updated with rate limiting (#2484)

Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>

.gitignore

@@ -23,6 +23,7 @@ frontend/tsconfig.tsbuildinfo
 /frontend/generated
 /frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
+/frontend/sharePrepStorage.json
 /backend/vendor
 /backend/*.cov
 /backend/*test_config.yaml

CHANGELOG.md

@@ -2,6 +2,107 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
+## v1.4.2
+
+ **Security**:
+ - [Moderate] Add Rate Limiting on Authentication Endpoint Enables Brute Force Attacks (GHSA-r4v7-6wcg-ghj5)
+ - [Critical] Path traversal in public share PATCH allows file ops outside shared directory -- thanks @Revanth011 and @fg0x0 (GHSA-qqqm-5547-774x)
+
+ **New Features**:
+ - read-only source configuration via `source.config.readOnly: true` (#2438)
+
+ **Notes**:
+ - auth rate limiting can be disabled via `auth.disableRateLimit`
+ - updated share hash middleware (#2443)
+ - updated source info popup to include private and readOnly properties
+
+ **BugFixes**:
+ - Logout from share page now redirects to the share instead of `/Login` again. (#2245)
+ - `This location cannot be reached` error when navigating with FileTree in shares. (#2245)
+ - Fix FileTree rename and move actions in previews. (#2245)
+ - Delete prompt not showing date and thumbnails in some previews. (#2245)
+ - fix path slash issue on windows (#2451) (#2433) (#2419)
+ - Always force url rewrite for onlyoffice internal URL. Fixes Error saving with OnlyOffice (#2450)
+ - Overriding a Deny with an Allow not working (#2405)
+
+## v1.4.1
+
+ **Security**:
+ - Fix critical: unauthenticated user can view source info
+
+## v1.4.0
+
+ **New Features**:
+ - Add Passkey (WebAuthn) support for passwordless authentication (#2287) (#2379) -- thanks @juansoler
+ - Lyrics support for audio files (#2360):
+   - Updated UI for audio previews!
+   - The lyrics and the player gets syncronized in UI with the audio player.
+   - Supports embedded lyrics (ID3v2 USLT, flac, ogg, clyr) and sidecar `.lrc` files with the same name as the audio file.
+   - The `Q` shortcut in audio files will toggle the new panel visibility.
+   - `E` shortcut to change between tabs of the panel if it's open.
+ - Api log filtering support via `apiFilter` option for logging.
+   - regex filter that excludes matching full api paths from being logged. (eg. `/user\?id\=self`) Defaults to `^/health|^/favicon.ico|^/static|^/public/static`
+   - Add config option to disable /health endpoint logging (#2291)
+ - More shortcuts (#2300)
+   - `CTRL+F1` switch to normal view.
+   - `CTRL+F2` switch to gallery view.
+   - `CTRL+F3` switch to list view.
+   - `Double click` on empty space to select all items.
+ - Option to hide certain files in UI by extension (#2403) (#2277)
+ - Additional search features
+   - wildcard search similar to regex, but limited to sqlite GLOB syntax (#769)
+   - advanced search tool that shows all results in a listing thats sortable and actionable like a normal listing (#1051)
+   - advanced search supports multiple custom scopes per search
+   - multiple search terms with AND or OR logic support
+
+ **Notes**:
+ - Enhanced indexing scheduler which doesn't wake the disk as often.
+ - New API route `media/lyrics` used to fetch and parse lyrics (embedded or from `.lrc` sidecar) (#2360)
+ - Swiping down gesture in fullscreen videos exit fullscreen instead of close preview.
+ - Improved styles for path selection and tables
+ - Improved style of drag and drop into listing view (#2407)
+ - Edit Sidebar links has new "show tools in sidebar" toggle and all users have this enabled by default. can be disabled via for new users `userDefaults.sidebar.showTools: false`
+ - Update user defaults ordering (#1140)
+ - Save view modes and sizes into local storage instead of db (#2301) 
+
+ **BugFixes**:
+ - Blue overlay when using gestures in video files on mobile (#2360)
+ - Playback queue wasn't updating when changing of folder (#2360)
+ - Added missing `UserDefaults.listing.showCopyPath` option to config file (#2364)
+ - Delete prompt thumbnail didn't worked when using it with the `delete` shortcut. (#2407)
+ - Searching icons in the Icon picker prompt wasn't working properly (#2407) 
+ - Drag and drop style state was stuck until page reload (#2407)
+ - Navigate close settings shows "something went wrong" (#2047)
+
+## v1.3.10
+
+ **Notes**:
+ - When indexing is disabled for a source, the usage will always reported as partition size.
+ - removed deprecated `source.config.disableIndexing`, see [rules](https://filebrowserquantum.com/en/docs/advanced/source-configuration/conditional-rules/#disable-indexing)
+
+ **BugFixes**:
+ - Disable index option not working (#2385)
+
+## v1.3.9
+
+ **Security**:
+ - [Critical] Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion GHSA-fwj3-42wh-8673
+ - [Moderate] Stored XSS via SVG File in Public Share (Missing CSP Header) GHSA-mmpx-jh39-wrv6
+
+ **BugFixes**:
+ - Fix context menu items and adjusted when items show to more accurately reflect permissions.
+
+## v1.3.8
+
+ **BugFixes**:
+ - Quick download icon style after icon change.
+ - Missing error popup for resource creatoin actions (upload/create)
+ - EnforcedOtp login failure until restart (#2330)
+ - Thumbnails for Folders only display sporadically (#2353)
+ - Unwanted user scope change for users with non-default scopes (#2347)
+ - Fix sidebar source info totals (#2321) (#2322) (#982)
+ - Error uploading a large number of photos -- only 100 items get uploaded (#2348)
+
 ## v1.3.7
 
  **Notes**:

README.md

@@ -1,7 +1,7 @@
 <div align="center">
 
   [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
-  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
+  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/0b548794f2ac4871a0cf7aa9ecab049f)](https://app.codacy.com/gh/gtsteffaniak/filebrowser/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
   [![latest version](https://img.shields.io/github/v/release/gtsteffaniak/filebrowser)](https://github.com/gtsteffaniak/filebrowser/releases)
   [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
   [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)

_docker/Dockerfile.playwright-settings

@@ -19,5 +19,7 @@ COPY [ "./backend/http/embed/", "./http/dist/"]
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser set -u testuser1,testuser1
 RUN ./filebrowser set rule -s access -p / -r user -v admin -allow -c config.yaml
+RUN ./filebrowser set rule -s access -p /excluded/showme.txt -r user -v admin -allow -c config.yaml
+RUN ./filebrowser set rule -s access -p /denied -r user -v admin -c config.yaml
 RUN ./filebrowser set rule -s access -p /excluded -r user -v admin -c config.yaml
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/src/general/backend/config.yaml

@@ -15,3 +15,4 @@ userDefaults:
   permissions:
     download: true
     create: true
+    share: true

_docker/src/general/backend/server-config.yaml

@@ -2,7 +2,8 @@ server-main: &server-main
   port: 80
   baseURL:  "/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"
@@ -11,5 +12,7 @@ server-main: &server-main
     - path: "."
       name: "docker"
       config:
-        disableIndexing: true
-        defaultEnabled: true
+        defaultEnabled: true
+        rules:
+          - folderPath: "/"
+            viewable: true

_docker/src/jwt/backend/config.yaml

@@ -1,7 +1,8 @@
 server:
   port: 8080
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       config:

_docker/src/noauth/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 80
   baseURL:  "/files/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "exclude"

_docker/src/oidc/backend/config.yaml

@@ -1,6 +1,7 @@
 server:
   logging:
     - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       config:

_docker/src/previews/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 80
   baseURL:  "/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
 

_docker/src/proxy/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 8080
   baseURL:  "/subpath"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       config:

_docker/src/screenshots/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 8080
   baseURL:  "/files/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright"

_docker/src/screenshots/frontend/playwright.config.ts

@@ -18,7 +18,7 @@ export default defineConfig({
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: false,
   /* Retry on CI only */
-  retries: 2,
+  retries: 1,
   /* Opt out of parallel tests on CI. */
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */
   reporter: "line",
@@ -53,8 +53,6 @@ export default defineConfig({
         ...devices["Desktop Chrome"],
         theme: 'dark',
       },
-      testMatch: /.*screenshots.spec.ts/,
-      retries: 0,
     },
     {
       name: "light-screenshots",
@@ -62,8 +60,6 @@ export default defineConfig({
         ...devices["Desktop Chrome"],
         theme: 'light',
       },
-      testMatch: /.*screenshots.spec.ts/,
-      retries: 0,
     },
   ],
 });

_docker/src/settings/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 80
   baseURL:  "/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"
@@ -11,8 +12,10 @@ server:
     - path: "."
       name: "docker"
       config:
-        disableIndexing: true
         defaultEnabled: true
+        rules:
+          - folderPath: "/"
+            viewable: true
     - path: "/tests/playwright-files"
       name: "access"
       config:

