := Config
-	defer func() { Config = saved }()
-
-	Config = Settings{
-		Server:       Server{},
-		UserDefaults: UserDefaults{LoginMethod: "jwt"},
-	}
-	u := &users.User{Username: "x"}
-	ApplyUserDefaults(u)
-	if u.LoginMethod != users.LoginMethodJwt {
-		t.Fatalf("LoginMethod: got %q want jwt", u.LoginMethod)
-	}
-}
-
-func TestApplyUserDefaults_preservesLoginMethodWhenAlreadySet(t *testing.T) {
-	saved := Config
-	defer func() { Config = saved }()
-
-	Config = Settings{
-		Server:       Server{},
-		UserDefaults: UserDefaults{LoginMethod: "password"},
-	}
-	u := &users.User{Username: "x", LoginMethod: users.LoginMethodProxy}
-	ApplyUserDefaults(u)
-	if u.LoginMethod != users.LoginMethodProxy {
-		t.Fatalf("LoginMethod: got %q want proxy", u.LoginMethod)
-	}
-}
@@ -6,11 +6,8 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"strconv"
-	"strings"

 	"github.com/coreos/go-oidc/v3/oidc"
-	ldap "github.com/go-ldap/ldap/v3"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
@@ -32,18 +29,6 @@ func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error
 	return t.base.RoundTrip(reqCopy)
 }

-// AuthCommon contains fields shared across multiple authentication methods
-type AuthCommon struct {
-	Enabled           bool     `json:"enabled"`           // whether to enable this authentication method.
-	AdminGroup        string   `json:"adminGroup"`        // if set, users in this group will be granted admin privileges
-	UserGroups        []string `json:"userGroups"`        // if set, only users in these groups are allowed to log in. Blocks all other users even with valid credentials.
-	GroupsClaim       string   `json:"groupsClaim"`       // the JSON field name to read groups from. Default is "groups"
-	UserIdentifier    string   `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username" in oidc, "sub" in jwt. Other common values are "email" or "username", or "phone"
-	DisableVerifyTLS  bool     `json:"disableVerifyTLS"`  // disable TLS verification (insecure, for testing only)
-	LogoutRedirectUrl string   `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
-	CreateUser        bool     `json:"createUser"`        // deprecated: always true for supported authentication methods
-}
-
 type Auth struct {
 	TokenExpirationHours int          `json:"tokenExpirationHours"` // time in hours each web UI session token is valid for. Default is 2 hours.
 	Methods              LoginMethods `json:"methods"`
@@ -59,8 +44,6 @@ type LoginMethods struct {
 	NoAuth       bool               `json:"noauth"` // if set to true, overrides all other auth methods and disables authentication
 	PasswordAuth PasswordAuthConfig `json:"password" validate:"omitempty"`
 	OidcAuth     OidcConfig         `json:"oidc" validate:"omitempty"`
-	LdapAuth     LdapConfig         `json:"ldap" validate:"omitempty"`
-	JwtAuth      JwtAuthConfig      `json:"jwt" validate:"omitempty"`
 }

 type PasswordAuthConfig struct {
@@ -72,8 +55,10 @@ type PasswordAuthConfig struct {
 }

 type ProxyAuthConfig struct {
-	AuthCommon `json:",inline"`
-	Header     string `json:"header"` // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
+	Enabled           bool   `json:"enabled"`
+	CreateUser        bool   `json:"createUser"`        // create user if not exists
+	Header            string `json:"header"`            // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
+	LogoutRedirectUrl string `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
 }

 type Recaptcha struct {
@@ -84,65 +69,19 @@ type Recaptcha struct {

 // OpenID OAuth2.0
 type OidcConfig struct {
-	AuthCommon   `json:",inline"`
-	ClientID     string                `json:"clientId"`     // secret: client id of the OIDC application
-	ClientSecret string                `json:"clientSecret"` // secret: client secret of the OIDC application
-	IssuerUrl    string                `json:"issuerUrl"`    // authorization URL of the OIDC provider
-	Scopes       string                `json:"scopes"`       // scopes to request from the OIDC provider
-	Provider     *oidc.Provider        `json:"-"`            // OIDC provider
-	Verifier     *oidc.IDTokenVerifier `json:"-"`            // OIDC verifier
-}
-
-type LdapConfig struct {
-	AuthCommon   `json:",inline"`
-	Server       string `json:"server"`       // scheme://host:port of the LDAP server (e.g. ldap://localhost:389)
-	BaseDN       string `json:"baseDN"`       // LDAP search base DN (e.g. dc=ldap,dc=goauthentik,dc=io)
-	UserDN       string `json:"userDN"`       // Bind DN for service account (e.g. cn=admin,ou=users,dc=ldap,dc=goauthentik,dc=io)
-	UserPassword string `json:"userPassword"` // Bind password for service account
-	UserFilter   string `json:"userFilter"`   // Search filter for finding user by username. Default (&(cn=%s)(objectClass=user)); override e.g. (email=%s) or (sAMAccountName=%s) for other directories.
-	Port         int    `json:"-"`            // derived from server
-	Scheme       string `json:"-"`            // derived from server
-	Host         string `json:"-"`            // derived from server
-}
-
-// JwtAuthConfig configures external JWT token authentication
-// Similar to Grafana's JWT auth: verifies HS* tokens with a shared secret, or RS*/ES* with a PEM public key (or certificate)
-// The query parameter is hardcoded to "jwt" (e.g. ?jwt=<token>)
-type JwtAuthConfig struct {
-	AuthCommon `json:",inline"`
-	Header     string `json:"header"`    // HTTP header to look for JWT token (e.g. X-JWT-Assertion). Default is "X-JWT-Assertion"
-	Secret     string `json:"secret"`    // Shared secret key/bytes for verifying JWT token signatures (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
-	Algorithm  string `json:"algorithm"` // JWT signing algorithm (HS256, HS384, HS512, RS256, ES256). Default is "HS256"
-}
-
-// ValidateLdapAuth checks LDAP config and sets defaults. Call when LDAP is enabled.
-func ValidateLdapAuth() error {
-	ldapCfg := &Config.Auth.Methods.LdapAuth
-	if ldapCfg.Server == "" {
-		return fmt.Errorf("LDAP server is required when LDAP is enabled")
-	}
-	scheme, host, port, err := parseLdapServer(ldapCfg.Server)
-	if err != nil {
-		return fmt.Errorf("LDAP server is invalid: %w", err)
-	}
-	ldapCfg.Server = fmt.Sprintf("%s://%s:%d", scheme, host, port)
-	ldapCfg.Scheme = scheme
-	ldapCfg.Host = host
-	ldapCfg.Port = port
-
-	if ldapCfg.BaseDN == "" {
-		return fmt.Errorf("LDAP baseDN is required when LDAP is enabled")
-	}
-	if ldapCfg.UserDN == "" {
-		return fmt.Errorf("LDAP userDN (bind DN) is required when LDAP is enabled")
-	}
-	if ldapCfg.UserFilter == "" {
-		ldapCfg.UserFilter = "(&(cn=%s)(objectClass=user))"
-	}
-	if err := verifyLdapConnection(); err != nil {
-		logger.Fatalf("LDAP connection check failed: %v", err)
-	}
-	return nil
+	Enabled           bool                  `json:"enabled"`           // whether to enable OIDC authentication
+	ClientID          string                `json:"clientId"`          // secret: client id of the OIDC application
+	ClientSecret      string                `json:"clientSecret"`      // secret: client secret of the OIDC application
+	IssuerUrl         string                `json:"issuerUrl"`         // authorization URL of the OIDC provider
+	Scopes            string                `json:"scopes"`            // scopes to request from the OIDC provider
+	UserIdentifier    string                `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username", can also be "email" or "username", or "phone"
+	DisableVerifyTLS  bool                  `json:"disableVerifyTLS"`  // disable TLS verification for the OIDC provider. This is insecure and should only be used for testing.
+	LogoutRedirectUrl string                `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
+	CreateUser        bool                  `json:"createUser"`        // create user if not exists
+	AdminGroup        string                `json:"adminGroup"`        // if set, users in this group will be granted admin privileges.
+	GroupsClaim       string                `json:"groupsClaim"`       // the JSON field name to read groups from. Default is "groups"
+	Provider          *oidc.Provider        `json:"-"`                 // OIDC provider
+	Verifier          *oidc.IDTokenVerifier `json:"-"`                 // OIDC verifier
 }

 // ValidateOidcAuth processes the OIDC callback and retrieves user identity
@@ -194,105 +133,3 @@ func validateOidcAuth() error {

 	return nil
 }
-
-func parseLdapServer(server string) (scheme, host string, port int, err error) {
-	parts := strings.Split(server, "://")
-	if len(parts) != 2 {
-		return "", "", 0, fmt.Errorf("invalid LDAP server: %s", server)
-	}
-	scheme = strings.ToLower(parts[0])
-	if scheme != "ldap" && scheme != "ldaps" {
-		return "", "", 0, fmt.Errorf("invalid LDAP scheme: %s", scheme)
-	}
-	hostParts := strings.Split(parts[1], ":")
-	host = strings.TrimSuffix(hostParts[0], "/")
-	if len(hostParts) > 1 && hostParts[1] != "" {
-		port, err = strconv.Atoi(strings.TrimSuffix(hostParts[1], "/"))
-		if err != nil || port == 0 {
-			return "", "", 0, fmt.Errorf("invalid LDAP port: %s", hostParts[1])
-		}
-	} else {
-		if scheme == "ldaps" {
-			port = 636
-		} else {
-			port = 389
-		}
-	}
-	return scheme, host, port, nil
-}
-
-// VerifyLdapConnection tests that the LDAP server is reachable, can bind (if credentials set), and responds to a search.
-func verifyLdapConnection() error {
-	if Config.Auth.Methods.LdapAuth.Server == "" {
-		return fmt.Errorf("LDAP server is required when LDAP is enabled")
-	}
-	if Config.Auth.Methods.LdapAuth.BaseDN == "" {
-		return fmt.Errorf("LDAP baseDN is required for connection verification")
-	}
-	var opts []ldap.DialOpt
-	scheme := Config.Auth.Methods.LdapAuth.Scheme
-	host := Config.Auth.Methods.LdapAuth.Host
-	port := Config.Auth.Methods.LdapAuth.Port
-	if Config.Auth.Methods.LdapAuth.DisableVerifyTLS && scheme == "ldaps" {
-		opts = append(opts, ldap.DialWithTLSConfig(&tls.Config{InsecureSkipVerify: true}))
-	}
-	fullURL := fmt.Sprintf("%s://%s:%d", scheme, host, port)
-	conn, err := ldap.DialURL(fullURL, opts...)
-	if err != nil {
-		return fmt.Errorf("LDAP connection failed (is the LDAP outpost running at %s? use port 389 for LDAP, 636 for LDAPS; this is not the HTTP port): %w", fullURL, err)
-	}
-	defer conn.Close()
-	if Config.Auth.Methods.LdapAuth.UserDN != "" && Config.Auth.Methods.LdapAuth.UserPassword != "" {
-		if err = conn.Bind(Config.Auth.Methods.LdapAuth.UserDN, Config.Auth.Methods.LdapAuth.UserPassword); err != nil {
-			return fmt.Errorf("LDAP bind failed (check userDN and userPassword): %w", err)
-		}
-		defer func() { _ = conn.Unbind() }()
-	}
-	// Dummy search to verify the server responds to LDAP search (same path that fails at login if misconfigured).
-	searchRequest := ldap.NewSearchRequest(
-		Config.Auth.Methods.LdapAuth.BaseDN,
-		ldap.ScopeBaseObject,
-		ldap.NeverDerefAliases,
-		0,
-		0,
-		false,
-		"(objectClass=*)",
-		[]string{"1.1"}, // no attributes
-		nil,
-	)
-	_, err = conn.Search(searchRequest)
-	if err != nil {
-		return fmt.Errorf("LDAP search test failed (server may require StartTLS or bind before search): %w", err)
-	}
-	return nil
-}
-
-// ValidateJwtAuth checks JWT config and sets defaults. Call when JWT auth is enabled.
-func ValidateJwtAuth() error {
-	jwtCfg := &Config.Auth.Methods.JwtAuth
-	if jwtCfg.Secret == "" {
-		return fmt.Errorf("JWT secret is required when JWT auth is enabled")
-	}
-	if jwtCfg.Header == "" {
-		jwtCfg.Header = "X-JWT-Assertion"
-	}
-	if jwtCfg.Algorithm == "" {
-		jwtCfg.Algorithm = "HS256"
-	}
-	if jwtCfg.GroupsClaim == "" {
-		jwtCfg.GroupsClaim = "groups"
-	}
-	if jwtCfg.UserIdentifier == "" {
-		jwtCfg.UserIdentifier = "sub"
-	}
-	// Validate algorithm
-	validAlgos := map[string]bool{
-		"HS256": true, "HS384": true, "HS512": true,
-		"RS256": true, "RS384": true, "RS512": true,
-		"ES256": true, "ES384": true, "ES512": true,
-	}
-	if !validAlgos[jwtCfg.Algorithm] {
-		return fmt.Errorf("unsupported JWT algorithm: %s. Supported: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512", jwtCfg.Algorithm)
-	}
-	return nil
-}
@@ -1,221 +0,0 @@
-package settings
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestParseLdapServer(t *testing.T) {
-	tests := []struct {
-		name       string
-		server     string
-		wantScheme string
-		wantHost   string
-		wantPort   int
-		wantErr    bool
-	}{
-		{
-			name:       "ldap with host and port",
-			server:     "ldap://localhost:389",
-			wantScheme: "ldap",
-			wantHost:   "localhost",
-			wantPort:   389,
-			wantErr:    false,
-		},
-		{
-			name:       "ldaps with host and port",
-			server:     "ldaps://ldap.example.com:636",
-			wantScheme: "ldaps",
-			wantHost:   "ldap.example.com",
-			wantPort:   636,
-			wantErr:    false,
-		},
-		{
-			name:       "ldap with trailing slash",
-			server:     "ldap://host:389/",
-			wantScheme: "ldap",
-			wantHost:   "host",
-			wantPort:   389,
-			wantErr:    false,
-		},
-		{
-			name:       "ldap port not provided defaults to 389",
-			server:     "ldap://localhost",
-			wantScheme: "ldap",
-			wantHost:   "localhost",
-			wantPort:   389,
-			wantErr:    false,
-		},
-		{
-			name:       "ldaps port not provided defaults to 636",
-			server:     "ldaps://ldap.example.com",
-			wantScheme: "ldaps",
-			wantHost:   "ldap.example.com",
-			wantPort:   636,
-			wantErr:    false,
-		},
-		{
-			name:    "port provided but invalid returns error",
-			server:  "ldap://host:bad",
-			wantErr: true,
-		},
-		{
-			name:    "port provided but invalid (ldaps) returns error",
-			server:  "ldaps://host:xyz",
-			wantErr: true,
-		},
-		{
-			name:    "port zero returns error",
-			server:  "ldap://host:0",
-			wantErr: true,
-		},
-		{
-			name:    "empty server",
-			server:  "",
-			wantErr: true,
-		},
-		{
-			name:    "no scheme",
-			server:  "localhost:389",
-			wantErr: true,
-		},
-		{
-			name:    "invalid scheme",
-			server:  "http://localhost:389",
-			wantErr: true,
-		},
-		{
-			name:    "invalid scheme ftp",
-			server:  "ftp://localhost:389",
-			wantErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			gotScheme, gotHost, gotPort, err := parseLdapServer(tt.server)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("parseLdapServer() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if !tt.wantErr {
-				if gotScheme != tt.wantScheme {
-					t.Errorf("parseLdapServer() scheme = %v, want %v", gotScheme, tt.wantScheme)
-				}
-				if gotHost != tt.wantHost {
-					t.Errorf("parseLdapServer() host = %v, want %v", gotHost, tt.wantHost)
-				}
-				if gotPort != tt.wantPort {
-					t.Errorf("parseLdapServer() port = %v, want %v", gotPort, tt.wantPort)
-				}
-			}
-		})
-	}
-}
-
-func TestVerifyLdapConnection_ValidationOnly(t *testing.T) {
-	// Save and restore global config so we don't affect other tests
-	saved := Config.Auth.Methods.LdapAuth
-	defer func() { Config.Auth.Methods.LdapAuth = saved }()
-
-	t.Run("empty server returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "",
-			BaseDN:     "dc=test,dc=local",
-		}
-		err := verifyLdapConnection()
-		if err == nil {
-			t.Fatal("verifyLdapConnection() expected error for empty server")
-		}
-		if !strings.Contains(err.Error(), "LDAP server is required") {
-			t.Errorf("verifyLdapConnection() error = %v, want message containing 'LDAP server is required'", err)
-		}
-	})
-
-	t.Run("empty baseDN returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "ldap://localhost:389",
-			Scheme:     "ldap",
-			Host:       "localhost",
-			Port:       389,
-			BaseDN:     "",
-		}
-		err := verifyLdapConnection()
-		if err == nil {
-			t.Fatal("verifyLdapConnection() expected error for empty baseDN")
-		}
-		if !strings.Contains(err.Error(), "baseDN is required") {
-			t.Errorf("verifyLdapConnection() error = %v, want message containing 'baseDN is required'", err)
-		}
-	})
-}
-
-func TestValidateLdapAuth_ConfigValidation(t *testing.T) {
-	saved := Config.Auth.Methods.LdapAuth
-	defer func() { Config.Auth.Methods.LdapAuth = saved }()
-
-	t.Run("empty server returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "",
-			BaseDN:     "dc=test,dc=local",
-			UserDN:     "cn=admin,dc=test,dc=local",
-		}
-		err := ValidateLdapAuth()
-		if err == nil {
-			t.Fatal("ValidateLdapAuth() expected error for empty server")
-		}
-		if !strings.Contains(err.Error(), "server is required") {
-			t.Errorf("ValidateLdapAuth() error = %v", err)
-		}
-	})
-
-	t.Run("invalid server URL returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "not-a-valid-ldap-url",
-			BaseDN:     "dc=test,dc=local",
-			UserDN:     "cn=admin,dc=test,dc=local",
-		}
-		err := ValidateLdapAuth()
-		if err == nil {
-			t.Fatal("ValidateLdapAuth() expected error for invalid server URL")
-		}
-		if !strings.Contains(err.Error(), "invalid") {
-			t.Errorf("ValidateLdapAuth() error = %v", err)
-		}
-	})
-
-	t.Run("empty baseDN returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "ldap://localhost:389",
-			BaseDN:     "",
-			UserDN:     "cn=admin,dc=test,dc=local",
-		}
-		err := ValidateLdapAuth()
-		if err == nil {
-			t.Fatal("ValidateLdapAuth() expected error for empty baseDN")
-		}
-		if !strings.Contains(err.Error(), "baseDN is required") {
-			t.Errorf("ValidateLdapAuth() error = %v", err)
-		}
-	})
-
-	t.Run("empty userDN returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "ldap://localhost:389",
-			BaseDN:     "dc=test,dc=local",
-			UserDN:     "",
-		}
-		err := ValidateLdapAuth()
-		if err == nil {
-			t.Fatal("ValidateLdapAuth() expected error for empty userDN")
-		}
-		if !strings.Contains(err.Error(), "userDN") {
-			t.Errorf("ValidateLdapAuth() error = %v", err)
-		}
-	})
-}
@@ -6,7 +6,6 @@ import (
 	"io"
 	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"runtime"
 	"slices"
@@ -56,7 +55,7 @@ func Initialize(configFile string) {
 	InitializeUserResolvers() // Initialize user package resolvers after sources are set up
 	setupUrls()
 	setupFrontend(false)
-	setupMedia(false)
+	setupMedia()
 }

 func setupServer() {
@@ -93,7 +92,7 @@ func setupFs() {
 		Config.Server.Filesystem.CreateDirectoryPermission = "755"
 		dirPermOctal, _ = strconv.ParseUint("755", 8, 32)
 	}
-	fileutils.SetFsPermissions(uint32(filePermOctal), uint32(dirPermOctal))
+	fileutils.SetFsPermissions(os.FileMode(filePermOctal), os.FileMode(dirPermOctal))

 	// Perform mandatory cache directory speed test
 	testCacheDirSpeed()
@@ -279,9 +278,11 @@ func setupFrontend(generate bool) {
 	}
 	// Load custom favicon if configured
 	loadCustomFavicon()
+	// Generate PWA icons from custom favicon if needed
+	generatePWAIcons()
 }

-func setupMedia(generate bool) {
+func setupMedia() {
 	// Save user's explicit config before applying defaults
 	userImageConfig := make(map[ImagePreviewType]*bool)
 	for k, v := range Config.Integrations.Media.Convert.ImagePreview {
@@ -315,19 +316,6 @@ func setupMedia(generate bool) {
 	for k, v := range userVideoConfig {
 		Config.Integrations.Media.Convert.VideoPreview[k] = v
 	}
-
-	// Resolve exiftool path once at startup: validate user path or discover via PATH
-	if Config.Integrations.Media.ExiftoolPath != "" && !generate {
-		if err := exec.Command(Config.Integrations.Media.ExiftoolPath, "-ver").Run(); err != nil {
-			logger.Warningf("exiftool path is invalid or not executable: %q (%v); disabling exiftool", Config.Integrations.Media.ExiftoolPath, err)
-			Config.Integrations.Media.ExiftoolPath = ""
-		}
-	}
-	if Config.Integrations.Media.ExiftoolPath == "" && !generate {
-		if path, err := exec.LookPath("exiftool"); err == nil && path != "" {
-			Config.Integrations.Media.ExiftoolPath = path
-		}
-	}
 }

 func setupSources(generate bool) {
@@ -350,7 +338,11 @@ func setupSources(generate bool) {
 			if name == "\\" {
 				name = strings.Split(realPath, ":")[0]
 			}
-			source.Path = realPath // use absolute path
+			if generate {
+				source.Path = generatorPath // use placeholder path
+			} else {
+				source.Path = realPath // use absolute path
+			}
 			if source.Name == "" {
 				_, ok := Config.Server.SourceMap[source.Path]
 				if ok {
@@ -359,10 +351,6 @@ func setupSources(generate bool) {
 					source.Name = name
 				}
 			}
-			if generate {
-				source.Path = generatorPath // use placeholder path
-				source.Name = "Source Name"
-			}
 			modifyExcludeInclude(source)
 			setConditionals(source)
 			if source.Config.DefaultUserScope == "" {
@@ -434,34 +422,20 @@ func setupAuth(generate bool) {
 	if Config.Auth.Methods.ProxyAuth.Enabled {
 		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "proxy")
 	}
+	if Config.Auth.Methods.OidcAuth.Enabled {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "oidc")
+	}
 	if Config.Auth.Methods.NoAuth {
 		logger.Warning("Configured with no authentication, this is not recommended.")
 		Config.Auth.AuthMethods = []string{"disabled"}
 	}
 	if Config.Auth.Methods.OidcAuth.Enabled || generate {
-		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "oidc")
 		err := validateOidcAuth()
 		if err != nil && !generate {
 			logger.Fatalf("Error validating OIDC auth: %v", err)
 		}
 		logger.Info("OIDC Auth configured successfully")
 	}
-	if Config.Auth.Methods.LdapAuth.Enabled || generate {
-		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "ldap")
-		err := ValidateLdapAuth()
-		if err != nil && !generate {
-			logger.Fatalf("Error validating LDAP auth: %v", err)
-		}
-		logger.Info("LDAP Auth configured successfully")
-	}
-	if Config.Auth.Methods.JwtAuth.Enabled || generate {
-		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "jwt")
-		err := ValidateJwtAuth()
-		if err != nil && !generate {
-			logger.Fatalf("Error validating JWT auth: %v", err)
-		}
-		logger.Info("JWT Auth configured successfully")
-	}

 	// use password auth as default if no auth methods are set
 	if len(Config.Auth.AuthMethods) == 0 {
@@ -650,11 +624,6 @@ func loadEnvConfig() {
 		logger.Info("Using ReCaptcha Secret from FILEBROWSER_RECAPTCHA_SECRET environment variable")
 	}

-	ldapUserPassword := os.Getenv("FILEBROWSER_LDAP_USER_PASSWORD")
-	if ldapUserPassword != "" {
-		Config.Auth.Methods.LdapAuth.UserPassword = ldapUserPassword
-		logger.Info("Using LDAP bind password from FILEBROWSER_LDAP_USER_PASSWORD environment variable")
-	}
 }

 func setDefaults(generate bool) Settings {
@@ -667,9 +636,14 @@ func setDefaults(generate bool) Settings {
 	database := os.Getenv("FILEBROWSER_DATABASE")
 	if database == "" {
 		database = "database.db"
+	} else {
+		// check if database file exists
+		if _, err := os.Stat(database); os.IsNotExist(err) {
+			database = "database.db"
+		}
 	}
 	if _, err := os.Stat(database); os.IsNotExist(err) {
-		logger.Warning("database file could not be found. If this is unexpected, please set the FILEBROWSER_DATABASE environment variable to the correct path.")
+		logger.Warning("database file could not be found. If this is unexpected, the default path is `./database.db`, but it can be configured in the config file under `server.database`.")
 	}
 	s := Settings{
 		Server: Server{
@@ -679,14 +653,13 @@ func setDefaults(generate bool) Settings {
 			Database:           database,
 			SourceMap:          map[string]*Source{},
 			NameToSource:       map[string]*Source{},
+			MaxArchiveSizeGB:   50,
 			CacheDir:           "tmp",
-			MaxArchiveSizeGB:   20,
 			IndexSqlConfig: IndexSqlConfig{
-				WalMode:               false,
-				BatchSize:             1000,
-				CacheSizeMB:           32,
-				DisableReuse:          false,
-				StartupIntegrityCheck: IndexStartupIntegrityQuickCheck,
+				WalMode:      false,
+				BatchSize:    1000,
+				CacheSizeMB:  32,
+				DisableReuse: false,
 			},
 			Filesystem: Filesystem{
 				CreateFilePermission:      "644",
@@ -708,19 +681,16 @@ func setDefaults(generate bool) Settings {
 			Name: "FileBrowser Quantum",
 		},
 		UserDefaults: UserDefaults{
-			DeleteAfterArchive:      true,
-			DisableOnlyOfficeExt:    ".md .txt .pdf .html .xml",
-			StickySidebar:           true,
-			HideFilesInTree:         false,
-			PreferEditorForMarkdown: false,
-			LockPassword:            false,
-			ShowHidden:              false,
-			DarkMode:                boolPtr(true),
-			DisableSettings:         false,
-			ViewMode:                "normal",
-			Locale:                  "en",
-			GallerySize:             3,
-			ThemeColor:              "var(--blue)",
+			DisableOnlyOfficeExt: ".md .txt .pdf .html .xml",
+			StickySidebar:        true,
+			LockPassword:         false,
+			ShowHidden:           false,
+			DarkMode:             boolPtr(true),
+			DisableSettings:      false,
+			ViewMode:             "normal",
+			Locale:               "en",
+			GallerySize:          3,
+			ThemeColor:           "var(--blue)",
 			Permissions: UserDefaultsPermissions{
 				Modify:   false,
 				Share:    false,
@@ -729,15 +699,14 @@ func setDefaults(generate bool) Settings {
 				Download: boolPtr(true), // defaults to true
 			},
 			Preview: UserDefaultsPreview{
+				HighQuality:        boolPtr(true),
 				Image:              boolPtr(true),
 				Video:              boolPtr(true),
-				Audio:              boolPtr(true),
 				MotionVideoPreview: boolPtr(true),
 				Office:             boolPtr(true),
 				PopUp:              boolPtr(true),
 				AutoplayMedia:      boolPtr(true),
 				Folder:             boolPtr(true),
-				Models:             boolPtr(true),
 			},
 			FileLoading: users.FileLoading{
 				MaxConcurrent:     10,
@@ -817,13 +786,23 @@ func loadCustomFavicon() {
 	Env.FaviconPath = validatedPath
 	Env.FaviconIsCustom = true
 	logger.Infof("Using custom favicon: %s", Env.FaviconPath)
-	// PWA and platform PNGs are generated at server startup from this path (SVG uses a raster
-	// sidecar next to the .svg when present; see icons.GeneratePWAIcons).
 }

-// PWAIconsCacheDir is where startup icon generation writes PNGs (under the server cache dir).
-func PWAIconsCacheDir() string {
-	return filepath.Join(Config.Server.CacheDir, "icons")
+// generatePWAIcons sets up PWA icon paths (actual generation happens after preview service starts)
+func generatePWAIcons() {
+	// Set PWA icons directory in cache
+	Env.PWAIconsDir = filepath.Join(Config.Server.CacheDir, "icons")
+
+	// Initialize with default paths (all icons will be generated)
+	Env.PWAIcon192 = "icons/pwa-icon-192.png"
+	Env.PWAIcon256 = "icons/pwa-icon-256.png"
+	Env.PWAIcon512 = "icons/pwa-icon-512.png"
+
+	// Create icons directory with configured permissions
+	// Note: Parent cache directory should already exist from testCacheDirSpeed()
+	if err := os.MkdirAll(Env.PWAIconsDir, fileutils.PermDir); err != nil {
+		logger.Warningf("Failed to create PWA icons directory %s: %v", Env.PWAIconsDir, err)
+	}
 }

 func loadLoginIcon() {
@@ -877,7 +856,26 @@ func setConditionals(config *Source) {
 		IgnoreAllZeroSizeFolders: false,
 		IgnoreAllSymlinks:        false,
 		IndexingDisabled:         false,
-		NoRules:                  len(rules) == 0,
+	}
+
+	// backwards compatibility
+	if config.Config.Conditionals.Hidden {
+		logger.Warning("source.conditionals.hidden is deprecated, use source.rules instead")
+		resolved.IgnoreAllHidden = true
+	}
+	// Backwards compatibility: if old format fields are set, treat as global rules
+	if config.Config.Conditionals.IgnoreHidden {
+		logger.Warning("source.conditionals.ignoreHidden is deprecated, use source.rules instead")
+		resolved.IgnoreAllHidden = true
+	}
+	if config.Config.DisableIndexing {
+		logger.Warning("source.disableIndexing is deprecated, use source.rules instead")
+		resolved.IndexingDisabled = true
+	}
+
+	if config.Config.Conditionals.ZeroSizeFolders {
+		logger.Warning("source.conditionals.zeroSizeFolders is deprecated, use source.rules instead")
+		resolved.IgnoreAllZeroSizeFolders = true
 	}

 	// Process all rules and infer global flags from root-level rules
@@ -14,7 +14,6 @@ import (
 	"sort"
 	"strings"

-	"golang.org/x/tools/go/packages"
 	"gopkg.in/yaml.v3"
 )

@@ -112,93 +111,74 @@ func CollectCommentsAndSecrets(srcPath string) (CommentsMap, SecretFieldsMap, De
 	return comments, secrets, deprecated, nil
 }

-// parseDirectoryComments parses a single directory for comments, secrets, and deprecated fields.
+// parseDirectoryComments parses a single directory for comments, secrets, and deprecated fields
 func parseDirectoryComments(dir string) (CommentsMap, SecretFieldsMap, DeprecatedFieldsMap, error) {
-	absDir, err := filepath.Abs(dir)
+	fset := token.NewFileSet()
+	pkgs, err := parser.ParseDir(fset, dir, nil, parser.ParseComments)
 	if err != nil {
 		return nil, nil, nil, err
 	}

-	var files []*ast.File
-	cfg := &packages.Config{
-		Mode: packages.NeedSyntax | packages.NeedFiles,
-		Dir:  absDir,
-		ParseFile: func(fset *token.FileSet, filename string, src []byte) (*ast.File, error) {
-			return parser.ParseFile(fset, filename, src, parser.ParseComments)
-		},
-	}
-	pkgs, err := packages.Load(cfg, ".")
-	if err == nil && len(pkgs) > 0 {
-		for _, pkg := range pkgs {
-			files = append(files, pkg.Syntax...)
-		}
-	}
-	if len(files) == 0 {
-		// Fallback for directories outside a module (e.g. test temp dirs): parse .go files directly
-		files, err = parseDirGoFiles(absDir)
-		if err != nil || len(files) == 0 {
-			return nil, nil, nil, err
-		}
-	}
-
 	comments := make(CommentsMap)
 	secrets := make(SecretFieldsMap)
 	deprecated := make(DeprecatedFieldsMap)

-	for _, file := range files {
-		for _, decl := range file.Decls {
-			gen, ok := decl.(*ast.GenDecl)
-			if !ok || gen.Tok != token.TYPE {
-				continue
-			}
-			for _, spec := range gen.Specs {
-				ts, ok := spec.(*ast.TypeSpec)
-				if !ok {
+	for _, pkg := range pkgs {
+		for _, file := range pkg.Files {
+			for _, decl := range file.Decls {
+				gen, ok := decl.(*ast.GenDecl)
+				if !ok || gen.Tok != token.TYPE {
 					continue
 				}
-				st, ok := ts.Type.(*ast.StructType)
-				if !ok {
-					continue
-				}
-				typeName := ts.Name.Name
-				commentMap := make(map[string]string)
-				secretMap := make(map[string]bool)
-				deprecatedMap := make(map[string]bool)
-				comments[typeName] = commentMap
-				secrets[typeName] = secretMap
-				deprecated[typeName] = deprecatedMap
-
-				for _, field := range st.Fields.List {
-					if len(field.Names) == 0 {
+				for _, spec := range gen.Specs {
+					ts, ok := spec.(*ast.TypeSpec)
+					if !ok {
 						continue
 					}
-					name := field.Names[0].Name
-					var parts []string
-					var fullComment string
-
-					if field.Doc != nil {
-						docText := strings.TrimSpace(field.Doc.Text())
-						parts = append(parts, docText)
-						fullComment += docText + " "
-					}
-					if field.Comment != nil {
-						commentText := strings.TrimSpace(field.Comment.Text())
-						parts = append(parts, commentText)
-						fullComment += commentText
+					st, ok := ts.Type.(*ast.StructType)
+					if !ok {
+						continue
 					}
+					typeName := ts.Name.Name
+					commentMap := make(map[string]string)
+					secretMap := make(map[string]bool)
+					deprecatedMap := make(map[string]bool)
+					comments[typeName] = commentMap
+					secrets[typeName] = secretMap
+					deprecated[typeName] = deprecatedMap

-					if len(parts) > 0 {
-						commentMap[name] = strings.Join(parts, " : ")
-					}
+					for _, field := range st.Fields.List {
+						if len(field.Names) == 0 {
+							continue
+						}
+						name := field.Names[0].Name
+						var parts []string
+						var fullComment string

-					// Check if field should be treated as secret
-					if strings.Contains(strings.ToLower(fullComment), "secret:") {
-						secretMap[name] = true
-					}
+						if field.Doc != nil {
+							docText := strings.TrimSpace(field.Doc.Text())
+							parts = append(parts, docText)
+							fullComment += docText + " "
+						}
+						if field.Comment != nil {
+							commentText := strings.TrimSpace(field.Comment.Text())
+							parts = append(parts, commentText)
+							fullComment += commentText
+						}

-					// Check if field should be treated as deprecated
-					if strings.Contains(strings.ToLower(fullComment), "deprecated:") {
-						deprecatedMap[name] = true
+						if len(parts) > 0 {
+							commentMap[name] = strings.Join(parts, " : ")
+						}
+
+						// Check if field should be treated as secret
+						if strings.Contains(strings.ToLower(fullComment), "secret:") {
+							secretMap[name] = true
+						}
+
+						// Check if field should be treated as deprecated
+						if strings.Contains(strings.ToLower(fullComment), "deprecated:") {
+							deprecatedMap[name] = true
+						}
 					}
 				}
 			}
@@ -207,29 +187,6 @@ func parseDirectoryComments(dir string) (CommentsMap, SecretFieldsMap, Deprecate
 	return comments, secrets, deprecated, nil
 }

-// parseDirGoFiles parses all .go files in dir and returns their ASTs. Used when the directory
-// is not inside a Go module (e.g. test temp dirs) so packages.Load would fail.
-func parseDirGoFiles(dir string) ([]*ast.File, error) {
-	entries, err := os.ReadDir(dir)
-	if err != nil {
-		return nil, err
-	}
-	fset := token.NewFileSet()
-	var files []*ast.File
-	for _, e := range entries {
-		if e.IsDir() || !strings.HasSuffix(e.Name(), ".go") {
-			continue
-		}
-		path := filepath.Join(dir, e.Name())
-		f, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
-		if err != nil {
-			return nil, err
-		}
-		files = append(files, f)
-	}
-	return files, nil
-}
-
 // PathToTypeField represents a mapping from YAML path to Go type and field info
 type PathToTypeField struct {
 	TypeName  string
@@ -561,130 +518,6 @@ func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.V

 			currentField := v.Field(i)

-			// Check if this is an inline/embedded field
-			yamlTag := sf.Tag.Get("yaml")
-			jsonTag := sf.Tag.Get("json")
-			isInline := strings.Contains(yamlTag, ",inline") || strings.Contains(jsonTag, ",inline") || sf.Anonymous
-
-			// If field is inline, merge its content directly into parent
-			if isInline && sf.Type.Kind() == reflect.Struct {
-				// Get the embedded struct's fields and add them directly to this level
-				embeddedType := sf.Type
-				embeddedValue := currentField
-				embeddedTypeName := embeddedType.Name()
-
-				for j := 0; j < embeddedType.NumField(); j++ {
-					embeddedField := embeddedType.Field(j)
-
-					// Skip unexported fields
-					if embeddedField.PkgPath != "" {
-						continue
-					}
-					if embeddedYamlTag := embeddedField.Tag.Get("yaml"); embeddedYamlTag == "-" {
-						continue
-					}
-					if embeddedJsonTag := embeddedField.Tag.Get("json"); embeddedJsonTag == "-" {
-						continue
-					}
-
-					// Skip deprecated fields
-					if len(deprecated) > 0 && deprecated[embeddedTypeName][embeddedField.Name] {
-						continue
-					}
-
-					embeddedFieldValue := embeddedValue.Field(j)
-
-					// If we have defaults, compare and skip if values match
-					if defaults.IsValid() && i < defaults.NumField() {
-						defaultInlineField := defaults.Field(i)
-						if defaultInlineField.Kind() == reflect.Struct && j < defaultInlineField.NumField() {
-							defaultEmbeddedField := defaultInlineField.Field(j)
-							embeddedCurrentValue := embeddedFieldValue.Interface()
-							embeddedDefaultValue := defaultEmbeddedField.Interface()
-
-							if reflect.DeepEqual(embeddedCurrentValue, embeddedDefaultValue) {
-								continue
-							}
-						}
-					}
-
-					// Determine key name for embedded field
-					embeddedYamlTag := embeddedField.Tag.Get("yaml")
-					embeddedJsonTag := embeddedField.Tag.Get("json")
-					var embeddedKeyName string
-					if embeddedYamlTag != "" && embeddedYamlTag != "-" {
-						embeddedKeyName = strings.Split(embeddedYamlTag, ",")[0]
-					} else if embeddedJsonTag != "" && embeddedJsonTag != "-" {
-						embeddedKeyName = strings.Split(embeddedJsonTag, ",")[0]
-					} else {
-						embeddedKeyName = embeddedField.Name
-					}
-
-					keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: embeddedKeyName}
-
-					// Attach comments for embedded field
-					var parts []string
-					var comment string
-					if cm := comm[embeddedTypeName][embeddedField.Name]; cm != "" {
-						comment = cm
-					}
-
-					if comment != "" {
-						parts = append(parts, comment)
-					}
-					if len(comm) > 0 {
-						if vt := embeddedField.Tag.Get("validate"); vt != "" {
-							parts = append(parts, fmt.Sprintf(" validate:%s", vt))
-						}
-					}
-
-					if len(parts) > 0 {
-						keyNode.LineComment = strings.Join(parts, " ")
-					}
-
-					// Build value node for embedded field
-					var valNode *yaml.Node
-					var err error
-					generateConfig := os.Getenv("FILEBROWSER_GENERATE_CONFIG") == "true"
-					if secrets[embeddedTypeName][embeddedField.Name] && !generateConfig {
-						fieldValue := embeddedFieldValue.Interface()
-						if str, ok := fieldValue.(string); ok && str == "" {
-							valNode = &yaml.Node{
-								Kind:  yaml.ScalarNode,
-								Tag:   "!!str",
-								Value: "",
-								Style: yaml.DoubleQuotedStyle,
-							}
-						} else {
-							valNode = &yaml.Node{
-								Kind:  yaml.ScalarNode,
-								Tag:   "!!str",
-								Value: "**hidden**",
-								Style: yaml.DoubleQuotedStyle,
-							}
-						}
-					} else {
-						var defaultEmbeddedField reflect.Value
-						if defaults.IsValid() && i < defaults.NumField() {
-							defaultInlineField := defaults.Field(i)
-							if defaultInlineField.Kind() == reflect.Struct && j < defaultInlineField.NumField() {
-								defaultEmbeddedField = defaultInlineField.Field(j)
-							}
-						}
-
-						valNode, err = buildNodeWithDefaults(embeddedFieldValue, comm, defaultEmbeddedField, secrets, deprecated)
-						if err != nil {
-							return nil, err
-						}
-					}
-
-					mapNode.Content = append(mapNode.Content, keyNode, valNode)
-				}
-
-				// Skip adding the embedded struct itself as a field
-				continue
-			}
-
 			// If we have defaults, compare and skip if values match
 			if defaults.IsValid() && i < defaults.NumField() {
 				defaultField := defaults.Field(i)
@@ -699,6 +532,8 @@ func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.V
 			}

 			// determine key: yaml tag > json tag > field name
+			yamlTag := sf.Tag.Get("yaml")
+			jsonTag := sf.Tag.Get("json")
 			var keyName string
 			if yamlTag != "" && yamlTag != "-" {
 				keyName = strings.Split(yamlTag, ",")[0]
@@ -877,11 +712,25 @@ func GenerateYaml() {
 	setupLogging()
 	setupFs()
 	setupAuth(true)
+
+	// Save original paths before setupSources modifies them (for YAML generation)
+	originalPaths := make(map[*Source]string)
+	for _, source := range Config.Server.Sources {
+		originalPaths[source] = source.Path
+	}
+
 	setupSources(true)
 	setupUrls()
-	setupMedia(true)
+	setupMedia()
 	setupFrontend(true)

+	// Restore original paths so the YAML output has the correct paths, not the placeholder
+	for _, source := range Config.Server.Sources {
+		if originalPath, ok := originalPaths[source]; ok {
+			source.Path = originalPath
+		}
+	}
+
 	output := "../frontend/public/config.generated.yaml" // "output YAML file"

 	// Generate YAML with comments enabled, full config, and deprecated fields filtered
@@ -65,71 +65,49 @@ func AdminPerms() users.Permissions {
 }

 // Apply applies the default options to a user.
-// Keep this in sync with [UserDefaults]: every user-facing field there should be copied
-// here (except DefaultScopes, which is wired through source config rather than this helper).
 func ApplyUserDefaults(u *users.User) {
-	d := Config.UserDefaults
+	u.StickySidebar = Config.UserDefaults.StickySidebar
+	u.DisableSettings = Config.UserDefaults.DisableSettings

-	u.DisableSettings = d.DisableSettings
-	u.LockPassword = d.LockPassword
+	// Handle DarkMode with default - dereference pointer from config
+	u.DarkMode = boolValueOrDefault(Config.UserDefaults.DarkMode, true)

-	u.EditorQuickSave = d.EditorQuickSave
-	u.HideSidebarFileActions = d.HideSidebarFileActions
-	u.DisableQuickToggles = d.DisableQuickToggles
-	u.DisableSearchOptions = d.DisableSearchOptions
-	u.StickySidebar = d.StickySidebar
-	u.HideFilesInTree = d.HideFilesInTree
-	u.DarkMode = boolValueOrDefault(d.DarkMode, true)
-	u.Locale = d.Locale
-	u.ViewMode = d.ViewMode
-	u.SingleClick = d.SingleClick
-	u.ShowHidden = d.ShowHidden
-	u.DateFormat = d.DateFormat
-	u.GallerySize = d.GallerySize
-	u.ThemeColor = d.ThemeColor
-	u.QuickDownload = d.QuickDownload
-	u.DisablePreviewExt = d.DisablePreviewExt
-	u.DisableViewingExt = d.DisableViewingExt
-	u.DisableUpdateNotifications = d.DisableUpdateNotifications
-	u.DisableOfficePreviewExt = d.DisableOfficePreviewExt
-	u.DisableOnlyOfficeExt = d.DisableOnlyOfficeExt
-	u.CustomTheme = d.CustomTheme
-	u.ShowSelectMultiple = d.ShowSelectMultiple
-	u.DebugOffice = d.DebugOffice
-	u.DeleteWithoutConfirming = d.DeleteWithoutConfirming
-	u.DeleteAfterArchive = d.DeleteAfterArchive
-	u.PreferEditorForMarkdown = d.PreferEditorForMarkdown
-	u.FileLoading = d.FileLoading
+	u.Locale = Config.UserDefaults.Locale
+	u.ViewMode = Config.UserDefaults.ViewMode
+	u.SingleClick = Config.UserDefaults.SingleClick