_docker/src/sharing/backend/config.yaml

@@ -2,7 +2,8 @@ server:
   port: 80
   baseURL:  "/"
   logging:
-    - levels: "info|error|debug"
+    - levels: "info|error|warning|debug"
+      apiFilter: 'disabled'
   sources:
     - path: "../frontend/tests/playwright-files"
       name: "playwright + files"

backend/adapters/fs/files/file_test.go

@@ -684,7 +684,7 @@ func runDeleteFilesSubfolderWithRaceStress(t *testing.T, iter int) {
 	}
 
 	indexing.StopAllScanners()
-	// Give scanners time to finish their cleanup (defer blocks in tryAcquireAndScan)
+	// Give scanners time to finish their cleanup (defer blocks in executeScan)
 	time.Sleep(100 * time.Millisecond)
 	indexing.ClearTestIndices()
 	t.Logf("iteration %d: cleaned scanners and indices", iter)

backend/adapters/fs/files/files.go

@@ -1,11 +1,13 @@
 package files
 
 import (
+	"bufio"
 	"context"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"sync"
@@ -46,7 +48,7 @@ func addMetadataToChildren(response *iteminfo.ExtendedFileInfo, opts utils.FileO
 		wg.Go(func() {
 			fullPath := response.RealPath + "/" + fileItem.Name
 			if isAudio {
-				if err := extractAudioMetadata(context.Background(), fileItem, fullPath, opts.AlbumArt, opts.Metadata, sharedFFmpegService); err != nil {
+				if err := extractAudioMetadata(context.Background(), fileItem, fullPath, opts.AlbumArt, opts.Metadata, false, sharedFFmpegService); err != nil {
 					logger.Debugf("failed to extract metadata for file: %s, error: %v", fileItem.Name, err)
 				}
 			} else {
@@ -143,7 +145,7 @@ func checkPermissionsImpl(opts utils.FileOptions, access *access.Storage, user *
 	// Layer 1: USER ACCESS CONTROL
 	// Quick check: Does THIS user have permission?
 	if !access.Permitted(idx.Path, indexPath, user.Username) {
-		return "", "", errors.ErrAccessDenied
+		return indexPath, "", errors.ErrAccessDenied
 	}
 	return indexPath, userScope, nil
 }
@@ -153,22 +155,37 @@ type Items struct {
 	Folders []string `json:"folders,omitempty"`
 }
 
+// This removes files whose names match any extension in hideFileExt.
+func filterFilesByExt(files []iteminfo.ExtendedItemInfo, hideFileExt string) []iteminfo.ExtendedItemInfo {
+	if hideFileExt == "" {
+		return files
+	}
+	filtered := files[:0]
+	for _, f := range files {
+		if !utils.HideFileByExt(f.Name, hideFileExt) {
+			filtered = append(filtered, f)
+		}
+	}
+	return filtered
+}
+
 func GetDirItems(opts utils.FileOptions, access *access.Storage, user *users.User) (Items, error) {
 	items := Items{}
-	indexPath, _, err := CheckPermissions(opts, access, user)
-	if err != nil {
-		return items, err
+	indexPath, _, topLevelErr := CheckPermissions(opts, access, user)
+	accessRulesErr := topLevelErr != nil && topLevelErr == errors.ErrAccessDenied && indexPath != ""
+	if topLevelErr != nil && !accessRulesErr {
+		return items, topLevelErr
 	}
 	// Get index
 	idx := indexing.GetIndex(opts.Source)
 	if idx == nil {
 		return items, fmt.Errorf("could not get index: %v ", opts.Source)
 	}
-
 	info, err := idx.GetFileInfo(indexing.FileInfoRequest{
 		IndexPath:         indexPath,
 		FollowSymlinks:    opts.FollowSymlinks,
 		ShowHidden:        opts.ShowHidden,
+		HideFileExt:       opts.HideFileExt,
 		Expand:            true,
 		SkipExtendedAttrs: true,
 	})
@@ -181,8 +198,15 @@ func GetDirItems(opts utils.FileOptions, access *access.Storage, user *users.Use
 	if err := access.CheckChildItemAccess(info, idx, user.Username); err != nil {
 		return items, err
 	}
+	hasAccessibleItems := len(info.Files) > 0 || len(info.Folders) > 0
+	if accessRulesErr && !hasAccessibleItems {
+		return items, errors.ErrAccessDenied
+	}
 	if opts.Only == "files" || opts.Only == "" {
 		for _, file := range info.Files {
+			if opts.HideFileExt != "" && utils.HideFileByExt(file.Name, opts.HideFileExt) {
+				continue
+			}
 			items.Files = append(items.Files, file.Name)
 		}
 	}
@@ -204,9 +228,10 @@ func FileInfoFaster(opts utils.FileOptions, access *access.Storage, user *users.
 // fileInfoFasterImpl is the actual implementation of FileInfoFaster
 func fileInfoFasterImpl(opts utils.FileOptions, access *access.Storage, user *users.User, share *share.Storage) (*iteminfo.ExtendedFileInfo, error) {
 	response := &iteminfo.ExtendedFileInfo{}
-	indexPath, userScope, err := CheckPermissions(opts, access, user)
-	if err != nil {
-		return response, err
+	indexPath, userScope, topLevelErr := CheckPermissions(opts, access, user)
+	accessRulesErr := topLevelErr != nil && topLevelErr == errors.ErrAccessDenied && indexPath != ""
+	if topLevelErr != nil && !accessRulesErr {
+		return response, topLevelErr
 	}
 	// Get index
 	idx := indexing.GetIndex(opts.Source)
@@ -219,19 +244,23 @@ func fileInfoFasterImpl(opts utils.FileOptions, access *access.Storage, user *us
 		IndexPath:         indexPath,
 		FollowSymlinks:    opts.FollowSymlinks,
 		ShowHidden:        opts.ShowHidden,
+		HideFileExt:       opts.HideFileExt,
 		Expand:            opts.Expand,
 		SkipExtendedAttrs: opts.SkipExtendedAttrs,
 	})
 	if err != nil {
 		return response, err // Path excluded by index rules OR doesn't exist
 	}
-
 	// otherwise response keeps unfiltered Folders/Files while CheckChildItemAccess only mutates info.
 	if info.Type == "directory" {
 		if err := access.CheckChildItemAccess(info, idx, user.Username); err != nil {
 			return response, err
 		}
 	}
+	hasAccessibleItems := len(info.Files) > 0 || len(info.Folders) > 0
+	if accessRulesErr && !hasAccessibleItems {
+		return response, errors.ErrAccessDenied
+	}
 
 	// Build response
 	response.FileInfo = *info
@@ -250,11 +279,17 @@ func fileInfoFasterImpl(opts utils.FileOptions, access *access.Storage, user *us
 	}
 	defer finalizeResponse(response, info, response.RealPath, user, userScope)
 	if opts.SkipExtendedAttrs {
+		if info.Type == "directory" && opts.HideFileExt != "" {
+			response.Files = filterFilesByExt(response.Files, opts.HideFileExt)
+		}
 		return response, nil
 	}
 	// Process directory metadata if requested
 	if info.Type == "directory" {
 		processDirectoryMetadata(response, idx, opts)
+		if opts.HideFileExt != "" {
+			response.Files = filterFilesByExt(response.Files, opts.HideFileExt)
+		}
 	}
 	// Process single file content/metadata
 	isAudioVideo := strings.HasPrefix(info.Type, "audio") || strings.HasPrefix(info.Type, "video")
@@ -306,7 +341,7 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 		extItem := &iteminfo.ExtendedItemInfo{
 			ItemInfo: info.ItemInfo,
 		}
-		err := extractAudioMetadata(context.Background(), extItem, info.RealPath, opts.AlbumArt || opts.Content, opts.Metadata || opts.Content, nil)
+		err := extractAudioMetadata(context.Background(), extItem, info.RealPath, opts.AlbumArt || opts.Content, opts.Metadata || opts.Content, false, nil)
 		if err != nil {
 			logger.Debugf("failed to extract audio metadata for file: "+info.RealPath, info.Name, err)
 		} else {
@@ -340,10 +375,58 @@ func generateOfficeId(realPath string) string {
 	return key
 }
 
+// Parses raw LRC text into a slice of Lyric.
+// Lines with [hh:mm:ss.xx] (timestamps) will be parsed to ms for synced lyrics
+// The ones without timestamp are kept as unsynced (timestamp 0).
+func parseLRC(raw string) []iteminfo.Lyric {
+	var lines []iteminfo.Lyric
+	scanner := bufio.NewScanner(strings.NewReader(raw))
+	re := regexp.MustCompile(`^\[(?:(\d{1,2}):)?(\d{1,2}):(\d{1,2})\.(\d+)\](.*)`)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+		matches := re.FindStringSubmatch(line)
+		if len(matches) == 6 {
+			// Hours default to 0 (if not present in the timestamps)
+			h := 0
+			if matches[1] != "" {
+				h, _ = strconv.Atoi(matches[1])
+			}
+			min, _ := strconv.Atoi(matches[2])
+			sec, _ := strconv.Atoi(matches[3])
+
+			msStr := matches[4]
+			// Normalise to 3 digits, some songs have more than 3 digits in the milliseconds
+			switch {
+			case len(msStr) < 3:
+				msStr += strings.Repeat("0", 3-len(msStr))
+			case len(msStr) > 3:
+				msStr = msStr[:3]
+			}
+			ms, _ := strconv.Atoi(msStr)
+			timestamp := int64((h*3600+min*60+sec)*1000 + ms)
+			text := strings.TrimSpace(matches[5])
+			lines = append(lines, iteminfo.Lyric{
+				Text:      text,
+				Timestamp: timestamp,
+			})
+		} else {
+			// Line without a valid timestamp – treat as unsynced (timestamp 0)
+			lines = append(lines, iteminfo.Lyric{
+				Text:      line,
+				Timestamp: 0,
+			})
+		}
+	}
+	return lines
+}
+
 // extractAudioMetadata extracts metadata from an audio file using dhowden/tag
 // and optionally extracts duration using the ffmpeg service with concurrency control
 // If ffmpegService is nil, a new service will be created (for backward compatibility)
-func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, getArt bool, getDuration bool, ffmpegService *ffmpeg.FFmpegService) error {
+func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, getArt bool, getDuration bool, getLyrics bool, ffmpegService *ffmpeg.FFmpegService) error {
 	file, err := os.Open(realPath)
 	if err != nil {
 		return err
@@ -379,6 +462,30 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 	track, _ := m.Track()
 	item.Metadata.Track = track
 
+	// Check if lyrics are available without extract them
+	if rawLyrics := m.Lyrics(); rawLyrics != "" {
+		item.Metadata.HasLyrics = true
+	} else {
+		// Check for sidecar .lrc file
+		dir := filepath.Dir(realPath)
+		base := filepath.Base(realPath)
+		ext := filepath.Ext(base)
+		nameWithoutExt := strings.TrimSuffix(base, ext)
+		lrcPath := filepath.Join(dir, nameWithoutExt+".lrc")
+		if _, err := os.Stat(lrcPath); err == nil {
+			item.Metadata.HasLyrics = true
+		}
+	}
+
+	if getLyrics {
+		lyrics, err := ExtractLyrics(realPath)
+		if err != nil {
+			logger.Debugf("failed to extract lyrics for %s: %v", realPath, err)
+		} else if len(lyrics) > 0 {
+			item.Metadata.Lyrics = lyrics
+		}
+	}
+
 	// Extract duration ONLY if explicitly requested using the ffmpeg VideoService
 	// This respects concurrency limits and gracefully handles missing ffmpeg
 	if getDuration {
@@ -411,6 +518,37 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 	return nil
 }
 
+// Returns lyrics from an audio file (from embedded tags or from a .lrc file with the same name).
+func ExtractLyrics(realPath string) ([]iteminfo.Lyric, error) {
+	file, err := os.Open(realPath)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	m, err := tag.ReadFrom(file)
+	if err != nil {
+		return nil, err
+	}
+
+	var lyrics []iteminfo.Lyric
+	if raw := m.Lyrics(); raw != "" {
+		lyrics = parseLRC(raw)
+	}
+	if len(lyrics) == 0 {
+		// Check for sidecar .lrc file
+		dir := filepath.Dir(realPath)
+		base := filepath.Base(realPath)
+		ext := filepath.Ext(base)
+		nameWithoutExt := strings.TrimSuffix(base, ext)
+		lrcPath := filepath.Join(dir, nameWithoutExt+".lrc")
+		if data, err := os.ReadFile(lrcPath); err == nil {
+			lyrics = parseLRC(string(data))
+		}
+	}
+	return lyrics, nil
+}
+
 // extractVideoMetadata extracts duration from video files using ffprobe
 // If ffmpegService is nil, a new service will be created (for backward compatibility)
 func extractVideoMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, ffmpegService *ffmpeg.FFmpegService) error {
@@ -445,7 +583,7 @@ func DeleteFiles(source, absPath string, isDir bool) error {
 		return fmt.Errorf("refusing to delete source root directory: %s", absPath)
 	}
 
-	if !index.Config.DisableIndexing {
+	if !index.Config.ResolvedRules.IndexingDisabled {
 		indexPath := index.MakeIndexPath(absPath, isDir)
 
 		// Perform the physical deletion
@@ -482,7 +620,7 @@ func RefreshIndex(source string, path string, isDir bool, recursive bool) error
 	if idx == nil {
 		return fmt.Errorf("could not get index: %v ", source)
 	}
-	if idx.Config.DisableIndexing {
+	if idx.Config.ResolvedRules.IndexingDisabled {
 		return nil
 	}
 	// Always normalize path using MakeIndexPath
@@ -590,7 +728,7 @@ func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 
 	// Handle SOURCE cleanup (treat as deletion)
 	// Run async to avoid blocking the HTTP response
-	if !srcIdx.Config.DisableIndexing {
+	if !srcIdx.Config.ResolvedRules.IndexingDisabled {
 		go func() {
 			if isSrcDir {
 				srcIdx.DeleteMetadata(srcIndexPath, true, true)
@@ -605,7 +743,7 @@ func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 
 	// Handle DESTINATION indexing
 	// Run async to avoid blocking the HTTP response
-	if !dstIdx.Config.DisableIndexing {
+	if !dstIdx.Config.ResolvedRules.IndexingDisabled {
 		if isSrcDir {
 			go func() {
 				// Recursively index the moved directory tree
@@ -663,7 +801,7 @@ func CopyResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 
 	// Refresh source (non-recursive, just metadata)
 	srcIdx := indexing.GetIndex(sourceIndex)
-	if srcIdx != nil && !srcIdx.Config.DisableIndexing {
+	if srcIdx != nil && !srcIdx.Config.ResolvedRules.IndexingDisabled {
 		srcRefreshPath := realsrc
 		if !isSrcDir {
 			srcRefreshPath = filepath.Dir(realsrc)
@@ -674,7 +812,7 @@ func CopyResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 	// Refresh destination (RECURSIVE for directories to capture full tree)
 	// Run async to avoid blocking the HTTP response
 	dstIdx := indexing.GetIndex(destIndex)
-	if dstIdx != nil && !dstIdx.Config.DisableIndexing {
+	if dstIdx != nil && !dstIdx.Config.ResolvedRules.IndexingDisabled {
 		if isSrcDir {
 			go func() {
 				// Recursively index the copied directory tree

backend/adapters/fs/files/mime.go

@@ -446,6 +446,7 @@ var types = map[string]string{
 	".ass":       "text/subtitle-ass",
 	".vtt":       "text/subtitle-vtt",
 	".ssa":       "text/subtitle-ssa",
+	".lrc":       "text/lyrics",
 	".sbv":       "text/plain",
 	".ssi":       "text/x-server-parsed-html",
 	".ssm":       "application/streamingmedia",

backend/adapters/fs/files/user.go

@@ -25,7 +25,11 @@ func MakeUserDirs(u *users.User, createDir bool) error {
 		return fmt.Errorf("MakeUserDirs: invalid user for home dir creation: [%s]", u.Username)
 	}
 	for i, scope := range u.Scopes {
-		source, ok := settings.Config.Server.SourceMap[scope.Name]
+		info, ok := users.ResolveSourceKey(scope.Name)
+		if !ok {
+			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
+		}
+		source, ok := settings.Config.Server.SourceMap[info.Path]
 		if !ok {
 			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
 		}

backend/adapters/fs/fileutils/file.go

@@ -240,3 +240,22 @@ func ClearCacheDir(cacheDir string) {
 	}
 
 }
+
+// ClearDirectoryContents removes all files and subdirectories inside dir; dir itself remains.
+// If dir does not exist, returns nil.
+func ClearDirectoryContents(dir string) error {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	for _, entry := range entries {
+		path := filepath.Join(dir, entry.Name())
+		if err := os.RemoveAll(path); err != nil {
+			return err
+		}
+	}
+	return nil
+}

backend/auth/totp.go

@@ -146,14 +146,14 @@ func decryptSecret(b64Ciphertext, b64Nonce string) (string, error) {
 }
 
 func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) error {
-	// get data from cache
 	cachedSecret, found := TotpCache.Get(user.Username)
 	if !found && user.TOTPSecret == "" {
 		return fmt.Errorf("OTP token not found in cache, please generate a new one")
 	}
+	useCache := found && user.TOTPSecret == ""
 	totpSecret := user.TOTPSecret // The encrypted or plaintext secret
 	totpNonce := user.TOTPNonce   // The nonce if encrypted, or empty if plaintext
-	if found {
+	if useCache {
 		splitSecret := strings.Split(cachedSecret, "||")
 		if len(splitSecret) < 2 {
 			return fmt.Errorf("invalid cached OTP token format")
@@ -173,9 +173,7 @@ func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) err
 		}
 		secretToValidate = decryptedSecret
 	}
-	// --- END: ADD THIS DECRYPTION LOGIC ---
 