-	u.Preview.DisableHideSidebar = d.Preview.DisableHideSidebar
-	u.Preview.Image = boolValueOrDefault(d.Preview.Image, true)
-	u.Preview.Video = boolValueOrDefault(d.Preview.Video, true)
-	u.Preview.Audio = boolValueOrDefault(d.Preview.Audio, true)
-	u.Preview.MotionVideoPreview = boolValueOrDefault(d.Preview.MotionVideoPreview, true)
-	u.Preview.Office = boolValueOrDefault(d.Preview.Office, true)
-	u.Preview.PopUp = boolValueOrDefault(d.Preview.PopUp, true)
-	u.Preview.AutoplayMedia = boolValueOrDefault(d.Preview.AutoplayMedia, true)
-	u.Preview.DefaultMediaPlayer = d.Preview.DefaultMediaPlayer
-	u.Preview.Folder = boolValueOrDefault(d.Preview.Folder, true)
-	u.Preview.Models = boolValueOrDefault(d.Preview.Models, true)
+	// Handle Permissions - convert from pointer-based defaults to regular bools
+	u.Permissions.Api = Config.UserDefaults.Permissions.Api
+	u.Permissions.Admin = Config.UserDefaults.Permissions.Admin
+	u.Permissions.Modify = Config.UserDefaults.Permissions.Modify
+	u.Permissions.Share = Config.UserDefaults.Permissions.Share
+	u.Permissions.Realtime = Config.UserDefaults.Permissions.Realtime
+	u.Permissions.Delete = Config.UserDefaults.Permissions.Delete
+	u.Permissions.Create = Config.UserDefaults.Permissions.Create
+	u.Permissions.Download = boolValueOrDefault(Config.UserDefaults.Permissions.Download, true)

-	if u.Username == "anonymous" {
-		return
-	}
-
-	u.Permissions.Api = d.Permissions.Api
-	u.Permissions.Admin = d.Permissions.Admin
-	u.Permissions.Modify = d.Permissions.Modify
-	u.Permissions.Share = d.Permissions.Share
-	u.Permissions.Realtime = d.Permissions.Realtime
-	u.Permissions.Delete = d.Permissions.Delete
-	u.Permissions.Create = d.Permissions.Create
-	u.Permissions.Download = boolValueOrDefault(d.Permissions.Download, true)
-
-	if u.LoginMethod == "" && d.LoginMethod != "" {
-		u.LoginMethod = users.LoginMethod(d.LoginMethod)
-	}
+	// Handle Preview - convert from pointer-based defaults to regular bools
+	u.Preview.DisableHideSidebar = Config.UserDefaults.Preview.DisableHideSidebar
+	u.Preview.HighQuality = boolValueOrDefault(Config.UserDefaults.Preview.HighQuality, true)
+	u.Preview.Image = boolValueOrDefault(Config.UserDefaults.Preview.Image, true)
+	u.Preview.Video = boolValueOrDefault(Config.UserDefaults.Preview.Video, true)
+	u.Preview.MotionVideoPreview = boolValueOrDefault(Config.UserDefaults.Preview.MotionVideoPreview, true)
+	u.Preview.Office = boolValueOrDefault(Config.UserDefaults.Preview.Office, true)
+	u.Preview.PopUp = boolValueOrDefault(Config.UserDefaults.Preview.PopUp, true)
+	u.Preview.AutoplayMedia = boolValueOrDefault(Config.UserDefaults.Preview.AutoplayMedia, true)
+	u.Preview.DefaultMediaPlayer = Config.UserDefaults.Preview.DefaultMediaPlayer
+	u.Preview.Folder = boolValueOrDefault(Config.UserDefaults.Preview.Folder, true)

+	u.ShowHidden = Config.UserDefaults.ShowHidden
+	u.DateFormat = Config.UserDefaults.DateFormat
+	u.DisableViewingExt = Config.UserDefaults.DisableViewingExt
+	u.ThemeColor = Config.UserDefaults.ThemeColor
+	u.GallerySize = Config.UserDefaults.GallerySize
+	u.QuickDownload = Config.UserDefaults.QuickDownload
+	u.LockPassword = Config.UserDefaults.LockPassword
+	u.DisableOnlyOfficeExt = Config.UserDefaults.DisableOnlyOfficeExt
+	u.FileLoading = Config.UserDefaults.FileLoading
+	u.DisableOfficePreviewExt = Config.UserDefaults.DisableOfficePreviewExt
 	if len(u.Scopes) == 0 {
 		for _, source := range Config.Server.Sources {
 			if source.Config.DefaultEnabled {
@@ -36,6 +36,10 @@ type Environment struct {
 	FaviconPath           string `json:"-"` // resolved favicon path (filesystem or embedded)
 	FaviconIsCustom       bool   `json:"-"` // true if favicon is from custom filesystem path
 	FaviconEmbeddedPath   string `json:"-"` // embedded asset path for default favicon
+	PWAIconsDir           string `json:"-"` // directory where generated PWA icons are stored
+	PWAIcon192            string `json:"-"` // path to 192x192 PWA icon
+	PWAIcon256            string `json:"-"` // path to 256x256 PWA icon
+	PWAIcon512            string `json:"-"` // path to 512x512 PWA icon
 }

 type Server struct {
@@ -58,10 +62,10 @@ type Server struct {
 	InternalUrl                  string         `json:"internalUrl"`     // used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
 	CacheDir                     string         `json:"cacheDir"`        // path to the cache directory, used for thumbnails and other cached files
 	CacheDirCleanup              bool           `json:"cacheDirCleanup"` // whether to automatically cleanup the cache directory. Note: docker must also mount a persistent volume to persist the cache (default: false)
-	MaxArchiveSizeGB             int64          `json:"maxArchiveSize"`  // maximum archive/unarchive size in GB. 0 means no limit. (default: 20)
+	MaxArchiveSizeGB             int64          `json:"maxArchiveSize"`  // max pre-archive combined size of files/folder that are allowed to be archived (in GB)
 	Filesystem                   Filesystem     `json:"filesystem"`      // filesystem settings
 	IndexSqlConfig               IndexSqlConfig `json:"indexSqlConfig"`  // Index database SQL configuration
-	DisableWebDAV                bool           `json:"disableWebDAV"`   // disable webdav support (default: false)
+
 	// not exposed to config
 	SourceMap    map[string]*Source `json:"-" validate:"omitempty"` // uses realpath as key
 	NameToSource map[string]*Source `json:"-" validate:"omitempty"` // uses name as key
@@ -72,22 +76,11 @@ type Filesystem struct {
 	CreateDirectoryPermission string `json:"createDirectoryPermission" validate:"required,file_permission"` // Unix permissions like 755, 2755, 1777 (default: 755)
 }

-// Index SQL startup integrity modes (IndexSqlConfig.StartupIntegrityCheck).
-const (
-	// IndexStartupIntegrityQuickCheck runs PRAGMA quick_check (default). Slower on very large DBs but thorough.
-	IndexStartupIntegrityQuickCheck = "quickCheck"
-	// IndexStartupIntegrityProbe verifies sqlite_master and optionally one row read only; fast for large indexes.
-	IndexStartupIntegrityProbe = "probe"
-	// IndexStartupIntegrityOff skips startup checks beyond sql.Open Ping; least safe, fastest boot.
-	IndexStartupIntegrityOff = "off"
-)
-
 type IndexSqlConfig struct {
-	BatchSize             int    `json:"batchSize"`                                                                       // number of items to batch in a single transaction, typically 500-5000. higher = faster but could use more memory.
-	CacheSizeMB           int    `json:"cacheSizeMB"`                                                                     // size of the SQLite cache in MB
-	WalMode               bool   `json:"walMode"`                                                                         // enable the more complex WAL journaling mode. Slower, more memory usage, but better for deployments with constant user activity.
-	DisableReuse          bool   `json:"disableReuse"`                                                                    // enable to always create a new indexing database on startup.
-	StartupIntegrityCheck string `json:"startupIntegrityCheck,omitempty" validate:"omitempty,oneof=quickCheck probe off"` // the method used to check the integrity of the index database on startup (default: quickCheck)
+	BatchSize    int  `json:"batchSize"`    // number of items to batch in a single transaction, typically 500-5000. higher = faster but could use more memory.
+	CacheSizeMB  int  `json:"cacheSizeMB"`  // size of the SQLite cache in MB
+	WalMode      bool `json:"walMode"`      // enable the more complex WAL journaling mode. Slower, more memory usage, but better for deployments with constant user activity.
+	DisableReuse bool `json:"disableReuse"` // enable to always create a new indexing database on startup.
 }

 type Integrations struct {
@@ -109,7 +102,6 @@ type Media struct {
 	Convert                  FfmpegConvert `json:"convert"`                  // config for ffmpeg conversion settings
 	Debug                    bool          `json:"debug"`                    // output ffmpeg stdout for media integration -- careful can produces lots of output!
 	ExtractEmbeddedSubtitles bool          `json:"extractEmbeddedSubtitles"` // extract embedded subtitles from media files
-	ExiftoolPath             string        `json:"exiftoolPath"`             // path to exiftool executable
 }

 type FfmpegConvert struct {
@@ -268,7 +260,6 @@ type ResolvedRulesConfig struct {
 	IgnoreAllZeroSizeFolders bool // Excludes all folders with 0 size
 	IgnoreAllSymlinks        bool // Excludes all symbolic links
 	IndexingDisabled         bool // Excludes all files and folders from indexing
-	NoRules                  bool // No rules are configured
 }

 type Frontend struct {
@@ -281,7 +272,6 @@ type Frontend struct {
 	Favicon               string         `json:"favicon"`             // path to a favicon to use for the frontend
 	Description           string         `json:"description"`         // description that shows up in html head meta description
 	LoginIcon             string         `json:"loginIcon"`           // path to an image file for the login page icon
-	LoginButtonText       string         `json:"loginButtonText"`     // text to display on the login button
 	OIDCLoginButtonText   string         `json:"oidcLoginButtonText"` // text to display on the OIDC login button
 }

@@ -311,17 +301,15 @@ type ExternalLink struct {
 // UserDefaultsPreview holds preview settings with pointer types for defaults
 type UserDefaultsPreview struct {
 	DisableHideSidebar bool  `json:"disableHideSidebar"` // keep sidebar open when previewing files
-	HighQuality        *bool `json:"highQuality"`        // deprecated: always true in v1.3.0+
+	HighQuality        *bool `json:"highQuality"`        // use high quality thumbnails
 	Image              *bool `json:"image"`              // show thumbnails for image files
 	Video              *bool `json:"video"`              // show thumbnails for video files
-	Audio              *bool `json:"audio"`              // show thumbnails for audio files
 	MotionVideoPreview *bool `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
 	Office             *bool `json:"office"`             // show thumbnails for office files
 	PopUp              *bool `json:"popup"`              // show larger popup preview when hovering over thumbnail
 	AutoplayMedia      *bool `json:"autoplayMedia"`      // autoplay media files in preview
 	DefaultMediaPlayer bool  `json:"defaultMediaPlayer"` // disable the styled feature-rich media player for browser default
 	Folder             *bool `json:"folder"`             // show thumbnails for folders that have previewable contents
-	Models             *bool `json:"models"`             // show live thumbnails for 3D models files
 }

 // UserDefaultsPermissions holds permission settings with pointer types for defaults
@@ -344,7 +332,6 @@ type UserDefaults struct {
 	DisableQuickToggles        bool                    `json:"disableQuickToggles"`       // disable the quick toggles in the sidebar
 	DisableSearchOptions       bool                    `json:"disableSearchOptions"`      // disable the search options in the search bar
 	StickySidebar              bool                    `json:"stickySidebar"`             // keep sidebar open when navigating
-	HideFilesInTree            bool                    `json:"hideFilesInTree"`           // hide files in the sidebar tree navigation, when true, will show only directories.
 	DarkMode                   *bool                   `json:"darkMode"`                  // should dark mode be enabled
 	Locale                     string                  `json:"locale"`                    // language to use: eg. de, en, or fr
 	ViewMode                   string                  `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
@@ -364,12 +351,10 @@ type UserDefaults struct {
 	LoginMethod                string                  `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
 	DisableUpdateNotifications bool                    `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
 	DeleteWithoutConfirming    bool                    `json:"deleteWithoutConfirming"`    // delete files without confirmation
-	DeleteAfterArchive         bool                    `json:"deleteAfterArchive"`         // delete source files after successful creation/extraction of archives
 	FileLoading                users.FileLoading       `json:"fileLoading"`                // upload and download settings
 	DisableOfficePreviewExt    string                  `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
 	DisableOnlyOfficeExt       string                  `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
 	CustomTheme                string                  `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
 	ShowSelectMultiple         bool                    `json:"showSelectMultiple"`         // show select multiple files on desktop
 	DebugOffice                bool                    `json:"debugOffice"`                // debug onlyoffice editor
-	PreferEditorForMarkdown    bool                    `json:"preferEditorForMarkdown"`    // prefer editor first for markdown files instead of the Markdown Viewer.
 }
@@ -1,46 +0,0 @@
-package utils
-
-import (
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/hex"
-
-	"golang.org/x/crypto/bcrypt"
-)
-
-var BcryptCost = bcrypt.DefaultCost
-var InvalidPasswordHash = ""
-
-// HashPwd hashes a password.
-func HashPwd(password string) (string, error) {
-	bytes, err := bcrypt.GenerateFromPassword([]byte(password), BcryptCost)
-	return string(bytes), err
-}
-
-// CheckPwd checks if a password is correct.
-func CheckPwd(password, hash string) error {
-	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
-}
-
-func SetInvalidPasswordHash() error {
-	passwordHash, err := HashPwd(InsecureRandomIdentifier(16))
-	if err != nil {
-		return err
-	}
-	InvalidPasswordHash = passwordHash
-	return nil
-}
-
-func HashSHA256(data string) string {
-	bytes := sha256.Sum256([]byte(data))
-	return hex.EncodeToString(bytes[:])
-}
-
-func GenerateKey() string {
-	b := make([]byte, 64)
-	_, err := rand.Read(b)
-	if err != nil {
-		return ""
-	}
-	return string(b)
-}
@@ -52,15 +52,12 @@ type FileOptions struct {
 	IsDir                    bool
 	Expand                   bool
 	Content                  bool
-	Recursive                bool   // whether to recursively index directories
-	Metadata                 bool   // whether to get metadata
-	ExtractEmbeddedSubtitles bool   // whether to extract embedded subtitles from media files
-	AlbumArt                 bool   // whether to get album art from media files
-	ShowHidden               bool   // whether to show hidden files (true = show, false = hide)
-	FollowSymlinks           bool   // whether to follow symlinks
-	Only                     string // whether to only get files or folders
-	SkipExtendedAttrs        bool   // whether to skip extended attributes
-	ShowSharedAttr           bool   // whether to show share attributes
+	Recursive                bool // whether to recursively index directories
+	Metadata                 bool // whether to get metadata
+	ExtractEmbeddedSubtitles bool // whether to extract embedded subtitles from media files
+	AlbumArt                 bool // whether to get album art from media files
+	ShowHidden               bool // whether to show hidden files (true = show, false = hide)
+	FollowSymlinks           bool // whether to follow symlinks
 }

 // SanitizeUserPath prevents path traversal attacks by cleaning and validating user input.
@@ -80,9 +77,5 @@ func SanitizeUserPath(userPath string) (string, error) {
 		}
 	}

-	if clean == "." {
-		return "", fmt.Errorf("invalid path: path must standard index path")
-	}
-
 	return clean, nil
 }
@@ -2,6 +2,9 @@ package utils

 import (
 	"cmp"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	math "math/rand"
 	"os"
@@ -20,6 +23,15 @@ func CheckErr(source string, err error) {
 	}
 }

+func GenerateKey() string {
+	b := make([]byte, 64)
+	_, err := rand.Read(b)
+	if err != nil {
+		return ""
+	}
+	return string(b)
+}
+
 // CapitalizeFirst returns the input string with the first letter capitalized.
 func CapitalizeFirst(s string) string {
 	if len(s) == 0 {
@@ -80,6 +92,11 @@ func GetParentDirectoryPath(path string) string {
 	return path[:lastSlash]
 }

+func HashSHA256(data string) string {
+	bytes := sha256.Sum256([]byte(data))
+	return hex.EncodeToString(bytes[:])
+}
+
 func GetLastComponent(path string) string {
 	if path == "" {
 		return ""
@@ -8,4 +8,4 @@ userDefaults:
    image: true
    popup: true
    video: true
-    audio: true
+    highQuality: true
@@ -11,7 +11,6 @@ userDefaults:
  disableQuickToggles: false              # disable the quick toggles in the sidebar
  disableSearchOptions: false             # disable the search options in the search bar
  stickySidebar: true                     # keep sidebar open when navigating
-  hideFilesInTree: false                  # hide files in the sidebar tree navigation, when true, will show only directories.
  darkMode: true                          # should dark mode be enabled (defaults to true if not set)
  viewMode: "normal"                      # view mode to use: eg. normal, list, grid, or compact
  singleClick: false                      # open directory on single click, also enables middle click to open in new tab
@@ -26,16 +25,15 @@ userDefaults:
  disableSettings: false                  # disable the user from viewing the settings page
  preview:
    disableHideSidebar: false             # disable the hide sidebar preview for previews and editors
+    highQuality: true                     # generate high quality thumbnail preview images (defaults to true if not set)
    image: true                           # show thumbnail preview image for image files (defaults to true if not set)
    video: true                           # show thumbnail preview image for video files (defaults to true if not set)
-    audio: true                           # show thumbnail preview image for audio files (defaults to true if not set)
    motionVideoPreview: true              # show multiple frames for videos in thumbnail preview when hovering (defaults to true if not set)
    office: true                          # show thumbnail preview image for office files (defaults to true if not set)
    popup: true                           # show larger popup preview when hovering over thumbnail (defaults to true if not set)
    autoplayMedia: true                   # autoplay media files in preview (defaults to true if not set)
    defaultMediaPlayer: false             # disable html5 media player and use the default media player
    folder: true                          # show thumbnail preview image for folder files (defaults to true if not set)
-    models: true                          # show live thumbnail preview for 3D Models files (defaults to true if not set)
  permissions:
    api: false                            # allow api access
    admin: false                          # allow admin access
@@ -47,9 +45,7 @@ userDefaults:
    download: true                        # allow downloading files (defaults to true if not set)
  disableUpdateNotifications: false       # disable update notifications banner for admin users
  deleteWithoutConfirming: false          # delete files without confirmation
-  deleteAfterArchive: true                # delete source files after successful creation/extraction of archives
  disableOnlyOfficeExt: ".md .txt .pdf .html .xml"   # list of file extensions to disable onlyoffice editor for
  customTheme: ""                         # Name of theme to use chosen from custom themes config.
  showSelectMultiple: false               # show select multiple files on desktop
-  debugOffice: false                      # debug onlyoffice editor
-  preferEditorForMarkdown: false          # prefer editor first for markdown files instead of the Markdown Viewer
+  debugOffice: false                      # debug onlyoffice editor
@@ -37,10 +37,8 @@ type SourceRuleMap map[string]RuleMap
 type StringSet map[string]struct{}

 type dbStorage struct {
-	AllRules      SourceRuleMap       `json:"all_rules"`
-	Groups        GroupMap            `json:"groups"`
-	RevokedTokens map[string]struct{} `json:"revoked_tokens"` // set of revoked token hashes
-	HashedTokens  map[string]uint     `json:"hashed_tokens"`  // maps token hash → user ID
+	AllRules SourceRuleMap `json:"all_rules"`
+	Groups   GroupMap      `json:"groups"`
 }

 // RuleSet groups users and groups for allow/deny lists.
@@ -74,26 +72,21 @@ type GroupMap map[string]StringSet

 // Storage manages access rules and group membership.
 type Storage struct {
-	mux           sync.RWMutex
-	AllRules      SourceRuleMap       // AllRules[sourcePath][indexPath] - in-memory authoritative state
-	Groups        GroupMap            // key: group name, value: set of usernames - in-memory authoritative state
-	RevokedTokens map[string]struct{} // set of revoked token hashes - in-memory authoritative state
-	HashedTokens  map[string]uint     // maps token hash → user ID - in-memory authoritative state
-	DB            *storm.DB           // Optional: DB for persistence
-	Users         *users.Storage      // Reference to users storage
+	mux      sync.RWMutex
+	AllRules SourceRuleMap  // AllRules[sourcePath][indexPath] - in-memory authoritative state
+	Groups   GroupMap       // key: group name, value: set of usernames - in-memory authoritative state
+	DB       *storm.DB      // Optional: DB for persistence
+	Users    *users.Storage // Reference to users storage
 }

 // SaveToDB persists all rules to the DB if DB is set.
-// IMPORTANT: Caller must hold s.mux lock (either read or write).
 func (s *Storage) SaveToDB() error {
 	if s.DB == nil {
 		return nil
 	}
 	data, err := json.Marshal(&dbStorage{
-		AllRules:      s.AllRules,
-		Groups:        s.Groups,
-		RevokedTokens: s.RevokedTokens,
-		HashedTokens:  s.HashedTokens,
+		AllRules: s.AllRules,
+		Groups:   s.Groups,
 	})
 	if err != nil {
 		return err
@@ -104,8 +97,6 @@ func (s *Storage) SaveToDB() error {
 // Flush persists the current in-memory state to the backing store.
 // Call during graceful shutdown to ensure DB matches memory.
 func (s *Storage) Flush() error {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
 	return s.SaveToDB()
 }

@@ -132,18 +123,6 @@ func (s *Storage) LoadFromDB() error {
 	if s.Groups == nil {
 		s.Groups = make(GroupMap)
 	}
-	s.RevokedTokens = storage.RevokedTokens
-	if s.RevokedTokens == nil {
-		s.RevokedTokens = make(map[string]struct{})
-	}
-	s.HashedTokens = storage.HashedTokens
-	if s.HashedTokens == nil {
-		s.HashedTokens = make(map[string]uint)
-	}
-	s.HashedTokens = storage.HashedTokens
-	if s.HashedTokens == nil {
-		s.HashedTokens = make(map[string]uint)
-	}
 	s.mux.Unlock()
 	return nil
 }
@@ -157,12 +136,10 @@ func (s *Storage) LoadFromDB() error {
 //	if err != nil { /* handle error */ }
 func NewStorage(db *storm.DB, usersStore *users.Storage) *Storage {
 	var s = &Storage{
-		AllRules:      make(SourceRuleMap),
-		Groups:        make(GroupMap),
-		RevokedTokens: make(map[string]struct{}),
-		HashedTokens:  make(map[string]uint),
-		DB:            db,
-		Users:         usersStore,
+		AllRules: make(SourceRuleMap),
+		Groups:   make(GroupMap),
+		DB:       db,
+		Users:    usersStore,
 	}
 	return s
 }
@@ -1259,63 +1236,3 @@ func (s *Storage) UpdateRulePath(sourcePath, oldPath, newPath string) error {
 	logger.Debugf("access rule path updated: source=%s, fromPath=%s, toPath=%s", sourcePath, oldPath, newPath)
 	return s.SaveToDB()
 }
-
-// RevokeToken adds a token hash to the revoked list and persists to DB.
-func (s *Storage) RevokeToken(tokenHash string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-
-	tokenHash = utils.HashSHA256(tokenHash)
-	s.RevokedTokens[tokenHash] = struct{}{}
-	// Also remove from HashedTokens to prevent future lookups
-	delete(s.HashedTokens, tokenHash)
-	return s.SaveToDB()
-}
-
-// IsTokenRevoked checks if a token hash is in the revoked list (memory-only read).
-func (s *Storage) IsTokenRevoked(tokenHash string) bool {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-	tokenHash = utils.HashSHA256(tokenHash)
-	_, exists := s.RevokedTokens[tokenHash]
-	return exists
-}
-
-// AddHashedToken adds a token hash to user ID mapping.
-func (s *Storage) AddApiToken(tokenString string, userID uint) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	tokenHash := utils.HashSHA256(tokenString)
-	s.HashedTokens[tokenHash] = userID
-	return s.SaveToDB()
-}
-
-// GetUserIDFromToken retrieves the user ID for a given token string (memory-only read).
-func (s *Storage) GetUserIDFromToken(tokenString string) (uint, bool) {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-	tokenHash := utils.HashSHA256(tokenString)
-	userID, exists := s.HashedTokens[tokenHash]
-	return userID, exists
-}
-
-// GetRevokedTokens returns a copy of all revoked token hashes.
-func (s *Storage) GetRevokedTokens() map[string]struct{} {
-	s.mux.RLock()
-	defer s.mux.RUnlock()
-	// Return a copy to prevent external modification
-	result := make(map[string]struct{}, len(s.RevokedTokens))
-	for k := range s.RevokedTokens {
-		result[k] = struct{}{}
-	}
-	return result
-}
-
-// RemoveApiToken removes a token hash mapping (used when deleting API keys).
-func (s *Storage) RemoveApiToken(tokenString string) error {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	tokenHash := utils.HashSHA256(tokenString)
-	delete(s.HashedTokens, tokenHash)
-	return s.SaveToDB()
-}
@@ -7,7 +7,7 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )

-func (s *Storage) CheckChildItemAccess(response *iteminfo.FileInfo, index *indexing.Index, username string) error {
+func (s *Storage) CheckChildItemAccess(response *iteminfo.ExtendedFileInfo, index *indexing.Index, username string) error {

 	// Collect all item names to check
 	allItemNames := make([]string, 0, len(response.Folders)+len(response.Files))
@@ -17,11 +17,6 @@ type IndexInfo struct {
 	NumDirs    uint64 `json:"numDirs"`
 	NumFiles   uint64 `json:"numFiles"`

-	// Disk usage (cached from periodic GetIndexInfo / partition probes; aligns with ReducedIndex Stats)
-	UsedAsIndexed uint64 `json:"used"`
-	UsedDisk      uint64 `json:"usedAlt"`
-	DiskTotal     uint64 `json:"total"`
-
 	// Scanner information - map of scanner path to scanner stats
 	Scanners map[string]*PersistedScannerInfo `json:"scanners"`
 }
@@ -2,13 +2,10 @@ package share

 import (
 	"fmt"
-	"net/url"
 	"os"
 	"path/filepath"
-	"strings"

 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

 // IsSingleFileShare determines if this share is for a single file (not a directory).
@@ -147,73 +144,10 @@ func (l *Link) HasReachedUserLimit(username string) bool {
 	return count >= l.DownloadsLimit
 }

-func (l *Link) GetSourceName() string {
+func (l *Link) GetSourceName() (string, error) {
 	sourceInfo, ok := settings.Config.Server.SourceMap[l.Source]
 	if !ok {
-		return ""
+		return "", fmt.Errorf("source not found")
 	}
-	return sourceInfo.Name
-}
-
-func (l *Link) UserCanEdit(user *users.User) bool {
-	return l.UserID == user.ID || user.Permissions.Admin
-}
-
-func (l *Link) SourceURL(user *users.User) string {
-	sourceName := l.GetSourceName()
-	// get user scope path from share
-	userScope, err := user.GetScopeForSourceName(sourceName)
-	if err != nil {
-		return ""
-	}
-	if !strings.HasPrefix(l.Path, userScope) {
-		return ""
-	}
-	scopedPath := strings.TrimPrefix(l.Path, userScope)
-	return "/" + filepath.Join("files", sourceName, scopedPath)
-}
-
-func (l *Link) BannerURL() string {
-	_, _, err := l.GetShareImagePartsHelper(true)
-	if err == nil {
-		return fmt.Sprintf("%s%spublic/api/share/image?banner=true&hash=%s", settings.Config.Server.ExternalUrl, settings.Config.Server.BaseURL, l.Hash)
-	}
-	return l.Banner
-}
-
-func (l *Link) FaviconURL() string {
-	_, _, err := l.GetShareImagePartsHelper(false)
-	if err == nil {
-		return fmt.Sprintf("%s%spublic/api/share/image?favicon=true&hash=%s", settings.Config.Server.ExternalUrl, settings.Config.Server.BaseURL, l.Hash)
-	}
-	return l.Favicon
-}
-
-func (l *Link) GetShareImagePartsHelper(isBanner bool) (string, string, error) {
-	// Get the asset query string from share
-	var assetQueryString string
-	if isBanner {
-		assetQueryString = l.Banner
-	} else {
-		assetQueryString = l.Favicon
-	}
-
-	if assetQueryString == "" {
-		return "", "", fmt.Errorf("asset not configured for this share")
-	}
-
-	// Parse the query string to extract source and path
-	assetParams, err := url.ParseQuery(assetQueryString)
-	if err != nil {
-		return "", "", fmt.Errorf("invalid asset configuration: %v", err)
-	}
-
-	sourceName := assetParams.Get("source")
-	assetPath := assetParams.Get("path")
-
-	if sourceName == "" || assetPath == "" {
-		return "", "", fmt.Errorf("source or path not found in asset configuration")
-	}
-
-	return sourceName, assetPath, nil
+	return sourceInfo.Name, nil
 }
@@ -43,10 +43,8 @@ type CommonShare struct {
 	AllowReplacements        bool                `json:"allowReplacements,omitempty"` // allow replacements of files
 	SidebarLinks             []users.SidebarLink `json:"sidebarLinks"`                // customizable sidebar links
 	HasPassword              bool                `json:"hasPassword,omitempty"`
-	ShowHidden               bool                `json:"showHidden,omitempty"` // show hidden files in share (true = show, false = hide)
-	DisableLoginOption       bool                `json:"disableLoginOption"`   // disable login option in share (true = hide, false = show)
-	SourceURL                string              `json:"sourceURL,omitempty"`
-	CanEditShare             bool                `json:"canEditShare,omitempty"`
+	ShowHidden               bool                `json:"showHidden,omitempty"`         // show hidden files in share (true = show, false = hide)
+	DisableLoginOption       bool                `json:"disableLoginOption,omitempty"` // disable login option in share (true = hide, false = show)
 }
 type CreateBody struct {
 	CommonShare
@@ -56,179 +56,86 @@ func (c *crudBackend) DeleteByID(id any) error {

 // Storage is a share storage using generics.
 type Storage struct {
-	Generic     *crud.Storage[Link]
-	back        StorageBackend
-	shareByHash map[string]*Link             // key: link hash
-	shareByPath map[string]map[string]string // key: pathKey(Source, Path), value: set of hashes (hash -> "")
-	mu          sync.RWMutex
-	users       *users.Storage
+	Generic    *crud.Storage[Link]
+	back       StorageBackend
+	shareCache map[string]*Link
+	mu         sync.RWMutex
+	users      *users.Storage
 }

-// pathKey returns the cache key for shareByPath (source + path).
-func pathKey(source, path string) string {
-	return source + ":" + path
-}
-
-// setCacheLocked updates both shareByHash and shareByPath for the given link.
-// Caller must hold s.mu.
-func (s *Storage) setCacheLocked(link *Link) {
-	if link == nil {
-		return
-	}
-	adjustedPath := utils.AddTrailingSlashIfNotExists(link.Path)
-	adjustedSource := utils.AddTrailingSlashIfNotExists(link.Source)
-	s.shareByHash[link.Hash] = link
-	key := pathKey(adjustedSource, adjustedPath)
-	if s.shareByPath[key] == nil {
-		s.shareByPath[key] = make(map[string]string)
-	}
-	s.shareByPath[key][link.Hash] = ""
-}
-
-// setCache updates both caches for the given link. It acquires s.mu.
-func (s *Storage) setCache(link *Link) {
-	s.mu.Lock()
-	s.setCacheLocked(link)
-	s.mu.Unlock()
-}
-
-// deleteFromCacheLocked removes the link (by hash) from both caches.
-// Caller must hold s.mu.
-func (s *Storage) deleteFromCacheLocked(hash string) {
-	link, ok := s.shareByHash[hash]
-	if !ok {
-		return
-	}
-	adjustedPath := utils.AddTrailingSlashIfNotExists(link.Path)
-	adjustedSource := utils.AddTrailingSlashIfNotExists(link.Source)
-	key := pathKey(adjustedSource, adjustedPath)
-	if inner, ok := s.shareByPath[key]; ok {
-		delete(inner, hash)
-		if len(inner) == 0 {
-			delete(s.shareByPath, key)
-		}
-	}
-	delete(s.shareByHash, hash)
-}
-
-// deleteFromCache removes the link (by hash) from both caches. It acquires s.mu.
-func (s *Storage) deleteFromCache(hash string) {
-	s.mu.Lock()
-	s.deleteFromCacheLocked(hash)
-	s.mu.Unlock()
-}
-
-// setCacheAfterMove updates both caches when a link's Source or Path changed. It acquires s.mu.
-func (s *Storage) setCacheAfterMove(link *Link, oldSource, oldPath string) {
-	s.mu.Lock()
-	if link == nil {
-		return
-	}
-	adjustedOldPath := utils.AddTrailingSlashIfNotExists(oldPath)
-	adjustedOldSource := utils.AddTrailingSlashIfNotExists(oldSource)
-	oldKey := pathKey(adjustedOldSource, adjustedOldPath)
-	if inner, ok := s.shareByPath[oldKey]; ok {
-		delete(inner, link.Hash)
-		if len(inner) == 0 {
-			delete(s.shareByPath, oldKey)
-		}
-	}
-	s.setCacheLocked(link)
-	s.mu.Unlock()
-}
-
-// NewStorage creates a share links storage from a backend and populates the
-// in-memory cache from the database so all reads can be served from cache.
+// NewStorage creates a share links storage from a backend.
 func NewStorage(back StorageBackend, usersStore *users.Storage) *Storage {
-	s := &Storage{
-		Generic:     crud.NewStorage[Link](&crudBackend{back: back}),
-		back:        back,
-		shareByHash: make(map[string]*Link),
-		shareByPath: make(map[string]map[string]string),
-		users:       usersStore,
+	return &Storage{
+		Generic:    crud.NewStorage[Link](&crudBackend{back: back}),
+		back:       back,
+		shareCache: make(map[string]*Link),
+		users:      usersStore,
 	}
-	s.loadShareCache()
-	return s
 }

-// loadShareCache fills shareByHash and shareByPath from the backend and removes expired links from the DB.
-// Call once at startup so all reads can be served from cache.
-func (s *Storage) loadShareCache() {
-	links, err := s.back.All()
-	if err != nil && err != errors.ErrNotExist {
-		return
-	}
-	if links == nil {
-		links = []*Link{}
-	}
-	s.mu.Lock()
-	for _, link := range links {
-		if link == nil {
-			continue
-		}
-		if link.Expire != 0 && link.Expire <= time.Now().Unix() && !link.KeepAfterExpiration {
-			_ = s.back.Delete(link.Hash)
-			continue
-		}
-		link.InitUserDownloads()
-		s.setCacheLocked(link)
-	}
-	s.mu.Unlock()
-}
-
-// LoadShareCacheFromDB repopulates the in-memory cache from the database.
-// Call at startup (e.g. from InitializeDb) to ensure shares are loaded after the store is ready.
-func (s *Storage) LoadShareCacheFromDB() {
-	s.loadShareCache()
-}
-
-// All returns all non-expired shares from the cache (populated at startup and by writes).
+// All wraps StorageBackend.All and handles expiry.
 func (s *Storage) All() ([]*Link, error) {
+	links, err := s.back.All()
+	if err != nil {
+		return nil, err
+	}
+	filtered, err := s.filterExpired(links)
+	if err != nil {
+		return nil, err
+	}
+
 	s.mu.Lock()
-	result := make([]*Link, 0, len(s.shareByHash))
-	for _, l := range s.shareByHash {
+	for i, l := range filtered {
 		if l == nil {
 			continue
 		}
-		if l.Expire != 0 && l.Expire <= time.Now().Unix() && !l.KeepAfterExpiration {
-			_ = s.back.Delete(l.Hash)
-			s.deleteFromCacheLocked(l.Hash)
-			continue
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			filtered[i] = existing
+		} else {
+			s.shareCache[l.Hash] = l
 		}
-		result = append(result, l)
 	}
 	s.mu.Unlock()
-	return result, nil
+	return filtered, nil
 }

-// FindByUserID returns non-expired shares for the user from the cache.
+// FindByUserID wraps StorageBackend.FindByUserID and handles expiry.
 func (s *Storage) FindByUserID(id uint) ([]*Link, error) {
+	links, err := s.back.FindByUserID(id)
+	if err != nil {
+		return nil, err
+	}
+	filtered, err := s.filterExpired(links)
+	if err != nil {
+		return nil, err
+	}
+
 	s.mu.Lock()
-	result := make([]*Link, 0)
-	for _, l := range s.shareByHash {
-		if l == nil || l.UserID != id {
+	for i, l := range filtered {
+		if l == nil {
 			continue
 		}
-		if l.Expire != 0 && l.Expire <= time.Now().Unix() && !l.KeepAfterExpiration {
-			_ = s.back.Delete(l.Hash)
-			s.deleteFromCacheLocked(l.Hash)
-			continue
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			filtered[i] = existing
+		} else {
+			s.shareCache[l.Hash] = l
 		}
-		result = append(result, l)
 	}
 	s.mu.Unlock()
-	return result, nil
+	return filtered, nil
 }

 // GetByHash wraps StorageBackend.GetByHash and handles expiry.
 func (s *Storage) GetByHash(hash string) (*Link, error) {
 	// return stable in-memory pointer if available
 	s.mu.RLock()
-	if link, ok := s.shareByHash[hash]; ok && link != nil {
+	if link, ok := s.shareCache[hash]; ok && link != nil {
 		s.mu.RUnlock()
 		if link.Expire != 0 && link.Expire <= time.Now().Unix() {
 			_ = s.back.Delete(hash)
-			s.deleteFromCache(hash)
+			s.mu.Lock()
+			delete(s.shareCache, hash)
+			s.mu.Unlock()
 			return nil, errors.ErrNotExist
 		}
 		return link, nil
@@ -247,7 +154,9 @@ func (s *Storage) GetByHash(hash string) (*Link, error) {
 	// Initialize UserDownloads map
 	link.InitUserDownloads()

-	s.setCache(link)
+	s.mu.Lock()
+	s.shareCache[hash] = link
+	s.mu.Unlock()
 	return link, nil
 }

@@ -255,74 +164,68 @@ func (s *Storage) GetByHash(hash string) (*Link, error) {
 func (s *Storage) GetPermanent(path, source string, id uint) (*Link, error) {
 	l, err := s.back.GetPermanent(path, source, id)
 	if err == nil && l != nil {
-		s.setCache(l)
+		s.mu.Lock()
+
+		s.shareCache[l.Hash] = l
+		s.mu.Unlock()
 	}
 	return l, err
 }

-// Gets returns shares for the given path, source, and user from the cache.
+// Gets wraps StorageBackend.Gets and handles expiry.
 func (s *Storage) Gets(sourcePath, source string, id uint) ([]*Link, error) {
-	s.mu.Lock()
-	adjustedPath := utils.AddTrailingSlashIfNotExists(sourcePath)
-	adjustedSource := utils.AddTrailingSlashIfNotExists(source)
-	key := pathKey(adjustedSource, adjustedPath)
-	hashes := s.shareByPath[key]
-	result := make([]*Link, 0, len(hashes))
-	for h := range hashes {
-		l := s.shareByHash[h]
-		if l == nil || l.UserID != id {
-			continue
-		}
-		if l.Expire != 0 && l.Expire <= time.Now().Unix() && !l.KeepAfterExpiration {
-			_ = s.back.Delete(l.Hash)
-			s.deleteFromCacheLocked(l.Hash)
-			continue
-		}
-		result = append(result, l)
+	links, err := s.back.Gets(sourcePath, source, id)
+	if err != nil {
+		return nil, err
+	}
+	filtered, err := s.filterExpired(links)
+	if err != nil {
+		return nil, err
 	}
-	s.mu.Unlock()
-	return result, nil
-}
-
-// GetBySourcePath returns shares for the given path and source from the cache.
-func (s *Storage) GetBySourcePath(path, source string) ([]*Link, error) {
 	s.mu.Lock()
-	adjustedPath := utils.AddTrailingSlashIfNotExists(path)
-	adjustedSource := utils.AddTrailingSlashIfNotExists(source)
-	key := pathKey(adjustedSource, adjustedPath)
-	hashes := s.shareByPath[key]
-	result := make([]*Link, 0, len(hashes))
-	for h := range hashes {
-		l := s.shareByHash[h]
+	for i, l := range filtered {
 		if l == nil {
 			continue
 		}
-		if l.Expire != 0 && l.Expire <= time.Now().Unix() && !l.KeepAfterExpiration {
-			_ = s.back.Delete(l.Hash)
-			s.deleteFromCacheLocked(l.Hash)
-			continue
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			filtered[i] = existing
+		} else {
+			s.shareCache[l.Hash] = l
 		}
-		result = append(result, l)
 	}
 	s.mu.Unlock()
-	return result, nil
+	return filtered, nil
 }

-// IsShared returns whether the given path and source have any shares in the cache.
-func (s *Storage) IsShared(path, source string, id uint) bool {
-	links, _ := s.GetBySourcePath(path, source)
-	for _, l := range links {
-		if l.UserID == id {
-			return true
+// GetBySourcePath wraps StorageBackend.GetBySourcePath and handles expiry.
+func (s *Storage) GetBySourcePath(path, source string) ([]*Link, error) {
+	links, err := s.back.GetBySourcePath(path, source)
+	if err != nil {
+		return nil, err
+	}
+	filtered, err := s.filterExpired(links)
+	if err != nil {
+		return nil, err
+	}
+	s.mu.Lock()
+	for i, l := range filtered {
+		if l == nil {
+			continue
+		}
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			filtered[i] = existing
+		} else {
+			s.shareCache[l.Hash] = l
 		}
 	}
-	return len(links) > 0
+	s.mu.Unlock()
+	return filtered, nil
 }

 // UpdateShares updates all shares that match oldSource and oldPath to point to newSource and newPath.
 // Handles both exact matches and subdirectories, regardless of trailing slashes.
 func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (int, error) {
-	links, err := s.All()
+	links, err := s.back.All()
 	if err != nil && err != errors.ErrNotExist {
 		logger.Error("failed to list shares", "error", err)
 		return 0, err
@@ -352,7 +255,14 @@ func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (i
 			return updated, err
 		}

-		s.setCacheAfterMove(l, oldSource, oldPath)
+		s.mu.Lock()
+		if existing, ok := s.shareCache[l.Hash]; ok && existing != nil {
+			existing.Source = l.Source
+			existing.Path = l.Path
+		} else {
+			s.shareCache[l.Hash] = l
+		}
+		s.mu.Unlock()
 		updated++
 	}
 	return updated, nil
@@ -373,7 +283,11 @@ func (s *Storage) UpdateSharePath(hash, newPath string) error {
 		return err
 	}

-	s.setCacheAfterMove(link, link.Source, oldPath)
+	s.mu.Lock()
+	if existing, ok := s.shareCache[hash]; ok && existing != nil {
+		existing.Path = newPath
+	}
+	s.mu.Unlock()

 	logger.Debug("share path updated", "hash", hash, "fromPath", oldPath, "toPath", newPath)
 	return nil
@@ -384,7 +298,9 @@ func (s *Storage) Save(l *Link) error {
 	if err := s.back.Save(l); err != nil {
 		return err
 	}
-	s.setCache(l)
+	s.mu.Lock()
+	s.shareCache[l.Hash] = l
+	s.mu.Unlock()
 	return nil
 }

@@ -393,16 +309,47 @@ func (s *Storage) Delete(hash string) error {
 	if err := s.back.Delete(hash); err != nil {
 		return err
 	}
-	s.deleteFromCache(hash)
+	s.mu.Lock()
+	delete(s.shareCache, hash)
+	s.mu.Unlock()
 	return nil
 }

-// Flush is a no-op: every share write (Save, Delete, UpdateShares, UpdateSharePath) already
-// updates the database, so the cache and DB stay in sync without flushing.
+// Flush persists the current in-memory state of all shares to the backing store.
+// Call during graceful shutdown to ensure DB matches memory.
 func (s *Storage) Flush() error {
+	s.mu.RLock()
+	links := make([]*Link, 0, len(s.shareCache))
+	for _, l := range s.shareCache {
+		if l != nil {
+			links = append(links, l)
+		}
+	}
+	s.mu.RUnlock()
+	for _, l := range links {
+		if err := s.back.Save(l); err != nil {
+			return err
+		}
+	}
 	return nil
 }

+// filterExpired removes expired links and deletes them from storage.
+func (s *Storage) filterExpired(links []*Link) ([]*Link, error) {
+	var filtered []*Link
+	for _, link := range links {
+		if link.Expire != 0 && link.Expire <= time.Now().Unix() && !link.KeepAfterExpiration {
+			_ = s.back.Delete(link.Hash)
+			s.mu.Lock()
+			delete(s.shareCache, link.Hash)
+			s.mu.Unlock()
+			continue
+		}
+		filtered = append(filtered, link)
+	}
+	return filtered, nil
+}
+
 // GetCommonShareByHash retrieves only the CommonShare attributes for a given hash
 func (s *Storage) GetCommonShareByHash(hash string) (*CommonShare, error) {
 	return s.back.GetCommonShareByHash(hash)
@@ -2,7 +2,6 @@ package sql

 import (
 	"database/sql"
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -91,8 +90,7 @@ func NewIndexDB(name string, journalMode string, batchSize int, cacheSizeMB int,
 	// For persistent databases, check integrity on startup
 	// If corrupted, delete and recreate the database
 	if !disableReuse {
-		mode := normalizeStartupIntegrityMode(settings.Config.Server.IndexSqlConfig.StartupIntegrityCheck)
-		if err := idxDB.runStartupIntegrityCheck(mode); err != nil {
+		if err := idxDB.checkIntegrityAndRecreateIfNeeded(); err != nil {
 			// Database was recreated due to corruption
 			logger.Warningf("[DB_INIT] SQLite database was found with issues which could be due to a dirty shutdown, recreating: tmp/index_%s.db", name)
 			isNewDb = true
@@ -114,73 +112,10 @@ func NewIndexDB(name string, journalMode string, batchSize int, cacheSizeMB int,
 	return idxDB, isNewDb, nil
 }