-	// Validate the token using the (now plaintext) secret.
 	valid, err := totp.ValidateCustom(code, secretToValidate, time.Now().UTC(), totp.ValidateOpts{
 		Period:    TOTPPeriod,
 		Skew:      TOTPSkew,
@@ -198,6 +196,7 @@ func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) err
 			logger.Error("error updating user with OTP token:", err)
 			return fmt.Errorf("error updating user with OTP token: %w", err)
 		}
+		TotpCache.Delete(user.Username)
 	} else {
 		return fmt.Errorf("opt secret is empty, cannot enable TOTP")
 	}

backend/auth/webauthn.go

@@ -0,0 +1,296 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"net/url"
+	"sync"
+	"time"
+
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/webauthn"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+type webAuthnSession struct {
+	SessionData *webauthn.SessionData
+	UserID      uint
+	ExpiresAt   time.Time
+}
+
+type WebAuthnService struct {
+	wa       *webauthn.WebAuthn
+	sessions sync.Map
+	stopCh   chan struct{}
+}
+
+var webAuthnInstance *WebAuthnService
+
+func InitWebAuthn() error {
+	cfg := &settings.Config.Auth.Methods.PasskeyAuth
+	if !cfg.Enabled {
+		webAuthnInstance = nil
+		return nil
+	}
+
+	waCfg, err := deriveWebAuthnConfig(cfg)
+	if err != nil {
+		return fmt.Errorf("webauthn config derivation failed: %w", err)
+	}
+
+	wa, err := webauthn.New(waCfg)
+	if err != nil {
+		return fmt.Errorf("failed to initialize WebAuthn: %w", err)
+	}
+
+	webAuthnInstance = &WebAuthnService{
+		wa:     wa,
+		stopCh: make(chan struct{}),
+	}
+	go webAuthnInstance.cleanupExpiredSessions()
+	return nil
+}
+
+func GetWebAuthn() *WebAuthnService {
+	return webAuthnInstance
+}
+
+func IsWebAuthnEnabled() bool {
+	return webAuthnInstance != nil
+}
+
+// ValidateOrigin checks if the given origin is in the configured whitelist.
+// Returns true if the origin is allowed, false otherwise.
+func (s *WebAuthnService) ValidateOrigin(origin string) bool {
+	for _, allowedOrigin := range s.wa.Config.RPOrigins {
+		if allowedOrigin == origin {
+			return true
+		}
+	}
+	return false
+}
+
+func generateSessionID() string {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return hex.EncodeToString([]byte(fmt.Sprintf("%d", time.Now().UnixNano())))
+	}
+	return hex.EncodeToString(b)
+}
+
+func (s *WebAuthnService) BeginMFALogin(username, password string, rpID string, userStore *users.Storage) (sessionID string, assertion *protocol.CredentialAssertion, err error) {
+	user, getErr := userStore.Get(username)
+	passwordHash := utils.InvalidPasswordHash
+	if getErr == nil {
+		passwordHash = user.Password
+	}
+	// Always run password check to prevent timing-based username enumeration
+	if err = utils.CheckPwd(password, passwordHash); err != nil {
+		return "", nil, errors.ErrUnauthorized
+	}
+	if getErr != nil {
+		return "", nil, errors.ErrUnauthorized
+	}
+
+	if !user.HasPasskeyMFA() {
+		return "", nil, errors.ErrPasskeyNoCredential
+	}
+
+	var opts []webauthn.LoginOption
+	if rpID != "" {
+		opts = append(opts, webauthn.WithLoginRelyingPartyID(rpID))
+	}
+	assertion, sessionData, err := s.wa.BeginLogin(user, opts...)
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to begin WebAuthn login: %w", err)
+	}
+
+	sessionID = generateSessionID()
+	s.sessions.Store(sessionID, &webAuthnSession{
+		SessionData: sessionData,
+		UserID:      user.ID,
+		ExpiresAt:   time.Now().Add(5 * time.Minute),
+	})
+
+	return sessionID, assertion, nil
+}
+
+func (s *WebAuthnService) FinishMFALogin(sessionID string, r *http.Request, userStore *users.Storage) (*users.User, error) {
+	sessionVal, ok := s.sessions.Load(sessionID)
+	if !ok {
+		return nil, errors.ErrPasskeyInvalidSession
+	}
+	sess, ok := sessionVal.(*webAuthnSession)
+	if !ok {
+		return nil, errors.ErrPasskeyInvalidSession
+	}
+	defer s.sessions.Delete(sessionID)
+
+	if time.Now().After(sess.ExpiresAt) {
+		return nil, errors.ErrPasskeyInvalidSession
+	}
+
+	user, err := userStore.Get(sess.UserID)
+	if err != nil {
+		return nil, fmt.Errorf("user not found: %w", err)
+	}
+
+	credential, err := s.wa.FinishLogin(user, *sess.SessionData, r)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %v", errors.ErrPasskeyVerification, err)
+	}
+
+	credB64 := base64.RawURLEncoding.EncodeToString(credential.ID)
+	for i := range user.PasskeyCredentials {
+		if user.PasskeyCredentials[i].ID == credB64 {
+			users.UpdateCredentialFromLibrary(&user.PasskeyCredentials[i], credential)
+			if err := userStore.Update(user, false, "PasskeyCredentials"); err != nil {
+				return nil, fmt.Errorf("failed to update credential: %w", err)
+			}
+			return user, nil
+		}
+	}
+
+	return user, nil
+}
+
+func (s *WebAuthnService) BeginRegistration(user *users.User, rpID string) (sessionID string, creation *protocol.CredentialCreation, err error) {
+	var opts []webauthn.RegistrationOption
+	if rpID != "" {
+		opts = append(opts, webauthn.WithRegistrationRelyingPartyID(rpID))
+	}
+	creation, sessionData, err := s.wa.BeginRegistration(user, opts...)
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to begin WebAuthn registration: %w", err)
+	}
+
+	sessionID = generateSessionID()
+	s.sessions.Store(sessionID, &webAuthnSession{
+		SessionData: sessionData,
+		UserID:      user.ID,
+		ExpiresAt:   time.Now().Add(5 * time.Minute),
+	})
+
+	return sessionID, creation, nil
+}
+
+func (s *WebAuthnService) FinishRegistration(user *users.User, sessionID string, credentialName string, r *http.Request) error {
+	sessionVal, ok := s.sessions.Load(sessionID)
+	if !ok {
+		return errors.ErrPasskeyInvalidSession
+	}
+	sess, ok := sessionVal.(*webAuthnSession)
+	if !ok {
+		return errors.ErrPasskeyInvalidSession
+	}
+	defer s.sessions.Delete(sessionID)
+
+	if time.Now().After(sess.ExpiresAt) {
+		return errors.ErrPasskeyInvalidSession
+	}
+
+	if sess.UserID != user.ID {
+		return errors.ErrUnauthorized
+	}
+
+	credential, err := s.wa.FinishRegistration(user, *sess.SessionData, r)
+	if err != nil {
+		return fmt.Errorf("failed to finish WebAuthn registration: %w", err)
+	}
+
+	credB64 := base64.RawURLEncoding.EncodeToString(credential.ID)
+	for _, c := range user.PasskeyCredentials {
+		if c.ID == credB64 {
+			return errors.ErrPasskeyExists
+		}
+	}
+
+	newCred := users.CredentialFromLibrary(credentialName, credential)
+	user.PasskeyCredentials = append(user.PasskeyCredentials, newCred)
+	return nil
+}
+
+func (s *WebAuthnService) DeleteCredential(user *users.User, credentialID string) error {
+	for i, c := range user.PasskeyCredentials {
+		if c.ID == credentialID {
+			user.PasskeyCredentials = append(user.PasskeyCredentials[:i], user.PasskeyCredentials[i+1:]...)
+			return nil
+		}
+	}
+	return errors.ErrPasskeyNoCredential
+}
+
+func (s *WebAuthnService) cleanupExpiredSessions() {
+	ticker := time.NewTicker(2 * time.Minute)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ticker.C:
+			now := time.Now()
+			s.sessions.Range(func(key, value interface{}) bool {
+				sess, ok := value.(*webAuthnSession)
+				if !ok {
+					s.sessions.Delete(key)
+					return true
+				}
+				if now.After(sess.ExpiresAt) {
+					s.sessions.Delete(key)
+				}
+				return true
+			})
+		case <-s.stopCh:
+			return
+		}
+	}
+}
+
+func deriveWebAuthnConfig(cfg *settings.PasskeyAuthConfig) (*webauthn.Config, error) {
+	rpID := cfg.RPID
+	if rpID == "" {
+		if settings.Config.Server.ExternalUrl != "" {
+			if u, err := url.Parse(settings.Config.Server.ExternalUrl); err == nil {
+				rpID = u.Hostname()
+			}
+		}
+		if rpID == "" {
+			rpID = "localhost"
+		}
+	}
+
+	displayName := cfg.RPDisplayName
+	if displayName == "" {
+		displayName = settings.Config.Frontend.Name
+	}
+	if displayName == "" {
+		displayName = "FileBrowser Quantum"
+	}
+
+	origins := cfg.RPOrigins
+	if len(origins) == 0 {
+		if settings.Config.Server.ExternalUrl != "" {
+			origins = append(origins, settings.Config.Server.ExternalUrl)
+		}
+		if settings.Config.Server.InternalUrl != "" && settings.Config.Server.InternalUrl != settings.Config.Server.ExternalUrl {
+			origins = append(origins, settings.Config.Server.InternalUrl)
+		}
+		if len(origins) == 0 {
+			origins = append(origins, "http://localhost")
+		}
+	}
+
+	return &webauthn.Config{
+		RPID:          rpID,
+		RPDisplayName: displayName,
+		RPOrigins:     origins,
+		AttestationPreference: protocol.PreferNoAttestation,
+		AuthenticatorSelection: protocol.AuthenticatorSelection{
+			UserVerification: protocol.VerificationPreferred,
+		},
+	}, nil
+}