-func normalizeStartupIntegrityMode(m string) string {
-	switch m {
-	case "", settings.IndexStartupIntegrityQuickCheck:
-		return settings.IndexStartupIntegrityQuickCheck
-	case settings.IndexStartupIntegrityProbe:
-		return settings.IndexStartupIntegrityProbe
-	case settings.IndexStartupIntegrityOff:
-		return settings.IndexStartupIntegrityOff
-	default:
-		logger.Warningf("[DB_INIT] unknown indexSqlConfig.startupIntegrityCheck %q, using %s", m, settings.IndexStartupIntegrityQuickCheck)
-		return settings.IndexStartupIntegrityQuickCheck
-	}
-}
-
-// runStartupIntegrityCheck runs the configured startup check (quick_check, probe, or off).
-func (db *IndexDB) runStartupIntegrityCheck(mode string) error {
-	switch mode {
-	case settings.IndexStartupIntegrityOff:
-		logger.Debugf("[DB_INTEGRITY] startup integrity skipped (startupIntegrityCheck=off)")
-		return nil
-	case settings.IndexStartupIntegrityProbe:
-		return db.checkAccessibilityProbe()
-	default:
-		// quickCheck (including normalized default)
-		return db.checkIntegrityAndRecreateIfNeeded()
-	}
-}
-
-// checkAccessibilityProbe verifies the DB file is readable: sqlite_master and optionally one row from index_items.
-// If index_items is absent (brand-new file), succeeds so CreateIndexTable can create it.
-func (db *IndexDB) checkAccessibilityProbe() error {
-	start := time.Now()
-	defer func() {
-		logger.Debugf("[DB_INTEGRITY] startup probe completed in %v", time.Since(start))
-	}()
-
-	var n int
-	err := db.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name = 'index_items'`).Scan(&n)
-	if err != nil {
-		logger.Warningf("[DB_INTEGRITY] probe: cannot read sqlite_master: %v", err)
-		return db.deleteCorruptedDatabase()
-	}
-	if n == 0 {
-		logger.Debugf("[DB_INTEGRITY] probe: index_items not present yet (new database), skipping row read")
-		return nil
-	}
-
-	var dummy int
-	err = db.QueryRow(`SELECT 1 FROM index_items LIMIT 1`).Scan(&dummy)
-	if errors.Is(err, sql.ErrNoRows) {
-		return nil
-	}
-	if err != nil {
-		logger.Warningf("[DB_INTEGRITY] probe: cannot read index_items: %v", err)
-		return db.deleteCorruptedDatabase()
-	}
-	return nil
-}
-
 // checkIntegrityAndRecreateIfNeeded checks database integrity.
 // If corruption is detected, deletes the database file and returns an error to trigger recreation.
 // Returns nil if integrity is OK, error if database needs to be recreated.
 func (db *IndexDB) checkIntegrityAndRecreateIfNeeded() error {
-	start := time.Now()
-	defer func() {
-		logger.Debugf("[DB_INTEGRITY] PRAGMA quick_check completed in %v", time.Since(start))
-	}()
 	// Quick integrity check
 	var result string
 	err := db.QueryRow("PRAGMA quick_check").Scan(&result)
@@ -298,70 +233,28 @@ func (db *IndexDB) InsertItem(source, path string, info *iteminfo.FileInfo) erro
 	return err
 }

-// dbTransientOpAttempts is how many times to run a bulk DB op that may hit SQLITE_BUSY before giving up.
-const dbTransientOpAttempts = 2
-
-const dbTransientRetryBackoff = 50 * time.Millisecond
-
 // BulkInsertItems inserts multiple items in a single transaction for a specific source.
 // Database errors (busy/locked) are treated as soft failures - the filesystem is the source of truth.
 // Returns nil on success or soft failure (busy/locked), error only on hard failures.
-// Transient busy/locked errors retry once before giving up (see dbTransientOpAttempts).
 func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) error {
-	if len(items) == 0 {
-		return nil
-	}

 	startTime := time.Now()
-	for attempt := 1; attempt <= dbTransientOpAttempts; attempt++ {
-		ok, transient, err := db.attemptBulkInsert(source, items)
-		if err != nil {
-			return err
-		}
-		if ok {
-			if attempt > 1 {
-				logger.Infof("[DB_TX] BulkInsertItems: succeeded on retry (%d items, attempt %d, %v)",
-					len(items), attempt, time.Since(startTime))
-			}
-			return nil
-		}
-		if transient && attempt < dbTransientOpAttempts {
-			logger.Warningf("[DB_TX] BulkInsertItems: transient DB error (attempt %d/%d, %d items), retrying after %v",
-				attempt, dbTransientOpAttempts, len(items), dbTransientRetryBackoff)
-			time.Sleep(dbTransientRetryBackoff)
-			continue
-		}
-		if transient {
-			logger.Warningf("[DB_TX] BulkInsertItems: still failing after %d attempts (%d items, %v) — batch dropped",
-				dbTransientOpAttempts, len(items), time.Since(startTime))
-		}
-		return nil
-	}
-	return nil // defensive if dbTransientOpAttempts is ever 0 and loop never runs
-}

-// attemptBulkInsert runs one transactional bulk insert.
-// Returns success=true when committed; transient=true when SQLITE_BUSY-like errors allow a retry (mutex released).
-func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo) (success bool, transient bool, err error) {
 	tx, err := db.BeginTransaction()
 	if err != nil {
+		// Soft failure: DB is busy or locked, skip this update
 		if isBusyError(err) || isTransactionError(err) {
-			db.mu.Unlock()
-			logger.Debugf("[DB_TX] BulkInsertItems: BeginTransaction failed (DB busy/locked): %v", err)
-			return false, true, nil
+			db.mu.Unlock() // Release mutex on error
+			logger.Debugf("[DB_TX] BulkInsertItems: BeginTransaction failed (DB busy/locked), skipping - took %v", time.Since(startTime))
+			return nil // Non-fatal: filesystem will be used as fallback
 		}
-		db.mu.Unlock()
-		return false, false, err
+		db.mu.Unlock() // Release mutex on error
+		return err     // Hard failure: something is wrong with the DB
 	}
+	defer db.mu.Unlock() // Ensure mutex is always released

-	committed := false
-	defer func() {
-		if !committed {
-			_ = tx.Rollback()
-		}
-		db.mu.Unlock()
-	}()
-
+	// Always update all fields including last_updated, even if nothing changed
+	// This ensures last_updated stays current for stale entry detection
 	stmt, err := tx.Prepare(`
 	INSERT INTO index_items (source, path, parent_path, name, size, mod_time, type, is_dir, is_hidden, has_preview, last_updated)
 	VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -378,12 +271,14 @@ func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo)
 	`)
 	if err != nil {
 		if isBusyError(err) || isTransactionError(err) {
-			logger.Debugf("[DB_TX] BulkInsertItems: Prepare busy/locked: %v", err)
-			return false, true, nil
+			// With EXCLUSIVE locking and mutex, this shouldn't happen.
+			// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
+			logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Prepare: %v", err)
+			return nil
 		}
-		return false, false, err
+		return err
 	}
-	defer stmt.Close()
+	defer stmt.Close() // Ensure statement is always closed

 	nowUnix := time.Now().Unix()
 	for _, info := range items {
@@ -403,23 +298,28 @@ func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo)
 		)
 		if err != nil {
 			if isBusyError(err) || isTransactionError(err) {
-				logger.Debugf("[DB_TX] BulkInsertItems: Exec busy/locked during insert: %v", err)
-				return false, true, nil
+				// With EXCLUSIVE locking and mutex, this shouldn't happen.
+				// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
+				logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Exec: %v", err)
+				return nil
 			}
 			logger.Errorf("[DB] BulkInsertItems: Exec failed for path=%s, source=%s, error=%v", info.Path, source, err)
-			return false, false, err
+			return err
 		}
 	}

+	// Try to commit
 	if err := tx.Commit(); err != nil {
 		if isBusyError(err) || isTransactionError(err) {
-			logger.Debugf("[DB_TX] BulkInsertItems: Commit busy/locked: %v", err)
-			return false, true, nil
+			// With EXCLUSIVE locking and mutex, this shouldn't happen.
+			// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
+			logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Commit: %v", err)
+			return nil
 		}
-		return false, false, err
+		return err
 	}
-	committed = true
-	return true, false, nil
+
+	return nil
 }

 // isBusyError checks if an error is SQLITE_BUSY (error code 5)
@@ -509,6 +409,51 @@ func (db *IndexDB) GetItemsByPaths(source string, paths []string) (map[string]*i
 	return result, nil
 }

+// GetHasPreviewBatch retrieves hasPreview status for multiple directory paths in a single query.
+// This is optimized for the N+1 query pattern in GetDirInfo where we need hasPreview for all subdirectories.
+// Returns map[path]hasPreview. Missing paths in the result indicate they're not in the database yet.
+func (db *IndexDB) GetHasPreviewBatch(source string, paths []string) (map[string]bool, error) {
+	if len(paths) == 0 {
+		return make(map[string]bool), nil
+	}
+
+	// Build query with IN clause - only select path and has_preview for efficiency
+	placeholders := make([]string, len(paths))
+	args := make([]interface{}, len(paths)+1)
+	args[0] = source
+	for i, path := range paths {
+		placeholders[i] = "?"
+		args[i+1] = path
+	}
+
+	query := fmt.Sprintf(`
+	SELECT path, has_preview
+	FROM index_items WHERE source = ? AND path IN (%s) AND is_dir = 1
+	`, strings.Join(placeholders, ","))
+
+	rows, err := db.Query(query, args...)
+	if err != nil {
+		// Soft failure: DB is busy or locked, return empty map
+		if isBusyError(err) || isTransactionError(err) {
+			return make(map[string]bool), nil
+		}
+		return nil, err
+	}
+	defer rows.Close()
+
+	result := make(map[string]bool)
+	for rows.Next() {
+		var path string
+		var hasPreview bool
+		if err := rows.Scan(&path, &hasPreview); err != nil {
+			return nil, err
+		}
+		result[path] = hasPreview
+	}
+
+	return result, nil
+}
+
 // GetDirectoryChildren retrieves all children of a directory for a specific source.
 func (db *IndexDB) GetDirectoryChildren(source, dirPath string) ([]*iteminfo.FileInfo, error) {
 	query := `
@@ -596,7 +541,7 @@ func (db *IndexDB) ExplainQueryPlan(query string, args ...interface{}) (string,
 		if err := rows.Scan(&id, &parent, &notused, &detail); err != nil {
 			return "", err
 		}
-		fmt.Fprintf(&plan, "%d|%d|%s\n", id, parent, detail)
+		plan.WriteString(fmt.Sprintf("%d|%d|%s\n", id, parent, detail))
 	}
 	return plan.String(), rows.Err()
 }
@@ -1067,31 +1012,17 @@ func (db *IndexDB) UpdateFolderSizesIfChanged(source string, pathSizes map[strin
 		args = append(args, path)
 	}

-	startTime := time.Now()
-	for attempt := 1; attempt <= dbTransientOpAttempts; attempt++ {
-		result, err := db.Exec(query, args...)
-		if err != nil {
-			if isBusyError(err) || isTransactionError(err) {
-				if attempt < dbTransientOpAttempts {
-					logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: busy/locked (attempt %d/%d), retrying after %v: %v",
-						attempt, dbTransientOpAttempts, dbTransientRetryBackoff, err)
-					time.Sleep(dbTransientRetryBackoff)
-					continue
-				}
-				logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: still busy after %d attempts (%d paths, %v) — skipped",
-					dbTransientOpAttempts, len(pathSizes), time.Since(startTime))
-				return 0, nil
-			}
-			return 0, err
+	result, err := db.Exec(query, args...)
+	if err != nil {
+		if isBusyError(err) || isTransactionError(err) {
+			logger.Debugf("[DB_TX] UpdateFolderSizesIfChanged: DB busy/locked, skipping update")
+			return 0, nil // Non-fatal: sizes will be synced on next scan
 		}
-		n, _ := result.RowsAffected()
-		if attempt > 1 {
-			logger.Infof("[DB_TX] UpdateFolderSizesIfChanged: succeeded on retry (%d rows, attempt %d, %v)",
-				n, attempt, time.Since(startTime))
-		}
-		return n, nil
+		return 0, err
 	}
-	return 0, nil // defensive: unreachable when dbTransientOpAttempts >= 1
+
+	rowsAffected, _ := result.RowsAffected()
+	return rowsAffected, nil
 }

 // LoadFolderSizes loads all folder sizes for a source from the database
@@ -1267,6 +1198,23 @@ func (db *IndexDB) GetSizeGroupsForDuplicates(source string, minSize int64, path
 	return sizes, sizeCounts, rows.Err()
 }

+// GetTotalSize returns the sum of all file sizes in the index for a specific source (excluding directories).
+func (db *IndexDB) GetTotalSize(source string) (uint64, error) {
+	query := `SELECT COALESCE(SUM(size), 0) FROM index_items WHERE source = ? AND is_dir = 0`
+
+	var totalSize int64
+	err := db.QueryRow(query, source).Scan(&totalSize)
+	if err != nil {
+		// Soft failure: DB is busy or locked, return 0
+		if isBusyError(err) || isTransactionError(err) {
+			return 0, nil
+		}
+		return 0, err
+	}
+
+	return uint64(totalSize), nil
+}
+
 // Helper functions

 // getNextPathPrefix returns the lexicographically next string after the given prefix.
@@ -1324,7 +1272,6 @@ func scanItem(scanner interface{ Scan(...interface{}) error }) (*iteminfo.FileIn
 		return nil, err
 	}
 	info.ModTime = time.Unix(modTime, 0)
-	info.IsDir = isDir
 	return &info, nil
 }

@@ -1,129 +0,0 @@
-package sql
-
-import (
-	"os"
-	"testing"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
-)
-
-func TestMain(m *testing.M) {
-	if fileutils.PermDir == 0 {
-		fileutils.SetFsPermissions(0o644, 0o755)
-	}
-	os.Exit(m.Run())
-}
-
-func TestNormalizeStartupIntegrityMode(t *testing.T) {
-	tests := []struct {
-		in   string
-		want string
-	}{
-		{"", settings.IndexStartupIntegrityQuickCheck},
-		{"quickCheck", settings.IndexStartupIntegrityQuickCheck},
-		{"probe", settings.IndexStartupIntegrityProbe},
-		{"off", settings.IndexStartupIntegrityOff},
-		{"not-a-real-mode", settings.IndexStartupIntegrityQuickCheck},
-	}
-	for _, tt := range tests {
-		if got := normalizeStartupIntegrityMode(tt.in); got != tt.want {
-			t.Errorf("normalizeStartupIntegrityMode(%q) = %q, want %q", tt.in, got, tt.want)
-		}
-	}
-}
-
-// pushTestIndexConfig sets CacheDir and index SQL options for NewIndexDB; returned func restores prior values.
-func pushTestIndexConfig(t *testing.T, cacheDir string, idx settings.IndexSqlConfig) func() {
-	t.Helper()
-	prevDir := settings.Config.Server.CacheDir
-	prevIdx := settings.Config.Server.IndexSqlConfig
-	settings.Config.Server.CacheDir = cacheDir
-	settings.Config.Server.IndexSqlConfig = idx
-	return func() {
-		settings.Config.Server.CacheDir = prevDir
-		settings.Config.Server.IndexSqlConfig = prevIdx
-	}
-}
-
-func testIndexSQLConfig(mode string) settings.IndexSqlConfig {
-	return settings.IndexSqlConfig{
-		WalMode:               false,
-		BatchSize:             1000,
-		CacheSizeMB:           32,
-		DisableReuse:          false,
-		StartupIntegrityCheck: mode,
-	}
-}
-
-func TestNewIndexDB_StartupProbe_NewFile(t *testing.T) {
-	dir := t.TempDir()
-	pop := pushTestIndexConfig(t, dir, testIndexSQLConfig(settings.IndexStartupIntegrityProbe))
-	defer pop()
-
-	db, _, err := NewIndexDB("probe_new", "OFF", 1000, 32, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer db.Close()
-}
-
-func TestNewIndexDB_StartupProbe_ReopenWithData(t *testing.T) {
-	dir := t.TempDir()
-	pop := pushTestIndexConfig(t, dir, testIndexSQLConfig(settings.IndexStartupIntegrityProbe))
-	defer pop()
-
-	db, _, err := NewIndexDB("probe_reopen", "OFF", 1000, 32, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	info := &iteminfo.FileInfo{
-		Path: "/a.txt",
-		ItemInfo: iteminfo.ItemInfo{
-			Name:    "a.txt",
-			Size:    12,
-			ModTime: time.Unix(1, 0),
-			Type:    "text/plain",
-			Hidden:  false,
-		},
-	}
-	if err = db.InsertItem("src1", "/a.txt", info); err != nil {
-		t.Fatal(err)
-	}
-	if err = db.Close(); err != nil {
-		t.Fatal(err)
-	}
-
-	var db2 *IndexDB
-	db2, _, err = NewIndexDB("probe_reopen", "OFF", 1000, 32, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer db2.Close()
-}
-
-func TestNewIndexDB_StartupQuickCheckStillWorks(t *testing.T) {
-	dir := t.TempDir()
-	pop := pushTestIndexConfig(t, dir, testIndexSQLConfig(settings.IndexStartupIntegrityQuickCheck))
-	defer pop()
-
-	db, _, err := NewIndexDB("quick_default", "OFF", 1000, 32, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer db.Close()
-}
-
-func TestNewIndexDB_StartupOff(t *testing.T) {
-	dir := t.TempDir()
-	pop := pushTestIndexConfig(t, dir, testIndexSQLConfig(settings.IndexStartupIntegrityOff))
-	defer pop()
-
-	db, _, err := NewIndexDB("off_mode", "OFF", 1000, 32, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer db.Close()
-}
@@ -9,6 +9,7 @@ import (
 	storm "github.com/asdine/storm/v3"

 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
@@ -74,6 +75,11 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 		return err
 	}

+	passwordUser := existingUser.LoginMethod == users.LoginMethodPassword
+	enforcedOtp := settings.Config.Auth.Methods.PasswordAuth.EnforcedOtp
+	if passwordUser && enforcedOtp && !existingUser.OtpEnabled {
+		return errors.ErrNoTotpConfigured
+	}
 	if user.LoginMethod == "" {
 		user.LoginMethod = existingUser.LoginMethod
 	}
@@ -81,21 +87,11 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 	if err != nil {
 		return err
 	}
-	enforcedOtp := settings.Config.Auth.Methods.PasswordAuth.EnforcedOtp
+
 	if user.LoginMethod == "" {
 		user.LoginMethod = existingUser.LoginMethod
 	}
-	if user.TOTPNonce == "" {
-		user.TOTPNonce = existingUser.TOTPNonce
-	}
-	if user.TOTPSecret == "" {
-		user.TOTPSecret = existingUser.TOTPSecret
-	}
-	if user.LoginMethod == users.LoginMethodPassword && enforcedOtp && !user.OtpEnabled {
-		if slices.Contains(fields, "OtpEnabled") {
-			return errors.ErrNoTotpConfigured
-		}
-	}
+
 	if !slices.Contains(fields, "Password") {
 		user.Password = existingUser.Password
 	} else {
@@ -118,16 +114,10 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 		if err != nil {
 			return err
 		}
-		for _, scope := range adjustedScopes {
-			// ensure full path exists
-			if scope.Scope == "" {
-				return fmt.Errorf("scope name is required")
-			}
-		}
 		user.Scopes = adjustedScopes
-		err = files.MakeUserDirs(user, false)
+		err = files.MakeUserDirs(user, true)
 		if err != nil {
-			return err
+			logger.Error(err.Error())
 		}
 	}
 	// converting scopes to map of paths intead of names (names can change)
@@ -168,6 +158,12 @@ func (st usersBackend) Update(user *users.User, actorIsAdmin bool, fields ...str
 		}
 	}

+	// last revoke api keys if needed.
+	if existingUser.Permissions.Api && !user.Permissions.Api && slices.Contains(fields, "Permissions") {
+		for _, key := range existingUser.ApiKeys {
+			auth.RevokeAPIKey(key.Key) // add to blacklist
+		}
+	}
 	return nil
 }

@@ -184,7 +180,7 @@ func (st usersBackend) Save(user *users.User, changePass, disableScopeChange boo
 		if err != nil {
 			return err
 		}
-		pass, err := utils.HashPwd(user.Password)
+		pass, err := users.HashPwd(user.Password)
 		if err != nil {
 			return err
 		}
@@ -197,7 +193,7 @@ func (st usersBackend) Save(user *users.User, changePass, disableScopeChange boo
 		return err
 	}
 	user.Scopes = adjustedScopes
-	err = files.MakeUserDirs(user, true)
+	err = files.MakeUserDirs(user, disableScopeChange)
 	if err != nil {
 		logger.Error(err.Error())
 	}
@@ -261,7 +257,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 			field := t.Field(i)
 			// which=all can't update password
 			switch strings.ToLower(field.Name) {
-			case "id", "username", "password", "tokens", "totpsecret", "totpnonce":
+			case "id", "username", "password", "apikeys", "totpsecret", "totpnonce":
 				// Skip these fields
 				continue
 			}
@@ -303,7 +299,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 				if err != nil {
 					return nil, fmt.Errorf("password does not meet complexity requirements")
 				}
-				value, err := utils.HashPwd(user.Password)
+				value, err := users.HashPwd(user.Password)
 				if err != nil {
 					logger.Error(err.Error())
 				}
@@ -6,12 +6,11 @@ import (

 	"github.com/asdine/storm/v3"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

 func init() {
-	utils.BcryptCost = 4 // bcrypt.MinCost for faster tests
+	users.BcryptCost = 4 // bcrypt.MinCost for faster tests

 	// Initialize test source configuration
 	settings.Config.Server.SourceMap = map[string]*settings.Source{
@@ -18,7 +18,6 @@ import (
 var userStore *users.Storage

 func InitializeDb(path string) (*bolt.BoltStore, bool, error) {
-	logger.Debugf("Initializing database: %v", path)
 	exists, err := dbExists(path)
 	if err != nil {
 		panic(err)
@@ -37,8 +36,6 @@ func InitializeDb(path string) (*bolt.BoltStore, bool, error) {
 	// Load access rules from DB on startup
 	// ignoring errors because
 	_ = store.Access.LoadFromDB()
-	// Load share cache from DB so shareByHash/shareByPath are populated at startup
-	store.Share.LoadShareCacheFromDB()
 	userStore = store.Users
 	err = bolt.Save(db, "version", 2)
 	if err != nil {
@@ -118,7 +115,7 @@ func CreateUser(userInfo users.User, permissions users.Permissions) error {
 			return fmt.Errorf("password is required to create a password login user")
 		}
 	} else {
-		hashpass, err := utils.HashPwd(userInfo.Username)
+		hashpass, err := users.HashPwd(userInfo.Username)
 		if err != nil {
 			return err
 		}
@@ -99,7 +99,7 @@ func (u *User) GetBackendSidebarLinks() ([]SidebarLink, error) {
 	newLinks := []SidebarLink{}
 	for _, link := range u.SidebarLinks {
 		// For source links, validate that the source exists using SourceName
-		if strings.HasPrefix(link.Category, "source") {
+		if link.Category == "source" {
 			if link.SourceName == "" {
 				return nil, fmt.Errorf("source link missing sourceName (link name: %v)", link.Name)
 			}
@@ -126,7 +126,7 @@ func (u *User) GetFrontendSidebarLinks() []SidebarLink {
 	newLinks := []SidebarLink{}
 	for _, link := range u.SidebarLinks {
 		// For source links, validate that the source still exists
-		if strings.HasPrefix(link.Category, "source") {
+		if link.Category == "source" {
 			if link.SourceName == "" {
 				continue
 			}
@@ -0,0 +1,18 @@
+package users
+
+import (
+	"golang.org/x/crypto/bcrypt"
+)
+
+var BcryptCost = bcrypt.DefaultCost
+
+// HashPwd hashes a password.
+func HashPwd(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), BcryptCost)
+	return string(bytes), err
+}
+
+// CheckPwd checks if a password is correct.
+func CheckPwd(password, hash string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+}
@@ -26,8 +26,8 @@ type Store interface {
 	Save(user *User, changePass bool, disableScopeChange bool) error
 	Delete(id interface{}) error
 	LastUpdate(id uint) int64
-	AddApiToken(userID uint, name string, tokenString string, metadata AuthToken) error
-	DeleteApiToken(userID uint, name string) error
+	AddApiKey(username uint, name string, key AuthToken) error
+	DeleteApiKey(username uint, name string) error
 }

 // crudBackend implements crud.CrudBackend[User] for users storage.
@@ -114,18 +114,17 @@ func (s *Storage) Update(user *User, adminIActor bool, fields ...string) error {
 	return nil
 }

-func (s *Storage) AddApiToken(userID uint, name string, tokenString string, metadata AuthToken) error {
+func (s *Storage) AddApiKey(userID uint, name string, key AuthToken) error {
 	user, err := s.Get(userID)
 	if err != nil {
 		return err
 	}
-	// Initialize the TokenHashes map if it is nil
-	if user.Tokens == nil {
-		user.Tokens = make(map[string]AuthToken)
+	// Initialize the ApiKeys map if it is nil
+	if user.ApiKeys == nil {
+		user.ApiKeys = make(map[string]AuthToken)
 	}
-	metadata.Token = tokenString
-	user.Tokens[name] = metadata
-	err = s.Update(user, true, "Tokens")
+	user.ApiKeys[name] = key
+	err = s.Update(user, true, "ApiKeys")
 	if err != nil {
 		return err
 	}
@@ -133,17 +132,17 @@ func (s *Storage) AddApiToken(userID uint, name string, tokenString string, meta
 	return nil
 }

-func (s *Storage) DeleteApiToken(userID uint, name string) error {
+func (s *Storage) DeleteApiKey(userID uint, name string) error {
 	user, err := s.Get(userID)
 	if err != nil {
 		return err
 	}
-	// Initialize the Tokens map if it is nil
-	if user.Tokens == nil {
-		user.Tokens = make(map[string]AuthToken)
+	// Initialize the ApiKeys map if it is nil
+	if user.ApiKeys == nil {
+		user.ApiKeys = make(map[string]AuthToken)
 	}
-	delete(user.Tokens, name)
-	err = s.Update(user, true, "Tokens")
+	delete(user.ApiKeys, name)
+	err = s.Update(user, true, "ApiKeys")
 	if err != nil {
 		return err
 	}
@@ -15,18 +15,13 @@ const (
 	LoginMethodPassword LoginMethod = "password"
 	LoginMethodProxy    LoginMethod = "proxy"
 	LoginMethodOidc     LoginMethod = "oidc"
-	LoginMethodLdap     LoginMethod = "ldap"
-	LoginMethodJwt      LoginMethod = "jwt"
 )

 type AuthToken struct {
 	MinimalAuthToken
-	Key         string      `json:"key,omitempty"` // for backward compatibility
-	Token       string      `json:"token,omitempty"`
+	Key         string      `json:"key,omitempty"`
 	Name        string      `json:"name,omitempty"`
 	BelongsTo   uint        `json:"belongsTo,omitempty"`
-	IssuedAt    int64       `json:"issuedAt,omitempty"`
-	ExpiresAt   int64       `json:"expiresAt,omitempty"`
 	Permissions Permissions `json:"Permissions,omitempty"`
 }

@@ -54,16 +49,15 @@ type Sorting struct {

 type Preview struct {
 	DisableHideSidebar bool `json:"disableHideSidebar"` // disable the hide sidebar preview for previews and editors
+	HighQuality        bool `json:"highQuality"`        // generate high quality thumbnail preview images
 	Image              bool `json:"image"`              // show thumbnail preview image for image files
 	Video              bool `json:"video"`              // show thumbnail preview image for video files
-	Audio              bool `json:"audio"`              // show thumbnail preview image for audio files
 	MotionVideoPreview bool `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
 	Office             bool `json:"office"`             // show thumbnail preview image for office files
 	PopUp              bool `json:"popup"`              // show larger popup preview when hovering over thumbnail
 	AutoplayMedia      bool `json:"autoplayMedia"`      // autoplay media files in preview
 	DefaultMediaPlayer bool `json:"defaultMediaPlayer"` // disable html5 media player and use the default media player
 	Folder             bool `json:"folder"`             // show thumbnail preview image for folder files
-	Models             bool `json:"models"`             // show live thumbnails for 3D models files
 }

 // User describes a user.
@@ -76,15 +70,15 @@ type User struct {
 	Scope           string               `json:"scope,omitempty"`
 	LockPassword    bool                 `json:"lockPassword"`
 	Permissions     Permissions          `json:"permissions"`
-	ApiKeys         map[string]AuthToken `json:"apiKeys,omitempty"` // deprecated: use Tokens instead
-	Tokens          map[string]AuthToken `json:"tokens,omitempty"`
+	ApiKeys         map[string]AuthToken `json:"apiKeys,omitempty"`
 	TOTPSecret      string               `json:"totpSecret,omitempty"`
 	TOTPNonce       string               `json:"totpNonce,omitempty"`
 	LoginMethod     LoginMethod          `json:"loginMethod"`
 	OtpEnabled      bool                 `json:"otpEnabled"` // true if TOTP is enabled, false otherwise
-	Version         int                  `json:"version"`
 	// legacy for migration purposes... og filebrowser has perm attribute
-	Perm Permissions `json:"perm,omitzero"` // deprecated: use Permissions instead
+	Perm           Permissions `json:"perm,omitzero"`
+	Version        int         `json:"version"`
+	ShowFirstLogin bool        `json:"showFirstLogin"`
 }

 type SourceScope struct {
@@ -120,14 +114,9 @@ type NonAdminEditable struct {
 	DisableViewingExt          string        `json:"disableViewingExt"`          // space separated list of file extensions to disable viewing for
 	CustomTheme                string        `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
 	ShowSelectMultiple         bool          `json:"showSelectMultiple"`         // show select multiple files on desktop
-	ShowCopyPath               bool          `json:"showCopyPath"`               // show copy path action in the context menu
 	DebugOffice                bool          `json:"debugOffice"`                // debug onlyoffice editor
 	OtpEnabled                 bool          `json:"otpEnabled"`                 // allow non-admin users to disable their own OTP
 	SidebarLinks               []SidebarLink `json:"sidebarLinks"`               // customizable sidebar links
-	HideFilesInTree            bool          `json:"hideFilesInTree"`            // hide files in the sidebar tree navigation, when true, will show only directories.
-	DeleteAfterArchive         bool          `json:"deleteAfterArchive"`         // delete source files after successful creation/extraction of archives
-	PreferEditorForMarkdown    bool          `json:"preferEditorForMarkdown"`    // prefer editor first for markdown files instead of the Markdown Viewer
-	ShowFirstLogin             bool          `json:"showFirstLogin"`
 }

 type FileLoading struct {
@@ -140,7 +129,7 @@ type FileLoading struct {
 // SidebarLink represents a customizable link in the sidebar.
 type SidebarLink struct {
 	Name       string `json:"name"`                 // Display name of the link
-	Category   string `json:"category"`             // Category type: "source", "source-link", "share", "tool", "custom", etc.
+	Category   string `json:"category"`             // Category type: "source", "share", "tool", "custom", etc.
 	Target     string `json:"target"`               // Target path/URL for the link (relative for source/share)
 	Icon       string `json:"icon"`                 // Material icon name
 	SourceName string `json:"sourceName,omitempty"` // Source identifier for source-type links
@@ -11,16 +11,12 @@ import (
 	"strings"

 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 )

 // GetImageOrientation extracts the EXIF orientation from an image file using exiftool
 func (s *FFmpegService) GetImageOrientation(imagePath string) (string, error) {
-	exiftoolPath := settings.Config.Integrations.Media.ExiftoolPath
-	if exiftoolPath == "" {
-		return "Horizontal (normal)", nil
-	}
-	cmd := exec.Command(exiftoolPath, "-Orientation", "-s3", imagePath)
+	// Use exiftool to get orientation information
+	cmd := exec.Command("exiftool", "-Orientation", "-s3", imagePath)
 	var out bytes.Buffer
 	var errOut bytes.Buffer
 	cmd.Stdout = &out
@@ -4,35 +4,33 @@ go 1.25.0

 require (
 	github.com/asdine/storm/v3 v3.2.1
-	github.com/coreos/go-oidc/v3 v3.18.0
+	github.com/coreos/go-oidc/v3 v3.17.0
 	github.com/coreos/go-systemd/v22 v22.7.0
 	github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8
 	github.com/dsoprea/go-exif/v3 v3.0.1
 	github.com/gen2brain/go-fitz v1.24.15
-	github.com/go-ldap/ldap/v3 v3.4.13
-	github.com/go-playground/validator/v10 v10.30.2
+	github.com/go-playground/validator/v10 v10.30.1
 	github.com/goccy/go-yaml v1.19.2
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/google/go-cmp v0.7.0
 	github.com/gtsteffaniak/go-cache v1.1.0
-	github.com/gtsteffaniak/go-logger v1.1.0
-	github.com/kovidgoyal/imaging v1.8.21
-	github.com/mattn/go-sqlite3 v1.14.42
+	github.com/gtsteffaniak/go-logger v1.0.2
+	github.com/kovidgoyal/imaging v1.8.19
+	github.com/mattn/go-sqlite3 v1.14.33
 	github.com/pquerna/otp v1.5.0
 	github.com/spf13/afero v1.15.0
 	github.com/stretchr/testify v1.11.1
 	github.com/swaggo/http-swagger v1.3.4
 	github.com/swaggo/swag v1.16.6
-	golang.org/x/crypto v0.50.0
-	golang.org/x/image v0.39.0
-	golang.org/x/mod v0.35.0
-	golang.org/x/net v0.53.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sys v0.43.0
-	golang.org/x/time v0.15.0
-	golang.org/x/tools v0.44.0
+	golang.org/x/crypto v0.47.0
+	golang.org/x/image v0.35.0
+	golang.org/x/mod v0.32.0
+	golang.org/x/net v0.49.0
+	golang.org/x/oauth2 v0.34.0
+	golang.org/x/sys v0.40.0
+	golang.org/x/time v0.14.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.50.0
+	modernc.org/sqlite v1.44.3
 )

 require (
@@ -50,22 +48,20 @@ require (
 	github.com/Antonboom/errname v1.1.1 // indirect
 	github.com/Antonboom/nilnil v1.1.1 // indirect
 	github.com/Antonboom/testifylint v1.6.4 // indirect
-	github.com/Azure/go-ntlmssp v0.1.1 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Djarvur/go-err113 v0.1.1 // indirect
 	github.com/KyleBanks/depth v1.2.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
-	github.com/MirrexOne/unqueryvet v1.5.4 // indirect
+	github.com/MirrexOne/unqueryvet v1.4.0 // indirect
 	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
-	github.com/air-verse/air v1.65.1 // indirect
-	github.com/alecthomas/chroma/v2 v2.23.1 // indirect
+	github.com/air-verse/air v1.64.2 // indirect
+	github.com/alecthomas/chroma/v2 v2.21.1 // indirect
 	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
 	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
-	github.com/alexkohler/prealloc v1.1.0 // indirect
+	github.com/alexkohler/prealloc v1.0.1 // indirect
 	github.com/alfatraining/structtag v1.0.0 // indirect
 	github.com/alingse/asasalint v0.0.11 // indirect
 	github.com/alingse/nilnesserr v0.2.0 // indirect
-	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
 	github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
@@ -75,7 +71,7 @@ require (
 	github.com/bkielbasa/cyclop v1.2.3 // indirect
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
 	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
-	github.com/bombsimon/wsl/v5 v5.6.0 // indirect
+	github.com/bombsimon/wsl/v5 v5.3.0 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
 	github.com/breml/bidichk v0.3.3 // indirect
 	github.com/breml/errchkjson v0.4.1 // indirect
@@ -87,7 +83,7 @@ require (
 	github.com/charithe/durationcheck v0.0.11 // indirect
 	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
 	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.10.1 // indirect
+	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/ckaznocha/intrange v0.3.1 // indirect
@@ -101,29 +97,28 @@ require (
 	github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
 	github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/ebitengine/purego v0.9.1 // indirect
 	github.com/ettle/strcase v0.2.0 // indirect
-	github.com/fatih/color v1.19.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/fatih/structtag v1.2.0 // indirect
 	github.com/firefart/nonamedreturns v1.0.6 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
-	github.com/ghostiam/protogetter v0.3.20 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/ghostiam/protogetter v0.3.18 // indirect
 	github.com/go-critic/go-critic v0.14.3 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-openapi/jsonpointer v0.23.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.5 // indirect
-	github.com/go-openapi/spec v0.22.4 // indirect
-	github.com/go-openapi/swag/conv v0.26.0 // indirect
-	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
-	github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
-	github.com/go-openapi/swag/loading v0.26.0 // indirect
-	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
-	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
-	github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
+	github.com/go-openapi/jsonpointer v0.22.4 // indirect
+	github.com/go-openapi/jsonreference v0.21.4 // indirect
+	github.com/go-openapi/spec v0.22.3 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-toolsmith/astcast v1.1.0 // indirect
@@ -133,21 +128,21 @@ require (
 	github.com/go-toolsmith/astp v1.1.0 // indirect
 	github.com/go-toolsmith/strparse v1.1.0 // indirect
 	github.com/go-toolsmith/typep v1.1.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/godoc-lint/godoc-lint v0.11.2 // indirect
+	github.com/godoc-lint/godoc-lint v0.11.1 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
 	github.com/gohugoio/hugo v0.149.1 // indirect
-	github.com/golang/geo v0.0.0-20260415063119-550b242b3150 // indirect
+	github.com/golang/geo v0.0.0-20260129164528-943061e2742c // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golangci/asciicheck v0.5.0 // indirect
 	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
 	github.com/golangci/go-printf-func-name v0.1.1 // indirect
 	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
-	github.com/golangci/golangci-lint/v2 v2.11.4 // indirect
-	github.com/golangci/golines v0.15.0 // indirect
-	github.com/golangci/misspell v0.8.0 // indirect
+	github.com/golangci/golangci-lint/v2 v2.8.0 // indirect
+	github.com/golangci/golines v0.14.0 // indirect
+	github.com/golangci/misspell v0.7.0 // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
 	github.com/golangci/revgrep v0.8.0 // indirect
 	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
@@ -169,9 +164,9 @@ require (
 	github.com/jjti/go-spancheck v0.6.5 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/julz/importas v0.2.0 // indirect
-	github.com/jupiterrider/ffi v0.6.0 // indirect
+	github.com/jupiterrider/ffi v0.5.1 // indirect
 	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
-	github.com/kisielk/errcheck v1.10.0 // indirect
+	github.com/kisielk/errcheck v1.9.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
 	github.com/kovidgoyal/go-parallel v1.1.1 // indirect
 	github.com/kovidgoyal/go-shm v1.0.0 // indirect
@@ -196,10 +191,10 @@ require (
 	github.com/maratori/testpackage v1.1.2 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.21 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/mgechev/revive v1.15.0 // indirect
+	github.com/mgechev/revive v1.13.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
@@ -208,7 +203,7 @@ require (
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
-	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
+	github.com/nunnatsa/ginkgolinter v0.21.2 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -228,15 +223,15 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
 	github.com/ryancurrah/gomodguard v1.4.1 // indirect
-	github.com/ryanrolds/sqlclosecheck v0.6.0 // indirect
+	github.com/ryanrolds/sqlclosecheck v0.5.1 // indirect
 	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
-	github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/securego/gosec/v2 v2.22.11 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
-	github.com/sonatard/noctx v0.5.1 // indirect
+	github.com/sonatard/noctx v0.4.0 // indirect
 	github.com/sourcegraph/go-diff v0.7.0 // indirect
 	github.com/spf13/cast v1.9.2 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
@@ -257,7 +252,7 @@ require (
 	github.com/ultraware/funlen v0.2.0 // indirect
 	github.com/ultraware/whitespace v0.2.0 // indirect
 	github.com/urfave/cli/v2 v2.3.0 // indirect
-	github.com/uudashr/gocognit v1.2.1 // indirect
+	github.com/uudashr/gocognit v1.2.0 // indirect
 	github.com/uudashr/iface v1.4.1 // indirect
 	github.com/xen0n/gosmopolitan v1.3.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
@@ -267,21 +262,23 @@ require (
 	gitlab.com/bosi/decorder v0.4.2 // indirect
 	go-simpler.org/musttag v0.14.0 // indirect
 	go-simpler.org/sloglint v0.11.1 // indirect
-	go.augendre.info/arangolint v0.4.0 // indirect
+	go.augendre.info/arangolint v0.3.1 // indirect
 	go.augendre.info/fatcontext v0.9.0 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
+	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.10.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
-	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/exp v0.0.0-20260112195511-716be5621a96 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	honnef.co/go/tools v0.7.0 // indirect
-	modernc.org/libc v1.72.1 // indirect
+	honnef.co/go/tools v0.6.1 // indirect
+	modernc.org/libc v1.67.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	mvdan.cc/gofumpt v0.9.2 // indirect
@@ -59,8 +59,6 @@ github.com/Antonboom/nilnil v1.1.1 h1:9Mdr6BYd8WHCDngQnNVV0b554xyisFioEKi30sksuf
 github.com/Antonboom/nilnil v1.1.1/go.mod h1:yCyAmSw3doopbOWhJlVci+HuyNRuHJKIv6V2oYQa8II=
 github.com/Antonboom/testifylint v1.6.4 h1:gs9fUEy+egzxkEbq9P4cpcMB6/G0DYdMeiFS87UiqmQ=
 github.com/Antonboom/testifylint v1.6.4/go.mod h1:YO33FROXX2OoUfwjz8g+gUxQXio5i9qpVy7nXGbxDD4=
-github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
-github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69 h1:+tu3HOoMXB7RXEINRVIpxJCT+KdYiI7LAEAUrOw3dIU=
 github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69/go.mod h1:L1AbZdiDllfyYH5l5OkAaZtk7VkWe89bPJFmnDBNHxg=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -75,18 +73,18 @@ github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/MirrexOne/unqueryvet v1.5.4 h1:38QOxShO7JmMWT+eCdDMbcUgGCOeJphVkzzRgyLJgsQ=
-github.com/MirrexOne/unqueryvet v1.5.4/go.mod h1:fs9Zq6eh1LRIhsDIsxf9PONVUjYdFHdtkHIgZdJnyPU=
+github.com/MirrexOne/unqueryvet v1.4.0 h1:6KAkqqW2KUnkl9Z0VuTphC3IXRPoFqEkJEtyxxHj5eQ=
+github.com/MirrexOne/unqueryvet v1.4.0/go.mod h1:IWwCwMQlSWjAIteW0t+28Q5vouyktfujzYznSIWiuOg=
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsuj3piCMx4=
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgzrVxUYBlgKNGquUo=
 github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863 h1:BRrxwOZBolJN4gIwvZMJY1tzqBvQgpaZiQRuIDD40jM=
 github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863/go.mod h1:D0JMgToj/WdxCgd30Kc1UcA9E+WdZoJqeVOuYW7iTBM=
-github.com/air-verse/air v1.65.1 h1:G4hy4YemKrIcGAvYMor+86PhxdtBEq0n9ebJ4RoYy8w=
-github.com/air-verse/air v1.65.1/go.mod h1:OaJZSfZqf7wyjS2oP/CcEVyIt0JmZuPh5x1gdtklmmY=
+github.com/air-verse/air v1.64.2 h1:H49xKRa4r3uFUycmCCA+JectVuZLNMPGdypLFpoHVcY=
+github.com/air-verse/air v1.64.2/go.mod h1:SOwv08NTvKextanAY819AK0FK6XzQO5/tC6s1R+rk8o=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
-github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
+github.com/alecthomas/chroma/v2 v2.21.1 h1:FaSDrp6N+3pphkNKU6HPCiYLgm8dbe5UXIXcoBhZSWA=
+github.com/alecthomas/chroma/v2 v2.21.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
 github.com/alecthomas/go-check-sumtype v0.3.1 h1:u9aUvbGINJxLVXiFvHUlPEaD7VDULsrxJb4Aq31NLkU=
 github.com/alecthomas/go-check-sumtype v0.3.1/go.mod h1:A8TSiN3UPRw3laIgWEUOHHLPa6/r9MtoigdlP5h3K/E=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
@@ -96,20 +94,16 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuy
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
-github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/alexkohler/nakedret/v2 v2.0.6 h1:ME3Qef1/KIKr3kWX3nti3hhgNxw6aqN5pZmQiFSsuzQ=
 github.com/alexkohler/nakedret/v2 v2.0.6/go.mod h1:l3RKju/IzOMQHmsEvXwkqMDzHHvurNQfAgE1eVmT40Q=
-github.com/alexkohler/prealloc v1.1.0 h1:cKGRBqlXw5iyQGLYhrXrDlcHxugXpTq4tQ5c91wkf8M=
-github.com/alexkohler/prealloc v1.1.0/go.mod h1:fT39Jge3bQrfA7nPMDngUfvUbQGQeJyGQnR+913SCig=
+github.com/alexkohler/prealloc v1.0.1 h1:A9P1haqowqUxWvU9nk6tQ7YktXIHf+LQM9wPRhuteEE=
+github.com/alexkohler/prealloc v1.0.1/go.mod h1:fT39Jge3bQrfA7nPMDngUfvUbQGQeJyGQnR+913SCig=
 github.com/alfatraining/structtag v1.0.0 h1:2qmcUqNcCoyVJ0up879K614L9PazjBSFruTB0GOFjCc=
 github.com/alfatraining/structtag v1.0.0/go.mod h1:p3Xi5SwzTi+Ryj64DqjLWz7XurHxbGsq6y3ubePJPus=
 github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQRnw=
 github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I=
 github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEWd/w=
 github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
-github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
-github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c h1:651/eoCRnQ7YtSjAnSzRucrJz+3iGEFt+ysraELS81M=
 github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asdine/storm/v3 v3.2.1 h1:I5AqhkPK6nBZ/qJXySdI7ot5BlXSZ7qvDY1zAn5ZJac=
@@ -160,8 +154,8 @@ github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ
 github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
 github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
 github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
-github.com/bombsimon/wsl/v5 v5.6.0 h1:4z+/sBqC5vUmSp1O0mS+czxwH9+LKXtCWtHH9rZGQL8=
-github.com/bombsimon/wsl/v5 v5.6.0/go.mod h1:Uqt2EfrMj2NV8UGoN1f1Y3m0NpUVCsUdrNCdet+8LvU=
+github.com/bombsimon/wsl/v5 v5.3.0 h1:nZWREJFL6U3vgW/B1lfDOigl+tEF6qgs6dGGbFeR0UM=
+github.com/bombsimon/wsl/v5 v5.3.0/go.mod h1:Gp8lD04z27wm3FANIUPZycXp+8huVsn0oxc+n4qfV9I=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
 github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
@@ -188,8 +182,8 @@ github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4p
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
-github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
+github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
+github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
@@ -203,8 +197,8 @@ github.com/clbanning/mxj/v2 v2.7.0 h1:WA/La7UGCanFe5NpHF0Q3DNtnCsVoxbPKuyBNHWRyM
 github.com/clbanning/mxj/v2 v2.7.0/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
-github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
+github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
+github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
 github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
 github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
@@ -248,8 +242,8 @@ github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 h1:DilThiXje
 github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349/go.mod h1:4GC5sXji84i/p+irqghpPFZBF8tRN/Q7+700G0/DLe8=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
-github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
+github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -258,8 +252,8 @@ github.com/ettle/strcase v0.2.0 h1:fGNiVF21fHXpX1niBgk0aROov1LagYsOwV/xqKDKR/Q=
 github.com/ettle/strcase v0.2.0/go.mod h1:DajmHElDSaX76ITe3/VHVyMin4LWSJN5Z909Wp+ED1A=
 github.com/evanw/esbuild v0.25.9 h1:aU7GVC4lxJGC1AyaPwySWjSIaNLAdVEEuq3chD0Khxs=
 github.com/evanw/esbuild v0.25.9/go.mod h1:D2vIQZqV/vIf/VRHtViaUtViZmG7o+kKmlBfVQuRi48=
-github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
-github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
 github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
 github.com/firefart/nonamedreturns v1.0.6 h1:vmiBcKV/3EqKY3ZiPxCINmpS431OcE1S47AQUwhrg8E=
@@ -279,10 +273,8 @@ github.com/getkin/kin-openapi v0.133.0 h1:pJdmNohVIJ97r4AUFtEXRXwESr8b0bD721u/Tz
 github.com/getkin/kin-openapi v0.133.0/go.mod h1:boAciF6cXk5FhPqe/NQeBTeenbjqU4LhWBf09ILVvWE=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
-github.com/ghostiam/protogetter v0.3.20/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
-github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
-github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/ghostiam/protogetter v0.3.18 h1:yEpghRGtP9PjKvVXtEzGpYfQj1Wl/ZehAfU6fr62Lfo=
+github.com/ghostiam/protogetter v0.3.18/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
 github.com/go-critic/go-critic v0.14.3 h1:5R1qH2iFeo4I/RJU8vTezdqs08Egi4u5p6vOESA0pog=
 github.com/go-critic/go-critic v0.14.3/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
@@ -294,53 +286,51 @@ github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3Bop
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
-github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
-github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
-github.com/go-openapi/jsonreference v0.21.5 h1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=
-github.com/go-openapi/jsonreference v0.21.5/go.mod h1:u25Bw85sX4E2jzFodh1FOKMTZLcfifd1Q+iKKOUxExw=
-github.com/go-openapi/spec v0.22.4 h1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ=
-github.com/go-openapi/spec v0.22.4/go.mod h1:WQ6Ai0VPWMZgMT4XySjlRIE6GP1bGQOtEThn3gcWLtQ=
+github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
+github.com/go-openapi/jsonpointer v0.22.4/go.mod h1:elX9+UgznpFhgBuaMQ7iu4lvvX1nvNsesQ3oxmYTw80=
+github.com/go-openapi/jsonreference v0.21.4 h1:24qaE2y9bx/q3uRK/qN+TDwbok1NhbSmGjjySRCHtC8=
+github.com/go-openapi/jsonreference v0.21.4/go.mod h1:rIENPTjDbLpzQmQWCj5kKj3ZlmEh+EFVbz3RTUh30/4=
+github.com/go-openapi/spec v0.22.3 h1:qRSmj6Smz2rEBxMnLRBMeBWxbbOvuOoElvSvObIgwQc=
+github.com/go-openapi/spec v0.22.3/go.mod h1:iIImLODL2loCh3Vnox8TY2YWYJZjMAKYyLH2Mu8lOZs=
 github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag/conv v0.26.0 h1:5yGGsPYI1ZCva93U0AoKi/iZrNhaJEjr324YVsiD89I=
-github.com/go-openapi/swag/conv v0.26.0/go.mod h1:tpAmIL7X58VPnHHiSO4uE3jBeRamGsFsfdDeDtb5ECE=
-github.com/go-openapi/swag/jsonname v0.26.0 h1:gV1NFX9M8avo0YSpmWogqfQISigCmpaiNci8cGECU5w=
-github.com/go-openapi/swag/jsonname v0.26.0/go.mod h1:urBBR8bZNoDYGr653ynhIx+gTeIz0ARZxHkAPktJK2M=
-github.com/go-openapi/swag/jsonutils v0.26.0 h1:FawFML2iAXsPqmERscuMPIHmFsoP1tOqWkxBaKNMsnA=
-github.com/go-openapi/swag/jsonutils v0.26.0/go.mod h1:2VmA0CJlyFqgawOaPI9psnjFDqzyivIqLYN34t9p91E=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0 h1:apqeINu/ICHouqiRZbyFvuDge5jCmmLTqGQ9V95EaOM=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.0/go.mod h1:AyM6QT8uz5IdKxk5akv0y6u4QvcL9GWERt0Jx/F/R8Y=
-github.com/go-openapi/swag/loading v0.26.0 h1:Apg6zaKhCJurpJer0DCxq99qwmhFddBhaMX7kilDcko=
-github.com/go-openapi/swag/loading v0.26.0/go.mod h1:dBxQ/6V2uBaAQdevN18VELE6xSpJWZxLX4txe12JwDg=
-github.com/go-openapi/swag/stringutils v0.26.0 h1:qZQngLxs5s7SLijc3N2ZO+fUq2o8LjuWAASSrJuh+xg=
-github.com/go-openapi/swag/stringutils v0.26.0/go.mod h1:sWn5uY+QIIspwPhvgnqJsH8xqFT2ZbYcvbcFanRyhFE=
-github.com/go-openapi/swag/typeutils v0.26.0 h1:2kdEwdiNWy+JJdOvu5MA2IIg2SylWAFuuyQIKYybfq4=
-github.com/go-openapi/swag/typeutils v0.26.0/go.mod h1:oovDuIUvTrEHVMqWilQzKzV4YlSKgyZmFh7AlfABNVE=
-github.com/go-openapi/swag/yamlutils v0.26.0 h1:H7O8l/8NJJQ/oiReEN+oMpnGMyt8G0hl460nRZxhLMQ=
-github.com/go-openapi/swag/yamlutils v0.26.0/go.mod h1:1evKEGAtP37Pkwcc7EWMF0hedX0/x3Rkvei2wtG/TbU=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.2 h1:5zRca5jw7lzVREKCZVNBpysDNBjj74rBh0N2BGQbSR0=
-github.com/go-openapi/testify/enable/yaml/v2 v2.4.2/go.mod h1:XVevPw5hUXuV+5AkI1u1PeAm27EQVrhXTTCPAF85LmE=
-github.com/go-openapi/testify/v2 v2.4.2 h1:tiByHpvE9uHrrKjOszax7ZvKB7QOgizBWGBLuq0ePx4=
-github.com/go-openapi/testify/v2 v2.4.2/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.30.2 h1:JiFIMtSSHb2/XBUbWM4i/MpeQm9ZK2xqPNk8vgvu5JQ=
-github.com/go-playground/validator/v10 v10.30.2/go.mod h1:mAf2pIOVXjTEBrwUMGKkCWKKPs9NheYGabeB04txQSc=
+github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
+github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
 github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
@@ -365,8 +355,8 @@ github.com/go-toolsmith/strparse v1.1.0 h1:GAioeZUK9TGxnLS+qfdqNbA4z0SSm5zVNtCQi
 github.com/go-toolsmith/strparse v1.1.0/go.mod h1:7ksGy58fsaQkGQlY8WVoBFNyEPMGuJin1rfoPS4lBSQ=
 github.com/go-toolsmith/typep v1.1.0 h1:fIRYDyF+JywLfqzyhdiHzRop/GQDxxNhLGQ6gFUNHus=
 github.com/go-toolsmith/typep v1.1.0/go.mod h1:fVIw+7zjdsMxDA3ITWnH1yOiw1rnTQKCsF/sk2H/qig=
-github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
-github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY=
 github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
@@ -375,8 +365,8 @@ github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/godoc-lint/godoc-lint v0.11.2 h1:Bp0FkJWoSdNsBikdNgIcgtaoo+xz6I/Y9s5WSBQUeeM=
-github.com/godoc-lint/godoc-lint v0.11.2/go.mod h1:iVpGdL1JCikNH2gGeAn3Hh+AgN5Gx/I/cxV+91L41jo=
+github.com/godoc-lint/godoc-lint v0.11.1 h1:z9as8Qjiy6miRIa3VRymTa+Gt2RLnGICVikcvlUVOaA=
+github.com/godoc-lint/godoc-lint v0.11.1/go.mod h1:BAqayheFSuZrEAqCRxgw9MyvsM+S/hZwJbU1s/ejRj8=
 github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
 github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -401,8 +391,8 @@ github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w
 github.com/golang/geo v0.0.0-20190916061304-5b978397cfec/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/geo v0.0.0-20200319012246-673a6f80352d/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/geo v0.0.0-20210211234256-740aa86cb551/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
-github.com/golang/geo v0.0.0-20260415063119-550b242b3150 h1:F5CQANtNulclG+xJt370ohUujAEHq2XNBBAjkoSukQI=
-github.com/golang/geo v0.0.0-20260415063119-550b242b3150/go.mod h1:Mymr9kRGDc64JPr03TSZmuIBODZ3KyswLzm1xL0HFA8=
+github.com/golang/geo v0.0.0-20260129164528-943061e2742c h1:ysO2h2Odnl1AJM1I2Lm/fa6JvO0pECMSt2CwBaa+ITo=
+github.com/golang/geo v0.0.0-20260129164528-943061e2742c/go.mod h1:Mymr9kRGDc64JPr03TSZmuIBODZ3KyswLzm1xL0HFA8=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -442,12 +432,12 @@ github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarog
 github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d h1:viFft9sS/dxoYY0aiOTsLKO2aZQAPT4nlQCsimGcSGE=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d/go.mod h1:ivJ9QDg0XucIkmwhzCDsqcnxxlDStoTl89jDMIoNxKY=
-github.com/golangci/golangci-lint/v2 v2.11.4 h1:GK+UlZBN5y7rh2PBnHA93XLSX6RaF7uhzJQ3JwU1wuA=
-github.com/golangci/golangci-lint/v2 v2.11.4/go.mod h1:ODQDCASMA3VqfZYIbbQLpTRTzV7O/vjmIRF6u8NyFwI=
-github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
-github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
-github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
-github.com/golangci/misspell v0.8.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg=
+github.com/golangci/golangci-lint/v2 v2.8.0 h1:wJnr3hJWY3eVzOUcfwbDc2qbi2RDEpvLmQeNFaPSNYA=
+github.com/golangci/golangci-lint/v2 v2.8.0/go.mod h1:xl+HafQ9xoP8rzw0z5AwnO5kynxtb80e8u02Ej/47RI=
+github.com/golangci/golines v0.14.0 h1:xt9d3RKBjhasA3qpoXs99J2xN2t6eBlpLHt0TrgyyXc=
+github.com/golangci/golines v0.14.0/go.mod h1:gf555vPG2Ia7mmy2mzmhVQbVjuK8Orw0maR1G4vVAAQ=
+github.com/golangci/misspell v0.7.0 h1:4GOHr/T1lTW0hhR4tgaaV1WS/lJ+ncvYCoFKmqJsj0c=
+github.com/golangci/misspell v0.7.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg=
 github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3HIYbzSuP53UAYgOpg=
 github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
 github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
@@ -481,8 +471,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY=
+github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -506,8 +496,8 @@ github.com/gostaticanalysis/testutil v0.5.0 h1:Dq4wT1DdTwTGCQQv3rl3IvD5Ld0E6HiY+
 github.com/gostaticanalysis/testutil v0.5.0/go.mod h1:OLQSbuM6zw2EvCcXTz1lVq5unyoNft372msDY0nY5Hs=
 github.com/gtsteffaniak/go-cache v1.1.0 h1:ni/2cJpCxpGmaMZd92iTDIGOy+yUcMcxQuW7bSKhkCE=
 github.com/gtsteffaniak/go-cache v1.1.0/go.mod h1:rHUZvf4huhMX/bnNK4/oQ3sNAE2fYC2jFpAWZiBPWac=
-github.com/gtsteffaniak/go-logger v1.1.0 h1:baFds+iibuLLNpNLwygz32bDqdsunI6dGWcdxwMIVKI=
-github.com/gtsteffaniak/go-logger v1.1.0/go.mod h1:rapapTju4D7bwt6h4JOdZNUXDjnp0WkTBd6TN5yWglI=
+github.com/gtsteffaniak/go-logger v1.0.2 h1:S4AgR7yDu2geD8y2D9NyJVOBqpZRnl37r2mBi7GDNR0=
+github.com/gtsteffaniak/go-logger v1.0.2/go.mod h1:rapapTju4D7bwt6h4JOdZNUXDjnp0WkTBd6TN5yWglI=
 github.com/hairyhenderson/go-codeowners v0.7.0 h1:s0W4wF8bdsBEjTWzwzSlsatSthWtTAF2xLgo4a4RwAo=
 github.com/hairyhenderson/go-codeowners v0.7.0/go.mod h1:wUlNgQ3QjqC4z8DnM5nnCYVq/icpqXJyJOukKx5U8/Q=
 github.com/hashicorp/go-immutable-radix/v2 v2.1.0 h1:CUW5RYIcysz+D3B+l1mDeXrQ7fUvGGCwJfdASSzbrfo=
@@ -528,18 +518,6 @@ github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSo
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
-github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
-github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
-github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
-github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
-github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
-github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
-github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
-github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
-github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
-github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
-github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jdkato/prose v1.2.1 h1:Fp3UnJmLVISmlc57BgKUzdjr0lOtjqTZicL3PaYy6cU=
 github.com/jdkato/prose v1.2.1/go.mod h1:AiRHgVagnEx2JbQRQowVBKjG0bcs/vtkGCH1dYAL1rA=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
@@ -565,12 +543,12 @@ github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7V
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
 github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
-github.com/jupiterrider/ffi v0.6.0 h1:UX378KcZvH5c8qgLi9KL/bL82SZTHdRspZ+jj7bvBng=
-github.com/jupiterrider/ffi v0.6.0/go.mod h1:PqZ5Go6X9by8CIXgfprxfMPYmn8oT5m2O7AA56s64bY=
+github.com/jupiterrider/ffi v0.5.1 h1:l7ANXU+Ex33LilVa283HNaf/sTzCrrht7D05k6T6nlc=
+github.com/jupiterrider/ffi v0.5.1/go.mod h1:x7xdNKo8h0AmLuXfswDUBxUsd2OqUP4ekC8sCnsmbvo=
 github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
 github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
-github.com/kisielk/errcheck v1.10.0 h1:Lvs/YAHP24YKg08LA8oDw2z9fJVme090RAXd90S+rrw=
-github.com/kisielk/errcheck v1.10.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
+github.com/kisielk/errcheck v1.9.0 h1:9xt1zI9EBfcYBvdU1nVrzMzzUPUtPKs9bVSIM3TAb3M=
+github.com/kisielk/errcheck v1.9.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE=
 github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg=
@@ -580,8 +558,8 @@ github.com/kovidgoyal/go-parallel v1.1.1 h1:1OzpNjtrUkBPq3UaqrnvOoB2F9RttSt811ui
 github.com/kovidgoyal/go-parallel v1.1.1/go.mod h1:BJNIbe6+hxyFWv7n6oEDPj3PA5qSw5OCtf0hcVxWJiw=
 github.com/kovidgoyal/go-shm v1.0.0 h1:HJEel9D1F9YhULvClEHJLawoRSj/1u/EDV7MJbBPgQo=
 github.com/kovidgoyal/go-shm v1.0.0/go.mod h1:Yzb80Xf9L3kaoB2RGok9hHwMIt7Oif61kT6t3+VnZds=
-github.com/kovidgoyal/imaging v1.8.21 h1:95S2+dowTeKJJHNpf6lnScvIennTr2H0zQotu+ptNQw=
-github.com/kovidgoyal/imaging v1.8.21/go.mod h1:976F+zjiQeZ7sd87Pxlm0a64S/w9bImSIWg3sSk1rdQ=
+github.com/kovidgoyal/imaging v1.8.19 h1:zWJdQqF2tfSKjvoB7XpLRhVGbYsze++M0iaqZ4ZkhNk=
+github.com/kovidgoyal/imaging v1.8.19/go.mod h1:I0q8RdoEuyc4G8GFOF9CaluTUHQSf68d6TmsqpvfRI8=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -640,16 +618,16 @@ github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
 github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
-github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
-github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
+github.com/mattn/go-sqlite3 v1.14.33 h1:A5blZ5ulQo2AtayQ9/limgHEkFreKj1Dv226a1K73s0=
+github.com/mattn/go-sqlite3 v1.14.33/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mgechev/revive v1.15.0 h1:vJ0HzSBzfNyPbHKolgiFjHxLek9KUijhqh42yGoqZ8Q=
-github.com/mgechev/revive v1.15.0/go.mod h1:LlAKO3QQe9OJ0pVZzI2GPa8CbXGZ/9lNpCGvK4T/a8A=
+github.com/mgechev/revive v1.13.0 h1:yFbEVliCVKRXY8UgwEO7EOYNopvjb1BFbmYqm9hZjBM=
+github.com/mgechev/revive v1.13.0/go.mod h1:efJfeBVCX2JUumNQ7dtOLDja+QKj9mYGgEZA7rt5u+0=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -681,8 +659,8 @@ github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhK
 github.com/nishanths/exhaustive v0.12.0/go.mod h1:mEZ95wPIZW+x8kC4TgC+9YCUgiST7ecevsVDTgc2obs=
 github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
 github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
-github.com/nunnatsa/ginkgolinter v0.23.0 h1:x3o4DGYOWbBMP/VdNQKgSj+25aJKx2Pe6lHr8gBcgf8=
-github.com/nunnatsa/ginkgolinter v0.23.0/go.mod h1:9qN1+0akwXEccwV1CAcCDfcoBlWXHB+ML9884pL4SZ4=
+github.com/nunnatsa/ginkgolinter v0.21.2 h1:khzWfm2/Br8ZemX8QM1pl72LwM+rMeW6VUbQ4rzh0Po=
+github.com/nunnatsa/ginkgolinter v0.21.2/go.mod h1:GItSI5fw7mCGLPmkvGYrr1kEetZe7B593jcyOpyabsY=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
 github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
@@ -693,10 +671,10 @@ github.com/olekukonko/ll v0.0.9 h1:Y+1YqDfVkqMWuEQMclsF9HUR5+a82+dxJuL1HHSRpxI=
 github.com/olekukonko/ll v0.0.9/go.mod h1:En+sEW0JNETl26+K8eZ6/W4UQ7CYSrrgg/EdIYT2H8g=
 github.com/olekukonko/tablewriter v1.0.9 h1:XGwRsYLC2bY7bNd93Dk51bcPZksWZmLYuaTHR0FqfL8=
 github.com/olekukonko/tablewriter v1.0.9/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
+github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
 github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
 github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
@@ -720,6 +698,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
 github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
@@ -769,8 +749,8 @@ github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd h1:CmH9+J6ZSsIjUK
 github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
 github.com/ryancurrah/gomodguard v1.4.1 h1:eWC8eUMNZ/wM/PWuZBv7JxxqT5fiIKSIyTvjb7Elr+g=
 github.com/ryancurrah/gomodguard v1.4.1/go.mod h1:qnMJwV1hX9m+YJseXEBhd2s90+1Xn6x9dLz11ualI1I=
-github.com/ryanrolds/sqlclosecheck v0.6.0 h1:pEyL9okISdg1F1SEpJNlrEotkTGerv5BMk7U4AG0eVg=
-github.com/ryanrolds/sqlclosecheck v0.6.0/go.mod h1:xyX16hsDaCMXHrMJ3JMzGf5OpDfHTOTTQrT7HOFUmeU=
+github.com/ryanrolds/sqlclosecheck v0.5.1 h1:dibWW826u0P8jNLsLN+En7+RqWWTYrjCB9fJfSfdyCU=
+github.com/ryanrolds/sqlclosecheck v0.5.1/go.mod h1:2g3dUjoS6AL4huFdv6wn55WpLIDjY7ZgUR4J8HOO/XQ=
 github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0=
 github.com/sanposhiho/wastedassign/v2 v2.1.0/go.mod h1:+oSmSC+9bQ+VUAxA66nBb0Z7N8CK7mscKTDYC6aIek4=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
@@ -779,8 +759,8 @@ github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tM
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
-github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 h1:AoLtJX4WUtZkhhUUMFy3GgecAALp/Mb4S1iyQOA2s0U=
-github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08/go.mod h1:+XLCJiRE95ga77XInNELh2M6zQP+PdqiT9Zpm0D9Wpk=
+github.com/securego/gosec/v2 v2.22.11 h1:tW+weM/hCM/GX3iaCV91d5I6hqaRT2TPsFM1+USPXwg=
+github.com/securego/gosec/v2 v2.22.11/go.mod h1:KE4MW/eH0GLWztkbt4/7XpyH0zJBBnu7sYB4l6Wn7Mw=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
@@ -789,12 +769,12 @@ github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeV
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
 github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
-github.com/sonatard/noctx v0.5.1 h1:wklWg9c9ZYugOAk7qG4yP4PBrlQsmSLPTvW1K4PRQMs=
-github.com/sonatard/noctx v0.5.1/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
+github.com/sonatard/noctx v0.4.0 h1:7MC/5Gg4SQ4lhLYR6mvOP6mQVSxCrdyiExo7atBs27o=
+github.com/sonatard/noctx v0.4.0/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
 github.com/sourcegraph/go-diff v0.7.0 h1:9uLlrd5T46OXs5qpp8L/MTltk0zikUGi0sNNyCpA8G0=
 github.com/sourcegraph/go-diff v0.7.0/go.mod h1:iBszgVvyxdc8SFZ7gm69go2KDdt3ag071iBaWPF6cjs=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
@@ -822,6 +802,7 @@ github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
@@ -860,8 +841,8 @@ github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSW
 github.com/ultraware/whitespace v0.2.0/go.mod h1:XcP1RLD81eV4BW8UhQlpaR+SDc2givTvyI8a586WjW8=
 github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
 github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
-github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4=
-github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
+github.com/uudashr/gocognit v1.2.0 h1:3BU9aMr1xbhPlvJLSydKwdLN3tEUUrzPSSM8S4hDYRA=
+github.com/uudashr/gocognit v1.2.0/go.mod h1:k/DdKPI6XBZO1q7HgoV2juESI2/Ofj9AcHPZhBBdrTU=
 github.com/uudashr/iface v1.4.1 h1:J16Xl1wyNX9ofhpHmQ9h9gk5rnv2A6lX/2+APLTo0zU=
 github.com/uudashr/iface v1.4.1/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
@@ -872,8 +853,6 @@ github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pH
 github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
-github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yagipy/maintidx v1.0.0 h1:h5NvIsCz+nRDapQ0exNv4aJ0yXSI0420omVANTv3GJM=
 github.com/yagipy/maintidx v1.0.0/go.mod h1:0qNf/I/CCZXSMhsRsrEPDZ+DkekpKLXAJfsTACwgXLk=
 github.com/yeya24/promlinter v0.3.0 h1:JVDbMp08lVCP7Y6NP3qHroGAO6z2yGKQtS5JsjqtoFs=
@@ -899,8 +878,8 @@ go-simpler.org/musttag v0.14.0 h1:XGySZATqQYSEV3/YTy+iX+aofbZZllJaqwFWs+RTtSo=
 go-simpler.org/musttag v0.14.0/go.mod h1:uP8EymctQjJ4Z1kUnjX0u2l60WfUdQxCwSNKzE1JEOE=
 go-simpler.org/sloglint v0.11.1 h1:xRbPepLT/MHPTCA6TS/wNfZrDzkGvCCqUv4Bdwc3H7s=
 go-simpler.org/sloglint v0.11.1/go.mod h1:2PowwiCOK8mjiF+0KGifVOT8ZsCNiFzvfyJeJOIt8MQ=
-go.augendre.info/arangolint v0.4.0 h1:xSCZjRoS93nXazBSg5d0OGCi9APPLNMmmLrC995tR50=
-go.augendre.info/arangolint v0.4.0/go.mod h1:l+f/b4plABuFISuKnTGD4RioXiCCgghv2xqst/xOvAA=
+go.augendre.info/arangolint v0.3.1 h1:n2E6p8f+zfXSFLa2e2WqFPp4bfvcuRdd50y6cT65pSo=
+go.augendre.info/arangolint v0.3.1/go.mod h1:6ZKzEzIZuBQwoSvlKT+qpUfIbBfFCE5gbAoTg0/117g=
 go.augendre.info/fatcontext v0.9.0 h1:Gt5jGD4Zcj8CDMVzjOJITlSb9cEch54hjRRlN3qDojE=
 go.augendre.info/fatcontext v0.9.0/go.mod h1:L94brOAT1OOUNue6ph/2HnwxoNlds9aXDF2FcUntbNw=
 go.etcd.io/bbolt v1.3.4/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
@@ -911,6 +890,8 @@ go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
@@ -928,8 +909,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -940,16 +921,16 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
-golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
+golang.org/x/exp v0.0.0-20260112195511-716be5621a96 h1:Z/6YuSHTLOHfNFdb8zVZomZr7cqNgTJvA8+Qz75D8gU=
+golang.org/x/exp v0.0.0-20260112195511-716be5621a96/go.mod h1:nzimsREAkjBCIEFtHiYkrJyT+2uy9YZJB7H1k68CXZU=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 h1:qWFG1Dj7TBjOjOvhEOkmyGPVoquqUKnIU0lEVLp8xyk=
-golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
+golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546 h1:HDjDiATsGqvuqvkDvgJjD1IgPrVekcSXVVE21JwvzGE=
+golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.35.0 h1:LKjiHdgMtO8z7Fh18nGY6KDcoEtVfsgLDPeLyguqb7I=
+golang.org/x/image v0.35.0/go.mod h1:MwPLTVgvxSASsxdLzKrl8BRFuyqMyGhLwmC+TO1Sybk=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -975,8 +956,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1019,16 +1000,16 @@ golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1044,8 +1025,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1090,15 +1071,17 @@ golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -1115,13 +1098,13 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
+golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1172,8 +1155,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -1279,6 +1262,7 @@ gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -1288,32 +1272,32 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.7.0 h1:w6WUp1VbkqPEgLz4rkBzH/CSU6HkoqNLp6GstyTx3lU=
-honnef.co/go/tools v0.7.0/go.mod h1:pm29oPxeP3P82ISxZDgIYeOaf9ta6Pi0EWvCFoLG2vc=
-modernc.org/cc/v4 v4.28.1 h1:XpLbkYVQ24E8tX5u8+yWGvaxerxkR/S4zqxI8ZoSBuc=
-modernc.org/cc/v4 v4.28.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.33.0 h1:dspBCm75jsj8Y/ufwAMVfe375L2iYdMyQ2QG/v3hL54=
-modernc.org/ccgo/v4 v4.33.0/go.mod h1:+RhXBoRYzRwaH21mV/aj6XvQRDtfjcZfAlPMsQo8CR0=
-modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
-modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+honnef.co/go/tools v0.6.1 h1:R094WgE8K4JirYjBaOpz/AvTyUu/3wbmAoskKN/pxTI=
+honnef.co/go/tools v0.6.1/go.mod h1:3puzxxljPCe8RGJX7BIy1plGbxEOZni5mR2aXe3/uk4=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.30.1 h1:4r4U1J6Fhj98NKfSjnPUN7Ze2c6MnAdL0hWw6+LrJpc=
+modernc.org/ccgo/v4 v4.30.1/go.mod h1:bIOeI1JL54Utlxn+LwrFyjCx2n2RDiYEaJVSrgdrRfM=
+modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
+modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
-modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.1 h1:k8T3gkXWY9sEiytKhcgyiZ2L0DTyCQ/nvX+LoCljoRE=
+modernc.org/gc/v3 v3.1.1/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.72.1 h1:db1xwJ6u1kE3KHTFTTbe2GCrczHPKzlURP0aDC4NGD0=
-modernc.org/libc v1.72.1/go.mod h1:HRMiC/PhPGLIPM7GzAFCbI+oSgE3dhZ8FWftmRrHVlY=
+modernc.org/libc v1.67.7 h1:H+gYQw2PyidyxwxQsGTwQw6+6H+xUk+plvOKW7+d3TI=
+modernc.org/libc v1.67.7/go.mod h1:UjCSJFl2sYbJbReVQeVpq/MgzlbmDM4cRHIYFelnaDk=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
 modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
-modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.50.0 h1:eMowQSWLK0MeiQTdmz3lqoF5dqclujdlIKeJA11+7oM=
-modernc.org/sqlite v1.50.0/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
+modernc.org/sqlite v1.44.3 h1:+39JvV/HWMcYslAwRxHb8067w+2zowvFOUrOWIy9PjY=
+modernc.org/sqlite v1.44.3/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -3,52 +3,90 @@ package http
 import (
 	"fmt"
 	"net/http"
-	"sort"
 	"strconv"
 	"strings"
 	"time"

+	jwt "github.com/golang-jwt/jwt/v4"
 	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
+	"github.com/gtsteffaniak/go-cache/cache"
 )

-// createApiTokenHandler creates an API token for the user.
-// @Summary Create API Token
-// @Description Create an API token with specified name, duration, and permissions.
-// @Tags Auth
+var (
+	ApiTokenUserCache = cache.NewCache[uint](24 * time.Hour) // API token to user ID mapping gets cached for 24 hours
+)
+
+// getUserFromApiToken finds the user ID associated with a given API token
+func getUserFromApiToken(token string) (uint, error) {
+	// Check cache first
+	if cached, ok := ApiTokenUserCache.Get(token); ok {
+		return cached, nil
+	}
+
+	// Get all users
+	allUsers, err := store.Users.Gets()
+	if err != nil {
+		return 0, fmt.Errorf("failed to get all users: %w", err)
+	}
+
+	// Iterate through all users and their API keys
+	for _, user := range allUsers {
+		if user.ApiKeys == nil {
+			continue
+		}
+		for _, apiKey := range user.ApiKeys {
+			if apiKey.Key == token {
+				// Cache the result
+				ApiTokenUserCache.Set(token, user.ID)
+				return user.ID, nil
+			}
+		}
+	}
+
+	// Token not found
+	return 0, fmt.Errorf("token not found")
+}
+
+// createApiKeyHandler creates an API key for the user.
+// @Summary Create API key
+// @Description Create an API key with specified name, duration, and permissions.
+// @Tags API Keys
 // @Accept json
 // @Produce json
-// @Param name query string true "Name of the API token"
-// @Param days query string true "Duration of the API token in days"
-// @Param permissions query string true "Permissions for the API token (comma-separated)"
-// @Success 200 {object} HttpResponse "Token created successfully, response contains json object with token"
+// @Param name query string true "Name of the API key"
+// @Param days query string true "Duration of the API key in days"
+// @Param permissions query string true "Permissions for the API key (comma-separated)"
+// @Success 200 {object} HttpResponse "Token created successfully, response contains json object with token key"
 // @Failure 400 {object} map[string]string "Bad request"
 // @Failure 404 {object} map[string]string "Not found"
 // @Failure 409 {object} map[string]string "Conflict"
 // @Failure 500 {object} map[string]string "Internal server error"
-// @Router /api/auth/token [post]
-func createApiTokenHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+// @Router /api/auth/token [put]
+func createApiKeyHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	name := r.URL.Query().Get("name")
 	durationStr := r.URL.Query().Get("days")
 	permissionsStr := r.URL.Query().Get("permissions")
-	minimal := permissionsStr == ""
+	minimal := r.URL.Query().Get("minimal") == "true"

 	if !d.user.Permissions.Api {
-		return http.StatusForbidden, fmt.Errorf("user does not have permission to create api tokens")
+		return http.StatusForbidden, fmt.Errorf("user does not have permission to create api keys")
 	}

-	if name == "" || strings.HasPrefix(name, "WEB_TOKEN") {
-		return http.StatusBadRequest, fmt.Errorf("api token name must be valid")
+	if name == "" {
+		return http.StatusBadRequest, fmt.Errorf("api name must be valid")
 	}
 	if durationStr == "" {
-		return http.StatusBadRequest, fmt.Errorf("api token duration must be valid")
+		return http.StatusBadRequest, fmt.Errorf("api duration must be valid")
 	}

 	// For full tokens (minimal=false), permissions are required in the claim
 	// For minimal tokens (minimal=true), permissions are not in the token
 	var permissions users.Permissions
 	if !minimal {
+		if permissionsStr == "" {
+			return http.StatusBadRequest, fmt.Errorf("api permissions must be valid for full tokens")
+		}
 		// Parse permissions from the query parameter
 		permissions = users.Permissions{
 			Api:      strings.Contains(permissionsStr, "api") && d.user.Permissions.Api,
@@ -70,160 +108,156 @@ func createApiTokenHandler(w http.ResponseWriter, r *http.Request, d *requestCon

 	// Here we assume the duration is in seconds; convert to time.Duration
 	duration := time.Duration(durationInt) * time.Hour * 24
-	tokenString, authToken, err := auth.MakeSignedTokenAPI(d.user, name, duration, permissions, minimal)
+	// get request body like:
+	token, err := makeSignedTokenAPI(d.user, name, duration, permissions, minimal)
 	if err != nil {
 		if strings.Contains(err.Error(), "key already exists with same name") {
 			return http.StatusConflict, err
 		}
 		return http.StatusInternalServerError, err
 	}
-
-	// Store API token metadata in user's Tokens map
-	err = store.Users.AddApiToken(d.user.ID, name, tokenString, authToken)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Store token hash → user ID mapping in access storage for fast lookups
-	err = store.Access.AddApiToken(tokenString, d.user.ID)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
 	response := HttpResponse{
 		Message: "here is your token!",
-		Token:   tokenString,
+		Token:   token.Key,
 	}
 	return renderJSON(w, r, response)
 }

-// deleteApiTokenHandler deletes an API token for the user.
-// @Summary Delete API token
-// @Description Delete an API token with specified name.
-// @Tags Auth
+// deleteApiKeyHandler deletes an API key for the user.
+// @Summary Delete API key
+// @Description Delete an API key with specified name.
+// @Tags API Keys
 // @Accept json
 // @Produce json
-// @Param name query string true "Name of the API token to delete"
-// @Success 200 {object} HttpResponse "API token deleted successfully"
+// @Param name query string true "Name of the API key to delete"
+// @Success 200 {object} HttpResponse "API key deleted successfully"
 // @Failure 404 {object} map[string]string "Not found"
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Router /api/auth/token [delete]
-func deleteApiTokenHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+func deleteApiKeyHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	name := r.URL.Query().Get("name")
 	if !d.user.Permissions.Api {
-		return http.StatusForbidden, fmt.Errorf("user does not have permission to delete api tokens")
+		return http.StatusForbidden, fmt.Errorf("user does not have permission to delete api keys")
 	}

-	tokenInfo, ok := d.user.Tokens[name]
+	keyInfo, ok := d.user.ApiKeys[name]
 	if !ok {
-		return http.StatusNotFound, fmt.Errorf("api token not found")
+		return http.StatusNotFound, fmt.Errorf("api key not found")
 	}
-
 	// Perform the user update
-	err := store.Users.DeleteApiToken(d.user.ID, name)
+	err := store.Users.DeleteApiKey(d.user.ID, name)
 	if err != nil {
 		return http.StatusNotFound, err
 	}

-	// Revoke the token (adds to RevokedTokens set)
-	if err := auth.RevokeApiToken(store.Access, tokenInfo.Token); err != nil {
-		logger.Errorf("Failed to revoke token: %v", err)
-	}
-	if err := store.Access.RemoveApiToken(tokenInfo.Token); err != nil {
-		logger.Errorf("Failed to remove api token: %v", err)
-	}
-
+	auth.RevokeAPIKey(keyInfo.Key) // add to blacklist
 	response := HttpResponse{
-		Message: "successfully deleted api token from user",
+		Message: "successfully deleted api key from user",
 	}
 	return renderJSON(w, r, response)
 }

-type AuthTokenFrontend struct {
-	Token       string            `json:"token"`
+type AuthTokenMin struct {
+	Key         string            `json:"key"`
 	Name        string            `json:"name"`
-	IssuedAt    int64             `json:"issuedAt"`
-	ExpiresAt   int64             `json:"expiresAt"`
+	Created     int64             `json:"created"`
+	Expires     int64             `json:"expires"`
 	Permissions users.Permissions `json:"Permissions,omitempty"`
+	Minimal     bool              `json:"minimal"`
 }

-// authTokenIssuedUnix returns iat from JWT claims when set, otherwise the persisted int64 (e.g. loaded from DB).
-func authTokenIssuedUnix(t users.AuthToken) int64 {
-	if t.RegisteredClaims.IssuedAt != nil {
-		return t.RegisteredClaims.IssuedAt.Unix()
-	}
-	return t.IssuedAt
-}
-
-// authTokenExpiresUnix returns exp from JWT claims when set, otherwise the persisted int64.
-func authTokenExpiresUnix(t users.AuthToken) int64 {
-	if t.RegisteredClaims.ExpiresAt != nil {
-		return t.RegisteredClaims.ExpiresAt.Unix()
-	}
-	return t.ExpiresAt
-}
-
-// listApiTokensHandler lists all API tokens or retrieves details for a specific token.
-// @Summary List API tokens
-// @Description List all API tokens or retrieve details for a specific token.
-// @Tags Auth
+// listApiKeysHandler lists all API keys or retrieves details for a specific key.
+// @Summary List API keys
+// @Description List all API keys or retrieve details for a specific key.
+// @Tags API Keys
 // @Accept json
 // @Produce json
-// @Success 200 {array} AuthTokenFrontend "List of API tokens"
+// @Param name query string false "Name of the API to retrieve details"
+// @Success 200 {object} AuthTokenMin "List of API keys or specific key details"
 // @Failure 404 {object} map[string]string "Not found"
 // @Failure 500 {object} map[string]string "Internal server error"
-// @Router /api/auth/token/list [get]
-func listApiTokensHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+// @Router /api/auth/tokens [get]
+func listApiKeysHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	key := r.URL.Query().Get("name")
 	if !d.user.Permissions.Api {
-		return http.StatusForbidden, fmt.Errorf("user does not have permission to list api tokens")
+		return http.StatusForbidden, fmt.Errorf("user does not have permission to list api keys")
 	}
-	if len(d.user.Tokens) == 0 {
-		return http.StatusNotFound, fmt.Errorf("no api tokens found")
-	}
-	AuthTokensFrontend := make([]AuthTokenFrontend, 0, len(d.user.Tokens))
-	for name, token := range d.user.Tokens {
-		AuthTokensFrontend = append(AuthTokensFrontend, AuthTokenFrontend{
-			Token:       token.Token,
-			Name:        name,
-			IssuedAt:    authTokenIssuedUnix(token),
-			ExpiresAt:   authTokenExpiresUnix(token),
-			Permissions: token.Permissions,
-		})
-	}
-	
-	sort.Slice(AuthTokensFrontend, func(i, j int) bool {
-		return AuthTokensFrontend[i].Name < AuthTokensFrontend[j].Name
-	})

-	return renderJSON(w, r, AuthTokensFrontend)
-}
+	if key != "" {
+		keyInfo, ok := d.user.ApiKeys[key]
+		if !ok {
+			return http.StatusNotFound, fmt.Errorf("api key not found")
+		}
+		// Determine if token is minimal by parsing the JWT claim
+		// For minimal tokens, the JWT claim doesn't have BelongsTo even though the database record does
+		minimal := false
+		if keyInfo.Key != "" {
+			keyFunc := func(token *jwt.Token) (interface{}, error) {
+				return []byte(config.Auth.Key), nil
+			}
+			var claim users.AuthToken
+			token, err := jwt.ParseWithClaims(keyInfo.Key, &claim, keyFunc)
+			if err == nil && token.Valid {
+				// If the parsed claim doesn't have BelongsTo, it's a minimal token
+				minimal = claim.BelongsTo == 0
+			}
+		}
+		modifiedKey := AuthTokenMin{
+			Key:     keyInfo.Key,
+			Name:    key,
+			Created: 0,
+			Expires: 0,
+			Minimal: minimal,
+		}
+		// Safely access IssuedAt and ExpiresAt (they're pointers)
+		if keyInfo.IssuedAt != nil {
+			modifiedKey.Created = keyInfo.IssuedAt.Unix()
+		}
+		if keyInfo.ExpiresAt != nil {
+			modifiedKey.Expires = keyInfo.ExpiresAt.Unix()
+		}
+		// Only include Permissions for full tokens (not minimal tokens)
+		if !minimal {
+			modifiedKey.Permissions = keyInfo.Permissions
+		}
+		return renderJSON(w, r, modifiedKey)
+	}