backend/cmd/cli.go

@@ -110,14 +110,13 @@ func runCLI() (bool, bool) {
 		}
 	}
 
-	dbExists := getStore(storeCfg)
-
 	switch cliSubcmd {
 	case "setup":
 		createConfig(configPath)
-		return false, dbExists
+		return false, false
 	case "set":
 		if setKind == "-u" {
+			dbExists := getStore(storeCfg)
 			logger.Debugf("setUser called with args: %v, config: %v, admin: %v", os.Args, dbConfig, asAdmin)
 			err := setUser(dbConfig, asAdmin)
 			if err != nil {
@@ -128,6 +127,7 @@ func runCLI() (bool, bool) {
 		}
 		switch setKind {
 		case "rule":
+			dbExists := getStore(storeCfg)
 			sourceInfo, ok := settings.Config.Server.NameToSource[sourceName] // backend source is path
 			if !ok {
 				fmt.Printf("error: invalid source name: %s\n", sourceName)
@@ -143,8 +143,9 @@ func runCLI() (bool, bool) {
 			fmt.Printf("error: unknown subcommand '%s' for 'set'. Use 'set user' or 'set rule'\n", setKind)
 			os.Exit(1)
 		}
-		return false, dbExists
+		return false, false
 	default:
+		dbExists := getStore(storeCfg)
 		return true, dbExists
 	}
 }
@@ -225,7 +226,7 @@ func setUser(dbConfig string, asAdmin bool) error {
 		for _, source := range settings.Config.Server.SourceMap {
 			if source.Config.DefaultEnabled {
 				newUser.Scopes = append(newUser.Scopes, users.SourceScope{
-					Name:  source.Name,
+					Name:  source.Path,
 					Scope: source.Config.DefaultUserScope,
 				})
 			}
@@ -237,7 +238,7 @@ func setUser(dbConfig string, asAdmin bool) error {
 		} else {
 			logger.Infof("Creating non-admin user: %s\n", username)
 		}
-		newUser.Permissions = settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Permissions)
+		newUser.Permissions = settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Account.Permissions)
 		newUser.Permissions.Admin = asAdmin
 		err = storage.CreateUser(newUser, newUser.Permissions)
 		if err != nil {
@@ -258,7 +259,7 @@ func setUser(dbConfig string, asAdmin bool) error {
 	}
 	// Ensure version is set for existing users being updated
 	if user.Version == 0 {
-		user.Version = 1
+		user.Version = users.CurrentUserMigrationVersion
 	}
 	err = store.Users.Save(user, true, false)
 	if err != nil {
@@ -268,51 +269,6 @@ func setUser(dbConfig string, asAdmin bool) error {
 	return nil
 }
 
-// UserDefaults defines default settings for new users.
-type UserDefaults struct {
-	Permissions users.Permissions `yaml:"permissions"`
-}
-
-// Frontend defines settings related to the web interface.
-type Frontend struct {
-	Name string `yaml:"name,omitempty"`
-}
-
-// Source defines a directory to be served.
-type Source struct {
-	Name string `yaml:"name,omitempty"`
-	Path string `yaml:"path"`
-}
-
-// Server defines server-specific configurations.
-type Server struct {
-	Port     int         `yaml:"port"`
-	Database string      `yaml:"database"`
-	Sources  []Source    `yaml:"sources"`
-	Logging  []LogConfig `json:"logging"`
-}
-
-type LogConfig struct {
-	Levels    string `json:"levels"`    // separated list of log levels to enable. (eg. "info|warning|error|debug")
-	ApiLevels string `json:"apiLevels"` // separated list of log levels to enable for the API. (eg. "info|warning|error")
-	Output    string `json:"output"`    // output location. (eg. "stdout" or "path/to/file.log")
-	NoColors  bool   `json:"noColors"`  // disable colors in the output
-	Utc       bool   `json:"utc"`       // use UTC time in the output instead of local time
-}
-
-type Auth struct {
-	AdminUsername string `yaml:"adminUsername"`
-	AdminPassword string `yaml:"adminPassword"`
-}
-
-// Settings is the top-level configuration structure.
-type Settings struct {
-	Server       Server       `yaml:"server"`
-	Frontend     Frontend     `yaml:"frontend,omitempty"`
-	Auth         Auth         `yaml:"auth"`
-	UserDefaults UserDefaults `yaml:"userDefaults"`
-}
-
 // askQuestion displays a prompt and reads a line of input from the user.
 // It returns the defaultValue if the user's input is empty.
 func askQuestion(reader *bufio.Reader, prompt string, defaultValue string) string {
@@ -344,30 +300,9 @@ func askYesNoQuestion(reader *bufio.Reader, prompt string, defaultValue string)
 
 // createConfig orchestrates the configuration process by asking the user a series of questions.
 func createConfig(configpath string) {
-	// check if config file exists
-	if _, err := os.Stat("config.yaml"); err == nil {
-		fmt.Println("Config file 'config.yaml' already exists, skipping setup.")
-		return
-	}
 	reader := bufio.NewReader(os.Stdin)
-	config := Settings{
-		Server: Server{
-			Logging: []LogConfig{
-				{
-					Levels:    "info|warning|error",
-					ApiLevels: "info|warning|error",
-					Output:    "stdout",
-					NoColors:  false,
-					Utc:       false,
-				},
-			},
-			Sources: []Source{
-				{
-					Path: "",
-				},
-			},
-		},
-	}
+	config := settings.SetDefaults(false)
+	config.Server.Sources = []*settings.Source{{Path: "./"}}
 
 	fmt.Println("--- Starting Configuration Setup ---")
 	realPath := ""
@@ -434,8 +369,8 @@ func createConfig(configpath string) {
 	config.Auth.AdminPassword = askQuestion(reader, "What should the default admin password be?", "admin")
 
 	// 6. Ask boolean (Yes/No) questions using the helper
-	config.UserDefaults.Permissions.Modify = askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
-	config.UserDefaults.Permissions.Share = askYesNoQuestion(reader, "Should a new user be able to create shares by default?", "no")
+	config.UserDefaults.Account.Permissions.Modify = askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
+	config.UserDefaults.Account.Permissions.Share = askYesNoQuestion(reader, "Should a new user be able to create shares by default?", "no")
 
 	fmt.Println("--- 	Configuration Complete 	---")
 

backend/cmd/root.go

@@ -12,6 +12,7 @@ import (
 	_ "net/http/pprof"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/version"
@@ -176,6 +177,9 @@ func StartFilebrowser() {
 		fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
 	}
 	<-shutdownComplete
+	if err := fileutils.ClearDirectoryContents(settings.DownloadCacheDir()); err != nil {
+		logger.Warningf("failed to clear download spool on shutdown: %v", err)
+	}
 	logger.Info("Shutdown complete.")
 }
 
@@ -216,6 +220,11 @@ func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.
 	// Initialize PWA manifest after icons are generated
 	icons.InitializePWAManifest()
 
+	// Initialize WebAuthn/Passkey service if enabled
+	if err := auth.InitWebAuthn(); err != nil {
+		logger.Fatalf("Failed to initialize WebAuthn: %v", err)
+	}
+
 	fbhttp.StartHttp(ctx, store, shutdownComplete)
 	return nil
 }

backend/cmd/user.go

@@ -44,10 +44,12 @@ func validateUserInfo(newDB bool) {
 		if updateTokens(user) {
 			updateUser = true
 		}
+		if updateShowToolsInSidebar(user) {
+			updateUser = true
+		}
 		adminUser := settings.Config.Auth.AdminUsername
 		adminPass := settings.Config.Auth.AdminPassword
-		passwordEnabled := settings.Config.Auth.Methods.PasswordAuth.Enabled
-		if user.Username == adminUser && adminPass != "" && passwordEnabled {
+		if user.Username == adminUser && adminPass != "" && user.LoginMethod == users.LoginMethodPassword {
 			logger.Info("Resetting admin user to default username and password.")
 			user.Permissions.Admin = true
 			user.Password = settings.Config.Auth.AdminPassword
@@ -63,7 +65,11 @@ func validateUserInfo(newDB bool) {
 					logger.Fatalf("Unable to create automatic backup of database due to error: %v", err)
 				}
 			}
-			err := store.Users.Save(user, changePass, true)
+			fields := []string{"Scopes", "SidebarLinks", "Tokens", "Permissions", "Preview", "ShowFirstLogin", "LoginMethod", "Version", "ShowToolsInSidebar"}
+			if changePass {
+				fields = append(fields, "Password")
+			}
+			err := store.Users.Update(user, true, fields...)
 			if err != nil {
 				logger.Errorf("could not update user: %v", err)
 			}
@@ -75,10 +81,12 @@ func updateUserScopes(user *users.User) bool {
 	newScopes := []users.SourceScope{}
 	seen := make(map[string]struct{})
 
-	// Build map for existing scopes by Name
+	// Build map of existing scopes keyed by canonical source path (DB may use path or display name).
 	existing := make(map[string]users.SourceScope)
 	for _, s := range user.Scopes {
-		existing[s.Name] = s
+		if info, ok := users.ResolveSourceKey(s.Name); ok {
+			existing[info.Path] = s
+		}
 	}
 