-// getApiTokenHandler gets a specific API token.
-// @Summary Get API token
-// @Description Get a specific API token.
-// @Tags Auth
-// @Accept json
-// @Produce json
-// @Param name query string true "Name of the API token to retrieve"
-// @Success 200 {object} AuthTokenFrontend "API token details"
-// @Failure 404 {object} map[string]string "Not found"
-// @Failure 500 {object} map[string]string "Internal server error"
-// @Router /api/auth/token [get]
-func getApiTokenHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	name := r.URL.Query().Get("name")
-	if !d.user.Permissions.Api {
-		return http.StatusForbidden, fmt.Errorf("user does not have permission to list api tokens")
+	modifiedList := map[string]AuthTokenMin{}
+	for key, value := range d.user.ApiKeys {
+		// Determine if token is minimal by parsing the JWT claim
+		// For minimal tokens, the JWT claim doesn't have BelongsTo even though the database record does
+		minimal := false
+		if value.Key != "" {
+			keyFunc := func(token *jwt.Token) (interface{}, error) {
+				return []byte(config.Auth.Key), nil
+			}
+			var claim users.AuthToken
+			token, err := jwt.ParseWithClaims(value.Key, &claim, keyFunc)
+			if err == nil && token.Valid {
+				// If the parsed claim doesn't have BelongsTo, it's a minimal token
+				minimal = claim.BelongsTo == 0
+			}
+		}
+		modifiedKey := AuthTokenMin{
+			Key:     value.Key,
+			Created: 0,
+			Expires: 0,
+			Minimal: minimal,
+		}
+		// Safely access IssuedAt and ExpiresAt (they're pointers)
+		if value.IssuedAt != nil {
+			modifiedKey.Created = value.IssuedAt.Unix()
+		}
+		if value.ExpiresAt != nil {
+			modifiedKey.Expires = value.ExpiresAt.Unix()
+		}
+		// Only include Permissions for full tokens (not minimal tokens)
+		if !minimal {
+			modifiedKey.Permissions = value.Permissions
+		}
+		modifiedList[key] = modifiedKey
 	}
-	tokenInfo, ok := d.user.Tokens[name]
-	if !ok {
-		return http.StatusNotFound, fmt.Errorf("api token not found")
-	}
-	AuthTokenFrontendResponse := AuthTokenFrontend{
-		Token:       tokenInfo.Token,
-		Name:        name,
-		IssuedAt:    authTokenIssuedUnix(tokenInfo),
-		ExpiresAt:   authTokenExpiresUnix(tokenInfo),
-		Permissions: tokenInfo.Permissions,
-	}
-	return renderJSON(w, r, AuthTokenFrontendResponse)
+
+	return renderJSON(w, r, modifiedList)
 }
@@ -1,289 +0,0 @@
-package http
-
-import (
-	"archive/zip"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestNormalizeArchiveEntryName(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		input   string
-		want    string
-		wantErr string
-	}{
-		{
-			name:  "simple forward slashes",
-			input: "DOCS/guide.pdf",
-			want:  "DOCS/guide.pdf",
-		},
-		{
-			name:  "Windows backslashes become logical path",
-			input: `DOCS\QUICK\chs.gif`,
-			want:  "DOCS/QUICK/chs.gif",
-		},
-		{
-			name:  "Intel-style leading backslash stripped so path stays relative",
-			input: `\PRO1000\Winx64\NDIS65\e1c65x64.cat`,
-			want:  "PRO1000/Winx64/NDIS65/e1c65x64.cat",
-		},
-		{
-			name:  "leading forward slashes stripped",
-			input: "/PRO1000/Winx64/readme.txt",
-			want:  "PRO1000/Winx64/readme.txt",
-		},
-		{
-			name:  "directory entry with trailing slash",
-			input: `PRO1000\Winx64\`,
-			want:  "PRO1000/Winx64",
-		},
-		{
-			name:  "mixed redundant segments cleaned",
-			input: "a/./b/../c/file",
-			want:  "a/c/file",
-		},
-		{
-			name:    "empty",
-			input:   "",
-			wantErr: "empty path",
-		},
-		{
-			name:    "whitespace only",
-			input:   "   ",
-			wantErr: "empty path",
-		},
-		{
-			name:    "UNC rejected",
-			input:   `//server/share/file`,
-			wantErr: "UNC or invalid path",
-		},
-		{
-			name:    "double slash prefix after backslash replace (UNC-style)",
-			input:   `\\?\C:\temp\file`,
-			wantErr: "UNC or invalid path",
-		},
-		{
-			name:    "Windows drive absolute rejected",
-			input:   `C:/Windows/system32`,
-			wantErr: "absolute path in archive",
-		},
-		{
-			name:    "lowercase drive rejected",
-			input:   `c:/data/file.txt`,
-			wantErr: "absolute path in archive",
-		},
-		{
-			name:    "bare dot-dot",
-			input:   "..",
-			wantErr: "path traversal",
-		},
-		{
-			name:    "prefixed dot-dot",
-			input:   "../etc/passwd",
-			wantErr: "path traversal",
-		},
-		{
-			name:    "traversal after path clean",
-			input:   "safe/../../outside",
-			wantErr: "path traversal after clean",
-		},
-		{
-			name:    "only dots and slashes",
-			input:   "./",
-			wantErr: "empty path after clean",
-		},
-		{
-			name:    "path cleans to nothing",
-			input:   "x/../.",
-			wantErr: "empty path after clean",
-		},
-		{
-			name:  "spaces preserved in file name",
-			input: "My Folder/read me.txt",
-			want:  "My Folder/read me.txt",
-		},
-		{
-			name:  "deep relative tree",
-			input: "a/b/c/d/e/f/g.bin",
-			want:  "a/b/c/d/e/f/g.bin",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			got, err := normalizeArchiveEntryName(tt.input)
-			if tt.wantErr != "" {
-				if err == nil {
-					t.Fatalf("expected error containing %q, got nil (result %q)", tt.wantErr, got)
-				}
-				if !strings.Contains(err.Error(), tt.wantErr) {
-					t.Fatalf("error %q should contain %q", err.Error(), tt.wantErr)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tt.want {
-				t.Fatalf("normalizeArchiveEntryName(%q) = %q, want %q", tt.input, got, tt.want)
-			}
-		})
-	}
-}
-
-// TestNormalizeArchiveEntryName_backslashInFileNameOnUnix documents that after normalization
-// a single backslash in the raw name is never a path separator: it becomes a slash in the
-// logical path (portable), so segments split correctly on every GOOS in safeExtractPath.
-func TestNormalizeArchiveEntryName_unifiesBackslashes(t *testing.T) {
-	t.Parallel()
-	got, err := normalizeArchiveEntryName(`folder\file.txt`)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if want := "folder/file.txt"; got != want {
-		t.Fatalf("got %q, want %q", got, want)
-	}
-}
-
-func TestSafeExtractPath(t *testing.T) {
-	t.Parallel()
-	dest := t.TempDir()
-	dest, err := filepath.Abs(dest)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	t.Run("file under dest", func(t *testing.T) {
-		t.Parallel()
-		got, err := safeExtractPath(dest, `DOCS\Adapter_User_Guide.pdf`)
-		if err != nil {
-			t.Fatal(err)
-		}
-		want := filepath.Join(dest, "DOCS", "Adapter_User_Guide.pdf")
-		if got != want {
-			t.Fatalf("got %q, want %q", got, want)
-		}
-	})
-
-	t.Run("leading backslash in zip name stays under dest", func(t *testing.T) {
-		t.Parallel()
-		got, err := safeExtractPath(dest, `\sub\file.txt`)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !strings.HasPrefix(got, dest+string(filepath.Separator)) {
-			t.Fatalf("result %q should be under dest %q", got, dest)
-		}
-		rel, err := filepath.Rel(dest, got)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if rel != filepath.Join("sub", "file.txt") {
-			t.Fatalf("Rel = %q, want sub%cfile.txt", rel, filepath.Separator)
-		}
-	})
-
-	t.Run("rejects path that escapes dest", func(t *testing.T) {
-		t.Parallel()
-		_, err := safeExtractPath(dest, "../../../x")
-		if err == nil {
-			t.Fatal("expected error for parent segments in archive name")
-		}
-		if !strings.Contains(err.Error(), "invalid entry path") {
-			t.Fatalf("unexpected error: %v", err)
-		}
-	})
-
-	t.Run("rejects when normalize fails", func(t *testing.T) {
-		t.Parallel()
-		_, err := safeExtractPath(dest, "..")
-		if err == nil {
-			t.Fatal("expected error")
-		}
-		if !strings.Contains(err.Error(), "invalid entry path") {
-			t.Fatalf("got %v", err)
-		}
-	})
-}
-
-// TestSafeExtractPath_rejectsParentTraversal ensures ".." in the archive name is rejected
-// by normalizeArchiveEntryName, not written under dest.
-func TestSafeExtractPath_rejectsParentTraversal(t *testing.T) {
-	t.Parallel()
-	dest := t.TempDir()
-	_, err := safeExtractPath(dest, `pkg/../../../secret`)
-	if err == nil {
-		t.Fatal("expected error for path traversal in archive name")
-	}
-}
-
-// TestSafeExtractPath_destJoinDoesNotDropBase verifies that a previously problematic pattern
-// (root-relative second segment) does not throw away dest after normalization.
-func TestSafeExtractPath_destJoinDoesNotDropBase(t *testing.T) {
-	t.Parallel()
-	dest := t.TempDir()
-	out, err := safeExtractPath(dest, `a\b\c.txt`)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.HasPrefix(out, dest+string(filepath.Separator)) {
-		t.Fatalf("expected path under %q, got %q", dest, out)
-	}
-}
-
-// TestExtractZip_nestedBackslashes extracts a Windows-style path in a zip (backslashes) into
-// nested directories under dest. This matches many vendor driver zips.
-func TestExtractZip_nestedBackslashes(t *testing.T) {
-	t.Parallel()
-	tmp := t.TempDir()
-	zipPath := filepath.Join(tmp, "test.zip")
-	out := filepath.Join(tmp, "out")
-	if err := os.MkdirAll(out, 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	f, err := os.Create(zipPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	zw := zip.NewWriter(f)
-	w, err := zw.Create(`DOCS\QUICK\readme.txt`)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = w.Write([]byte("hello")); err != nil {
-		t.Fatal(err)
-	}
-	if err = zw.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err = f.Close(); err != nil {
-		t.Fatal(err)
-	}
-
-	if err = extractZip(zipPath, out); err != nil {
-		t.Fatalf("extractZip: %v", err)
-	}
-	b, err := os.ReadFile(filepath.Join(out, "DOCS", "QUICK", "readme.txt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(b) != "hello" {
-		t.Fatalf("content = %q", b)
-	}
-}
-
-// Benchmarks (optional, keep small)
-func BenchmarkNormalizeArchiveEntryName(b *testing.B) {
-	const name = `PRO1000\Winx64\NDIS65\e1c65x64.cat`
-	b.ReportAllocs()
-	for i := 0; i < b.N; i++ {
-		_, _ = normalizeArchiveEntryName(name)
-	}
-}
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"

+	jwt "github.com/golang-jwt/jwt/v4"
 	"github.com/golang-jwt/jwt/v4/request"
 	"golang.org/x/crypto/bcrypt"

@@ -86,22 +87,25 @@ func setupProxyUser(r *http.Request, data *requestContext, proxyUser string) (*u
 		if err.Error() != "the resource does not exist" {
 			return nil, err
 		}
-		// Auto-create user on first proxy authentication
-		user := users.User{
-			LoginMethod: users.LoginMethodProxy,
-			Username:    proxyUser,
-		}
-		settings.ApplyUserDefaults(&user)
-		if user.Username == config.Auth.AdminUsername {
-			user.Permissions.Admin = true
-		}
-		err = storage.CreateUser(user, user.Permissions)
-		if err != nil {
-			return nil, err
-		}
-		data.user, err = store.Users.Get(proxyUser)
-		if err != nil {
-			return nil, err
+		if config.Auth.Methods.ProxyAuth.CreateUser {
+			user := users.User{
+				LoginMethod: users.LoginMethodProxy,
+				Username:    proxyUser,
+			}
+			settings.ApplyUserDefaults(&user)
+			if user.Username == config.Auth.AdminUsername {
+				user.Permissions.Admin = true
+			}
+			err = storage.CreateUser(user, user.Permissions)
+			if err != nil {
+				return nil, err
+			}
+			data.user, err = store.Users.Get(proxyUser)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			return nil, fmt.Errorf("proxy authentication failed - no user found")
 		}
 	}
 	if data.user.LoginMethod != users.LoginMethodProxy {
@@ -117,99 +121,6 @@ func setupProxyUser(r *http.Request, data *requestContext, proxyUser string) (*u
 	return data.user, nil
 }

-// setupJwtUser retrieves or creates a user based on external JWT token claims
-func setupJwtUser(r *http.Request, data *requestContext, username string, claims map[string]interface{}) (*users.User, error) {
-	var err error
-	// Retrieve the user from the store
-	data.user, err = store.Users.Get(username)
-	if err != nil {
-		if err.Error() != "the resource does not exist" {
-			return nil, err
-		}
-		// Auto-create user on first JWT authentication
-		user := users.User{
-			LoginMethod: users.LoginMethodJwt,
-			Username:    username,
-		}
-		settings.ApplyUserDefaults(&user)
-		
-		// Check if user should be admin based on groups
-		if config.Auth.Methods.JwtAuth.AdminGroup != "" {
-			groups := auth.ExtractGroupsFromClaims(claims, config.Auth.Methods.JwtAuth.GroupsClaim)
-			for _, group := range groups {
-				if group == config.Auth.Methods.JwtAuth.AdminGroup {
-					user.Permissions.Admin = true
-					break
-				}
-			}
-		}
-		
-		// Also check if username matches admin username
-		if user.Username == config.Auth.AdminUsername {
-			user.Permissions.Admin = true
-		}
-		
-		err = storage.CreateUser(user, user.Permissions)
-		if err != nil {
-			return nil, err
-		}
-		data.user, err = store.Users.Get(username)
-		if err != nil {
-			return nil, err
-		}
-	}
-	
-	// Verify login method matches
-	if data.user.LoginMethod != users.LoginMethodJwt {
-		return nil, errors.ErrWrongLoginMethod
-	}
-	
-	// Check if user is in allowed groups (if UserGroups is configured)
-	if len(config.Auth.Methods.JwtAuth.UserGroups) > 0 {
-		groups := auth.ExtractGroupsFromClaims(claims, config.Auth.Methods.JwtAuth.GroupsClaim)
-		allowed := false
-		for _, userGroup := range groups {
-			for _, allowedGroup := range config.Auth.Methods.JwtAuth.UserGroups {
-				if userGroup == allowedGroup {
-					allowed = true
-					break
-				}
-			}
-			if allowed {
-				break
-			}
-		}
-		if !allowed {
-			return nil, fmt.Errorf("user is not in allowed groups")
-		}
-	}
-	
-	// Update admin status if needed
-	shouldBeAdmin := false
-	if config.Auth.Methods.JwtAuth.AdminGroup != "" {
-		groups := auth.ExtractGroupsFromClaims(claims, config.Auth.Methods.JwtAuth.GroupsClaim)
-		for _, group := range groups {
-			if group == config.Auth.Methods.JwtAuth.AdminGroup {
-				shouldBeAdmin = true
-				break
-			}
-		}
-	}
-	if data.user.Username == config.Auth.AdminUsername {
-		shouldBeAdmin = true
-	}
-	
-	if shouldBeAdmin != data.user.Permissions.Admin {
-		data.user.Permissions.Admin = shouldBeAdmin
-		err = store.Users.Update(data.user, true, "Permissions")
-		if err != nil {
-			return nil, err
-		}
-	}
-	
-	return data.user, nil
-}
-
 // loginHandler handles user authentication via password.
 // @Summary User login
 // @Description Authenticate a user with a username and password. The password must be URL-encoded and sent in the X-Password header to support special characters (e.g., ^, %, £, €, etc.).
@@ -225,13 +136,16 @@ func setupJwtUser(r *http.Request, data *requestContext, username string, claims
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Router /api/auth/login [post]
 func loginHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if d.user.LoginMethod == users.LoginMethodProxy {
+		return printToken(w, r, d.user)
+	}
 	passwordUser := d.user.LoginMethod == users.LoginMethodPassword
 	enforcedOtp := config.Auth.Methods.PasswordAuth.EnforcedOtp
 	missingOtp := d.user.TOTPSecret == ""
 	if passwordUser && enforcedOtp && missingOtp {
 		return http.StatusForbidden, errors.ErrNoTotpConfigured
 	}
-	return printToken(w, r, d.user)
+	return printToken(w, r, d.user) // Pass the data object
 }

 // logoutHandler handles user logout
@@ -243,9 +157,7 @@ func loginHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (in
 // @Success 200 {object} map[string]string "{"logoutUrl": "http://..."}"
 // @Router /api/auth/logout [post]
 func logoutHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	if err := auth.RevokeApiToken(store.Access, d.token); err != nil {
-		logger.Errorf("Failed to revoke token on logout: %v", err)
-	}
+	defer auth.RevokeAPIKey(d.token)

 	// Clear the authentication cookie by setting it to expire in the past
 	// Get the correct domain for cookie - prefer X-Forwarded-Host from reverse proxy
@@ -258,7 +170,7 @@ func logoutHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 		Value:    "",
 		Domain:   strings.Split(host, ":")[0],
 		Path:     "/",
-		SameSite: http.SameSiteStrictMode,
+		SameSite: http.SameSiteLaxMode,
 		Expires:  time.Unix(0, 0), // Expire immediately
 		MaxAge:   -1,              // Delete cookie
 	}
@@ -275,16 +187,6 @@ func logoutHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 		if oidcRedirectUrl != "" {
 			logoutUrl = oidcRedirectUrl
 		}
-	} else if d.user != nil && d.user.LoginMethod == users.LoginMethodLdap {
-		ldapRedirectUrl := config.Auth.Methods.LdapAuth.LogoutRedirectUrl
-		if ldapRedirectUrl != "" {
-			logoutUrl = ldapRedirectUrl
-		}
-	} else if d.user != nil && d.user.LoginMethod == users.LoginMethodJwt {
-		jwtRedirectUrl := config.Auth.Methods.JwtAuth.LogoutRedirectUrl
-		if jwtRedirectUrl != "" {
-			logoutUrl = jwtRedirectUrl
-		}
 	}
 	if logoutUrl == "" {
 		logger.Debug("no logout url found, using default")
@@ -355,7 +257,7 @@ func signupHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 // @Success 200 {string} string "New JWT token generated"
 // @Failure 401 {object} map[string]string "Unauthorized - invalid token"
 // @Failure 500 {object} map[string]string "Internal server error"
-// @Router /api/auth/renew [post]
+// @Router /api/renew [post]
 func renewHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	// check if x-auth header is present and token is
 	return printToken(w, r, d.user)
@@ -363,7 +265,7 @@ func renewHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (in

 func printToken(w http.ResponseWriter, r *http.Request, user *users.User) (int, error) {
 	expires := time.Hour * time.Duration(config.Auth.TokenExpirationHours)
-	tokenString, _, err := auth.MakeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), expires, user.Permissions, false)
+	signed, err := makeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), expires, user.Permissions, false)
 	if err != nil {
 		if strings.Contains(err.Error(), "key already exists with same name") {
 			return http.StatusConflict, err
@@ -375,16 +277,90 @@ func printToken(w http.ResponseWriter, r *http.Request, user *users.User) (int,
 	// This allows backend to identify expired sessions and provide better user feedback
 	expiresTime := time.Now().Add(expires).Add(time.Minute * 30)

-	setSessionCookie(w, r, tokenString, expiresTime)
+	setSessionCookie(w, r, signed.Key, expiresTime)

 	// Still return token in body for backward compatibility and state management
 	w.Header().Set("Content-Type", "text/plain")
-	if _, err := w.Write([]byte(tokenString)); err != nil {
+	if _, err := w.Write([]byte(signed.Key)); err != nil {
 		return 401, errors.ErrUnauthorized
 	}
 	return 0, nil
 }

+func makeSignedTokenAPI(user *users.User, name string, duration time.Duration, perms users.Permissions, minimal bool) (users.AuthToken, error) {
+	_, ok := user.ApiKeys[name]
+	if ok {
+		return users.AuthToken{}, fmt.Errorf("key already exists with same name %v ", name)
+	}
+	now := time.Now()
+	expires := now.Add(duration)
+
+	var tokenString string
+	var err error
+
+	if minimal {
+		// Create minimal token with only JWT standard claims
+		minimalClaim := users.MinimalAuthToken{
+			RegisteredClaims: jwt.RegisteredClaims{
+				IssuedAt:  jwt.NewNumericDate(now),
+				ExpiresAt: jwt.NewNumericDate(expires),
+				Issuer:    "FileBrowser Quantum",
+			},
+		}
+		token := jwt.NewWithClaims(jwt.SigningMethodHS256, minimalClaim)
+		tokenString, err = token.SignedString([]byte(config.Auth.Key))
+		if err != nil {
+			return users.AuthToken{}, err
+		}
+	} else {
+		// Create full token with permissions and user ID
+		fullClaim := users.AuthToken{
+			MinimalAuthToken: users.MinimalAuthToken{
+				RegisteredClaims: jwt.RegisteredClaims{
+					IssuedAt:  jwt.NewNumericDate(now),
+					ExpiresAt: jwt.NewNumericDate(expires),
+					Issuer:    "FileBrowser Quantum",
+				},
+			},
+			Name:        name,
+			Permissions: perms,
+			BelongsTo:   user.ID,
+		}
+		token := jwt.NewWithClaims(jwt.SigningMethodHS256, fullClaim)
+		tokenString, err = token.SignedString([]byte(config.Auth.Key))
+		if err != nil {
+			return users.AuthToken{}, err
+		}
+	}
+
+	// Create the AuthToken to store in database (always includes permissions and user ID)
+	storedClaim := users.AuthToken{
+		MinimalAuthToken: users.MinimalAuthToken{
+			RegisteredClaims: jwt.RegisteredClaims{
+				IssuedAt:  jwt.NewNumericDate(now),
+				ExpiresAt: jwt.NewNumericDate(expires),
+				Issuer:    "FileBrowser Quantum",
+			},
+		},
+		Key:         tokenString,
+		Name:        name,
+		Permissions: perms,
+		BelongsTo:   user.ID,
+	}
+
+	if strings.HasPrefix(name, "WEB_TOKEN") {
+		// don't add to api tokens, its a short lived web token
+		return storedClaim, nil
+	}
+
+	// Perform the user update
+	err = store.Users.AddApiKey(user.ID, name, storedClaim)
+	if err != nil {
+		return storedClaim, err
+	}
+	return storedClaim, nil
+}
+
 func authenticateShareRequest(r *http.Request, l *share.Link) (int, error) {
 	if l.PasswordHash == "" {
 		return 200, nil
@@ -442,8 +418,10 @@ func setSessionCookie(w http.ResponseWriter, r *http.Request, token string, expi
 		Value:    token,
 		Domain:   strings.Split(host, ":")[0], // Set domain to the host without port
 		Path:     "/",
-		SameSite: http.SameSiteStrictMode, // strict mode prevents cookie from being sent to other domains
+		SameSite: http.SameSiteLaxMode, // Lax mode allows cookie on navigation from OIDC provider
 		Expires:  expiresTime,
+		// HttpOnly: true, // Cannot use HttpOnly since frontend needs to read cookie for renew operations
+		// Secure: true, // Enable this in production with HTTPS
 	}
 	http.SetCookie(w, cookie)
 }
@@ -1,306 +0,0 @@
-package http
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
-	"github.com/gtsteffaniak/go-logger/logger"
-	"golang.org/x/time/rate"
-)
-
-// throttledReadSeeker is a wrapper around an io.ReadSeeker that throttles the reading speed.
-type throttledReadSeeker struct {
-	rs      io.ReadSeeker
-	limiter *rate.Limiter
-	ctx     context.Context
-}
-
-// throttledWriter is a wrapper around an io.Writer that throttles the writing speed.
-type throttledWriter struct {
-	w       io.Writer
-	limiter *rate.Limiter
-	ctx     context.Context
-}
-
-// newThrottledReadSeeker creates a new throttledReadSeeker.
-func newThrottledReadSeeker(rs io.ReadSeeker, limit rate.Limit, burst int, ctx context.Context) *throttledReadSeeker {
-	return &throttledReadSeeker{
-		rs:      rs,
-		limiter: rate.NewLimiter(limit, burst),
-		ctx:     ctx,
-	}
-}
-
-func (r *throttledReadSeeker) Read(p []byte) (n int, err error) {
-	n, err = r.rs.Read(p)
-	if n > 0 {
-		if waitErr := r.limiter.WaitN(r.ctx, n); waitErr != nil {
-			// The original error (like io.EOF) is potentially more important
-			// than the context error.
-			if err == nil {
-				err = waitErr
-			}
-		}
-	}
-	return
-}
-
-func (r *throttledReadSeeker) Seek(offset int64, whence int) (int64, error) {
-	return r.rs.Seek(offset, whence)
-}
-
-// newThrottledWriter creates a new throttledWriter.
-func newThrottledWriter(w io.Writer, limit rate.Limit, burst int, ctx context.Context) *throttledWriter {
-	return &throttledWriter{
-		w:       w,
-		limiter: rate.NewLimiter(limit, burst),
-		ctx:     ctx,
-	}
-}
-
-func (w *throttledWriter) Write(p []byte) (n int, err error) {
-	n, err = w.w.Write(p)
-	if n > 0 {
-		if waitErr := w.limiter.WaitN(w.ctx, n); waitErr != nil {
-			if err != nil {
-				// The original error (like io.EOF) is potentially more important
-				// than the context error.
-				err = waitErr
-			}
-		}
-	}
-	return
-}
-
-// toASCIIFilename converts a filename to ASCII-safe format by replacing non-ASCII characters with underscores
-func toASCIIFilename(fileName string) string {
-	var result strings.Builder
-	for _, r := range fileName {
-		if r > 127 {
-			// Replace non-ASCII characters with underscore
-			result.WriteRune('_')
-		} else {
-			result.WriteRune(r)
-		}
-	}
-	return result.String()
-}
-
-func setContentDisposition(w http.ResponseWriter, r *http.Request, fileName string) {
-	dispositionType := "attachment"
-	if r.URL.Query().Get("inline") == "true" {
-		dispositionType = "inline"
-		// Inline SVG (and similar) can execute embedded scripts when opened as a top-level document; match upstream filebrowser mitigation.
-		w.Header().Set("Content-Security-Policy", "script-src 'none'")
-	}
-
-	// standard: ASCII-only safe fallback
-	asciiFileName := toASCIIFilename(fileName)
-	// RFC 5987: UTF-8 encoded
-	encodedFileName := url.PathEscape(fileName)
-
-	// Always set both filename (ASCII) and filename* (UTF-8) for maximum compatibility (RFC 6266)
-	w.Header().Set("Content-Disposition", fmt.Sprintf("%s; filename=%q; filename*=utf-8''%s", dispositionType, asciiFileName, encodedFileName))
-}
-
-// downloadHandler serves the raw content of a file, multiple files, or directory in various formats.
-// @Summary Download content of a file, multiple files, or directory
-// @Description Returns the raw content of a file, multiple files, or a directory. Supports downloading files as archives in various formats.
-// @Description
-// @Description **Filename Encoding:**
-// @Description - The Content-Disposition header will always include both:
-// @Description   1. `filename="..."`: An ASCII-safe version of the filename for compatibility.
-// @Description   2. `filename*=utf-8"...`: The full UTF-8 encoded filename (RFC 6266/5987) for modern clients.
-// @Description
-// @Description **Multiple Files:**
-// @Description - Use repeated query parameters: `?file=file1.txt&file=file2.txt&file=file3.txt`
-// @Description - This supports filenames containing commas and special characters
-// @Tags Resources
-// @Accept json
-// @Param source query string true "Source name for the files (required)"
-// @Param file query []string true "File path (can be repeated for multiple files)"
-// @Param inline query bool false "If true, sets 'Content-Disposition' to 'inline'. Otherwise, defaults to 'attachment'."
-// @Param algo query string false "Compression algorithm for archiving multiple files or directories. Options: 'zip' and 'tar.gz'. Default is 'zip'."
-// @Success 200 {file} file "Raw file or directory content, or archive for multiple files"
-// @Failure 202 {object} map[string]string "Modify permissions required"
-// @Failure 400 {object} map[string]string "Invalid request path"
-// @Failure 404 {object} map[string]string "File or directory not found"
-// @Failure 500 {object} map[string]string "Internal server error"
-// @Router /api/resources/download [get]
-func downloadHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	source := r.URL.Query().Get("source")
-	fileList := r.URL.Query()["file"]
-
-	// Rule 1: Validate all user-provided file paths to prevent path traversal
-	for i, filePath := range fileList {
-		cleanPath, err := utils.SanitizeUserPath(filePath)
-		if err != nil {
-			return http.StatusBadRequest, fmt.Errorf("invalid file path: %v", err)
-		}
-		fileList[i] = cleanPath
-	}
-
-	return rawFilesHandler(w, r, d, source, fileList)
-}
-
-func rawFilesHandler(w http.ResponseWriter, r *http.Request, d *requestContext, source string, fileList []string) (int, error) {
-	if !d.user.Permissions.Download && d.share == nil {
-		return http.StatusForbidden, fmt.Errorf("user is not allowed to download")
-	}
-
-	if len(fileList) == 0 && d.share == nil {
-		return http.StatusBadRequest, fmt.Errorf("no files specified")
-	}
-
-	firstFilePath := fileList[0]
-	var err error
-	var userscope string
-	fileName := filepath.Base(firstFilePath)
-
-	// Check if this is an OnlyOffice file early for error logging
-	isOnlyOffice := isOnlyOfficeCompatibleFile(fileName) && config.Integrations.OnlyOffice.Url != ""
-	var documentId string
-	var logContext *OnlyOfficeLogContext
-
-	// modify all filepaths for user scope
-	if d.share == nil {
-		userscope, err = d.user.GetScopeForSourceName(source)
-		if err != nil {
-			// Send OnlyOffice error log if this was an OnlyOffice file
-			if isOnlyOffice {
-				// Try to get document ID for error logging
-				idx := indexing.GetIndex(source)
-				if idx != nil {
-					tempPath := utils.JoinPathAsUnix(userscope, firstFilePath)
-					if realPath, _, realErr := idx.GetRealPath(tempPath); realErr == nil {
-						if docId, _ := getOnlyOfficeId(realPath); docId != "" {
-							if ctx := getOnlyOfficeLogContext(docId); ctx != nil {
-								sendOnlyOfficeLogEvent(ctx, "ERROR", "download",
-									fmt.Sprintf("OnlyOffice download failed - source not available: %s - %v", firstFilePath, err))
-							}
-						}
-					}
-				}
-			}
-			return http.StatusForbidden, err
-		}
-		for i, filePath := range fileList {
-			fileList[i] = utils.JoinPathAsUnix(userscope, filePath)
-		}
-	}
-	firstFilePath = fileList[0]
-	// For shares, the path is already correctly resolved by publicRawHandler
-	idx := indexing.GetIndex(source)
-	if idx == nil {
-		// Send OnlyOffice error log if this was an OnlyOffice file
-		if isOnlyOffice {
-			sendOnlyOfficeLogEvent(logContext, "ERROR", "download",
-				fmt.Sprintf("OnlyOffice download failed - source index not available: %s", source))
-		}
-		return http.StatusInternalServerError, fmt.Errorf("source %s is not available", source)
-	}
-	realPath, isDir, err := idx.GetRealPath(firstFilePath)
-	if err != nil {
-		// Send OnlyOffice error log if this was an OnlyOffice file
-		if isOnlyOffice {
-			if docId, _ := getOnlyOfficeId(realPath); docId != "" {
-				if ctx := getOnlyOfficeLogContext(docId); ctx != nil {
-					sendOnlyOfficeLogEvent(ctx, "ERROR", "download",
-						fmt.Sprintf("OnlyOffice download failed - could not resolve path: %s - %v", firstFilePath, err))
-				}
-			}
-		}
-		return http.StatusInternalServerError, err
-	}
-
-	// ** Single file download with Content-Length **
-	if len(fileList) == 1 && !isDir {
-		// Get document ID and log context for OnlyOffice downloads
-		if isOnlyOffice {
-			documentId, _ = getOnlyOfficeId(realPath)
-			if documentId != "" {
-				logContext = getOnlyOfficeLogContext(documentId)
-			}
-		}
-
-		// Verify access control before opening the file (direct rule check)
-		if d.share == nil && store.Access != nil {
-			if !store.Access.Permitted(idx.Path, firstFilePath, d.user.Username) {
-				logger.Debugf("user %s denied access to path %s", d.user.Username, firstFilePath)
-				// Send OnlyOffice error log if this was an OnlyOffice download
-				if isOnlyOffice && logContext != nil {
-					sendOnlyOfficeLogEvent(logContext, "ERROR", "download",
-						fmt.Sprintf("OnlyOffice download failed - access denied by rule: %s", firstFilePath))
-				}
-				return http.StatusForbidden, fmt.Errorf("access denied to path %s", firstFilePath)
-			}
-		}
-
-		fd, err2 := os.Open(realPath)
-		if err2 != nil {
-			// Send OnlyOffice error log if this was an OnlyOffice download
-			if isOnlyOffice && logContext != nil {
-				sendOnlyOfficeLogEvent(logContext, "ERROR", "download",
-					fmt.Sprintf("OnlyOffice download failed - could not open file: %s - %v", firstFilePath, err2))
-			}
-			return http.StatusInternalServerError, err2
-		}
-		defer fd.Close()
-
-		// Get file size
-		fileInfo, err2 := fd.Stat()
-		if err2 != nil {
-			// Send OnlyOffice error log if this was an OnlyOffice download
-			if isOnlyOffice && logContext != nil {
-				sendOnlyOfficeLogEvent(logContext, "ERROR", "download",
-					fmt.Sprintf("OnlyOffice download failed - could not get file info: %s - %v", firstFilePath, err2))
-			}
-			return http.StatusInternalServerError, err2
-		}
-
-		// Send success log for OnlyOffice downloads
-		if isOnlyOffice && logContext != nil {
-			logger.Infof("OnlyOffice Server is downloading file: %s (documentId: %s)",
-				firstFilePath, documentId)
-
-			sendOnlyOfficeLogEvent(logContext, "INFO", "download",
-				fmt.Sprintf("OnlyOffice Server downloading file: %s", firstFilePath))
-		}
-
-		// Set headers
-		setContentDisposition(w, r, fileName)
-		w.Header().Set("Cache-Control", "private")
-		w.Header().Set("X-Content-Type-Options", "nosniff")
-		w.Header().Set("Content-Length", fmt.Sprintf("%d", fileInfo.Size()))
-		// serve content allows for range requests.
-		// video scrubbing, etc.
-		// Note: http.ServeContent will respect our already-set Content-Disposition header
-		var reader io.ReadSeeker = fd
-		if d.share != nil && d.share.MaxBandwidth > 0 {
-			// convert KB/s to B/s
-			limit := rate.Limit(d.share.MaxBandwidth * 1024)
-			// burst size can be the same as limit
-			burst := d.share.MaxBandwidth * 1024
-			reader = newThrottledReadSeeker(fd, limit, burst, r.Context())
-		}
-		http.ServeContent(w, r, fileName, fileInfo.ModTime(), reader)
-		return 200, nil
-	}
-
-	// ** Archive (ZIP/TAR.GZ) handling ** — delegate to archive package
-	return BuildAndStreamArchive(w, r, d, source, fileList)
-}
-
-// isOnlyOfficeCompatibleFile checks if a file extension is supported by OnlyOffice
-func isOnlyOfficeCompatibleFile(fileName string) bool {
-	return iteminfo.IsOnlyOffice(fileName)
-}
@@ -133,7 +133,7 @@ func (s *duplicateProcessingStats) shouldStop() (bool, string) {
 //
 // @Summary Find Duplicate Files
 // @Description Finds duplicate files using multi-stage filtering: size → type → fuzzy filename → progressive checksums. Files must match on size, MIME type, and have 50%+ filename similarity before checksum verification. Large fuzzy groups (>10 files) are skipped to avoid false positives. Checksums use 2-pass progressive verification (header → middle) for accuracy while minimizing disk I/O (~16KB read per file).
-// @Tags Tools
+// @Tags Duplicates
 // @Accept json
 // @Produce json
 // @Param source query string true "Source name for the desired source"
@@ -142,7 +142,7 @@ func (s *duplicateProcessingStats) shouldStop() (bool, string) {
 // @Success 200 {object} duplicateResponse "List of duplicate file groups with metadata. Response includes 'incomplete' flag if processing stopped early due to resource limits."
 // @Failure 400 {object} map[string]string "Bad Request"
 // @Failure 503 {object} map[string]string "Service Unavailable (indexing in progress or another search running)"
-// @Router /api/tools/duplicateFinder [get]
+// @Router /api/duplicates [get]
 func duplicatesHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	opts, err := prepDuplicatesOptions(r, d)
 	if err != nil {
@@ -26,9 +26,10 @@ type fileWatchResponse struct {
 // fileWatchMetadata contains file information for non-text files
 type fileWatchMetadata struct {
 	Name     string    `json:"name"`     // File name
-	Size     int64     `json:"size"`     // File size in bytes (for directories, total size of all files)
+	Size     int64     `json:"size"`     // File size in bytes
 	Type     string    `json:"type"`     // MIME type
 	Modified time.Time `json:"modified"` // Modification time
+	Path     string    `json:"path"`     // File path
 }

 // readLastNLines reads the last N lines from a file efficiently
@@ -122,7 +123,7 @@ func readLastNLines(filePath string, n int) (string, error) {
 // @Failure 403 {object} map[string]string "Permission denied"
 // @Failure 404 {object} map[string]string "File not found"
 // @Failure 500 {object} map[string]string "Internal server error"
-// @Router /api/tools/fileWatcher [get]
+// @Router /api/tools/watch [get]
 func fileWatchHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	// Check for latency check request - return immediately with minimal response
 	if r.URL.Query().Get("latencyCheck") != "" {
@@ -139,7 +140,7 @@ func fileWatchHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 	var err error
 	path, err = utils.SanitizeUserPath(path)
 	if err != nil {
-		return http.StatusBadRequest, err
+		return http.StatusBadRequest, fmt.Errorf("invalid path: %v", err)
 	}

 	// Parse lines parameter
@@ -189,43 +190,55 @@ func fileWatchHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 		return http.StatusNotFound, fmt.Errorf("file not found: %v", err)
 	}

-	// Get file/directory info
+	// Verify it's a file, not a directory
 	info, err := os.Stat(realPath)
 	if err != nil {
-		return http.StatusNotFound, fmt.Errorf("path not found: %v", err)
+		return http.StatusNotFound, fmt.Errorf("file not found: %v", err)
+	}
+	if info.IsDir() {
+		return http.StatusBadRequest, fmt.Errorf("path is a directory, not a file")
+	}
+
+	// Check if file is a text file
+	isText, err := utils.IsTextFile(realPath)
+	if err != nil {
+		return http.StatusInternalServerError, fmt.Errorf("error checking file type: %v", err)
 	}

 	// Get MIME type from the index if available
 	mimeType := "application/octet-stream"
 	reducedInfo, exists := idx.GetReducedMetadata(scopePath, false)
-	if exists && reducedInfo.Type != "" {
+	if exists && reducedInfo.Type != "" && reducedInfo.Type != "directory" {
 		mimeType = reducedInfo.Type
 	}

-	response := fileWatchResponse{}
-	// Handle directory - just return metadata, no content
-	response.IsText = false
-	response.Metadata = &fileWatchMetadata{
-		Name:     info.Name(),
-		Size:     0, // Directories don't have a meaningful size
-		Type:     mimeType,
-		Modified: info.ModTime(),
+	response := fileWatchResponse{
+		IsText: isText,
 	}
-	if !info.IsDir() {
-		// Handle regular file
-		// Check if file is a text file
-		isText, err := utils.IsTextFile(realPath)
+
+	if isText {
+		// Read the last N lines for text files
+		content, err := readLastNLines(realPath, lines)
 		if err != nil {
-			return http.StatusInternalServerError, fmt.Errorf("error checking file type: %v", err)
+			return http.StatusInternalServerError, fmt.Errorf("error reading file: %v", err)
 		}
-		if isText {
-			response.IsText = true
-			// Read the last N lines for text files only
-			content, err := readLastNLines(realPath, lines)
-			if err != nil {
-				return http.StatusInternalServerError, fmt.Errorf("error reading file: %v", err)
-			}
-			response.Contents = content
+		response.Contents = content
+		// Include metadata for text files too (for file size display)
+		response.Metadata = &fileWatchMetadata{
+			Name:     info.Name(),
+			Size:     info.Size(),
+			Type:     mimeType,
+			Modified: info.ModTime(),
+			Path:     path,
+		}
+	} else {
+		// For non-text files, return metadata
+		response.Metadata = &fileWatchMetadata{
+			Name:     info.Name(),
+			Size:     info.Size(),
+			Type:     mimeType,
+			Modified: info.ModTime(),
+			Path:     path,
 		}
 	}

@@ -252,7 +265,7 @@ type fileWatchSSEEvent struct {
 // @Failure 400 {object} map[string]string "Invalid request"
 // @Failure 403 {object} map[string]string "Permission denied"
 // @Failure 404 {object} map[string]string "File not found"
-// @Router /api/tools/fileWatcher/sse [get]
+// @Router /api/tools/watch/sse [get]
 func fileWatchSSEHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	// Check realtime permissions
 	if !(d.user.Permissions.Realtime) {
@@ -276,7 +289,7 @@ func fileWatchSSEHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 	// Rule 1: Validate user-provided path to prevent path traversal
 	cleanPath, err := utils.SanitizeUserPath(path)
 	if err != nil {
-		return http.StatusBadRequest, err
+		return http.StatusBadRequest, fmt.Errorf("invalid path: %v", err)
 	}
 	path = cleanPath

@@ -333,13 +346,16 @@ func fileWatchSSEHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 	// Get real file path
 	realPath, _, err := idx.GetRealPath(scopePath)
 	if err != nil {
-		return http.StatusNotFound, fmt.Errorf("path not found: %v", err)
+		return http.StatusNotFound, fmt.Errorf("file not found: %v", err)
 	}

-	// Get file/directory info
+	// Verify it's a file, not a directory
 	info, err := os.Stat(realPath)
 	if err != nil {
-		return http.StatusNotFound, fmt.Errorf("path not found: %v", err)
+		return http.StatusNotFound, fmt.Errorf("file not found: %v", err)
+	}
+	if info.IsDir() {
+		return http.StatusBadRequest, fmt.Errorf("path is a directory, not a file")
 	}

 	// Set up SSE headers
@@ -370,13 +386,10 @@ func fileWatchSSEHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 	// Get MIME type (we'll reuse this)
 	mimeType := "application/octet-stream"
 	reducedInfo, exists := idx.GetReducedMetadata(scopePath, false)
-	if exists && reducedInfo.Type != "" {
+	if exists && reducedInfo.Type != "" && reducedInfo.Type != "directory" {
 		mimeType = reducedInfo.Type
 	}

-	// Determine if this is a directory
-	isDir := info.IsDir()
-
 	// Start background goroutine to periodically send file updates via events system
 	stopTicker := make(chan struct{})
 	go func() {
@@ -384,14 +397,14 @@ func fileWatchSSEHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		defer ticker.Stop()

 		// Send initial update
-		sendFileWatchUpdate(username, realPath, path, source, lines, mimeType, isDir)
+		sendFileWatchUpdate(username, realPath, path, lines, mimeType)

 		for {
 			select {
 			case <-stopTicker:
 				return
 			case <-ticker.C:
-				sendFileWatchUpdate(username, realPath, path, source, lines, mimeType, isDir)
+				sendFileWatchUpdate(username, realPath, path, lines, mimeType)
 			}
 		}
 	}()
@@ -430,58 +443,54 @@ func fileWatchSSEHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 	}
 }

-// sendFileWatchUpdate reads the file/directory and sends an update via the events system
-func sendFileWatchUpdate(username, realPath, path, source string, lines int, mimeType string, isDir bool) {
-	// Re-check path (in case it was deleted or changed)
+// sendFileWatchUpdate reads the file and sends an update via the events system
+func sendFileWatchUpdate(username, realPath, path string, lines int, mimeType string) {
+	// Re-check file (in case it was deleted or changed)
 	info, err := os.Stat(realPath)
 	if err != nil {
-		// Path no longer exists
-		errorMsg, _ := json.Marshal(map[string]interface{}{"status": "error", "error": "path not found"})
+		// File no longer exists
+		errorMsg, _ := json.Marshal(map[string]interface{}{"status": "error", "error": "file not found"})
 		events.SendToUsers("fileWatch", string(errorMsg), []string{username})
 		return
 	}

-	// Build the SSE event
-	sseEvent := fileWatchSSEEvent{}
+	// Check if file is a text file
+	isText, err := utils.IsTextFile(realPath)
+	if err != nil {
+		// Error checking file, skip this update
+		return
+	}

-	if isDir {
-		// Handle directory - just return metadata, no content
-		sseEvent.IsText = false
-		sseEvent.Metadata = &fileWatchMetadata{
-			Name:     info.Name(),
-			Size:     0, // Directories don't have a meaningful size
-			Type:     "directory",
-			Modified: info.ModTime(),
-		}
-	} else {
-		// Handle regular file
-		// Check if file is a text file
-		var isText bool
-		isText, err = utils.IsTextFile(realPath)
+	// Build the SSE event
+	sseEvent := fileWatchSSEEvent{
+		IsText: isText,
+	}
+
+	if isText {
+		// Read the last N lines for text files
+		var content string
+		content, err = readLastNLines(realPath, lines)
 		if err != nil {
-			// Error checking file, skip this update
+			// Error reading, skip this update
 			return
 		}
-
-		sseEvent.IsText = isText
+		sseEvent.Contents = content
 		sseEvent.Metadata = &fileWatchMetadata{
 			Name:     info.Name(),
 			Size:     info.Size(),
 			Type:     mimeType,
 			Modified: info.ModTime(),
+			Path:     path,
 		}
-
-		if isText {
-			// Read the last N lines for text files only
-			var content string
-			content, err = readLastNLines(realPath, lines)
-			if err != nil {
-				// Error reading, skip this update
-				return
-			}
-			sseEvent.Contents = content
+	} else {
+		// For non-text files, send metadata
+		sseEvent.Metadata = &fileWatchMetadata{
+			Name:     info.Name(),
+			Size:     info.Size(),
+			Type:     mimeType,
+			Modified: info.ModTime(),
+			Path:     path,
 		}
-		// For non-text files, Contents stays empty - frontend displays metadata
 	}

 	// Serialize and send via events system
@@ -6,10 +6,10 @@ import (
 	"embed"
 	"encoding/json"
 	"fmt"
-	"html/template"
 	"io/fs"
 	"net"
 	"net/http"
+	"text/template"
 	"time"

 	_ "net/http/pprof"
@@ -74,69 +74,51 @@ func StartHttp(ctx context.Context, storage *bolt.BoltStore, shutdownComplete ch
 		devMode:   settings.Env.IsDevMode,
 	}

-	// Core routing
-	router := http.NewServeMux()
-	api := http.NewServeMux()
-	publicRoutes := http.NewServeMux()
-	publicApi := http.NewServeMux()
+	// Initialize cached PWA manifest
+	InitializePWAManifest()