 	// Preserve order by using Config.Server.Sources
@@ -94,7 +102,6 @@ func updateUserScopes(user *users.User) bool {
 		} else {
 			continue
 		}
-
 		newScopes = append(newScopes, users.SourceScope{
 			Name:  src.Path,
 			Scope: existingScope.Scope,
@@ -102,17 +109,30 @@ func updateUserScopes(user *users.User) bool {
 		seen[src.Path] = struct{}{}
 	}
 
-	// Preserve user-defined scopes not matching current sources, append to end
+	// Preserve explicit or legacy scopes not already merged (e.g. non-defaultEnabled sources, removed sources).
 	for _, s := range user.Scopes {
-		if _, ok := seen[s.Name]; !ok {
-			newScopes = append(newScopes, s)
+		if info, ok := users.ResolveSourceKey(s.Name); ok {
+			if _, already := seen[info.Path]; already {
+				continue
+			}
 		}
+		newScopes = append(newScopes, s)
 	}
 	changed := !reflect.DeepEqual(user.Scopes, newScopes)
 	user.Scopes = newScopes
 	return changed
 }
 
+// updateShowToolsInSidebar one-time defaults for legacy users (Version < CurrentUserMigrationVersion) from configured userDefaults.
+func updateShowToolsInSidebar(user *users.User) bool {
+	if user.Version >= 3 {
+		return false
+	}
+	user.ShowToolsInSidebar = true
+	user.Version = users.CurrentUserMigrationVersion
+	return true
+}
+
 func updateShowFirstLogin(user *users.User) bool {
 	if user.ShowFirstLogin && !settings.Env.IsFirstLoad {
 		user.ShowFirstLogin = false
@@ -127,7 +147,6 @@ func updatePermissions(user *users.User) bool {
 		return false
 	}
 	updateUser := true
-	user.Permissions.Download = true
 	// if any keys are true, set the permissions to true
 	if user.Perm.Api {
 		user.Permissions.Api = true
@@ -169,7 +188,7 @@ func updatePermissions(user *users.User) bool {
 		user.Permissions.Delete = true
 		updateUser = true
 	}
-	user.Version = 2
+	user.Version = users.CurrentUserMigrationVersion
 	if updateUser {
 		createBackup = true
 	}
@@ -203,11 +222,11 @@ func updateSidebarLinks(user *users.User) bool {
 	for _, link := range user.SidebarLinks {
 		if strings.HasPrefix(link.Category, "source") {
 			sourceLinksCount++
-			// Check if this source still exists
-			if link.SourceName != "" {
-				if _, ok := settings.Config.Server.SourceMap[link.SourceName]; ok {
-					validSourceLinksCount++
-				}
+			if link.SourceName == "" {
+				continue
+			}
+			if _, ok := users.ResolveSourceKey(link.SourceName); ok {
+				validSourceLinksCount++
 			}
 		}
 	}
@@ -219,8 +238,6 @@ func updateSidebarLinks(user *users.User) bool {
 
 	// If user has source links but NONE are valid, rebuild from their scopes
 	if validSourceLinksCount == 0 {
-		logger.Infof("User %s has %d stale source links, rebuilding from scopes", user.Username, sourceLinksCount)
-
 		// Remove all existing source links
 		newLinks := []users.SidebarLink{}
 		for _, link := range user.SidebarLinks {
@@ -229,25 +246,24 @@ func updateSidebarLinks(user *users.User) bool {
 			}
 		}
 
-		// Add new source links based on user's scopes
 		for _, scope := range user.Scopes {
-			if source, ok := settings.Config.Server.SourceMap[scope.Name]; ok {
-				// User has access to this source, add it to sidebar
-				newLinks = append(newLinks, users.SidebarLink{
-					Name:       source.Name,
-					Category:   "source",
-					Target:     "/",
-					Icon:       "",
-					SourceName: source.Path,
-				})
+			info, ok := users.ResolveSourceKey(scope.Name)
+			if !ok {
+				continue
 			}
+			newLinks = append(newLinks, users.SidebarLink{
+				Name:       info.Name,
+				Category:   "source",
+				Target:     "/",
+				Icon:       "",
+				SourceName: info.Path,
+			})
 		}
 
 		user.SidebarLinks = newLinks
 		return true
 	}
 
-	// User has at least one valid source link, no update needed
 	return false
 }
 
@@ -262,6 +278,6 @@ func updateTokens(user *users.User) bool {
 			user.Tokens[name] = token
 		}
 	}
-	user.Version = 2
+	user.Version = users.CurrentUserMigrationVersion
 	return true
 }

backend/cmd/user_test.go

@@ -25,6 +25,7 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 		"sourceA": &sourceA,
 		"sourceB": &sourceB,
 	}
+	settings.InitializeUserResolvers()
 
 	// ---------------------
 	// Test Cases Definition

backend/common/errors/errors.go

@@ -26,4 +26,10 @@ var (
 	ErrWrongLoginMethod     = errors.New("user attempted to login with wrong login method")
 	ErrDownloadNotAllowed   = errors.New("downloads are not allowed for this share")
 	ErrUploadNotAllowed     = errors.New("upload permission not allowed for this share")
+	ErrPasskeyMFARequired   = errors.New("passkey MFA is required")
+	ErrPasskeyVerification  = errors.New("passkey verification failed")
+	ErrPasskeyNoCredential  = errors.New("no passkey credentials found for user")
+	ErrPasskeyExists        = errors.New("passkey credential already exists")
+	ErrPasskeyNotEnabled    = errors.New("passkey authentication is not enabled")
+	ErrPasskeyInvalidSession = errors.New("invalid or expired passkey session")
 )

backend/common/settings/apply_user_defaults_test.go

@@ -19,63 +19,78 @@ func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
 	Config = Settings{
 		Server: Server{},
 		UserDefaults: UserDefaults{
-			EditorQuickSave:            true,
-			HideSidebarFileActions:     true,
-			DisableQuickToggles:        true,
-			DisableSearchOptions:       true,
-			StickySidebar:              false,
-			HideFilesInTree:            true,
-			DarkMode:                   &dark,
-			Locale:                     "de",
-			ViewMode:                   "list",
-			SingleClick:                true,
-			ShowHidden:                 true,
-			DateFormat:                 true,
-			GallerySize:                7,
-			ThemeColor:                 "var(--red)",
-			QuickDownload:              true,
-			DisablePreviewExt:          ".exe",
-			DisableViewingExt:          ".bat",
-			DisableSettings:            true,
-			LockPassword:               true,
-			DisableUpdateNotifications: true,
-			DeleteWithoutConfirming:    true,
-			DeleteAfterArchive:         false,
-			DisableOfficePreviewExt:    "legacy",
-			DisableOnlyOfficeExt:       ".x",
-			CustomTheme:                "Night",
-			ShowSelectMultiple:         true,
-			DebugOffice:                true,
-			PreferEditorForMarkdown:    true,
-			LoginMethod:                "password",
-			FileLoading: users.FileLoading{
-				MaxConcurrent:     3,
-				UploadChunkSize:   5,
-				DownloadChunkSize: 2,
+			Sidebar: UserDefaultsSidebar{
+				DisableQuickToggles:  true,
+				HideFileActions:      true,
+				DisableHideOnPreview: true,
+				Sticky:               false,
+				HideFiles:            true,
+				ShowTools:            boolPtr(true),
 			},
-			Permissions: UserDefaultsPermissions{
-				Api:      true,
-				Admin:    true,
-				Modify:   true,
-				Share:    true,
-				Realtime: true,
-				Delete:   true,
-				Create:   true,
-				Download: &dlFalse,
+			Listing: UserDefaultsListing{
+				DeleteWithoutConfirming: true,
+				DateFormat:              true,
+				ShowHidden:              true,
+				QuickDownload:           true,
+				ShowSelectMultiple:      true,
+				SingleClick:             true,
+				HideFileExt:             "",
+				ShowCopyPath:            false,
+				DeleteAfterArchive:      false,
+				ViewMode:                "list",
+				GallerySize:             7,
 			},
 			Preview: UserDefaultsPreview{
-				DisableHideSidebar: true,
 				Image:              boolPtr(false),
 				Video:              boolPtr(false),
 				Audio:              boolPtr(false),
 				MotionVideoPreview: boolPtr(false),
 				Office:             boolPtr(false),
 				PopUp:              boolPtr(false),
-				AutoplayMedia:      boolPtr(false),
-				DefaultMediaPlayer: true,
+				DisablePreviewExt:  ".exe",
+				HighQuality:        boolPtr(true),
 				Folder:             boolPtr(false),
 				Models:             boolPtr(false),
 			},
+			FileViewer: UserDefaultsFileViewer{
+				EditorQuickSave:         true,
+				AutoplayMedia:           boolPtr(false),
+				DisableViewingExt:       ".bat",
+				DisableOnlyOfficeExt:    ".x",
+				PreferEditorForMarkdown: true,
+				DebugOffice:             true,
+				DefaultMediaPlayer:      true,
+			},
+			Search: UserDefaultsSearch{
+				DisableOptions: true,
+			},
+			UI: UserDefaultsUI{
+				DarkMode:    &dark,
+				ThemeColor:  "var(--red)",
+				CustomTheme: "Night",
+				Locale:      "de",
+			},
+			FileLoading: users.FileLoading{
+				MaxConcurrent:     3,
+				UploadChunkSize:   5,
+				DownloadChunkSize: 2,
+			},
+			Account: UserDefaultsAccount{
+				Permissions: UserDefaultsAccountPermissions{
+					Api:      true,
+					Admin:    true,
+					Modify:   true,
+					Share:    true,
+					Realtime: true,
+					Delete:   true,
+					Create:   true,
+					Download: &dlFalse,
+				},
+				LockPassword:               true,
+				DisableSettings:            true,
+				LoginMethod:                "password",
+				DisableUpdateNotifications: true,
+			},
 		},
 	}
 