-	// ========================================
-	// User Routes - /api/users/ (with public routes)
-	// ========================================
+	router := http.NewServeMux()
+	// API group routing
+	api := http.NewServeMux()
+	// Public group routing (new structure)
+	publicRoutes := http.NewServeMux()
+
+	// User routes
 	api.HandleFunc("GET /users", withUser(userGetHandler))
 	api.HandleFunc("POST /users", withSelfOrAdmin(usersPostHandler))
 	api.HandleFunc("PUT /users", withUser(userPutHandler))
 	api.HandleFunc("DELETE /users", withSelfOrAdmin(userDeleteHandler))
-	publicApi.HandleFunc("GET /users", withUser(userGetHandler))
+	api.HandleFunc("GET /health", healthHandler)

-	// ========================================
-	// Auth Routes - /api/auth/
-	// ========================================
-	api.HandleFunc("POST /auth/login", loginHelper(loginHandler))
+	// Auth routes
+	api.HandleFunc("POST /auth/login", userWithoutOTP(loginHandler))
 	api.HandleFunc("POST /auth/logout", withOrWithoutUser(logoutHandler))
 	api.HandleFunc("POST /auth/signup", withoutUser(signupHandler))
-	api.HandleFunc("POST /auth/otp/generate", withOrWithoutUser(generateOTPHandler))
-	api.HandleFunc("POST /auth/otp/verify", withOrWithoutUser(verifyOTPHandler))
+	api.HandleFunc("POST /auth/otp/generate", userWithoutOTP(generateOTPHandler))
+	api.HandleFunc("POST /auth/otp/verify", userWithoutOTP(verifyOTPHandler))
 	api.HandleFunc("POST /auth/renew", withUser(renewHandler))
-	api.HandleFunc("POST /auth/token", withUser(createApiTokenHandler))
-	api.HandleFunc("DELETE /auth/token", withUser(deleteApiTokenHandler))
-	api.HandleFunc("GET /auth/token/list", withUser(listApiTokensHandler))
-	api.HandleFunc("GET /auth/token", withUser(getApiTokenHandler))
+	api.HandleFunc("PUT /auth/token", withUser(createApiKeyHandler))
+	api.HandleFunc("GET /auth/token", withUser(createApiKeyHandler))
+	api.HandleFunc("DELETE /auth/token", withUser(deleteApiKeyHandler))
+	api.HandleFunc("GET /auth/tokens", withUser(listApiKeysHandler))
 	api.HandleFunc("GET /auth/oidc/callback", wrapHandler(oidcCallbackHandler))
 	api.HandleFunc("GET /auth/oidc/login", wrapHandler(oidcLoginHandler))

-	// ========================================
-	// Resources Routes - /api/resources/ (with public routes)
-	// ========================================
+	// Resources routes
 	api.HandleFunc("GET /resources", withUser(resourceGetHandler))
-	api.HandleFunc("GET /resources/items", withUser(itemsGetHandler))
 	api.HandleFunc("DELETE /resources", withUser(resourceDeleteHandler))
 	api.HandleFunc("POST /resources", withUser(resourcePostHandler))
 	api.HandleFunc("PUT /resources", withUser(resourcePutHandler))
 	api.HandleFunc("PATCH /resources", withUser(resourcePatchHandler))
-	api.HandleFunc("DELETE /resources/bulk", withUser(resourceBulkDeleteHandler))
-	api.HandleFunc("POST /resources/archive", withUser(archiveCreateHandler))
-	api.HandleFunc("POST /resources/unarchive", withUser(unarchiveHandler))
-	api.HandleFunc("GET /resources/download", withUser(downloadHandler))
-	api.HandleFunc("GET /resources/preview", withTimeout(60*time.Second, withUserHelper(previewHandler)))
-	api.HandleFunc("POST /resources/pause", withUser(resourcePauseHandler))
-	publicApi.HandleFunc("GET /resources", withHashFile(publicGetResourceHandler))
-	publicApi.HandleFunc("GET /resources/items", withHashFile(publicItemsGetHandler))
-	publicApi.HandleFunc("POST /resources", withHashFile(publicUploadHandler))
-	publicApi.HandleFunc("PUT /resources", withHashFile(publicPutHandler))
-	publicApi.HandleFunc("DELETE /resources", withHashFile(publicDeleteHandler))
-	publicApi.HandleFunc("DELETE /resources/bulk", withHashFile(publicBulkDeleteHandler))
-	publicApi.HandleFunc("PATCH /resources", withHashFile(publicPatchHandler))
-	publicApi.HandleFunc("GET /resources/download", withHashFile(publicDownloadHandler))
-	publicApi.HandleFunc("GET /resources/preview", withHashFile(publicPreviewHandler))
-	publicApi.HandleFunc("POST /resources/pause", withHashFile(publicPauseHandler))
-	// Legacy routes (backwards compatibility)
-	api.HandleFunc("GET /raw", withUser(downloadHandler))
-	publicApi.HandleFunc("GET /raw", withHashFile(publicDownloadHandler))
-
-	// ========================================
-	// Access Routes - /api/access/
-	// ========================================
+	api.HandleFunc("POST /resources/bulk/delete", withUser(resourceBulkDeleteHandler))
+	api.HandleFunc("GET /raw", withUser(rawHandler))
+	api.HandleFunc("GET /preview", withTimeout(60*time.Second, withUserHelper(previewHandler)))
+	api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))
+	if settings.Env.IsDevMode {
+		api.HandleFunc("GET /inspectIndex", inspectIndex)
+		api.HandleFunc("GET /mockData", mockData)
+	}
+	// Access routes
 	api.HandleFunc("GET /access", withAdmin(accessGetHandler))
 	api.HandleFunc("POST /access", withAdmin(accessPostHandler))
 	api.HandleFunc("PATCH /access", withAdmin(accessPatchHandler))
@@ -145,98 +127,87 @@ func StartHttp(ctx context.Context, storage *bolt.BoltStore, shutdownComplete ch
 	api.HandleFunc("POST /access/group", withAdmin(groupPostHandler))
 	api.HandleFunc("DELETE /access/group", withAdmin(groupDeleteHandler))

-	// ========================================
-	// Share Routes - /api/share/
-	// ========================================
-	api.HandleFunc("GET /share/list", withPermShare(shareListHandler))
+	// Share management routes (require permission)
+	api.HandleFunc("GET /shares", withPermShare(shareListHandler))
 	api.HandleFunc("GET /share/direct", withPermShare(shareDirectDownloadHandler))
-	api.HandleFunc("GET /share", withUser(shareGetHandler))
+	api.HandleFunc("GET /share", withPermShare(shareGetHandler))
 	api.HandleFunc("POST /share", withPermShare(sharePostHandler))
 	api.HandleFunc("PATCH /share", withPermShare(sharePatchHandler))
 	api.HandleFunc("DELETE /share", withPermShare(shareDeleteHandler))
-	publicApi.HandleFunc("GET /share/info", withOrWithoutUser(shareInfoHandler))
-	publicApi.HandleFunc("GET /share/image", withHashFile(getShareImage))

-	// ========================================
-	// Settings Routes - /api/settings/
-	// ========================================
+	// Create API sub-router for public API endpoints
+	publicAPI := http.NewServeMux()
+	// NEW PUBLIC ROUTES - All publicly accessible endpoints
+	// Public API routes (hash-based authentication)
+	publicAPI.HandleFunc("GET /raw", withHashFile(publicRawHandler))
+	publicAPI.HandleFunc("GET /preview", withTimeout(60*time.Second, withHashFileHelper(publicPreviewHandler)))
+	publicAPI.HandleFunc("GET /resources", withHashFile(publicGetResourceHandler))
+	publicAPI.HandleFunc("GET /users", withUser(userGetHandler))
+	publicAPI.HandleFunc("POST /onlyoffice/callback", withHashFile(onlyofficeCallbackHandler))
+	publicAPI.HandleFunc("GET /onlyoffice/callback", withHashFile(onlyofficeCallbackHandler))
+	publicAPI.HandleFunc("GET /onlyoffice/config", withHashFile(onlyofficeClientConfigGetHandler))
+	publicAPI.HandleFunc("POST /resources", withHashFile(publicUploadHandler))
+	publicAPI.HandleFunc("PUT /resources", withHashFile(publicPutHandler))
+	publicAPI.HandleFunc("DELETE /resources", withHashFile(publicDeleteHandler))
+	publicAPI.HandleFunc("POST /resources/bulk/delete", withHashFile(publicBulkDeleteHandler))
+	publicAPI.HandleFunc("PATCH /resources", withHashFile(publicPatchHandler))
+	publicAPI.HandleFunc("GET /shareinfo", withOrWithoutUser(shareInfoHandler))
+	publicAPI.HandleFunc("GET /share/image", withHashFile(getShareImage))
+
+	// Settings routes
 	api.HandleFunc("GET /settings", withAdmin(settingsGetHandler))
 	api.HandleFunc("GET /settings/config", withAdmin(settingsConfigHandler))
-	api.HandleFunc("GET /settings/sources", withUser(getSourceInfoHandler))

-	// ========================================
-	// Tools Routes - /api/tools/
-	// ========================================
-	api.HandleFunc("GET /tools/search", withUser(searchHandler))
-	api.HandleFunc("GET /tools/duplicateFinder", withUser(duplicatesHandler))
-	api.HandleFunc("GET /tools/fileWatcher", withUser(fileWatchHandler))
-	api.HandleFunc("GET /tools/fileWatcher/sse", withUser(fileWatchSSEHandler))
+	// Events routes
+	api.HandleFunc("GET /events", withUser(func(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+		d.ctx = ctx // Pass the parent context to ensure proper shutdown
+		return sseHandler(w, r, d)
+	}))
+	// Job routes
+	api.HandleFunc("GET /jobs/{action}/{target}", withUser(getJobsHandler))

-	// ========================================
-	// Media Routes - /api/media/ (with public routes)
-	// ========================================
-	api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))
-	api.HandleFunc("GET /media/metadata", withUser(metadataHandler))
-	publicApi.HandleFunc("GET /media/metadata", withHashFile(publicMetadataHandler))
+	api.HandleFunc("GET /onlyoffice/config", withUser(onlyofficeClientConfigGetHandler))
+	api.HandleFunc("POST /onlyoffice/callback", withUser(onlyofficeCallbackHandler))
+	api.HandleFunc("GET /onlyoffice/callback", withUser(onlyofficeCallbackHandler))

-	// ========================================
-	// OnlyOffice Routes - /api/office/ (with public routes)
-	// ========================================
-	api.HandleFunc("GET /office/config", withUser(onlyofficeClientConfigGetHandler))
-	api.HandleFunc("POST /office/callback", withUser(onlyofficeCallbackHandler))
-	api.HandleFunc("GET /office/callback", withUser(onlyofficeCallbackHandler))
-	publicApi.HandleFunc("POST /office/callback", withHashFile(onlyofficeCallbackHandler))
-	publicApi.HandleFunc("GET /office/callback", withHashFile(onlyofficeCallbackHandler))
-	publicApi.HandleFunc("GET /office/config", withHashFile(onlyofficeClientConfigGetHandler))
+	api.HandleFunc("GET /search", withUser(searchHandler))
+	api.HandleFunc("GET /duplicates", withUser(duplicatesHandler))
+	api.HandleFunc("GET /tools/watch", withUser(fileWatchHandler))
+	api.HandleFunc("GET /tools/watch/sse", withUser(fileWatchSSEHandler))
+	// Mount the public API sub-router
+	publicRoutes.Handle("/api/", http.StripPrefix("/api", publicAPI))

-	// ========================================
-	// Misc Routes
-	// ========================================
-	api.HandleFunc("GET /health", healthHandler)
-	api.HandleFunc("GET /events", withUser(sseHandler))
-	if settings.Env.IsDevMode {
-		api.HandleFunc("GET /inspectIndex", inspectIndex)
-		api.HandleFunc("GET /mockData", mockData)
-	}
-
-	// Mount public API
-	publicRoutes.Handle("/api/", http.StripPrefix("/api", publicApi))
-
-	// ========================================
-	// Configure Main Router
-	// ========================================
+	// Mount the route groups
 	apiPath := config.Server.BaseURL + "api"
 	publicPath := config.Server.BaseURL + "public"
 	webDavPath := config.Server.BaseURL + "dav"
-
-	// Mount primary API and public routes
 	router.Handle(apiPath+"/", http.StripPrefix(apiPath, api))
 	router.Handle(publicPath+"/", http.StripPrefix(publicPath, publicRoutes))
-
-	// WebDAV handler
-	if !config.Server.DisableWebDAV {
-		// Uses Basic Auth where password is JWT token
-		// Note: do not trim /dav prefix here - webdav library requires it
-		router.Handle(webDavPath+"/{source}/{path...}", withBasicAuth(webDAVHandler))
-	}
+	// WebDav resources (catch-all)
+	// similar to NextCloud and others
+	// (reddec) do not trim /dav prefix here - webdav library for some reason does not like it.
+	router.Handle(webDavPath+"/{scope}/{path...}", wrapHandlerOpts(withUserHelper(createWebDAVHandler(webDavPath)), wrapperOpts{
+		requestBasicAuth: true,
+	}))

 	// Frontend share route redirect (DEPRECATED - maintain for backwards compatibility)
-	// TODO: Playwright tests need updating to remove this redirect
+	// Playwright tests need updating to remove this redirect.
 	router.HandleFunc(fmt.Sprintf("GET %vshare/", config.Server.BaseURL), withOrWithoutUser(redirectToShare))

-	// New frontend share route handler
+	// New frontend share route handler - handle share page and any subpaths
 	publicRoutes.HandleFunc("GET /share/", withOrWithoutUser(indexHandler))

-	// Static assets
+	// Static and index file handlers
 	publicRoutes.Handle("GET /static/", http.HandlerFunc(staticAssetHandler))
+
+	// Standard browser favicon route
 	router.HandleFunc("GET /favicon.svg", http.HandlerFunc(staticAssetHandler))

-	// Index and utility routes
 	router.HandleFunc(config.Server.BaseURL, withOrWithoutUser(indexHandler))
 	router.HandleFunc(fmt.Sprintf("GET %vhealth", config.Server.BaseURL), healthHandler)
 	router.Handle(fmt.Sprintf("%vswagger/", config.Server.BaseURL), withUser(swaggerHandler))

-	// Base URL redirect (non-root deployments)
+	// redirect to baseUrl if not root
 	if config.Server.BaseURL != "/" {
 		router.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 			http.Redirect(w, r, config.Server.BaseURL, http.StatusMovedPermanently)
@@ -0,0 +1,33 @@
+package http
+
+import (
+	"net/http"
+
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// getJobsHandler returns job info for the user.
+// @Summary Get jobs info
+// @Description Returns job info for the user.
+// @Tags Jobs
+// @Accept json
+// @Produce json
+// @Param action path string true "Job action"
+// @Param target path string true "Job target"
+// @Success 200 {object} map[string]indexing.ReducedIndex "Job info"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/jobs/{action}/{target} [get]
+func getJobsHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	sources := d.user.GetSourceNames()
+	reducedIndexes := map[string]indexing.ReducedIndex{}
+	for _, source := range sources {
+		reducedIndex, err := indexing.GetIndexInfo(source, false)
+		if err != nil {
+			logger.Debugf("error getting index info: %v", err)
+			continue
+		}
+		reducedIndexes[source] = reducedIndex
+	}
+	return renderJSON(w, r, reducedIndexes)
+}
@@ -1,263 +0,0 @@
-package http
-
-import (
-	"crypto/tls"
-	"fmt"
-	"strings"
-
-	ldap "github.com/go-ldap/ldap/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// AuthenticateLDAPUser attempts LDAP authentication and returns the filebrowser user if successful.
-func AuthenticateLDAPUser(username, password string) (*users.User, error) {
-	username = strings.TrimSpace(username)
-	if username == "" {
-		return nil, fmt.Errorf("username required")
-	}
-	groups, userAttributes, err := authenticateLDAP(username, password)
-	if err != nil {
-		logger.Debugf("ldap authentication failed: %v", err)
-		return nil, err
-	}
-
-	// Use the configured UserIdentifier if available, otherwise use the login username
-	ldapCfg := settings.Config.Auth.Methods.LdapAuth
-	mappedUsername := username
-	if ldapCfg.UserIdentifier != "" {
-		if val, ok := userAttributes[ldapCfg.UserIdentifier]; ok && val != "" {
-			mappedUsername = val
-			logger.Debugf("ldap: mapped username from %s: %s -> %s", ldapCfg.UserIdentifier, username, mappedUsername)
-		} else {
-			logger.Warningf("ldap: userIdentifier '%s' not found in LDAP entry for user %s, using login username", ldapCfg.UserIdentifier, username)
-		}
-	}
-
-	logger.Debugf("ldap authentication successful, getting or creating user %s", mappedUsername)
-	return getOrCreateLdapUser(mappedUsername, groups)
-}
-
-func authenticateLDAP(username, password string) ([]string, map[string]string, error) {
-	c := settings.Config.Auth.Methods.LdapAuth
-	logger.Debugf("ldap: connecting to %s", c.Server)
-
-	var opts []ldap.DialOpt
-	if c.DisableVerifyTLS && c.Scheme == "ldaps" {
-		opts = append(opts, ldap.DialWithTLSConfig(&tls.Config{InsecureSkipVerify: true}))
-		logger.Warning("LDAP TLS verification is disabled.")
-	}
-
-	conn, err := ldap.DialURL(c.Server, opts...)
-	if err != nil {
-		return nil, nil, fmt.Errorf("ldap connect: %w", err)
-	}
-	defer conn.Close()
-
-	// Bind with service account
-	if c.UserPassword != "" {
-		logger.Debugf("ldap: binding as service account %s", c.UserDN)
-		if err = conn.Bind(c.UserDN, c.UserPassword); err != nil {
-			return nil, nil, fmt.Errorf("ldap bind (service): %w", err)
-		}
-	} else {
-		logger.Debugf("ldap: no service account bind (userPassword empty)")
-	}
-
-	// Build list of attributes to fetch
-	groupAttr := c.GroupsClaim
-	if groupAttr == "" {
-		groupAttr = "memberOf"
-	}
-	attributes := []string{"dn", groupAttr}
-	if c.UserIdentifier != "" {
-		attributes = append(attributes, c.UserIdentifier)
-	}
-
-	filter := fmt.Sprintf(c.UserFilter, ldap.EscapeFilter(username))
-	searchRequest := ldap.NewSearchRequest(
-		c.BaseDN,
-		ldap.ScopeWholeSubtree,
-		ldap.NeverDerefAliases,
-		0,
-		0,
-		false,
-		filter,
-		attributes,
-		nil,
-	)
-
-	result, err := conn.Search(searchRequest)
-	if err != nil {
-		return nil, nil, fmt.Errorf("ldap search (%s): %w", c.Server, err)
-	}
-
-	if len(result.Entries) == 0 {
-		return nil, nil, fmt.Errorf("user not found: %s (LDAP search for %s returned no entries)", username, filter)
-	}
-
-	entry := result.Entries[0]
-	if len(result.Entries) > 1 {
-		// Prefer the user entry when multiple match (e.g. Authentik returns user + virtual group with same cn).
-		if u := pickUserEntry(result.Entries); u != nil {
-			entry = u
-			logger.Debugf("ldap: multiple entries, using user entry DN=%s", entry.DN)
-		} else {
-			return nil, nil, fmt.Errorf("multiple entries for user: %s (set userFilter to narrow, e.g. (&(cn=%%s)(objectClass=user)))", username)
-		}
-	}
-	userDN := entry.DN
-
-	// Verify password by binding as the user
-	if err := conn.Bind(userDN, password); err != nil {
-		logger.Debugf("ldap: bind as user failed: %v", err)
-		return nil, nil, fmt.Errorf("ldap bind (user): %w", err)
-	}
-
-	// Re-bind as service account for any follow-up (we're done; this is optional)
-	if c.UserPassword != "" {
-		_ = conn.Bind(c.UserDN, c.UserPassword)
-	}
-
-	groups := entry.GetAttributeValues(groupAttr)
-
-	// Extract user attributes for identifier mapping
-	userAttributes := make(map[string]string)
-	if c.UserIdentifier != "" {
-		values := entry.GetAttributeValues(c.UserIdentifier)
-		if len(values) > 0 {
-			userAttributes[c.UserIdentifier] = values[0]
-		}
-	}
-
-	return groups, userAttributes, nil
-}
-
-// pickUserEntry returns the entry that represents a user when multiple entries match (e.g. Authentik user + virtual group).
-// Prefers entries with objectClass=user or DN under ou=users; returns nil if none or multiple user entries.
-func pickUserEntry(entries []*ldap.Entry) *ldap.Entry {
-	var user *ldap.Entry
-	for _, e := range entries {
-		oc := e.GetAttributeValues("objectClass")
-		dnLower := strings.ToLower(e.DN)
-		isUser := false
-		for _, c := range oc {
-			if strings.EqualFold(c, "user") {
-				isUser = true
-				break
-			}
-		}
-		if !isUser && strings.Contains(dnLower, "ou=users") {
-			isUser = true
-		}
-		if isUser {
-			if user != nil {
-				return nil // multiple user entries
-			}
-			user = e
-		}
-	}
-	return user
-}
-
-// ldapGroupMatchesAdmin returns true if the LDAP group DN matches the configured admin group (full DN or CN value).
-func ldapGroupMatchesAdmin(groupDN, adminGroup string) bool {
-	g := strings.TrimSpace(groupDN)
-	if g == adminGroup {
-		return true
-	}
-	dn, err := ldap.ParseDN(g)
-	if err != nil {
-		return false
-	}
-	for _, rdn := range dn.RDNs {
-		for _, attr := range rdn.Attributes {
-			if strings.EqualFold(attr.Type, "cn") && attr.Value == adminGroup {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// getOrCreateLdapUser returns the filebrowser user for an LDAP-authenticated username, creating one if configured.
-func getOrCreateLdapUser(username string, groups []string) (*users.User, error) {
-	logger.Debugf("getting or creating ldap user %s", username)
-	ldapCfg := config.Auth.Methods.LdapAuth
-
-	// Check if user is in required groups (if userGroups is configured)
-	if len(ldapCfg.UserGroups) > 0 {
-		userInAllowedGroup := false
-		for _, allowedGroup := range ldapCfg.UserGroups {
-			for _, userGroup := range groups {
-				if ldapGroupMatchesAdmin(userGroup, allowedGroup) {
-					userInAllowedGroup = true
-					break
-				}
-			}
-			if userInAllowedGroup {
-				break
-			}
-		}
-		if !userInAllowedGroup {
-			logger.Warningf("User %s is not in any of the required groups %v. Access denied.", username, ldapCfg.UserGroups)
-			return nil, fmt.Errorf("user %s is not authorized to access this application (not in required groups)", username)
-		}
-		logger.Debugf("User %s is in required group, allowing access.", username)
-	}
-
-	isAdmin := false
-	if ldapCfg.AdminGroup != "" {
-		for _, g := range groups {
-			if ldapGroupMatchesAdmin(g, ldapCfg.AdminGroup) {
-				isAdmin = true
-				break
-			}
-		}
-		if isAdmin {
-			logger.Debugf("User %s is in admin group %s, granting admin privileges.", username, ldapCfg.AdminGroup)
-		}
-	}
-
-	user, err := store.Users.Get(username)
-	if err != nil {
-		if err.Error() != "the resource does not exist" {
-			return nil, err
-		}
-		// Auto-create user on first LDAP authentication
-		if ldapCfg.AdminGroup == "" {
-			isAdmin = config.UserDefaults.Permissions.Admin
-		}
-		user = &users.User{
-			Username:    username,
-			LoginMethod: users.LoginMethodLdap,
-		}
-		settings.ApplyUserDefaults(user)
-		if isAdmin {
-			user.Permissions.Admin = true
-		}
-		if err = storage.CreateUser(*user, user.Permissions); err != nil {
-			return nil, err
-		}
-		user, err = store.Users.Get(username)
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		if user.LoginMethod != users.LoginMethodLdap {
-			return nil, errors.ErrWrongLoginMethod
-		}
-		if ldapCfg.AdminGroup != "" && isAdmin != user.Permissions.Admin {
-			user.Permissions.Admin = isAdmin
-			_ = store.Users.Update(user, true, "Permissions")
-		}
-	}
-
-	if err := store.Access.SyncUserGroups(username, groups); err != nil {
-		logger.Warningf("failed to sync ldap user %s groups: %v", username, err)
-	}
-	return user, nil
-}
@@ -1,151 +0,0 @@
-package http
-
-import (
-	"testing"
-
-	ldap "github.com/go-ldap/ldap/v3"
-)
-
-// newLDAPEntry creates a minimal *ldap.Entry for testing (DN and optional objectClass).
-func newLDAPEntry(dn string, objectClasses []string) *ldap.Entry {
-	attrs := []*ldap.EntryAttribute{}
-	if len(objectClasses) > 0 {
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: objectClasses})
-	}
-	return &ldap.Entry{DN: dn, Attributes: attrs}
-}
-
-func TestPickUserEntry(t *testing.T) {
-	tests := []struct {
-		name    string
-		entries []*ldap.Entry
-		wantNil bool
-		wantDN  string // if wantNil is false, expected entry DN
-	}{
-		{
-			name: "single user entry by objectClass",
-			entries: []*ldap.Entry{
-				newLDAPEntry("cn=alice,ou=users,dc=test", []string{"user", "organizationalPerson"}),
-			},
-			wantNil: false,
-			wantDN:  "cn=alice,ou=users,dc=test",
-		},
-		{
-			name: "single user entry by ou=users in DN",
-			entries: []*ldap.Entry{
-				newLDAPEntry("cn=bob,ou=users,dc=example,dc=com", []string{"group"}),
-			},
-			wantNil: false,
-			wantDN:  "cn=bob,ou=users,dc=example,dc=com",
-		},
-		{
-			name: "user and virtual group - picks user",
-			entries: []*ldap.Entry{
-				newLDAPEntry("cn=akadmin,ou=virtual-groups,dc=test", []string{"group"}),
-				newLDAPEntry("cn=akadmin,ou=users,dc=test", []string{"user"}),
-			},
-			wantNil: false,
-			wantDN:  "cn=akadmin,ou=users,dc=test",
-		},
-		{
-			name: "two user entries - returns nil",
-			entries: []*ldap.Entry{
-				newLDAPEntry("cn=u1,ou=users,dc=test", []string{"user"}),
-				newLDAPEntry("cn=u2,ou=users,dc=test", []string{"user"}),
-			},
-			wantNil: true,
-		},
-		{
-			name: "only group entries - returns nil",
-			entries: []*ldap.Entry{
-				newLDAPEntry("cn=admins,ou=groups,dc=test", []string{"group"}),
-				newLDAPEntry("cn=akadmin,ou=virtual-groups,dc=test", []string{"group"}),
-			},
-			wantNil: true,
-		},
-		{
-			name:    "empty entries",
-			entries: []*ldap.Entry{},
-			wantNil: true,
-		},
-		{
-			name: "objectClass case insensitive",
-			entries: []*ldap.Entry{
-				newLDAPEntry("cn=u,ou=users,dc=test", []string{"USER"}),
-			},
-			wantNil: false,
-			wantDN:  "cn=u,ou=users,dc=test",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := pickUserEntry(tt.entries)
-			if tt.wantNil && got != nil {
-				t.Errorf("pickUserEntry() = %v, want nil", got)
-			}
-			if !tt.wantNil && got == nil {
-				t.Errorf("pickUserEntry() = nil, want non-nil entry")
-			}
-		})
-	}
-}
-
-func TestLdapGroupMatchesAdmin(t *testing.T) {
-	tests := []struct {
-		name       string
-		groupDN    string
-		adminGroup string
-		want       bool
-	}{
-		{
-			name:       "exact DN match",
-			groupDN:    "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
-			adminGroup: "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
-			want:       true,
-		},
-		{
-			name:       "CN match",
-			groupDN:    "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
-			adminGroup: "authentik Admins",
-			want:       true,
-		},
-		{
-			name:       "CN no match",
-			groupDN:    "cn=Other Group,ou=groups,dc=test",
-			adminGroup: "authentik Admins",
-			want:       false,
-		},
-		{
-			name:       "exact no match",
-			groupDN:    "cn=admins,ou=groups,dc=test",
-			adminGroup: "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
-			want:       false,
-		},
-		{
-			name:       "whitespace trimmed",
-			groupDN:    "  cn=admins,ou=groups,dc=test  ",
-			adminGroup: "cn=admins,ou=groups,dc=test",
-			want:       true,
-		},
-		{
-			name:       "invalid DN returns false",
-			groupDN:    "not-a-valid-dn",
-			adminGroup: "admins",
-			want:       false,
-		},
-		{
-			name:       "empty adminGroup no match",
-			groupDN:    "cn=admins,ou=groups,dc=test",
-			adminGroup: "",
-			want:       false,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := ldapGroupMatchesAdmin(tt.groupDN, tt.adminGroup)
-			if got != tt.want {
-				t.Errorf("ldapGroupMatchesAdmin(%q, %q) = %v, want %v", tt.groupDN, tt.adminGroup, got, tt.want)
-			}
-		})
-	}
-}
@@ -8,8 +8,6 @@ import (
 	"path/filepath"
 	"time"

-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
@@ -18,7 +16,7 @@ import (
 // subtitlesHandler handles subtitle requests for both external files and embedded streams
 // @Summary Get subtitle content
 // @Description Returns raw subtitle content from external files or embedded streams
-// @Tags Resources
+// @Tags Subtitles
 // @Accept json
 // @Produce text/plain
 // @Param path query string true "Index path to the video file"
@@ -101,77 +99,3 @@ func subtitlesHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 	http.ServeContent(w, r, name, time.Now(), bytes.NewReader([]byte(content)))
 	return http.StatusOK, nil
 }
-
-// metadataHandler returns the same directory resource shape as GET /api/resources with metadata enabled,
-// for client-side patching after a fast listing load.
-// @Summary Directory with media metadata
-// @Description Same ExtendedFileInfo as resources GET with metadata=true (typically used for directories).
-// @Tags Resources
-// @Accept json
-// @Produce json
-// @Param path query string true "Path to the directory or file"
-// @Param source query string true "Source name"
-// @Param albumArt query bool false "When true, include embedded album art bytes in audio metadata"
-// @Success 200 {object} iteminfo.ExtendedFileInfo
-// @Failure 403 {object} map[string]string "Forbidden"
-// @Failure 404 {object} map[string]string "Not found"
-// @Router /api/media/metadata [get]
-func metadataHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	path := r.URL.Query().Get("path")
-	source := r.URL.Query().Get("source")
-	albumArt := r.URL.Query().Get("albumArt") == "true"
-	fileInfo, err := files.FileInfoFaster(utils.FileOptions{
-		FollowSymlinks:           true,
-		Path:                     path,
-		Source:                   source,
-		Expand:                   true,
-		Content:                  false,
-		Metadata:                 true,
-		AlbumArt:                 albumArt,
-		ExtractEmbeddedSubtitles: settings.Config.Integrations.Media.ExtractEmbeddedSubtitles,
-		ShowHidden:               d.user.ShowHidden,
-		SkipExtendedAttrs:        false,
-		ShowSharedAttr:           true,
-	}, store.Access, d.user, store.Share)
-	if err != nil {
-		return errToStatus(err), err
-	}
-	return renderJSON(w, r, fileInfo)
-}
-
-// publicMetadataHandler is the share-link variant of metadataHandler.
-// @Summary Directory with media metadata (public share)
-// @Tags Shares
-// @Produce json
-// @Param hash query string true "Share hash"
-// @Param path query string false "Path within the share"
-// @Param albumArt query bool false "When true, include embedded album art bytes in audio metadata (heavier)"
-// @Success 200 {object} iteminfo.ExtendedFileInfo
-// @Router /public/api/media/metadata [get]
-func publicMetadataHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	if d.share.ShareType == "upload" {
-		return http.StatusNotImplemented, fmt.Errorf("browsing is disabled for upload shares")
-	}
-	path := r.URL.Query().Get("path")
-	albumArt := r.URL.Query().Get("albumArt") == "true"
-	sourceCfg, ok := config.Server.SourceMap[d.share.Source]
-	if !ok {
-		return http.StatusNotFound, fmt.Errorf("source not found")
-	}
-	fileInfo, err := files.FileInfoFaster(utils.FileOptions{
-		Path:                     d.IndexPath,
-		Source:                   sourceCfg.Name,
-		Expand:                   true,
-		Content:                  false,
-		Metadata:                 true,
-		AlbumArt:                 albumArt,
-		ExtractEmbeddedSubtitles: settings.Config.Integrations.Media.ExtractEmbeddedSubtitles && d.share.ExtractEmbeddedSubtitles,
-		ShowHidden:               d.share.ShowHidden,
-		FollowSymlinks:           false,
-	}, store.Access, d.shareUser, store.Share)
-	if err != nil {
-		return errToStatus(err), err
-	}
-	fileInfo.Path = utils.AddTrailingSlashIfNotExists(path)
-	return renderJSON(w, r, fileInfo)
-}
@@ -5,9 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"net"
 	"net/http"
-	"net/url"
 	"runtime"
 	"slices"
 	"strings"
@@ -53,11 +51,7 @@ type handleFunc func(w http.ResponseWriter, r *http.Request, data *requestContex
 func withHashFileHelper(fn handleFunc) handleFunc {
 	return withOrWithoutUserHelper(func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
 		hash := r.URL.Query().Get("hash")
-		inputPath := r.URL.Query().Get("path")
-		path, err := utils.SanitizeUserPath(inputPath)
-		if err != nil && inputPath != "" {
-			return http.StatusBadRequest, err
-		}
+		path := r.URL.Query().Get("path")

 		// Get the file link by hash
 		link, err := store.Share.GetByHash(hash)
@@ -119,10 +113,8 @@ func withHashFileHelper(fn handleFunc) handleFunc {
 			pathWithoutUserScope = pathWithoutUserScope + "/"
 		}
 		data.IndexPath = pathWithoutUserScope
-		// skip file fetch for certain apis
-		if (r.Method == "POST" && strings.Contains(r.URL.Path, "/resources")) ||
-			(r.Method == "GET" && strings.Contains(r.URL.Path, "/resources/items")) ||
-			(r.Method == "GET" && strings.Contains(r.URL.Path, "/media/metadata")) {
+		if r.Method == "POST" && strings.Contains(r.URL.Path, "/resources") {
+			// no need to fetch file info for uploads
 			return fn(w, r, data)
 		}
 		file, err := FileInfoFasterFunc(utils.FileOptions{
@@ -135,7 +127,7 @@ func withHashFileHelper(fn handleFunc) handleFunc {
 			ExtractEmbeddedSubtitles: settings.Config.Integrations.Media.ExtractEmbeddedSubtitles && link.ExtractEmbeddedSubtitles,
 			ShowHidden:               link.ShowHidden,
 			FollowSymlinks:           true,
-		}, store.Access, data.shareUser, store.Share)
+		}, store.Access, data.shareUser)
 		if err != nil {
 			logger.Errorf("error fetching file info for share. hash=%v path=%v error=%v", hash, path, err)
 			return errToStatus(err), fmt.Errorf("error fetching share from server")
@@ -318,58 +310,34 @@ func withoutUserHelper(fn handleFunc) handleFunc {
 }

 // allow user without OTP to pass
-func LoginHelper(disableOtp bool, fn handleFunc) handleFunc {
+func userWithoutOTPhelper(fn handleFunc) handleFunc {
 	return func(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-
-		if config.Auth.Methods.ProxyAuth.Enabled {
-			proxyUser := r.Header.Get(config.Auth.Methods.ProxyAuth.Header)
-			if proxyUser != "" {
-				return getProxyUser(w, r, d, fn, proxyUser)
+		// This middleware is used when no user authentication is required
+		// Call the actual handler function with the updated context
+		username := r.URL.Query().Get("username")
+		password := r.Header.Get("X-Password")
+		if username == "" || password == "" {
+			return withUserHelper(fn)(w, r, d)
+		} else {
+			if !config.Auth.Methods.PasswordAuth.Enabled {
+				return 401, errors.ErrUnauthorized
 			}
-		}
-
-		// Try LDAP first if enabled; on success set d.user and continue to handler
-		if config.Auth.Methods.LdapAuth.Enabled {
-			// No valid admin token - proceed with username/password authentication
-			username := r.URL.Query().Get("username")
-			password := r.Header.Get("X-Password")
-			// URL-decode password to support special characters in headers
-			password, err := url.QueryUnescape(password)
-			if err != nil {
-				return 401, fmt.Errorf("invalid password encoding")
-			}
-			logger.Debug("ldap auth, calling AuthenticateLDAPUser")
-			ldapUser, err := AuthenticateLDAPUser(username, password)
-			if err == nil {
-				logger.Debugf("ldap auth successful, calling handler")
-				d.user = ldapUser
-				return fn(w, r, d)
-			}
-			logger.Debug("ldap auth failed, calling password auth", err)
-		}
-		if config.Auth.Methods.PasswordAuth.Enabled {
+			// Get the authentication method from the settings
 			auther, err := store.Auth.Get("password")
 			if err != nil {
 				return 401, errors.ErrUnauthorized
 			}
-			// OTP routes: password only (do not mutate stored *JSONAuth).
-			if ja, ok := auther.(*auth.JSONAuth); ok {
-				x := *ja
-				x.DisableOtp = disableOtp
-				auther = &x
-			}
+			// Authenticate the user based on the request
 			user, err := auther.Auth(r, store.Users)
 			if err != nil {
-				logger.Debug("password auth failed, calling handler:", err)
 				if err == errors.ErrNoTotpProvided {
 					return 403, err
 				}
 				return 401, errors.ErrUnauthorized
 			}
 			d.user = user
-			return fn(w, r, d)
 		}
-		return withUserHelper(fn)(w, r, d)
+		return fn(w, r, d)
 	}
 }

@@ -389,75 +357,58 @@ func withUserHelper(fn handleFunc) handleFunc {
 			}
 			return fn(w, r, data)
 		}
-
-		// Check for JWT external auth first (header or query param)
-		if config.Auth.Methods.JwtAuth.Enabled {
-			jwtToken := r.Header.Get(config.Auth.Methods.JwtAuth.Header)
-			if jwtToken == "" {
-				// Check query parameter (hardcoded to "jwt")
-				jwtToken = r.URL.Query().Get("jwt")
-			}
-
-			if jwtToken != "" {
-				return getJwtUser(w, r, data, fn, jwtToken)
-			}
-		}
-
 		proxyUser := r.Header.Get(config.Auth.Methods.ProxyAuth.Header)
 		isProxyUser := config.Auth.Methods.ProxyAuth.Enabled && proxyUser != ""
 		keyFunc := func(token *jwt.Token) (interface{}, error) {
 			return []byte(config.Auth.Key), nil
 		}
-		if data.token == "" {
-			var err error
-			data.token, err = extractToken(r)
-			if err != nil && !isProxyUser {
-				return http.StatusUnauthorized, err
-			}
+		tokenString, err := extractToken(r)
+		if err != nil && !isProxyUser {
+			return http.StatusUnauthorized, err
 		}
-
+		data.token = tokenString
 		var tk users.AuthToken
-		token, err := jwt.ParseWithClaims(data.token, &tk, keyFunc)
+		token, err := jwt.ParseWithClaims(tokenString, &tk, keyFunc)
 		if err != nil {
 			if isProxyUser {
 				return getProxyUser(w, r, data, fn, proxyUser)
 			}
 			// JWT library automatically validates expiration - if expired, it returns an error
-			return http.StatusUnauthorized, fmt.Errorf("invalid token: %v", err)
+			return http.StatusUnauthorized, fmt.Errorf("error processing token, %v", err)
 		}
 		if !token.Valid {
 			return http.StatusUnauthorized, fmt.Errorf("invalid token")
 		}
-		if auth.IsRevokedApiToken(store.Access, data.token) {
-			return http.StatusUnauthorized, fmt.Errorf("token is expired or revoked")
+		if auth.IsRevokedApiKey(data.token) {
+			if isProxyUser {
+				return getProxyUser(w, r, data, fn, proxyUser)
+			}
+			return http.StatusUnauthorized, fmt.Errorf("token revoked")
 		}
 		// ExpiresAt should always be set in valid tokens created by our system
-		// JWT library populates RegisteredClaims.ExpiresAt
-		if tk.RegisteredClaims.ExpiresAt == nil {
-			return http.StatusUnauthorized, fmt.Errorf("token is invalid or revoked")
+		// If it's nil, the token is invalid
+		if tk.ExpiresAt == nil {
+			return http.StatusUnauthorized, fmt.Errorf("invalid token: missing expiration")
 		}
 		// Check if token is about to expire for renewal header
-		if tk.RegisteredClaims.ExpiresAt.Unix() < time.Now().Add(time.Minute*30).Unix() {
+		if tk.ExpiresAt.Unix() < time.Now().Add(time.Minute*30).Unix() {
 			w.Header().Add("X-Renew-Token", "true")
 		}
 		// Check if token is minimal/stateful (no BelongsTo in claim)
 		if tk.BelongsTo == 0 {
-			// Hash the token and look up user ID in access storage
-			userID, found := store.Access.GetUserIDFromToken(data.token)
-			if !found {
-				return http.StatusUnauthorized, fmt.Errorf("token is invalid or revoked")
+			tk.BelongsTo, err = getUserFromApiToken(data.token)
+			if err != nil {
+				return http.StatusUnauthorized, err
 			}
-			tk.BelongsTo = userID
 		}
 		data.user, err = store.Users.Get(tk.BelongsTo)
 		if err != nil {
 			logger.Errorf("Failed to get user with ID %v: %v", tk.BelongsTo, err)
 			return http.StatusInternalServerError, err
 		}
-
 		// Set cookie. Some clients like gvfs relies on it for concurrent uploads
-		if tk.RegisteredClaims.ExpiresAt != nil {
-			setSessionCookie(w, r, data.token, tk.RegisteredClaims.ExpiresAt.Time)
+		if expire := tk.ExpiresAt; expire != nil {
+			setSessionCookie(w, r, tokenString, expire.Time)
 		}
 		setUserInResponseWriter(w, data.user)
 		if data.user.Username == "" {
@@ -471,48 +422,6 @@ func withUserHelper(fn handleFunc) handleFunc {
 	}
 }

-func getJwtUser(w http.ResponseWriter, r *http.Request, data *requestContext, fn handleFunc, jwtToken string) (int, error) {
-	// Verify the external JWT token
-	username, claims, err := auth.VerifyExternalJWT(
-		jwtToken,
-		config.Auth.Methods.JwtAuth.Secret,
-		config.Auth.Methods.JwtAuth.Algorithm,
-		config.Auth.Methods.JwtAuth.UserIdentifier,
-	)
-	if err != nil {
-		logger.Debugf("JWT verification failed: %v", err)
-		return http.StatusForbidden, fmt.Errorf("JWT authentication failed: %w", err)
-	}
-
-	// Setup user based on JWT claims
-	user, err := setupJwtUser(r, data, username, claims)
-	if err != nil {
-		return http.StatusForbidden, err
-	}
-	data.user = user
-	setUserInResponseWriter(w, data.user)
-	if data.user.Username == "" {
-		return http.StatusForbidden, errors.ErrUnauthorized
-	}
-
-	// Generate a FileBrowser session token for JWT users if they don't have one
-	if data.token == "" {
-		expires := time.Hour * time.Duration(config.Auth.TokenExpirationHours)
-		tokenString, _, err := auth.MakeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), expires, user.Permissions, false)
-		if err != nil {
-			logger.Errorf("Failed to generate token for JWT user %s: %v", username, err)
-			return http.StatusInternalServerError, fmt.Errorf("failed to generate token")
-		}
-		data.token = tokenString
-	}
-
-	// Call the handler function, passing in the context (or return OK if no handler)
-	if fn == nil {
-		return http.StatusOK, nil
-	}
-	return fn(w, r, data)
-}
-
 func getProxyUser(w http.ResponseWriter, r *http.Request, data *requestContext, fn handleFunc, proxyUser string) (int, error) {
 	// proxy user logic
 	user, err := setupProxyUser(r, data, proxyUser)
@@ -527,12 +436,12 @@ func getProxyUser(w http.ResponseWriter, r *http.Request, data *requestContext,
 	// Generate a token for proxy users if they don't have one
 	if data.token == "" {
 		expires := time.Hour * time.Duration(config.Auth.TokenExpirationHours)
-		tokenString, _, err := auth.MakeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), expires, user.Permissions, false)
+		signed, err := makeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), expires, user.Permissions, false)
 		if err != nil {
 			logger.Errorf("Failed to generate token for proxy user %s: %v", proxyUser, err)
 			return http.StatusInternalServerError, fmt.Errorf("failed to generate token")
 		}
-		data.token = tokenString
+		data.token = signed.Key
 	}
 	// Call the handler function, passing in the context (or return OK if no handler)
 	if fn == nil {
@@ -554,10 +463,16 @@ func withSelfOrAdminHelper(fn handleFunc) handleFunc {
 }

 func wrapHandler(fn handleFunc) http.HandlerFunc {
+	return wrapHandlerOpts(fn, wrapperOpts{})
+}
+
+type wrapperOpts struct {
+	requestBasicAuth bool
+}
+
+func wrapHandlerOpts(fn handleFunc, opts wrapperOpts) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		data := &requestContext{
-			ctx: r.Context(),
-		}
+		data := &requestContext{}

 		// Call the actual handler function and get status code and error
 		status, err := fn(w, r, data)
@@ -569,6 +484,10 @@ func wrapHandler(fn handleFunc) http.HandlerFunc {
 				Message: err.Error(),
 			}