@@ -115,7 +130,7 @@ func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
 			DisablePreviewExt:          ".exe",
 			DisableViewingExt:          ".bat",
 			DisableUpdateNotifications: true,
-			DisableOfficePreviewExt:    "legacy",
+			DisableOfficePreviewExt:    ".x", // deprecated: mapped to DisableOnlyOfficeExt
 			DisableOnlyOfficeExt:       ".x",
 			CustomTheme:                "Night",
 			ShowSelectMultiple:         true,
@@ -123,6 +138,7 @@ func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
 			DeleteWithoutConfirming:    true,
 			DeleteAfterArchive:         false,
 			PreferEditorForMarkdown:    true,
+			ShowToolsInSidebar:         true,
 			FileLoading: users.FileLoading{
 				MaxConcurrent:     3,
 				UploadChunkSize:   5,
@@ -166,8 +182,12 @@ func TestApplyUserDefaults_setsLoginMethodWhenEmpty(t *testing.T) {
 	defer func() { Config = saved }()
 
 	Config = Settings{
-		Server:       Server{},
-		UserDefaults: UserDefaults{LoginMethod: "jwt"},
+		Server: Server{},
+		UserDefaults: UserDefaults{
+			Account: UserDefaultsAccount{
+				LoginMethod: "jwt",
+			},
+		},
 	}
 	u := &users.User{Username: "x"}
 	ApplyUserDefaults(u)
@@ -181,8 +201,12 @@ func TestApplyUserDefaults_preservesLoginMethodWhenAlreadySet(t *testing.T) {
 	defer func() { Config = saved }()
 
 	Config = Settings{
-		Server:       Server{},
-		UserDefaults: UserDefaults{LoginMethod: "password"},
+		Server: Server{},
+		UserDefaults: UserDefaults{
+			Account: UserDefaultsAccount{
+				LoginMethod: "password",
+			},
+		},
 	}
 	u := &users.User{Username: "x", LoginMethod: users.LoginMethodProxy}
 	ApplyUserDefaults(u)

backend/common/settings/auth.go

@@ -61,6 +61,7 @@ type LoginMethods struct {
 	OidcAuth     OidcConfig         `json:"oidc" validate:"omitempty"`
 	LdapAuth     LdapConfig         `json:"ldap" validate:"omitempty"`
 	JwtAuth      JwtAuthConfig      `json:"jwt" validate:"omitempty"`
+	PasskeyAuth  PasskeyAuthConfig  `json:"passkey" validate:"omitempty"`
 }
 
 type PasswordAuthConfig struct {
@@ -111,10 +112,19 @@ type LdapConfig struct {
 type JwtAuthConfig struct {
 	AuthCommon `json:",inline"`
 	Header     string `json:"header"`    // HTTP header to look for JWT token (e.g. X-JWT-Assertion). Default is "X-JWT-Assertion"
-	Secret     string `json:"secret"`    // Shared secret key/bytes for verifying JWT token signatures (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
+	Secret     string `json:"secret"`    // secret: Shared secret key/bytes for verifying JWT token signatures (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
 	Algorithm  string `json:"algorithm"` // JWT signing algorithm (HS256, HS384, HS512, RS256, ES256). Default is "HS256"
 }
 
+// PasskeyAuthConfig configures WebAuthn / Passkey authentication as a second factor.
+type PasskeyAuthConfig struct {
+	Enabled         bool     `json:"enabled"`         // whether to enable passkey MFA
+	RPDisplayName   string   `json:"rpDisplayName"`   // the Relying Party display name (defaults to frontend name)
+	RPID            string   `json:"rpId"`            // the Relying Party ID; if empty, auto-derived from base URL host
+	RPOrigins       []string `json:"rpOrigins"`       // allowed origins; if empty, auto-derived from base URL
+	LoginButtonText string   `json:"loginButtonText"` // custom text for the passkey login button
+}
+
 // ValidateLdapAuth checks LDAP config and sets defaults. Call when LDAP is enabled.
 func ValidateLdapAuth() error {
 	ldapCfg := &Config.Auth.Methods.LdapAuth

backend/common/settings/config.go

@@ -39,6 +39,8 @@ func Initialize(configFile string) {
 	setupLogging()
 	// setup logging first to ensure we log any errors
 	setupEnv()
+	// Migrate deprecated UserDefaults fields to new organized structure
+	migrateUserDefaults()
 	err = ValidateConfig(Config)
 	if err != nil {
 		errmsg := "The provided config file failed validation. "
@@ -51,6 +53,7 @@ func Initialize(configFile string) {
 	}
 	setupFs()
 	setupServer()
+	setupHttp()
 	setupAuth(false)
 	setupSources(false)
 	InitializeUserResolvers() // Initialize user package resolvers after sources are set up
@@ -81,6 +84,15 @@ func setupEnv() {
 	}
 }
 
+func setupHttp() {
+	if len(Config.Http.TrustedHeadersArray) > 0 {
+		Config.Http.TrustedHeaders = make(map[string]bool)
+		for _, header := range Config.Http.TrustedHeadersArray {
+			Config.Http.TrustedHeaders[strings.ToLower(header)] = true
+		}
+	}
+}
+
 func setupFs() {
 	// Convert permission values (like 644, 755) to octal interpretation
 	filePermOctal, err := strconv.ParseUint(Config.Server.Filesystem.CreateFilePermission, 8, 32)
@@ -98,6 +110,10 @@ func setupFs() {
 	// Perform mandatory cache directory speed test
 	testCacheDirSpeed()
 
+	if err := PrepareDownloadSpoolDir(); err != nil {
+		logger.Fatalf("cacheDir failed to prepare download spool: %v", err)
+	}
+
 	logger.Infof("cache directory setup successfully: %v", Config.Server.CacheDir)
 
 }
@@ -462,13 +478,17 @@ func setupAuth(generate bool) {
 		}
 		logger.Info("JWT Auth configured successfully")
 	}
+	if Config.Auth.Methods.PasskeyAuth.Enabled || generate {
+		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "passkey")
+		logger.Info("Passkey Auth configured successfully")
+	}
 
 	// use password auth as default if no auth methods are set
 	if len(Config.Auth.AuthMethods) == 0 {
 		Config.Auth.Methods.PasswordAuth.Enabled = true
 		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "password")
 	}
-	Config.UserDefaults.LoginMethod = Config.Auth.AuthMethods[0]
+	Config.UserDefaults.Account.LoginMethod = Config.Auth.AuthMethods[0]
 
 }
 
@@ -480,31 +500,324 @@ func setupLogging() {
 			},
 		}
 	}
-	for _, logConfig := range Config.Server.Logging {
+	for i := range Config.Server.Logging {
+		cfg := &Config.Server.Logging[i]
 		// Enable debug logging automatically in dev mode
-		levels := logConfig.Levels
+		levels := cfg.Levels
 		if os.Getenv("FILEBROWSER_DEVMODE") == "true" {
 			levels = "info|warning|error|debug"
 		}
-
-		logConfig := logger.JsonConfig{
-			Levels:     levels,
-			ApiLevels:  logConfig.ApiLevels,
-			Output:     logConfig.Output,
-			Utc:        logConfig.Utc,
-			NoColors:   logConfig.NoColors,
-			Json:       logConfig.Json,
-			Structured: false,
+		pattern := cfg.ApiFilter
+		if pattern == "" {
+			pattern = "^/health|^/favicon.ico|^/static|^/public/static"
 		}
-		err := logger.EnableCompatibilityMode(logConfig)
+		jsonCfg := logger.JsonConfig{
+			Levels:         levels,
+			ApiLevels:      cfg.ApiLevels,
+			Output:         cfg.Output,
+			Utc:            cfg.Utc,
+			NoColors:       cfg.NoColors,
+			Json:           cfg.Json,
+			Structured:     false,
+			ApiPathExclude: pattern,
+		}
+		err := logger.EnableCompatibilityMode(jsonCfg)
 		if err != nil {
 			log.Println("[ERROR] Failed to set up logger:", err)
 		}
 	}
 }
 