+			if status == http.StatusUnauthorized && opts.requestBasicAuth {
+				w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
+			}
+
 			// Set the content type to JSON and status code
 			w.Header().Set("Content-Type", "application/json; charset=utf-8")
 			w.WriteHeader(status)
@@ -595,21 +514,6 @@ func wrapHandler(fn handleFunc) http.HandlerFunc {
 	}
 }

-// wrapHandlerBasicAuth wraps a handler and automatically sets WWW-Authenticate header
-// for 401 Unauthorized responses, triggering Basic Auth challenge
-func wrapHandlerBasicAuth(fn handleFunc) http.HandlerFunc {
-	// Wrap the handler to set WWW-Authenticate header for 401 responses
-	wrappedFn := func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
-		status, err := fn(w, r, data)
-		// Set WWW-Authenticate header before returning 401
-		if status == http.StatusUnauthorized {
-			w.Header().Set("WWW-Authenticate", `Basic realm="WebDAV"`)
-		}
-		return status, err
-	}
-	return wrapHandler(wrappedFn)
-}
-
 func withPermShareHelper(fn handleFunc) handleFunc {
 	return withUserHelper(func(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 		if !d.user.Permissions.Share {
@@ -619,30 +523,11 @@ func withPermShareHelper(fn handleFunc) handleFunc {
 	})
 }

-// withBasicAuthHelper extracts Basic Auth credentials and uses the password as a JWT token
-// to authenticate the user. The username is ignored, and the password should be a JWT token.
-func withBasicAuthHelper(fn handleFunc) handleFunc {
-	return func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
-		_, password, ok := r.BasicAuth()
-		if !ok || password == "" {
-			// Return 401 - wrapHandlerBasicAuth will set WWW-Authenticate header
-			return http.StatusUnauthorized, fmt.Errorf("basic authentication required")
-		}
-		data.token = password
-		return withUserHelper(fn)(w, r, data)
-	}
-}
-
-// withBasicAuth returns an http.HandlerFunc for use with router.Handle.
-// It extracts Basic Auth credentials and uses the password as a JWT token to authenticate the user.
-func withBasicAuth(fn handleFunc) http.HandlerFunc {
-	return wrapHandlerBasicAuth(withBasicAuthHelper(fn))
-}
-
 func withPermShare(fn handleFunc) http.HandlerFunc {
 	return wrapHandler(withPermShareHelper(fn))
 }

+// Example of wrapping specific middleware functions for use with http.HandleFunc
 func withHashFile(fn handleFunc) http.HandlerFunc {
 	return wrapHandler(withHashFileHelper(fn))
 }
@@ -663,8 +548,8 @@ func withoutUser(fn handleFunc) http.HandlerFunc {
 	return wrapHandler(withoutUserHelper(fn))
 }

-func loginHelper(fn handleFunc) http.HandlerFunc {
-	return wrapHandler(LoginHelper(false, fn))
+func userWithoutOTP(fn handleFunc) http.HandlerFunc {
+	return wrapHandler(userWithoutOTPhelper(fn))
 }

 func withSelfOrAdmin(fn handleFunc) http.HandlerFunc {
@@ -756,26 +641,6 @@ func setUserInResponseWriter(w http.ResponseWriter, user *users.User) {
 	}
 }

-func getRemoteIP(r *http.Request) string {
-	// 1. Check X-Forwarded-For
-	xff := r.Header.Get("X-Forwarded-For")
-	if xff != "" {
-		// The first IP is the original client
-		ips := strings.Split(xff, ",")
-		return strings.TrimSpace(ips[0])
-	}
-
-	// 2. Check X-Real-IP
-	xri := r.Header.Get("X-Real-IP")
-	if xri != "" {
-		return xri
-	}
-
-	// 3. Fallback to RemoteAddr (strip port if necessary)
-	ip, _, _ := net.SplitHostPort(r.RemoteAddr)
-	return ip
-}
-
 // LoggingMiddleware logs each request and its status code.
 func LoggingMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -784,6 +649,7 @@ func LoggingMiddleware(next http.Handler) http.Handler {
 			if rcv := recover(); rcv != nil {
 				method := r.Method
 				url := r.URL.String()
+				remoteAddr := r.RemoteAddr
 				username := "unknown" // Default username

 				// Attempt to get username from ResponseWriterWrapper if it's set
@@ -796,7 +662,7 @@ func LoggingMiddleware(next http.Handler) http.Handler {
 				stackTrace := string(buf[:n])

 				logger.Errorf("PANIC RECOVERED: %v\nUser: %s\nMethod: %s\nURL: %s\nRemoteAddr: %s\nGo Stack Trace:\n%s",
-					rcv, username, method, url, getRemoteIP(r), stackTrace)
+					rcv, username, method, url, remoteAddr, stackTrace)

 				// Attempt to send a 500 error response to the client
 				// This is a best-effort; the connection might be broken or process too unstable.
@@ -839,7 +705,7 @@ func LoggingMiddleware(next http.Handler) http.Handler {
 			fmt.Sprintf("%-7s | %3d | %-15s | %-12s | %-12s | \"%s\"",
 				r.Method,
 				wrappedWriter.StatusCode,
-				getRemoteIP(r),
+				r.RemoteAddr,
 				truncUser,
 				fmt.Sprintf("%vms", duration.Milliseconds()),
 				fullURL))
@@ -8,7 +8,6 @@ import (
 	"time"

 	storm "github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/access"
@@ -53,7 +52,7 @@ func mockFileInfoFaster(t *testing.T) {
 	t.Cleanup(func() { FileInfoFasterFunc = originalFileInfoFaster })

 	// Mock the function to skip execution
-	FileInfoFasterFunc = func(opts utils.FileOptions, access *access.Storage, user *users.User, share *share.Storage) (*iteminfo.ExtendedFileInfo, error) {
+	FileInfoFasterFunc = func(opts utils.FileOptions, access *access.Storage, user *users.User) (*iteminfo.ExtendedFileInfo, error) {
 		return &iteminfo.ExtendedFileInfo{
 			FileInfo: iteminfo.FileInfo{
 				Path: opts.Path,
@@ -110,7 +109,7 @@ func TestWithAdminHelper(t *testing.T) {
 			data := &requestContext{
 				user: tc.user,
 			}
-			tokenString, _, err := auth.MakeSignedTokenAPI(tc.user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), time.Hour*2, tc.user.Perm, false)
+			token, err := makeSignedTokenAPI(tc.user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), time.Hour*2, tc.user.Perm, false)
 			if err != nil {
 				t.Fatalf("Error making token for request: %v", err)
 			}
@@ -127,7 +126,7 @@ func TestWithAdminHelper(t *testing.T) {
 			}
 			req.AddCookie(&http.Cookie{
 				Name:  "filebrowser_quantum_jwt",
-				Value: tokenString,
+				Value: token.Key,
 			})

 			// Call the handler with the test request and mock context
@@ -4,7 +4,6 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"net/http"
 	"net/url"
 	"slices"
@@ -12,7 +11,6 @@ import (
 	"time"

 	"github.com/coreos/go-oidc/v3/oidc"
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
@@ -42,118 +40,38 @@ func (u *userInfoUnmarshaller) UnmarshalJSON(data []byte) error {
 		return err
 	}

-	// Extract groups if configured (supports nested claims like "resource_access.filebrowser-client.roles")
+	// Extract groups if configured
 	if u.groupsClaim != "" {
-		u.userInfo.Groups = extractGroupsFromOIDCClaims(raw, u.groupsClaim)
+		if v, ok := raw[u.groupsClaim]; ok {
+			switch val := v.(type) {
+			case []interface{}:
+				groups := make([]string, len(val))
+				for i, g := range val {
+					if s, ok := g.(string); ok {
+						groups[i] = strings.TrimSpace(s)
+					}
+				}
+				u.userInfo.Groups = groups
+			case string:
+				if val != "" {
+					parts := strings.Split(val, ",")
+					for i := range parts {
+						parts[i] = strings.TrimSpace(parts[i])
+					}
+					u.userInfo.Groups = parts
+				}
+			}
+		}
 	}

 	u.userInfo.Claims = raw
 	return nil
 }

-// extractGroupsFromOIDCClaims extracts groups from OIDC claims supporting nested paths.
-// Supports both direct claims (e.g., "groups") and nested claims using '.' separator (e.g., "resource_access.filebrowser-client.roles")
-func extractGroupsFromOIDCClaims(claims map[string]interface{}, groupsClaimField string) []string {
-	var groups []string
-
-	if groupsClaimField == "" {
-		return groups
-	}
-
-	// Try to resolve nested path first (e.g., "custom.groups")
-	groupsVal := resolveOIDCNestedClaim(claims, groupsClaimField)
-
-	if groupsVal == nil {
-		// If nested path didn't work, try direct lookup
-		if val, ok := claims[groupsClaimField]; ok {
-			groupsVal = val
-		}
-	}
-
-	if groupsVal != nil {
-		groups = parseOIDCGroupsValue(groupsVal)
-	}
-
-	return groups
-}
-
-// resolveOIDCNestedClaim resolves nested OIDC claims using '.' as a separator
-func resolveOIDCNestedClaim(claims map[string]interface{}, path string) interface{} {
-	parts := strings.Split(path, ".")
-	current := interface{}(claims)
-
-	for _, part := range parts {
-		switch v := current.(type) {
-		case map[string]interface{}:
-			if val, ok := v[part]; ok {
-				current = val
-			} else {
-				return nil
-			}
-		default:
-			return nil
-		}
-	}
-
-	return current
-}
-
-// parseOIDCGroupsValue parses OIDC claim values into a string slice of groups
-// Returns nil for missing/empty non-array values, []string{} for empty arrays
-func parseOIDCGroupsValue(groupsVal interface{}) []string {
-	var groups []string
-
-	switch val := groupsVal.(type) {
-	case map[string]interface{}:
-		// Groups as map keys - return empty slice for empty map
-		groups = slices.Collect(maps.Keys(val))
-	case []interface{}:
-		// Groups as array of interfaces - always initialize as empty slice for arrays
-		groups = []string{}
-		for _, g := range val {
-			if groupStr, ok := g.(string); ok {
-				groups = append(groups, strings.TrimSpace(groupStr))
-			}
-		}
-	case []string:
-		// Groups as array of strings - always initialize as empty slice for arrays
-		groups = val
-		if groups == nil {
-			groups = []string{}
-		}
-	case string:
-		// Single group as string or comma-separated groups
-		// Return nil for empty strings, parsed array otherwise
-		if val != "" {
-			parts := strings.Split(val, ",")
-			for i := range parts {
-				parts[i] = strings.TrimSpace(parts[i])
-			}
-			groups = parts
-		}
-		// else: groups stays nil for empty string
-	default:
-		// Try to unmarshal as JSON array
-		if jsonBytes, err := json.Marshal(val); err == nil {
-			var groupsArray []string
-			if err := json.Unmarshal(jsonBytes, &groupsArray); err == nil {
-				// Initialize as empty slice if array was parsed
-				if groupsArray == nil {
-					groups = []string{}
-				} else {
-					groups = groupsArray
-				}
-			}
-		}
-	}
-
-	return groups
-}
-
 // oidcLoginHandler initiates OIDC login.
 // @Summary OIDC login
 // @Description Initiates OIDC login flow.
-// @Tags Auth
+// @Tags OIDC
 // @Accept json
 // @Produce json
 // @Success 302 {string} string "Redirect to OIDC provider"
@@ -187,7 +105,7 @@ func oidcLoginHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 // oidcCallbackHandler handles OIDC callback.
 // @Summary OIDC callback
 // @Description Handles OIDC login callback.
-// @Tags Auth
+// @Tags OIDC
 // @Accept json
 // @Produce json
 // @Param code query string false "OIDC code"
@@ -255,7 +173,7 @@ func oidcCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestConte

 	// --- Attempt to process ID Token ---
 	if ok && rawIDToken != "" {
-		logger.Debugf("ID token found in token response, attempting verification. Raw ID Token: %s", rawIDToken)
+		logger.Debug("ID token found in token response, attempting verification.")

 		// Verify the ID token
 		// This uses the verifier initialized with the provider's JWKS endpoint and client ID
@@ -280,6 +198,7 @@ func oidcCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 					claimsFromIDToken = true
 				}
 			}
+			logger.Debugf("Failed to verify ID token: %v", verify_err)
 		}

 	} else {
@@ -324,29 +243,11 @@ func oidcCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 // based on the configured UserIdentifier and logs the user into the application.
 // It creates a new user if one doesn't exist.
 func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string, groups []string) (int, error) {
-	oidcCfg := config.Auth.Methods.OidcAuth
-
-	// Check if user is in required groups (if userGroups is configured)
-	if len(oidcCfg.UserGroups) > 0 {
-		userInAllowedGroup := false
-		for _, allowedGroup := range oidcCfg.UserGroups {
-			if slices.Contains(groups, allowedGroup) {
-				userInAllowedGroup = true
-				break
-			}
-		}
-		if !userInAllowedGroup {
-			logger.Warningf("User %s is not in any of the required groups %v. Access denied.", username, oidcCfg.UserGroups)
-			return http.StatusForbidden, fmt.Errorf("user %s is not authorized to access this application (not in required groups)", username)
-		}
-		logger.Debugf("User %s is in required group, allowing access.", username)
-	}
-
 	isAdmin := false // Default to non-admin user
-	if oidcCfg.AdminGroup != "" {
-		if slices.Contains(groups, oidcCfg.AdminGroup) {
+	if config.Auth.Methods.OidcAuth.AdminGroup != "" {
+		if slices.Contains(groups, config.Auth.Methods.OidcAuth.AdminGroup) {
 			isAdmin = true // User is in the admin group, grant admin privileges
-			logger.Debugf("User %s is in admin group %s, granting admin privileges.", username, oidcCfg.AdminGroup)
+			logger.Debugf("User %s is in admin group %s, granting admin privileges.", username, config.Auth.Methods.OidcAuth.AdminGroup)
 		}
 	}
 	logger.Debugf("Successfully authenticated OIDC username: %s isAdmin: %v", username, isAdmin)
@@ -356,29 +257,32 @@ func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string,
 		if err.Error() != "the resource does not exist" {
 			return http.StatusInternalServerError, err
 		}
-		// Auto-create user on first OIDC authentication
-		if oidcCfg.AdminGroup == "" {
-			isAdmin = config.UserDefaults.Permissions.Admin
-		}
-		user = &users.User{
-			Username:    username,
-			LoginMethod: users.LoginMethodOidc,
-		}
-		settings.ApplyUserDefaults(user)
-		if isAdmin {
-			user.Permissions.Admin = true
-		}
-		err = storage.CreateUser(*user, user.Permissions)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-		user, err = store.Users.Get(username)
-		if err != nil {
-			return http.StatusInternalServerError, err
+		if config.Auth.Methods.OidcAuth.CreateUser {
+			if config.Auth.Methods.OidcAuth.AdminGroup == "" {
+				isAdmin = config.UserDefaults.Permissions.Admin
+			}
+			user = &users.User{
+				Username:    username,
+				LoginMethod: users.LoginMethodOidc,
+			}
+			settings.ApplyUserDefaults(user)
+			if isAdmin {
+				user.Permissions.Admin = true
+			}
+			err = storage.CreateUser(*user, user.Permissions)
+			if err != nil {
+				return http.StatusInternalServerError, err
+			}
+			user, err = store.Users.Get(username)
+			if err != nil {
+				return http.StatusInternalServerError, err
+			}
+		} else {
+			return http.StatusForbidden, fmt.Errorf("user %s does not exist and createUser is disabled. Your admin needs to create your user before you can access this application", username)
 		}
 	} else {
 		// update user admin perms
-		if isAdmin != user.Permissions.Admin && oidcCfg.AdminGroup != "" {
+		if isAdmin != user.Permissions.Admin && config.Auth.Methods.OidcAuth.AdminGroup != "" {
 			user.Permissions.Admin = isAdmin
 			err = store.Users.Update(user, true, "Permissions")
 			if err != nil {
@@ -397,7 +301,7 @@ func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string,

 	expires := time.Hour * time.Duration(config.Auth.TokenExpirationHours)
 	// Generate a signed token for the user
-	tokenString, _, err2 := auth.MakeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), expires, user.Permissions, false)
+	signed, err2 := makeSignedTokenAPI(user, "WEB_TOKEN_"+utils.InsecureRandomIdentifier(4), expires, user.Permissions, false)
 	if err2 != nil {
 		// Handle potential errors during token generation
 		if strings.Contains(err2.Error(), "key already exists with same name") {
@@ -418,7 +322,7 @@ func loginWithOidcUser(w http.ResponseWriter, r *http.Request, username string,
 	}
 	cookie := &http.Cookie{
 		Name:     "filebrowser_quantum_jwt",
-		Value:    tokenString,
+		Value:    signed.Key,
 		Domain:   strings.Split(host, ":")[0], // Set domain to the host without port
 		Path:     "/",
 		SameSite: http.SameSiteLaxMode, // Lax mode allows cookie on navigation from OIDC provider
@@ -77,101 +77,6 @@ func TestUserInfoUnmarshaller(t *testing.T) {
 				Groups: []string{},
 			},
 		},
-		{
-			name:        "preferred_username and sub",
-			jsonData:    `{"sub":"auth0|123","preferred_username":"jdoe","email":"jdoe@example.com"}`,
-			groupsClaim: "groups",
-			expected: userInfo{
-				Claims: map[string]interface{}{
-					"sub":                 "auth0|123",
-					"preferred_username": "jdoe",
-					"email":              "jdoe@example.com",
-				},
-				Groups: nil,
-			},
-		},
-		{
-			name:        "empty groups string",
-			jsonData:    `{"name":"Dana","groups":""}`,
-			groupsClaim: "groups",
-			expected: userInfo{
-				Claims: map[string]interface{}{
-					"name":   "Dana",
-					"groups": "",
-				},
-				Groups: nil,
-			},
-		},
-		{
-			name:        "single group in array",
-			jsonData:    `{"preferred_username":"single","groups":["admins"]}`,
-			groupsClaim: "groups",
-			expected: userInfo{
-				Claims: map[string]interface{}{
-					"preferred_username": "single",
-					"groups":             []interface{}{"admins"},
-				},
-				Groups: []string{"admins"},
-			},
-		},
-		{
-			name:        "nested single-level claim",
-			jsonData:    `{"username":"john","custom":{"groups":["admin","users"]}}`,
-			groupsClaim: "custom.groups",
-			expected: userInfo{
-				Claims: map[string]interface{}{
-					"username": "john",
-					"custom": map[string]interface{}{
-						"groups": []interface{}{"admin","users"},
-					},
-				},
-				Groups: []string{"admin", "users"},
-			},
-		},
-		{
-			name:        "keycloak resource_access nested structure",
-			jsonData:    `{"sub":"user123","resource_access":{"filebrowser-client":{"roles":["admin","editor","viewer"]}}}`,
-			groupsClaim: "resource_access.filebrowser-client.roles",
-			expected: userInfo{
-				Claims: map[string]interface{}{
-					"sub": "user123",
-					"resource_access": map[string]interface{}{
-						"filebrowser-client": map[string]interface{}{
-							"roles": []interface{}{"admin","editor","viewer"},
-						},
-					},
-				},
-				Groups: []string{"admin", "editor", "viewer"},
-			},
-		},
-		{
-			name:        "nested claim with single string value",
-			jsonData:    `{"username":"bob","auth":{"group":"admin"}}`,
-			groupsClaim: "auth.group",
-			expected: userInfo{
-				Claims: map[string]interface{}{
-					"username": "bob",
-					"auth": map[string]interface{}{
-						"group": "admin",
-					},
-				},
-				Groups: []string{"admin"},
-			},
-		},
-		{
-			name:        "invalid nested path returns empty groups",
-			jsonData:    `{"username":"alice","custom":{"roles":["user"]}}`,
-			groupsClaim: "custom.nonexistent.roles",
-			expected: userInfo{
-				Claims: map[string]interface{}{
-					"username": "alice",
-					"custom": map[string]interface{}{
-						"roles": []interface{}{"user"},
-					},
-				},
-				Groups: nil,
-			},
-		},
 	}

 	for _, tt := range tests {
@@ -193,12 +98,3 @@ func TestUserInfoUnmarshaller(t *testing.T) {
 		})
 	}
 }
-
-func TestUserInfoUnmarshaller_InvalidJSON(t *testing.T) {
-	var userdata userInfo
-	u := &userInfoUnmarshaller{userInfo: &userdata, groupsClaim: "groups"}
-	err := json.Unmarshal([]byte(`{invalid json}`), u)
-	if err == nil {
-		t.Fatal("Unmarshal expected to fail on invalid JSON")
-	}
-}
@@ -65,21 +65,6 @@ type OnlyOfficeJWTPayload struct {
 	} `json:"actions"`
 }

-// onlyofficeClientConfigGetHandler retrieves OnlyOffice client configuration
-//
-// @Summary Get OnlyOffice client configuration
-// @Description Returns the configuration needed for OnlyOffice document editor client
-// @Tags Office
-// @Accept json
-// @Produce json
-// @Param source query string false "Source name"
-// @Param path query string false "File path"
-// @Param hash query string false "Share hash (for public shares)"
-// @Success 200 {object} map[string]interface{} "OnlyOffice configuration"
-// @Failure 400 {object} map[string]string "Missing or invalid parameters"
-// @Failure 500 {object} map[string]string "Server error"
-// @Router /api/office/config [get]
-// @Security ApiKeyAuth
 func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	if settings.Config.Integrations.OnlyOffice.Url == "" {
 		return http.StatusInternalServerError, errors.New("only-office integration must be configured in settings")
@@ -99,7 +84,7 @@ func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d
 	// Rule 1: Validate user-provided path to prevent path traversal
 	cleanPath, err := utils.SanitizeUserPath(providedPath)
 	if err != nil {
-		return http.StatusBadRequest, err
+		return http.StatusBadRequest, fmt.Errorf("invalid path: %v", err)
 	}
 	providedPath = cleanPath

@@ -131,7 +116,7 @@ func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d
 			Source:         source,
 			Expand:         false,
 			FollowSymlinks: true,
-		}, store.Access, d.user, store.Share)
+		}, store.Access, d.user)
 		if err != nil {
 			logger.Errorf("OnlyOffice: failed to get file info for source=%s, path=%s: %v", source, path, err)
 			return errToStatus(err), err
@@ -280,12 +265,14 @@ func buildOnlyOfficeDownloadURL(r *http.Request, source, path, hash, token strin
 	}

 	escapedPath := url.QueryEscape(path)
-	downloadURL := fmt.Sprintf("%s/api/resources/download?file=%s&auth=%s&source=%s",
-		strings.TrimSuffix(baseURL, "/"), escapedPath, token, url.QueryEscape(source))
+	downloadURL := fmt.Sprintf("%s/api/raw?file=%s&auth=%s",
+		strings.TrimSuffix(baseURL, "/"), escapedPath, token)
 	if hash != "" {
-		downloadURL = fmt.Sprintf("%s/public/api/resources/download?file=%s&auth=%s&hash=%s",
-			strings.TrimSuffix(baseURL, "/"), escapedPath, token, hash)
+		downloadURL = downloadURL + "&hash=" + hash
+	} else {
+		downloadURL = downloadURL + "&source=" + url.QueryEscape(source)
 	}
+
 	return downloadURL
 }

@@ -331,7 +318,7 @@ func buildOnlyOfficeCallbackURL(r *http.Request, source, path, hash, token strin
 		params.Set("path", path) // This should be the path relative to the share, not the full filesystem path
 		params.Set("auth", token)

-		callbackURL = fmt.Sprintf("%s/public/api/office/callback?%s",
+		callbackURL = fmt.Sprintf("%s/public/api/onlyoffice/callback?%s",
 			strings.TrimSuffix(baseURL, "/"), params.Encode())
 	} else {
 		// Regular callback URL - include source for non-share requests
@@ -340,7 +327,7 @@ func buildOnlyOfficeCallbackURL(r *http.Request, source, path, hash, token strin
 		params.Set("path", path)
 		params.Set("auth", token)

-		callbackURL = fmt.Sprintf("%s/api/office/callback?%s",
+		callbackURL = fmt.Sprintf("%s/api/onlyoffice/callback?%s",
 			strings.TrimSuffix(baseURL, "/"), params.Encode())
 	}

@@ -352,13 +339,6 @@ func processOnlyOfficeCallback(w http.ResponseWriter, r *http.Request, d *reques
 	// Extract clean parameters from query string
 	source := r.URL.Query().Get("source")
 	path := r.URL.Query().Get("path")
-	user := d.user
-
-	if d.share != nil {
-		source = d.share.GetSourceName()
-		path = d.IndexPath
-		user = d.shareUser
-	}

 	// Validate required parameters
 	if (path == "" || source == "") && d.fileInfo.Hash == "" {
@@ -369,10 +349,40 @@ func processOnlyOfficeCallback(w http.ResponseWriter, r *http.Request, d *reques
 	// Rule 1: Validate user-provided path to prevent path traversal
 	cleanPath, err := utils.SanitizeUserPath(path)
 	if err != nil {
-		return returnOnlyOfficeError(w, r, 400, err.Error())
+		logger.Errorf("OnlyOffice callback: invalid path: %v", err)
+		return returnOnlyOfficeError(w, r, 400, "invalid path")
 	}
 	path = cleanPath

+	var sourceInfo *settings.Source
+	var ok bool
+	if d.fileInfo.Hash != "" {
+		sourceInfo, ok = settings.Config.Server.SourceMap[d.share.Source]
+		if !ok {
+			logger.Error("OnlyOffice: share source not found")
+			return returnOnlyOfficeError(w, r, 404, "source not found")
+		}
+	} else {
+		sourceInfo, ok = settings.Config.Server.NameToSource[source]
+		if !ok {
+			logger.Error("OnlyOffice: source not found")
+			return returnOnlyOfficeError(w, r, 404, "source not found")
+		}
+	}
+
+	if d.fileInfo.Hash == "" {
+		// Regular user request - need to resolve scope
+		userScope, scopeErr := d.user.GetScopeForSourceName(source)
+		if scopeErr != nil {
+			logger.Errorf("OnlyOffice callback: source %s not available for user %s: %v", source, d.user.Username, scopeErr)
+			return returnOnlyOfficeError(w, r, 403, "source not available")
+		}
+		path = utils.JoinPathAsUnix(userScope, path)
+	} else {
+		source = sourceInfo.Name
+		// path is index path, so we build from share path
+		path = utils.JoinPathAsUnix(d.share.Path, path)
+	}
 	// Handle document closure - clean up document key cache
 	if data.Status == onlyOfficeStatusDocumentClosedWithChanges ||
 		data.Status == onlyOfficeStatusDocumentClosedWithNoChanges {
@@ -477,14 +487,14 @@ func processOnlyOfficeCallback(w http.ResponseWriter, r *http.Request, d *reques
 		}

 		// Check share permissions first if this is a share request
-		if d.share != nil {
+		if d.fileInfo.Hash != "" {
 			if !d.share.AllowModify {
 				logger.Errorf("OnlyOffice callback: edit permission not allowed for this share")
 				return returnOnlyOfficeError(w, r, 403, "edit permission not allowed for this share")
 			}
 		} else {
 			// Verify user has modify permissions
-			if !user.Permissions.Modify {
+			if !d.user.Permissions.Modify {
 				logger.Errorf("OnlyOffice callback: user %s lacks modify permissions for path=%s",
 					d.user.Username, path)
 				return returnOnlyOfficeError(w, r, 403, "user lacks modify permissions")
@@ -518,7 +528,7 @@ func processOnlyOfficeCallback(w http.ResponseWriter, r *http.Request, d *reques
 		_, err = files.FileInfoFaster(utils.FileOptions{
 			Source: source,
 			Path:   path,
-		}, store.Access, user, store.Share)
+		}, store.Access, d.user)
 		if err != nil {
 			logger.Errorf("OnlyOffice callback: original file no longer exists at path=%s: %v",
 				path, err)
@@ -533,7 +543,7 @@ func processOnlyOfficeCallback(w http.ResponseWriter, r *http.Request, d *reques
 		}

 		// Get user scope to resolve full index path for write operation
-		userScope, err := user.GetScopeForSourceName(source)
+		userScope, err := d.user.GetScopeForSourceName(source)
 		if err != nil {
 			return returnOnlyOfficeError(w, r, 403, "user scope not found")
 		}
@@ -565,22 +575,6 @@ func processOnlyOfficeCallback(w http.ResponseWriter, r *http.Request, d *reques
 	return returnOnlyOfficeSuccess(w, r)
 }

-// onlyofficeCallbackHandler handles OnlyOffice document server callbacks
-//
-// @Summary Handle OnlyOffice document server callback
-// @Description Receives callbacks from OnlyOffice document server for document status changes and saves
-// @Tags Office
-// @Accept json
-// @Produce json
-// @Param source query string false "Source name"
-// @Param path query string false "File path"
-// @Param hash query string false "Share hash (for public shares)"
-// @Success 200 {object} map[string]interface{} "Callback processed successfully"
-// @Failure 400 {object} map[string]string "Invalid callback data"
-// @Failure 500 {object} map[string]string "Server error"
-// @Router /api/office/callback [post]
-// @Router /api/office/callback [get]
-// @Security ApiKeyAuth
 func onlyofficeCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	// Parse callback data based on request method
 	var callbackData *OnlyOfficeCallback
@@ -53,7 +53,7 @@ func isClientCancellation(ctx context.Context, err error) bool {
 // @Failure 415 {object} map[string]string "Unsupported file type for preview"
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Failure 501 {object} map[string]string "Preview generation not implemented"
-// @Router /api/resources/preview [get]
+// @Router /api/preview [get]
 func previewHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	if config.Server.DisablePreviews {
 		return http.StatusNotImplemented, fmt.Errorf("preview is disabled")
@@ -71,7 +71,7 @@ func previewHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (
 		Source:   source,
 		AlbumArt: true, // Extract album art for audio previews
 		Expand:   true,
-	}, store.Access, d.user, store.Share)
+	}, store.Access, d.user)
 	if err != nil {
 		logger.Errorf("error getting file info: %v", err)
 		return errToStatus(err), err
@@ -99,60 +99,60 @@ func rawFileHandler(w http.ResponseWriter, r *http.Request, file iteminfo.Extend
 	return 0, nil
 }

-// getDirectoryPreview returns the previewable file at the given frame index (0–3) for motion preview.
-// atPercentage maps to frame: 0→0, 1–25→1, 26–50→2, 51–100→3. The returned file is frameIndex % n where n is the number of previewable items.
-func getDirectoryPreview(r *http.Request, d *requestContext, frameIndex int) (*iteminfo.ExtendedFileInfo, error) {
-	// Build list of previewable item names in stable order (same as d.fileInfo.Files)
-	var previewableNames []string
+// getDirectoryPreview finds a valid preview file within a directory.
+func getDirectoryPreview(r *http.Request, d *requestContext) (*iteminfo.ExtendedFileInfo, error) {
+	var lastErr error
 	for _, item := range d.fileInfo.Files {
-		if !iteminfo.ShouldBubbleUpToFolderPreview(item.ItemInfo) {
+		if !item.HasPreview || !iteminfo.ShouldBubbleUpToFolderPreview(item.ItemInfo) {
 			continue
 		}
-		previewableNames = append(previewableNames, item.Name)
-	}
-	if len(previewableNames) == 0 {
-		return nil, fmt.Errorf("no previewable files found in directory")
-	}
-	// Cycle: 1 image → always 0; 2 images → 0,1,0,1; 3 → 0,1,2,0; 4 → 0,1,2,3
-	index := frameIndex % len(previewableNames)
-	name := previewableNames[index]
-
-	source := d.fileInfo.Source
-	path := utils.JoinPathAsUnix(d.fileInfo.Path, name)
-	user := d.user
-	if d.share != nil {
-		sourceInfo, ok := settings.Config.Server.SourceMap[d.share.Source]
-		if !ok {
-			return nil, fmt.Errorf("source not found for share")
-		}
-		source = sourceInfo.Name
-		path = d.IndexPath + name
-		user = d.shareUser
-	}
-	fileInfo, err := files.FileInfoFaster(
-		utils.FileOptions{
-			Path:     path,
-			Source:   source,
-			AlbumArt: true,
-			Metadata: true,
-		}, store.Access, user, store.Share)
-	if err != nil {
-		return nil, err
-	}
-	tempCtx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
-	_, previewErr := preview.GetPreviewForFile(tempCtx, *fileInfo, "small", "", 0)
-	cancel()
-	if previewErr != nil {
-		if !errors.Is(previewErr, context.Canceled) && !errors.Is(previewErr, context.DeadlineExceeded) {
-			logger.Debugf("Skipping preview file in directory '%s': %s (error: %v)", d.fileInfo.Name, name, previewErr)
-			// Fallback: try first item (frame 0) once so atPercentage=0 still works when another frame fails
-			if index != 0 {
-				return getDirectoryPreview(r, d, 0)
+		source := d.fileInfo.Source
+		path := utils.JoinPathAsUnix(d.fileInfo.Path, item.Name)
+		if d.share != nil {
+			sourceInfo, ok := settings.Config.Server.SourceMap[d.share.Source]
+			if !ok {
+				return nil, fmt.Errorf("source not found for share")
 			}
+			source = sourceInfo.Name
+			path = d.IndexPath + item.Name
 		}
-		return nil, previewErr
+		fileInfo, err := files.FileInfoFaster(
+			utils.FileOptions{
+				Path:     path,
+				Source:   source,
+				AlbumArt: true, // Extract album art for audio previews
+				Metadata: true,
+			}, store.Access, d.user)
+		if err != nil {
+			lastErr = err
+			continue // Try next file if this one fails
+		}
+		// Try to generate preview to verify the file is not corrupted
+		tempCtx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+		_, previewErr := preview.GetPreviewForFile(tempCtx, *fileInfo, "small", "", 0)
+		cancel()
+		if previewErr != nil {
+			// Skip context errors (timeout or cancellation) - they're not corruption issues
+			if !errors.Is(previewErr, context.Canceled) && !errors.Is(previewErr, context.DeadlineExceeded) {
+				// File might be corrupted, try next one
+				logger.Debugf("Skipping preview file in directory '%s': %s (error: %v)",
+					d.fileInfo.Name, item.Name, previewErr)
+			} else {
+				// if it is a context error, return the error
+				// don't keep trying
+				return nil, previewErr
+			}
+			lastErr = previewErr
+			continue
+		}
+		return fileInfo, nil
 	}
-	return fileInfo, nil
+	// If we exhausted all files and none worked, return the last error
+	if lastErr != nil {
+		return nil, fmt.Errorf("no valid preview files found in directory: %w", lastErr)
+	}
+
+	return nil, fmt.Errorf("no previewable files found in directory")
 }

 func previewHelperFunc(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
@@ -164,39 +164,14 @@ func previewHelperFunc(w http.ResponseWriter, r *http.Request, d *requestContext
 		return http.StatusBadRequest, fmt.Errorf("this item does not have a preview")
 	}

-	seekPercentage := 0
-	percentage := r.URL.Query().Get("atPercentage")
-	if percentage != "" {
-		var err error
-		seekPercentage, err = strconv.Atoi(percentage)
-		if err != nil {
-			seekPercentage = 0
-		}
-		if seekPercentage < 0 || seekPercentage > 100 {
-			seekPercentage = 0
-		}
-	}
-
-	// For directories: map atPercentage to frame index 0–3 for motion preview (cycle over previewable items)
-	var dirFrameIndex int
 	if d.fileInfo.Type == "directory" {
-		switch {
-		case seekPercentage <= 0:
-			dirFrameIndex = 0
-		case seekPercentage <= 25:
-			dirFrameIndex = 1
-		case seekPercentage <= 50:
-			dirFrameIndex = 2
-		default:
-			dirFrameIndex = 3
-		}
-		fileInfo, err := getDirectoryPreview(r, d, dirFrameIndex)
+		// Get extended file info of first previewable item in directory
+		fileInfo, err := getDirectoryPreview(r, d)
 		if err != nil {
 			logger.Errorf("error getting directory preview: %v", err)
 			return http.StatusInternalServerError, err
 		}
 		d.fileInfo = *fileInfo
-		seekPercentage = 0
 	}

 	setContentDisposition(w, r, d.fileInfo.Name)
@@ -204,15 +179,29 @@ func previewHelperFunc(w http.ResponseWriter, r *http.Request, d *requestContext
 	ext := strings.ToLower(filepath.Ext(d.fileInfo.Name))
 	resizable := iteminfo.ResizableImageTypes[ext]

-	// For small, displayable images (jpg, png, etc.) serve the original to avoid processing.
-	const maxSizeForOriginal = 128 * 1024 // 128KB
-	if resizable && (config.Server.DisableResize || d.fileInfo.Size < maxSizeForOriginal) && isImage {
+	// If image is under 500KB, serve the original instead of generating a preview
+	const maxSizeForOriginal = 500 * 1024 // 500KB
+	if (!resizable || config.Server.DisableResize || d.fileInfo.Size < maxSizeForOriginal) && isImage {
 		return rawFileHandler(w, r, d.fileInfo)
 	}

+	seekPercentage := 0
+	percentage := r.URL.Query().Get("atPercentage")
+	if percentage != "" {
+		var err error
+		// convert string to int
+		seekPercentage, err = strconv.Atoi(percentage)
+		if err != nil {
+			seekPercentage = 10
+		}
+		if seekPercentage < 0 || seekPercentage > 100 {
+			seekPercentage = 10
+		}
+	}
+
 	officeUrl := ""
 	if d.fileInfo.OnlyOfficeId != "" {
-		pathUrl := fmt.Sprintf("/api/resources/download?file=%s&source=%s", url.QueryEscape(d.fileInfo.Path), url.QueryEscape(d.fileInfo.Source))
+		pathUrl := fmt.Sprintf("/api/raw?file=%s&source=%s", url.QueryEscape(d.fileInfo.Path), url.QueryEscape(d.fileInfo.Source))
 		pathUrl = pathUrl + "&auth=" + d.token
 		if settings.Config.Server.InternalUrl != "" {
 			officeUrl = config.Server.InternalUrl + pathUrl
@@ -4,26 +4,28 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"

 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
 	"github.com/gtsteffaniak/go-logger/logger"

 	_ "github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
 )

-// publicDownloadHandler serves the raw content of a file, multiple files, or directory via a public share.
+// publicRawHandler serves the raw content of a file, multiple files, or directory via a public share.
 // @Summary Download files from a public share
 // @Description Downloads raw content from a public share. Supports single files, multiple files, or directories as archives. Enforces download limits (global or per-user) and blocks anonymous users when per-user limits are enabled.
 // @Description
 // @Description **Multiple Files:**
 // @Description - Use repeated query parameters: `?file=file1.txt&file=file2.txt&file=file3.txt`
 // @Description - This supports filenames containing commas and special characters
-// @Tags Shares
+// @Tags Public Shares
 // @Accept json
 // @Produce octet-stream
 // @Param hash query string true "Share hash for authentication"
@@ -36,8 +38,8 @@ import (
 // @Failure 404 {object} map[string]string "Share not found or file not found"
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Failure 501 {object} map[string]string "Downloads disabled for upload shares"
-// @Router /public/api/resources/download [get]
-func publicDownloadHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+// @Router /public/api/raw [get]
+func publicRawHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	if d.share.ShareType == "upload" {
 		return http.StatusNotImplemented, fmt.Errorf("downloads are disabled for upload shares")
 	}
@@ -76,7 +78,7 @@ func publicDownloadHandler(w http.ResponseWriter, r *http.Request, d *requestCon
 	// Get all "file" parameter values (supports repeated params)
 	files := r.URL.Query()["file"]
 	if len(files) == 0 {
-		files = []string{"/"}
+		return http.StatusBadRequest, fmt.Errorf("no files specified")
 	}

 	// Get the actual source name from the share's source mapping
@@ -114,7 +116,7 @@ func publicDownloadHandler(w http.ResponseWriter, r *http.Request, d *requestCon
 // publicShareHandler returns file or directory information from a public share.
 // @Summary Get file/directory information from a public share
 // @Description Returns metadata for files or directories accessible via a public share link. Browsing is disabled for upload-only shares.
-// @Tags Shares
+// @Tags Public Shares
 // @Accept json
 // @Produce json
 // @Param hash query string true "Share hash for authentication"
@@ -137,7 +139,7 @@ func publicGetResourceHandler(w http.ResponseWriter, r *http.Request, d *request
 // publicUploadHandler processes file uploads to a public upload share.
 // @Summary Upload files to a public upload share
 // @Description Handles file and directory uploads to an upload-only public share. Supports chunked uploads, conflict resolution (override), and directory creation.
-// @Tags Shares
+// @Tags Public Shares
 // @Accept multipart/form-data
 // @Produce json
 // @Param hash query string true "Share hash for authentication"
@@ -179,6 +181,7 @@ func publicUploadHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 // @Summary Health Check
 // @Schemes
 // @Description Returns the health status of the API.
+// @Tags Health
 // @Accept json
 // @Produce json
 // @Success 200 {object} HttpResponse "successful health check response"
@@ -195,7 +198,7 @@ func healthHandler(w http.ResponseWriter, r *http.Request) {
 // publicPreviewHandler handles the preview request for images from public shares.
 // @Summary Get image/video preview from a public share
 // @Description Returns a preview (thumbnail) for images or videos accessible via a public share. Preview generation can be disabled globally or per-share. Not available for upload-only shares.
-// @Tags Shares
+// @Tags Public Shares
 // @Accept json
 // @Produce image/jpeg
 // @Param hash query string true "Share hash for authentication"
@@ -206,7 +209,7 @@ func healthHandler(w http.ResponseWriter, r *http.Request) {
 // @Failure 404 {object} map[string]string "File not found or preview not available"
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Failure 501 {object} map[string]string "Previews disabled globally, for this share, or for upload shares"
-// @Router /public/api/resources/preview [get]
+// @Router /public/api/preview [get]
 func publicPreviewHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	if config.Server.DisablePreviews || d.share.DisableThumbnails {
 		return http.StatusNotImplemented, fmt.Errorf("preview is disabled")
@@ -226,7 +229,7 @@ func publicPreviewHandler(w http.ResponseWriter, r *http.Request, d *requestCont
 // publicPutHandler handles the PUT request for a public share.
 // @Summary Update a file in a public share
 // @Description Updates the content of a file in a public share.
-// @Tags Shares
+// @Tags Public Shares
 // @Accept json
 // @Produce json
 // @Param hash query string true "Share hash for authentication"
@@ -243,8 +246,8 @@ func publicPutHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 	if !d.share.AllowModify {
 		return http.StatusForbidden, fmt.Errorf("create is not allowed for this share")
 	}
-	sourceName := d.share.GetSourceName()
-	if sourceName == "" {
+	source, err := d.share.GetSourceName()
+	if err != nil {
 		return http.StatusNotFound, fmt.Errorf("source not available")
 	}

@@ -257,11 +260,11 @@ func publicPutHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 	// Rule 1: Validate user-provided path to prevent path traversal
 	cleanPath, err := utils.SanitizeUserPath(path)
 	if err != nil {
-		return http.StatusBadRequest, err
+		return http.StatusBadRequest, fmt.Errorf("invalid path: %v", err)
 	}

 	resolvedPath := utils.JoinPathAsUnix(d.share.Path, cleanPath)
-	err = files.WriteFile(sourceName, resolvedPath, r.Body)
+	err = files.WriteFile(source, resolvedPath, r.Body)
 	// hide the error
 	if err != nil {
 		logger.Errorf("public put handler: error updating resource with error %v", err)
@@ -279,7 +282,7 @@ func publicDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		FollowSymlinks: true,
 		Path:           d.IndexPath,
 		Source:         d.share.Source,
-	}, store.Access, d.shareUser, store.Share)
+	}, store.Access, d.shareUser)
 	if err != nil {
 		return http.StatusNotFound, fmt.Errorf("resource not available")
 	}
@@ -296,7 +299,7 @@ func publicDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 // publicBulkDeleteHandler deletes multiple resources from a public share in a single request.
 // @Summary Bulk delete resources from public share
 // @Description Deletes multiple resources specified in the request body. Returns a list of succeeded and failed deletions.
-// @Tags Shares
+// @Tags Public Shares
 // @Accept json
 // @Produce json
 // @Param hash query string true "Share hash for authentication"
@@ -306,7 +309,7 @@ func publicDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 // @Failure 400 {object} map[string]string "Bad request - invalid JSON or empty items array"
 // @Failure 403 {object} map[string]string "Forbidden - delete not allowed for this share"
 // @Failure 500 {object} map[string]string "Internal server error - all deletions failed"
-// @Router /public/api/resources/bulk [delete]
+// @Router /public/api/resources/bulk/delete [post]
 func publicBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	if !d.share.AllowDelete {
 		return http.StatusForbidden, fmt.Errorf("delete is not allowed for this share")
@@ -323,7 +326,7 @@ func publicBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestC
 // publicPatchHandler performs a patch operation (e.g., move, copy, rename) on resources in a public share.
 // @Summary Move, copy, or rename resources in a public share
 // @Description Performs move, copy, or rename operations on multiple resources within a public share. All operations are performed atomically.
-// @Tags Shares
+// @Tags Public Shares
 // @Accept json
 // @Produce json
 // @Param hash query string true "Share hash for authentication"
@@ -341,8 +344,8 @@ func publicPatchHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 	}

 	// Get the source from the share
-	sourceName := d.share.GetSourceName()
-	if sourceName == "" {
+	source, err := d.share.GetSourceName()
+	if err != nil {
 		return http.StatusNotFound, fmt.Errorf("source not available")
 	}

@@ -368,9 +371,9 @@ func publicPatchHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 	// Note: Share paths are absolute, so we don't strip user scope here
 	// resourcePatchHandler will skip adding scope for shares
 	for i := range req.Items {
-		req.Items[i].FromSource = sourceName
+		req.Items[i].FromSource = source
 		req.Items[i].FromPath = utils.JoinPathAsUnix(d.share.Path, req.Items[i].FromPath)
-		req.Items[i].ToSource = sourceName
+		req.Items[i].ToSource = source
 		req.Items[i].ToPath = utils.JoinPathAsUnix(d.share.Path, req.Items[i].ToPath)
 	}
 	d.Data = req
@@ -392,7 +395,7 @@ func publicPatchHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 // getShareImage serves banner or favicon files for shares as resizable previews
 // @Summary Get share image (banner or favicon) as preview
 // @Description Returns a resizable preview (large size) for the banner or favicon file of a share
-// @Tags Shares
+// @Tags Public Shares
 // @Produce image/jpeg
 // @Param hash query string true "Share hash"
 // @Param banner query bool false "Request banner file"
@@ -416,7 +419,7 @@ func getShareImage(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 		return http.StatusNotFound, fmt.Errorf("user for share no longer exists")
 	}

-	sourceName, assetPath, err := d.share.GetShareImagePartsHelper(isBanner)
+	sourceName, assetPath, err := getShareImagePartsHelper(d.share, isBanner)
 	if err != nil {
 		return http.StatusBadRequest, fmt.Errorf("invalid asset configuration: %v", err)
 	}
@@ -430,7 +433,7 @@ func getShareImage(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 		Metadata:       false,
 		ShowHidden:     false,
 		FollowSymlinks: true,
-	}, store.Access, shareCreatedByUser, store.Share)
+	}, store.Access, shareCreatedByUser)

 	if err != nil {
 		logger.Errorf("error accessing share asset: source=%v path=%v error=%v", sourceName, assetPath, err)
@@ -462,37 +465,28 @@ func getShareImage(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 	return status, err
 }

-// publicItemsGetHandler efficiently returns a basic list of items for a directory in a public share.
-// @Summary Get directory items (public share)
-// @Description Efficiently returns a basic list of items for the specified path in a public share. Use hash for authentication instead of source. Use 'only' parameter to filter by only files or folders.
-// @Tags Shares
-// @Accept json
-// @Produce json
-// @Param hash query string true "Share hash for authentication"
-// @Param path query string false "Path within the share to list child items. Defaults to share root."
-// @Param only query string false "Filter: 'files', 'folders', or omit for both"
-// @Success 200 {object} files.Items "lists files and folders"
-// @Failure 403 {object} map[string]string "Forbidden (access denied)"
-// @Failure 404 {object} map[string]string "Share not found or source not found"
-// @Failure 500 {object} map[string]string "Internal server error"
-// @Router /public/api/resources/items [get]
-func publicItemsGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	sourceInfo, ok := config.Server.SourceMap[d.share.Source]
-	if !ok {
-		return http.StatusNotFound, fmt.Errorf("source not found")
+func getShareImagePartsHelper(share *share.Link, isBanner bool) (string, string, error) {
+
+	// Get the asset query string from share
+	var assetQueryString string
+	if isBanner {
+		assetQueryString = share.Banner
+	} else {
+		assetQueryString = share.Favicon
 	}
-	items, err := files.GetDirItems(utils.FileOptions{
-		FollowSymlinks: true,
-		Path:           d.IndexPath,
-		Source:         sourceInfo.Name,
-		ShowHidden:     d.shareUser.ShowHidden,
-		Only:           r.URL.Query().Get("only"),
-	}, store.Access, d.shareUser)
+
+	if assetQueryString == "" {
+		return "", "", fmt.Errorf("asset not configured for this share")
+	}
+
+	// Parse the query string to extract source and path
+	assetParams, err := url.ParseQuery(assetQueryString)
 	if err != nil {
-		if err == errors.ErrAccessDenied {
-			return http.StatusForbidden, err
-		}
-		return http.StatusInternalServerError, err
+		return "", "", fmt.Errorf("invalid asset configuration: %v", err)
 	}
-	return renderJSON(w, r, items)
+
+	sourceName := assetParams.Get("source")
+	assetPath := assetParams.Get("path")
+
+	return sourceName, assetPath, nil
 }
@@ -0,0 +1,620 @@
+package http
+
+import (
+	"archive/tar"
+	"archive/zip"
+	"compress/gzip"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
+	"github.com/gtsteffaniak/go-logger/logger"
+	"golang.org/x/time/rate"
+)
+
+// throttledReadSeeker is a wrapper around an io.ReadSeeker that throttles the reading speed.
+type throttledReadSeeker struct {
+	rs      io.ReadSeeker
+	limiter *rate.Limiter
+	ctx     context.Context
+}
+
+// newThrottledReadSeeker creates a new throttledReadSeeker.
+func newThrottledReadSeeker(rs io.ReadSeeker, limit rate.Limit, burst int, ctx context.Context) *throttledReadSeeker {
+	return &throttledReadSeeker{
+		rs:      rs,
+		limiter: rate.NewLimiter(limit, burst),
+		ctx:     ctx,
+	}
+}
+
+func (r *throttledReadSeeker) Read(p []byte) (n int, err error) {
+	n, err = r.rs.Read(p)
+	if n > 0 {
+		if waitErr := r.limiter.WaitN(r.ctx, n); waitErr != nil {
+			// The original error (like io.EOF) is potentially more important
+			// than the context error.
+			if err == nil {
+				err = waitErr
+			}
+		}
+	}
+	return
+}
+
+func (r *throttledReadSeeker) Seek(offset int64, whence int) (int64, error) {
+	return r.rs.Seek(offset, whence)
+}
+
+// toASCIIFilename converts a filename to ASCII-safe format by replacing non-ASCII characters with underscores
+func toASCIIFilename(fileName string) string {
+	var result strings.Builder
+	for _, r := range fileName {
+		if r > 127 {
+			// Replace non-ASCII characters with underscore
+			result.WriteRune('_')
+		} else {
+			result.WriteRune(r)
+		}
+	}
+	return result.String()
+}
+
+func setContentDisposition(w http.ResponseWriter, r *http.Request, fileName string) {
+	dispositionType := "attachment"
+	if r.URL.Query().Get("inline") == "true" {
+		dispositionType = "inline"
+	}
+
+	// standard: ASCII-only safe fallback
+	asciiFileName := toASCIIFilename(fileName)
+	// RFC 5987: UTF-8 encoded
+	encodedFileName := url.PathEscape(fileName)
+
+	// Always set both filename (ASCII) and filename* (UTF-8) for maximum compatibility (RFC 6266)
+	w.Header().Set("Content-Disposition", fmt.Sprintf("%s; filename=%q; filename*=utf-8''%s", dispositionType, asciiFileName, encodedFileName))
+}
+
+// rawHandler serves the raw content of a file, multiple files, or directory in various formats.
+// @Summary Get raw content of a file, multiple files, or directory
+// @Description Returns the raw content of a file, multiple files, or a directory. Supports downloading files as archives in various formats.
+// @Description
+// @Description **Filename Encoding:**
+// @Description - The Content-Disposition header will always include both:
+// @Description   1. `filename="..."`: An ASCII-safe version of the filename for compatibility.
+// @Description   2. `filename*=utf-8"...`: The full UTF-8 encoded filename (RFC 6266/5987) for modern clients.
+// @Description
+// @Description **Multiple Files:**
+// @Description - Use repeated query parameters: `?file=file1.txt&file=file2.txt&file=file3.txt`
+// @Description - This supports filenames containing commas and special characters
+// @Tags Resources
+// @Accept json
+// @Param source query string true "Source name for the files (required)"
+// @Param file query []string true "File path (can be repeated for multiple files)"
+// @Param inline query bool false "If true, sets 'Content-Disposition' to 'inline'. Otherwise, defaults to 'attachment'."
+// @Param algo query string false "Compression algorithm for archiving multiple files or directories. Options: 'zip' and 'tar.gz'. Default is 'zip'."
+// @Success 200 {file} file "Raw file or directory content, or archive for multiple files"
+// @Failure 202 {object} map[string]string "Modify permissions required"
+// @Failure 400 {object} map[string]string "Invalid request path"
+// @Failure 404 {object} map[string]string "File or directory not found"
+// @Failure 500 {object} map[string]string "Internal server error"
+// @Router /api/raw [get]
+func rawHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	source := r.URL.Query().Get("source")
+	fileList := r.URL.Query()["file"]
+
+	// Rule 1: Validate all user-provided file paths to prevent path traversal
+	for i, filePath := range fileList {
+		cleanPath, err := utils.SanitizeUserPath(filePath)
+		if err != nil {
+			return http.StatusBadRequest, fmt.Errorf("invalid file path: %v", err)
+		}
+		fileList[i] = cleanPath
+	}
+
+	return rawFilesHandler(w, r, d, source, fileList)
+}
+
+func addFile(source string, path string, d *requestContext, tarWriter *tar.Writer, zipWriter *zip.Writer, flatten bool) error {
+	// Path handling is now done inside FileInfoFaster
+	// For shares, path comes from share context
+	// For regular users, FileInfoFaster will apply user scope
+
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		return fmt.Errorf("source %s is not available", source)
+	}
+
+	// Check access control directly for each file and silently skip if access is denied
+	if d.share == nil && store.Access != nil {
+		if !store.Access.Permitted(idx.Path, path, d.user.Username) {
+			return nil // Silently skip this file/folder
+		}
+	}
+
+	// Verify file exists
+	_, err := files.FileInfoFaster(utils.FileOptions{
+		Path:           path,
+		Source:         source,
+		Expand:         false,
+		FollowSymlinks: true,
+	}, store.Access, d.user)
+	if err != nil {
+		return err
+	}
+	realPath, _, _ := idx.GetRealPath(path)
+	info, err := os.Stat(realPath)
+	if err != nil {
+		return err
+	}
+
+	// Get the base name of the top-level folder or file
+	baseName := filepath.Base(realPath)
+
+	if info.IsDir() {
+		// Walk through directory contents
+		return filepath.Walk(realPath, func(filePath string, fileInfo os.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+
+			// Calculate the relative path
+			relPath, err := filepath.Rel(realPath, filePath) // Use realPath directly
+			if err != nil {
+				return err
+			}
+
+			// Normalize for tar: convert \ to /
+			relPath = filepath.ToSlash(relPath)
+
+			// Skip adding `.` (current directory)
+			if relPath == "." {
+				return nil
+			}
+
+			// Check access control for each file/folder during walk
+			if d.share == nil {
+				indexRelPath := utils.JoinPathAsUnix(path, relPath)
+				indexRelPath = filepath.ToSlash(indexRelPath) // Normalize separators
+				if !store.Access.Permitted(idx.Path, indexRelPath, d.user.Username) {
+					// Skip this file/folder silently
+					if fileInfo.IsDir() {
+						// Skip the entire directory by returning filepath.SkipDir
+						return filepath.SkipDir
+					}
+					return nil
+				}
+			}
+
+			// Prepend base folder name unless flatten is true
+			if !flatten {
+				relPath = filepath.Join(baseName, relPath)
+				relPath = filepath.ToSlash(relPath) // Ensure normalized separators
+			}
+
+			if fileInfo.IsDir() {
+				if tarWriter != nil {
+					header := &tar.Header{
+						Name:     relPath + "/",
+						Mode:     int64(fileutils.PermDir),
+						Typeflag: tar.TypeDir,
+						ModTime:  fileInfo.ModTime(),
+					}
+					return tarWriter.WriteHeader(header)
+				}
+				if zipWriter != nil {
+					_, err := zipWriter.Create(relPath + "/")
+					return err
+				}
+				return nil
+			}
+			return addSingleFile(filePath, relPath, zipWriter, tarWriter)
+		})
+	} else {
+		// For a single file, use the base name as the archive path
+		return addSingleFile(realPath, baseName, zipWriter, tarWriter)
+	}
+}
+
+func addSingleFile(realPath, archivePath string, zipWriter *zip.Writer, tarWriter *tar.Writer) error {
+	file, err := os.Open(realPath)
+	if err != nil {
+		// If we get "is a directory" error, this is likely a symlink to a directory
+		// that wasn't properly detected. Skip it gracefully.
+		if strings.Contains(err.Error(), "is a directory") {
+			return nil
+		}
+		return err
+	}
+	defer file.Close()
+
+	info, err := file.Stat()
+	if err != nil {
+		return err
+	}
+
+	// Double-check if this is actually a directory (in case of symlinks)
+	if info.IsDir() {
+		return nil
+	}
+
+	if tarWriter != nil {
+		header, err := tar.FileInfoHeader(info, "")
+		if err != nil {
+			return err
+		}
+		header.Name = filepath.ToSlash(archivePath)
+		if err = tarWriter.WriteHeader(header); err != nil {
+			return err
+		}
+		_, err = io.Copy(tarWriter, file)
+		return err
+	}
+
+	if zipWriter != nil {
+		header, err := zip.FileInfoHeader(info)
+		if err != nil {
+			return err
+		}
+		header.Name = archivePath
+		writer, err := zipWriter.CreateHeader(header)
+		if err != nil {
+			return err
+		}
+		_, err = io.Copy(writer, file)
+		return err
+	}
+
+	return nil
+}
+
+func rawFilesHandler(w http.ResponseWriter, r *http.Request, d *requestContext, source string, fileList []string) (int, error) {
+	if !d.user.Permissions.Download && d.share == nil {
+		return http.StatusForbidden, fmt.Errorf("user is not allowed to download")
+	}
+
+	if len(fileList) == 0 {
+		return http.StatusBadRequest, fmt.Errorf("no files specified")
+	}
+
+	firstFilePath := fileList[0]
+	var err error
+	var userscope string
+	fileName := filepath.Base(firstFilePath)
+
+	// Check if this is an OnlyOffice file early for error logging
+	isOnlyOffice := isOnlyOfficeCompatibleFile(fileName) && config.Integrations.OnlyOffice.Url != ""
+	var documentId string
+	var logContext *OnlyOfficeLogContext
+
+	if d.share == nil {
+		userscope, err = d.user.GetScopeForSourceName(source)
+		if err != nil {
+			// Send OnlyOffice error log if this was an OnlyOffice file
+			if isOnlyOffice {
+				// Try to get document ID for error logging
+				idx := indexing.GetIndex(source)
+				if idx != nil {
+					tempPath := utils.JoinPathAsUnix(userscope, firstFilePath)
+					if realPath, _, realErr := idx.GetRealPath(tempPath); realErr == nil {
+						if docId, _ := getOnlyOfficeId(realPath); docId != "" {
+							if ctx := getOnlyOfficeLogContext(docId); ctx != nil {
+								sendOnlyOfficeLogEvent(ctx, "ERROR", "download",
+									fmt.Sprintf("OnlyOffice download failed - source not available: %s - %v", firstFilePath, err))
+							}
+						}
+					}
+				}
+			}
+			return http.StatusForbidden, err
+		}
+		firstFilePath = utils.JoinPathAsUnix(userscope, firstFilePath)
+	}
+	// For shares, the path is already correctly resolved by publicRawHandler
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		// Send OnlyOffice error log if this was an OnlyOffice file
+		if isOnlyOffice {
+			sendOnlyOfficeLogEvent(logContext, "ERROR", "download",
+				fmt.Sprintf("OnlyOffice download failed - source index not available: %s", source))
+		}
+		return http.StatusInternalServerError, fmt.Errorf("source %s is not available", source)
+	}
+	realPath, isDir, err := idx.GetRealPath(firstFilePath)
+	if err != nil {
+		// Send OnlyOffice error log if this was an OnlyOffice file
+		if isOnlyOffice {
+			if docId, _ := getOnlyOfficeId(realPath); docId != "" {
+				if ctx := getOnlyOfficeLogContext(docId); ctx != nil {
+					sendOnlyOfficeLogEvent(ctx, "ERROR", "download",
+						fmt.Sprintf("OnlyOffice download failed - could not resolve path: %s - %v", firstFilePath, err))
+				}
+			}
+		}
+		return http.StatusInternalServerError, err
+	}
+	// Compute estimated download size
+	estimatedSize, err := computeArchiveSize(source, fileList, d)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	// ** Single file download with Content-Length **
+	if len(fileList) == 1 && !isDir {
+		// Get document ID and log context for OnlyOffice downloads
+		if isOnlyOffice {
+			documentId, _ = getOnlyOfficeId(realPath)
+			if documentId != "" {
+				logContext = getOnlyOfficeLogContext(documentId)
+			}
+		}
+
+		// Verify access control before opening the file (direct rule check)
+		if d.share == nil && store.Access != nil {
+			if !store.Access.Permitted(idx.Path, firstFilePath, d.user.Username) {
+				logger.Debugf("user %s denied access to path %s", d.user.Username, firstFilePath)
+				// Send OnlyOffice error log if this was an OnlyOffice download
+				if isOnlyOffice && logContext != nil {
+					sendOnlyOfficeLogEvent(logContext, "ERROR", "download",
+						fmt.Sprintf("OnlyOffice download failed - access denied by rule: %s", firstFilePath))
+				}
+				return http.StatusForbidden, fmt.Errorf("access denied to path %s", firstFilePath)
+			}
+		}
+
+		fd, err2 := os.Open(realPath)
+		if err2 != nil {
+			// Send OnlyOffice error log if this was an OnlyOffice download
+			if isOnlyOffice && logContext != nil {
+				sendOnlyOfficeLogEvent(logContext, "ERROR", "download",
+					fmt.Sprintf("OnlyOffice download failed - could not open file: %s - %v", firstFilePath, err2))
+			}
+			return http.StatusInternalServerError, err2
+		}
+		defer fd.Close()
+
+		// Get file size
+		fileInfo, err2 := fd.Stat()
+		if err2 != nil {
+			// Send OnlyOffice error log if this was an OnlyOffice download
+			if isOnlyOffice && logContext != nil {
+				sendOnlyOfficeLogEvent(logContext, "ERROR", "download",
+					fmt.Sprintf("OnlyOffice download failed - could not get file info: %s - %v", firstFilePath, err2))
+			}
+			return http.StatusInternalServerError, err2
+		}
+
+		// Send success log for OnlyOffice downloads
+		if isOnlyOffice && logContext != nil {
+			logger.Infof("OnlyOffice Server is downloading file: %s (documentId: %s)",
+				firstFilePath, documentId)
+
+			sendOnlyOfficeLogEvent(logContext, "INFO", "download",
+				fmt.Sprintf("OnlyOffice Server downloading file: %s", firstFilePath))
+		}
+
+		// Set headers
+		setContentDisposition(w, r, fileName)
+		w.Header().Set("Cache-Control", "private")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", fileInfo.Size()))
+		sizeInMB := estimatedSize / 1024 / 1024
+		// if larger than 500 MB, log it
+		if sizeInMB > 500 {
+			logger.Debugf("User %v is downloading large (%d MB) file: %v", d.user.Username, sizeInMB, fileName)
+		}
+		// serve content allows for range requests.
+		// video scrubbing, etc.
+		// Note: http.ServeContent will respect our already-set Content-Disposition header
+		var reader io.ReadSeeker = fd
+		if d.share != nil && d.share.MaxBandwidth > 0 {
+			// convert KB/s to B/s
+			limit := rate.Limit(d.share.MaxBandwidth * 1024)
+			// burst size can be the same as limit
+			burst := d.share.MaxBandwidth * 1024
+			reader = newThrottledReadSeeker(fd, limit, burst, r.Context())
+		}
+		http.ServeContent(w, r, fileName, fileInfo.ModTime(), reader)
+		return 200, nil
+	}
+
+	if config.Server.MaxArchiveSizeGB > 0 {
+		maxSize := config.Server.MaxArchiveSizeGB * 1024 * 1024 * 1024
+		if estimatedSize > maxSize {
+			return http.StatusRequestEntityTooLarge, fmt.Errorf("pre-archive combined size of files exceeds maximum limit of %d GB", config.Server.MaxArchiveSizeGB)
+		}
+	}
+	// ** Archive (ZIP/TAR.GZ) handling **
+	algo := r.URL.Query().Get("algo")
+	var extension string
+	switch algo {
+	case "zip", "true", "":
+		extension = ".zip"
+	case "tar.gz":
+		extension = ".tar.gz"
+	default:
+		return http.StatusInternalServerError, errors.New("format not implemented")
+	}
+
+	baseDirName := filepath.Base(filepath.Dir(firstFilePath))
+	if baseDirName == "" || baseDirName == "/" {
+		baseDirName = "download"
+	}
+	if len(fileList) == 1 && isDir {
+		baseDirName = filepath.Base(realPath)
+	}
+	// Store original filename before any encoding
+	originalFileName := baseDirName + extension
+
+	archiveData := filepath.Join(config.Server.CacheDir, utils.InsecureRandomIdentifier(10))
+	if extension == ".zip" {
+		archiveData = archiveData + ".zip"
+		err = createZip(d, source, archiveData, fileList...)
+	} else {
+		archiveData = archiveData + ".tar.gz"
+		err = createTarGz(d, source, archiveData, fileList...)
+	}
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	// stream archive to response
+	fd, err := os.Open(archiveData)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	defer fd.Close()
+
+	// Get file size
+	fileInfo, err := fd.Stat()
+	if err != nil {
+		os.Remove(archiveData) // Remove the file if stat fails
+		return http.StatusInternalServerError, err
+	}
+
+	sizeInMB := fileInfo.Size() / 1024 / 1024
+	if sizeInMB > 500 {
+		logger.Debugf("User %v is downloading large (%d MB) file: %v", d.user.Username, sizeInMB, originalFileName)
+	}
+
+	// Set headers AFTER computing actual archive size
+	// Use the same setContentDisposition logic for archives
+	setContentDisposition(w, r, originalFileName)
+	w.Header().Set("Content-Length", fmt.Sprintf("%d", fileInfo.Size()))
+	w.Header().Set("Content-Type", "application/octet-stream")
+
+	// Stream the file
+	var reader io.Reader = fd
+	if d.share != nil && d.share.MaxBandwidth > 0 {
+		// convert KB/s to B/s
+		limit := rate.Limit(d.share.MaxBandwidth * 1024)
+		// burst size can be the same as limit
+		burst := d.share.MaxBandwidth * 1024
+		reader = newThrottledReadSeeker(fd, limit, burst, r.Context())
+	}
+	_, err = io.Copy(w, reader)
+	os.Remove(archiveData) // Remove the file after streaming
+	if err != nil {
+		logger.Errorf("Failed to copy archive data to response: %v", err)
+		return http.StatusInternalServerError, err
+	}
+
+	return 0, nil
+}
+
+func computeArchiveSize(source string, fileList []string, d *requestContext) (int64, error) {
+	var estimatedSize int64
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		return 0, fmt.Errorf("source %s is not available", source)
+	}
+
+	var userScope string
+	var err error
+	if d.share == nil {
+		userScope, err = d.user.GetScopeForSourceName(source)
+		if err != nil {
+			return 0, fmt.Errorf("source %s is not available for user %s", source, d.user.Username)
+		}
+	}
+
+	for _, path := range fileList {
+		var fullPath string
+		if d.share == nil {
+			fullPath = utils.JoinPathAsUnix(userScope, path)
+			// Check access control for each file in the archive
+			// Silently skip if access is denied (as if the file doesn't exist)
+			if store.Access != nil && !store.Access.Permitted(idx.Path, fullPath, d.user.Username) {
+				continue // Skip this file and continue with the next one
+			}
+		} else {
+			fullPath = path
+		}
+
+		// For shares, the path is already correctly resolved by publicRawHandler
+		realPath, isDir, err := idx.GetRealPath(fullPath)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+		indexPath := idx.MakeIndexPath(realPath, isDir)
+		info, ok := idx.GetReducedMetadata(indexPath, isDir)
+		if !ok {
+			info, err = idx.GetFsInfo(indexPath, false, true)
+			if err != nil {
+				return 0, fmt.Errorf("failed to get file info for %s : %v", path, err)
+			}
+		}
+		estimatedSize += info.Size
+	}
+	return estimatedSize, nil
+}
+
+func createZip(d *requestContext, source string, tmpDirPath string, filenames ...string) error {
+	file, err := os.Create(tmpDirPath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	zipWriter := zip.NewWriter(file)
+
+	for _, fname := range filenames {
+		err := addFile(source, fname, d, nil, zipWriter, false)
+		if err != nil {
+			// Access control failures return nil, so any error here is a real error
+			logger.Errorf("Failed to add %s to ZIP: %v", fname, err)
+			return err
+		}
+	}
+
+	// Close the ZIP writer and check for errors
+	if err := zipWriter.Close(); err != nil {
+		return fmt.Errorf("failed to finalize ZIP archive: %w", err)
+	}
+
+	return nil
+}
+
+func createTarGz(d *requestContext, source string, tmpDirPath string, filenames ...string) error {
+	file, err := os.Create(tmpDirPath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	gzWriter := gzip.NewWriter(file)
+	tarWriter := tar.NewWriter(gzWriter)
+
+	for _, fname := range filenames {
+		err := addFile(source, fname, d, tarWriter, nil, false)
+		if err != nil {
+			logger.Errorf("Failed to add %s to TAR.GZ: %v", fname, err)
+			return err
+		}
+	}
+
+	// Close writers in reverse order and check for errors
+	if err := tarWriter.Close(); err != nil {
+		return fmt.Errorf("failed to finalize TAR archive: %w", err)
+	}
+	if err := gzWriter.Close(); err != nil {
+		return fmt.Errorf("failed to finalize GZIP compression: %w", err)
+	}
+
+	return nil
+}
+
+// isOnlyOfficeCompatibleFile checks if a file extension is supported by OnlyOffice
+func isOnlyOfficeCompatibleFile(fileName string) bool {
+	return iteminfo.IsOnlyOffice(fileName)
+}
@@ -13,7 +13,6 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
-	"time"

 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
@@ -23,24 +22,9 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
-	"github.com/gtsteffaniak/go-cache/cache"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

-var pauseCache = cache.NewCache[string](1 * time.Minute)
-var publicPauseCache = cache.NewCache[string](1 * time.Minute)
-
-// pauseCacheKeySep separates segments in pause cache keys (not used in source names/paths).
-const pauseCacheKeySep = "\x1e"
-
-func pauseUploadCacheKey(source, path string) string {
-	return source + pauseCacheKeySep + path
-}
-
-func publicPauseUploadCacheKey(shareHash, source, indexPath string) string {
-	return shareHash + pauseCacheKeySep + source + pauseCacheKeySep + indexPath
-}
-
 // validateMoveOperation checks if a move/rename operation is valid at the HTTP level
 // It prevents moving a directory into itself or its subdirectories
 func validateMoveOperation(src, dst string, isSrcDir bool) error {
@@ -77,10 +61,9 @@ func validateMoveOperation(src, dst string, isSrcDir bool) error {
 // @Accept json
 // @Produce json
 // @Param path query string true "Path to the resource"
-// @Param skipExtendedAttrs query string false "When true, omit index-level extended fields (e.g. hasPreview); does not disable ffmpeg/media extraction"
 // @Param source query string true "Source name for the desired source, default is used if not provided"
 // @Param content query string false "Include file content if true"
-// @Param metadata query string false "When true, run audio/video metadata extraction, subtitles, and directory media batch processing"
+// @Param metadata query string false "Extract audio/video metadata if true"
 // @Param checksum query string false "Optional checksum validation"
 // @Success 200 {object} iteminfo.FileInfo "Resource metadata"
 // @Failure 404 {object} map[string]string "Resource not found"
@@ -91,7 +74,6 @@ func resourceGetHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 	source := r.URL.Query().Get("source")
 	getContent := r.URL.Query().Get("content") == "true"
 	getMetadata := r.URL.Query().Get("metadata") == "true"
-	skipExtendedAttrs := r.URL.Query().Get("skipExtendedAttrs") == "true"
 	fileInfo, err := files.FileInfoFaster(utils.FileOptions{
 		FollowSymlinks:           true,
 		Path:                     path,
@@ -101,9 +83,7 @@ func resourceGetHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 		Metadata:                 getMetadata,
 		ExtractEmbeddedSubtitles: settings.Config.Integrations.Media.ExtractEmbeddedSubtitles,
 		ShowHidden:               d.user.ShowHidden,
-		SkipExtendedAttrs:        skipExtendedAttrs,
-		ShowSharedAttr:           true,
-	}, store.Access, d.user, store.Share)
+	}, store.Access, d.user)
 	if err != nil {
 		return errToStatus(err), err
 	}
@@ -157,7 +137,7 @@ func resourceDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestCon
 		Source:     source,
 		Expand:     false,
 		ShowHidden: d.user.ShowHidden,
-	}, store.Access, d.user, store.Share)
+	}, store.Access, d.user)
 	if err != nil {
 		return errToStatus(err), err
 	}
@@ -221,7 +201,7 @@ type MoveCopyResponse struct {
 // @Failure 400 {object} map[string]string "Bad request - invalid JSON or empty items array"
 // @Failure 403 {object} map[string]string "Forbidden"
 // @Failure 500 {object} map[string]string "Internal server error - all deletions failed"
-// @Router /api/resources/bulk [delete]
+// @Router /api/resources/bulk/delete [post]
 func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	filePermUser := d.user
 	if d.share != nil {
@@ -251,71 +231,61 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques

 	// Process each item one at a time
 	for _, item := range items {
-		rawPath := item.Path
 		// Validate item
-		if rawPath == "" {
+		if item.Path == "" {
 			response.Failed = append(response.Failed, BulkDeleteItem{
 				Source:  item.Source,
-				Path:    rawPath,
+				Path:    item.Path,
 				Message: "path was empty",
 			})
 			continue
 		}

 		// Prevent deletion of root
-		if rawPath == "/" {
+		if item.Path == "/" {
 			response.Failed = append(response.Failed, BulkDeleteItem{
 				Source:  item.Source,
-				Path:    rawPath,
+				Path:    item.Path,
 				Message: "cannot delete root directory",
 			})
 			continue
 		}
-		sanitizedPath, err := utils.SanitizeUserPath(rawPath)
-		if err != nil {
-			response.Failed = append(response.Failed, BulkDeleteItem{
-				Source:  item.Source,
-				Path:    sanitizedPath,
-				Message: err.Error(),
-			})
-			continue
-		}

 		if d.share != nil {
-			sourceName := d.share.GetSourceName()
-			if sourceName == "" {
+			source, err := d.share.GetSourceName()
+			if err != nil {
 				return http.StatusNotFound, fmt.Errorf("source not available")
 			}
 			// get user scope path from share
-			userScope, err := d.shareUser.GetScopeForSourceName(sourceName)
+			userScope, err := d.shareUser.GetScopeForSourceName(source)
 			if err != nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    sanitizedPath,
+					Path:    item.Path,
 					Message: "user does not have access",
 				})
 				continue
 			}
 			withoutUserScope := strings.TrimPrefix(d.share.Path, userScope)
-			indexPath := utils.JoinPathAsUnix(withoutUserScope, sanitizedPath)
+			indexPath := utils.JoinPathAsUnix(withoutUserScope, item.Path)

 			fileInfo, err := files.FileInfoFaster(utils.FileOptions{
 				FollowSymlinks: true,
 				Path:           indexPath,
-				Source:         sourceName,
+				Source:         source,
 				ShowHidden:     true,
-			}, store.Access, filePermUser, store.Share)
+			}, store.Access, filePermUser)
 			if err != nil {
 				return http.StatusNotFound, fmt.Errorf("resource not available")
 			}

 			// Delete the file/directory
-			err = files.DeleteFiles(sourceName, fileInfo.RealPath, fileInfo.Type == "directory")
+			err = files.DeleteFiles(source, fileInfo.RealPath, fileInfo.Type == "directory")
 			if err != nil {
 				logger.Errorf("resource bulk delete handler: error deleting file/directory: %v", err)
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    sanitizedPath,
+					Path:    item.Path,
 					Message: "error deleting file/directory, admin must check the logs",
 				})
 				continue
@@ -327,7 +297,7 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			if item.Source == "" {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    sanitizedPath,
+					Path:    item.Path,
 					Message: "source was empty, source is required",
 				})
 				continue
@@ -338,7 +308,7 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			if err != nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    sanitizedPath,
+					Path:    item.Path,
 					Message: fmt.Sprintf("user does not have access: %v", err),
 				})
 				continue
@@ -348,7 +318,7 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			if idx == nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    sanitizedPath,
+					Path:    item.Path,
 					Message: "source not found",
 				})
 				continue
@@ -357,14 +327,14 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			// Get file info
 			fileInfo, err := files.FileInfoFaster(utils.FileOptions{
 				FollowSymlinks: true,
-				Path:           sanitizedPath,
+				Path:           idx.MakeIndexPath(item.Path, false),
 				Source:         item.Source,
 				ShowHidden:     true,
-			}, store.Access, filePermUser, store.Share)
+			}, store.Access, filePermUser)
 			if err != nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    sanitizedPath,
+					Path:    item.Path,
 					Message: err.Error(),
 				})
 				continue
@@ -373,7 +343,7 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			if err != nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    sanitizedPath,
+					Path:    item.Path,
 					Message: err.Error(),
 				})
 				continue
@@ -393,74 +363,6 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 	return renderJSON(w, r, response, statusCode)
 }

-// resourcePauseHandler registers a graceful pause for an in-flight chunked upload.
-// Call immediately before aborting the chunk POST so the server keeps partial data.
-// @Summary Register graceful chunked upload pause
-// @Description Sets a short-lived server flag for the given source and path. When the active chunk POST then fails (e.g. client abort), the server trims the incomplete chunk but keeps the temp partial file for resume.
-// @Tags Resources
-// @Accept json
-// @Produce json
-// @Param path query string true "Destination path (same as upload)"
-// @Param source query string true "Source name (same as upload)"
-// @Success 200 "Pause registered"
-// @Failure 400 {object} map[string]string "Bad request"
-// @Failure 403 {object} map[string]string "Forbidden"
-// @Failure 404 {object} map[string]string "Source not found"
-// @Router /api/resources/pause [post]
-func resourcePauseHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	if d.share != nil {
-		return http.StatusBadRequest, fmt.Errorf("use public pause endpoint for share uploads")
-	}
-	if !d.user.Permissions.Create {
-		return http.StatusForbidden, fmt.Errorf("user is not allowed to pause uploads")
-	}
-	path := r.URL.Query().Get("path")
-	source := r.URL.Query().Get("source")
-	cleanPath, err := utils.SanitizeUserPath(path)
-	if err != nil {
-		return http.StatusBadRequest, err
-	}
-	path = cleanPath
-	idx := indexing.GetIndex(source)
-	if idx == nil {
-		logger.Debugf("source %s not found", source)
-		return http.StatusNotFound, fmt.Errorf("source %s not found", source)
-	}
-	if _, err := d.user.GetScopeForSourceName(source); err != nil {
-		return http.StatusForbidden, err
-	}
-	if !store.Access.Permitted(idx.Path, path, d.user.Username) {
-		return http.StatusForbidden, fmt.Errorf("access denied to path %s", path)
-	}
-	pauseCache.Set(pauseUploadCacheKey(source, path), "1")
-	return http.StatusOK, nil
-}
-
-// publicPauseHandler registers a graceful pause for a public share chunked upload.
-// @Summary Register graceful chunked upload pause (public share)
-// @Description Same as authenticated pause, for upload shares. Uses hash and path query parameters like other public resource APIs.
-// @Tags Shares
-// @Accept json
-// @Produce json
-// @Param hash query string true "Share hash"
-// @Param path query string true "Path within the share (same as upload)"
-// @Success 200 "Pause registered"
-// @Failure 403 {object} map[string]string "Forbidden"
-// @Failure 404 {object} map[string]string "Source not found"
-// @Router /public/api/resources/pause [post]
-func publicPauseHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	if d.share.ShareType != "upload" && !d.share.AllowCreate {
-		return http.StatusForbidden, fmt.Errorf("pausing uploads is not allowed for this share")
-	}
-	src, ok := config.Server.SourceMap[d.share.Source]
-	if !ok {
-		return http.StatusNotFound, fmt.Errorf("source not found")
-	}
-	sourceName := src.Name
-	publicPauseCache.Set(publicPauseUploadCacheKey(d.share.Hash, sourceName, d.IndexPath), "1")
-	return http.StatusOK, nil
-}
-
 // resourcePostHandler creates or uploads a new resource.
 // @Summary Create or upload a resource
 // @Description Creates a new resource or uploads a file at the specified path. Supports file uploads and directory creation.
@@ -484,7 +386,7 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 	// Rule 1: Validate user-provided path to prevent path traversal
 	cleanPath, err := utils.SanitizeUserPath(path)
 	if err != nil {
-		return http.StatusBadRequest, err
+		return http.StatusBadRequest, fmt.Errorf("invalid path: %v", err)
 	}
 	path = cleanPath

@@ -531,10 +433,6 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		existingIsDir := stat.IsDir()
 		requestingDir := isDir

-		if r.URL.Query().Get("override") != "true" {
-			return http.StatusConflict, nil
-		}
-
 		// If type mismatch (file vs folder or folder vs file) and not overriding
 		if existingIsDir != requestingDir && r.URL.Query().Get("override") != "true" {
 			logger.Debugf("Type conflict detected in chunked: existing is dir=%v, requesting dir=%v at path=%v", existingIsDir, requestingDir, realPath)
@@ -589,7 +487,7 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 			}

 			var fileInfo *iteminfo.ExtendedFileInfo
-			fileInfo, err = files.FileInfoFaster(fileOpts, store.Access, filePermUser, store.Share)
+			fileInfo, err = files.FileInfoFaster(fileOpts, store.Access, filePermUser)
 			if err == nil { // File exists
 				if r.URL.Query().Get("override") != "true" {
 					logger.Debugf("resource already exists: %v", fileInfo.RealPath)
@@ -604,7 +502,13 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		// Create a unique name for the temporary file to avoid collisions.
 		hasher := md5.New()
 		hasher.Write([]byte(realPath))
-		tempFilePath := fmt.Sprintf("%s.%s.uploading.tmp", realPath, hex.EncodeToString(hasher.Sum(nil)))
+		uploadID := hex.EncodeToString(hasher.Sum(nil))
+		tempFilePath := filepath.Join(settings.Config.Server.CacheDir, "uploads", uploadID)
+
+		if err = os.MkdirAll(filepath.Dir(tempFilePath), fileutils.PermDir); err != nil {
+			logger.Debugf("could not create temp dir: %v", err)
+			return http.StatusInternalServerError, fmt.Errorf("could not create temp dir: %v", err)
+		}
 		// Create or open the temporary file
 		var outFile *os.File
 		outFile, err = os.OpenFile(tempFilePath, os.O_CREATE|os.O_WRONLY, fileutils.PermFile)
@@ -626,31 +530,6 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		chunkSize, err = io.Copy(outFile, r.Body)
 		if err != nil {
 			logger.Debugf("could not write chunk to temp file: %v", err)
-			if truncErr := outFile.Truncate(offset); truncErr != nil {
-				logger.Debugf("could not truncate temp file after failed chunk (offset=%d): %v", offset, truncErr)
-			}
-			_ = outFile.Sync()
-
-			gracefulPause := false
-			if d.share != nil {
-				k := publicPauseUploadCacheKey(d.share.Hash, source, path)
-				if _, ok := publicPauseCache.Get(k); ok {
-					gracefulPause = true
-					publicPauseCache.Delete(k)
-				}
-			} else {
-				k := pauseUploadCacheKey(source, path)
-				if _, ok := pauseCache.Get(k); ok {
-					gracefulPause = true
-					pauseCache.Delete(k)
-				}
-			}
-
-			if gracefulPause {
-				logger.Debugf("chunk upload ended after graceful pause; keeping partial file (source=%s path=%s)", source, path)
-				return 499, nil
-			}
-			_ = os.Remove(tempFilePath)
 			return http.StatusInternalServerError, fmt.Errorf("could not write chunk to temp file: %v", err)
 		}
 		// check if the file is complete
@@ -667,7 +546,7 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		return http.StatusOK, nil
 	}

-	fileInfo, err := files.FileInfoFaster(fileOpts, store.Access, filePermUser, store.Share)
+	fileInfo, err := files.FileInfoFaster(fileOpts, store.Access, filePermUser)
 	if err == nil { // File exists
 		if r.URL.Query().Get("override") != "true" {
 			logger.Debugf("resource already exists: %v", fileInfo.RealPath)
@@ -706,15 +585,21 @@ func resourcePutHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 	// Rule 1: Validate user-provided path to prevent path traversal
 	cleanPath, err := utils.SanitizeUserPath(path)
 	if err != nil {
-		return http.StatusBadRequest, err
+		return http.StatusBadRequest, fmt.Errorf("invalid path: %v", err)
 	}
 	path = cleanPath
+
+	// Only allow PUT for files.
+	if strings.HasSuffix(path, "/") {
+		return http.StatusMethodNotAllowed, nil
+	}
 	// Get user scope to resolve full index path for write operation
 	userScope, err := d.user.GetScopeForSourceName(source)
 	if err != nil {
 		return http.StatusForbidden, err
 	}
 	fullIndexPath := utils.JoinPathAsUnix(userScope, path)
+
 	// Check access control for the target path
 	idx := indexing.GetIndex(source)
 	if idx == nil {
@@ -725,14 +610,7 @@ func resourcePutHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 		return http.StatusForbidden, fmt.Errorf("access denied to path %s", path)
 	}

-	// check if destination is a directory
-	stat, err := os.Stat(filepath.Join(idx.Path + fullIndexPath))
-	if err == nil && stat.IsDir() {
-		// if directory return StatusMethodNotAllowed
-		return http.StatusMethodNotAllowed, fmt.Errorf("path is a directory")
-	}
-
-	err = files.WriteFile(source, fullIndexPath, r.Body)
+	err = files.WriteFile(source, utils.JoinPathAsUnix(userScope, path), r.Body)
 	return errToStatus(err), err
 }

@@ -1049,7 +927,7 @@ func patchAction(ctx context.Context, params patchActionParams) error {
 			Source:         params.srcIndex,
 			IsDir:          params.isSrcDir,
 			ShowHidden:     params.d.user.ShowHidden,
-		}, store.Access, params.d.user, store.Share)
+		}, store.Access, params.d.user)

 		if err != nil {
 			return err
@@ -1087,33 +965,3 @@ func mockData(w http.ResponseWriter, r *http.Request) {
 	mockDir := indexing.CreateMockData(NumDirs, numFiles)
 	renderJSON(w, r, mockDir) // nolint:errcheck
 }
-
-// itemsGetHandler efficiently returns a basic list of items for a directory.
-// @Summary Get directory items
-// @Description Efficiently returns a basic list of items for the specified path and source. Use 'only' parameter to filter by only files or folders
-// @Tags Resources
-// @Accept json
-// @Produce json
-// @Param path query string true "A directory path to list child items"
-// @Param source query string true "The source name which contains the path"
-// @Param only query string false "Filter: 'files', 'folders', or omit for both"
-// @Success 200 {object} files.Items "lists files and folders"
-// @Failure 403 {object} map[string]string "Forbidden (access denied)"
-// @Failure 500 {object} map[string]string "Internal server error"
-// @Router /api/resources/items [get]
-func itemsGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	items, err := files.GetDirItems(utils.FileOptions{
-		FollowSymlinks: true,
-		Path:           r.URL.Query().Get("path"),
-		Source:         r.URL.Query().Get("source"),
-		ShowHidden:     d.user.ShowHidden,
-		Only:           r.URL.Query().Get("only"),
-	}, store.Access, d.user)
-	if err != nil {
-		if err == errors.ErrAccessDenied {
-			return http.StatusForbidden, err
-		}
-		return http.StatusInternalServerError, err
-	}
-	return renderJSON(w, r, items)
-}
Author	SHA1	Message	Date
Graham Steffaniak	5c2e2f6af5	ensure folder sizes get updated (#1977 )	2026-02-13 15:00:42 -06:00
Graham Steffaniak	dc8d71ddb0	Fix image selection buttons (#1972 )	2026-02-12 18:17:43 -06:00
zarevandGraham Steffaniak	86c41db9c5	Corrections (#1969 ) Co-authored-by: Graham Steffaniak <42989099+gtsteffaniak@users.noreply.github.com>	2026-02-12 15:21:56 -06:00
Graham Steffaniak	89d99090ec	fix otp settings update (#1967 )	2026-02-12 13:14:18 -06:00
Graham Steffaniak	dfe217d020	filename rename fix (#1966 )	2026-02-12 08:54:18 -06:00
zarevandGraham Steffaniak	1d2ac2ab06	Update fr.json (#1965 ) Co-authored-by: Graham Steffaniak <42989099+gtsteffaniak@users.noreply.github.com>	2026-02-12 08:21:33 -06:00
Graham Steffaniak	87923add8a	updated with dutch language (#1961 )	2026-02-11 18:10:37 -06:00
Graham Steffaniak	be7df9000a	Fix subtitles (#1960 )	2026-02-11 17:22:46 -06:00
Graham Steffaniak	1126fe7d95	Fix encoding issues (#1959 )	2026-02-11 14:02:54 -06:00