+// migrateUserDefaults migrates deprecated UserDefaults fields to the new organized structure.
+// This function maintains backwards compatibility by checking if new fields are unset and copying
+// values from old deprecated fields if found. Logs warnings when old fields are migrated.
+func migrateUserDefaults() {
+	ud := &Config.UserDefaults
+	hasOldFields := false
+
+	// Helper function to check if a bool pointer is unset (nil)
+	isUnsetBoolPtr := func(v *bool) bool {
+		return v == nil
+	}
+
+	// Helper function to check if a string is unset (empty)
+	isUnsetString := func(v string) bool {
+		return v == ""
+	}
+
+	// Helper function to check if an int is unset (zero)
+	isUnsetInt := func(v int) bool {
+		return v == 0
+	}
+
+	// Migrate Preview-related deprecated fields
+	if !ud.Sidebar.DisableHideOnPreview && ud.Preview.DisableHideSidebar {
+		ud.Sidebar.DisableHideOnPreview = ud.Preview.DisableHideSidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.disableHideSidebar' to 'sidebar.disableHideOnPreview'")
+	}
+
+	if !ud.FileViewer.DefaultMediaPlayer && ud.Preview.DefaultMediaPlayer {
+		ud.FileViewer.DefaultMediaPlayer = ud.Preview.DefaultMediaPlayer
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.defaultMediaPlayer' to 'fileViewer.defaultMediaPlayer'")
+	}
+
+	if isUnsetBoolPtr(ud.FileViewer.AutoplayMedia) && ud.Preview.AutoplayMedia {
+		autoplay := ud.Preview.AutoplayMedia
+		ud.FileViewer.AutoplayMedia = &autoplay
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.autoplayMedia' to 'fileViewer.autoplayMedia'")
+	}
+
+	if isUnsetString(ud.Preview.DisablePreviewExt) && !isUnsetString(ud.DisablePreviewExt) {
+		ud.Preview.DisablePreviewExt = ud.DisablePreviewExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disablePreviewExt' to 'preview.disablePreviewExt'")
+	}
+
+	// Migrate Sidebar fields
+	if !ud.Sidebar.DisableQuickToggles && ud.DisableQuickToggles {
+		ud.Sidebar.DisableQuickToggles = ud.DisableQuickToggles
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableQuickToggles' to 'sidebar.disableQuickToggles'")
+	}
+
+	if !ud.Sidebar.HideFileActions && ud.HideSidebarFileActions {
+		ud.Sidebar.HideFileActions = ud.HideSidebarFileActions
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideSidebarFileActions' to 'sidebar.hideFileActions'")
+	}
+
+	if !ud.Sidebar.Sticky && ud.StickySidebar {
+		ud.Sidebar.Sticky = ud.StickySidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'stickySidebar' to 'sidebar.sticky'")
+	}
+
+	if isUnsetString(ud.Listing.ViewMode) && !isUnsetString(ud.ViewMode) {
+		ud.Listing.ViewMode = ud.ViewMode
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'viewMode' to 'sidebar.viewMode'")
+	}
+
+	if isUnsetInt(ud.Listing.GallerySize) && !isUnsetInt(ud.GallerySize) {
+		ud.Listing.GallerySize = ud.GallerySize
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'gallerySize' to 'sidebar.gallerySize'")
+	}
+
+	if !ud.Sidebar.HideFiles && ud.HideFilesInTree {
+		ud.Sidebar.HideFiles = ud.HideFilesInTree
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideFilesInTree' to 'sidebar.hideFiles'")
+	}
+
+	if isUnsetBoolPtr(ud.Sidebar.ShowTools) && ud.ShowToolsInSidebar != nil {
+		ud.Sidebar.ShowTools = ud.ShowToolsInSidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showToolsInSidebar' to 'sidebar.showTools'")
+	}
+
+	// Migrate Listing fields
+	if !ud.Listing.DeleteWithoutConfirming && ud.DeleteWithoutConfirming {
+		ud.Listing.DeleteWithoutConfirming = ud.DeleteWithoutConfirming
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'deleteWithoutConfirming' to 'listing.deleteWithoutConfirming'")
+	}
+
+	if !ud.Listing.DateFormat && ud.DateFormat {
+		ud.Listing.DateFormat = ud.DateFormat
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'dateFormat' to 'listing.dateFormat'")
+	}
+
+	if !ud.Listing.ShowHidden && ud.ShowHidden {
+		ud.Listing.ShowHidden = ud.ShowHidden
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showHidden' to 'listing.showHidden'")
+	}
+
+	if !ud.Listing.QuickDownload && ud.QuickDownload {
+		ud.Listing.QuickDownload = ud.QuickDownload
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'quickDownload' to 'listing.quickDownload'")
+	}
+
+	if !ud.Listing.ShowSelectMultiple && ud.ShowSelectMultiple {
+		ud.Listing.ShowSelectMultiple = ud.ShowSelectMultiple
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showSelectMultiple' to 'listing.showSelectMultiple'")
+	}
+
+	if !ud.Listing.SingleClick && ud.SingleClick {
+		ud.Listing.SingleClick = ud.SingleClick
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'singleClick' to 'listing.singleClick'")
+	}
+
+	if isUnsetString(ud.Listing.HideFileExt) && !isUnsetString(ud.HideFileExt) {
+		ud.Listing.HideFileExt = ud.HideFileExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideFileExt' to 'listing.hideFileExt'")
+	}
+
+	if !ud.Listing.ShowCopyPath && ud.ShowCopyPath {
+		ud.Listing.ShowCopyPath = ud.ShowCopyPath
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showCopyPath' to 'listing.showCopyPath'")
+	}
+
+	if !ud.Listing.DeleteAfterArchive && ud.DeleteAfterArchive {
+		ud.Listing.DeleteAfterArchive = ud.DeleteAfterArchive
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'deleteAfterArchive' to 'listing.deleteAfterArchive'")
+	}
+
+	// Migrate FileViewer fields
+	if !ud.FileViewer.EditorQuickSave && ud.EditorQuickSave {
+		ud.FileViewer.EditorQuickSave = ud.EditorQuickSave
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'editorQuickSave' to 'fileViewer.editorQuickSave'")
+	}
+
+	if isUnsetString(ud.FileViewer.DisableViewingExt) && !isUnsetString(ud.DisableViewingExt) {
+		ud.FileViewer.DisableViewingExt = ud.DisableViewingExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableViewingExt' to 'fileViewer.disableViewingExt'")
+	}
+
+	if isUnsetString(ud.FileViewer.DisableOnlyOfficeExt) && !isUnsetString(ud.DisableOnlyOfficeExt) {
+		ud.FileViewer.DisableOnlyOfficeExt = ud.DisableOnlyOfficeExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableOnlyOfficeExt' to 'fileViewer.disableOnlyOfficeExt'")
+	}
+
+	if !ud.FileViewer.PreferEditorForMarkdown && ud.PreferEditorForMarkdown {
+		ud.FileViewer.PreferEditorForMarkdown = ud.PreferEditorForMarkdown
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preferEditorForMarkdown' to 'fileViewer.preferEditorForMarkdown'")
+	}
+
+	if !ud.FileViewer.DebugOffice && ud.DebugOffice {
+		ud.FileViewer.DebugOffice = ud.DebugOffice
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'debugOffice' to 'fileViewer.debugOffice'")
+	}
+
+	// Migrate Search fields
+	if !ud.Search.DisableOptions && ud.DisableSearchOptions {
+		ud.Search.DisableOptions = ud.DisableSearchOptions
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableSearchOptions' to 'search.disableOptions'")
+	}
+
+	// Migrate UI fields
+	if isUnsetBoolPtr(ud.UI.DarkMode) && ud.DarkMode != nil {
+		ud.UI.DarkMode = ud.DarkMode
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'darkMode' to 'ui.darkMode'")
+	}
+
+	if isUnsetString(ud.UI.ThemeColor) && !isUnsetString(ud.ThemeColor) {
+		ud.UI.ThemeColor = ud.ThemeColor
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'themeColor' to 'ui.themeColor'")
+	}
+
+	if isUnsetString(ud.UI.CustomTheme) && !isUnsetString(ud.CustomTheme) {
+		ud.UI.CustomTheme = ud.CustomTheme
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'customTheme' to 'ui.customTheme'")
+	}
+
+	if isUnsetString(ud.UI.Locale) && !isUnsetString(ud.Locale) {
+		ud.UI.Locale = ud.Locale
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'locale' to 'ui.locale'")
+	}
+
+	// Migrate Account fields
+	if !ud.Account.LockPassword && ud.LockPassword {
+		ud.Account.LockPassword = ud.LockPassword
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'lockPassword' to 'account.lockPassword'")
+	}
+
+	if !ud.Account.DisableSettings && ud.DisableSettings {
+		ud.Account.DisableSettings = ud.DisableSettings
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableSettings' to 'account.disableSettings'")
+	}
+
+	if isUnsetString(ud.Account.LoginMethod) && !isUnsetString(ud.LoginMethod) {
+		ud.Account.LoginMethod = ud.LoginMethod
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'loginMethod' to 'account.loginMethod'")
+	}
+
+	if !ud.Account.DisableUpdateNotifications && ud.DisableUpdateNotifications {
+		ud.Account.DisableUpdateNotifications = ud.DisableUpdateNotifications
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableUpdateNotifications' to 'account.disableUpdateNotifications'")
+	}
+
+	// Migrate Account Permissions fields
+	if !ud.Account.Permissions.Api && ud.Permissions.Api {
+		ud.Account.Permissions.Api = ud.Permissions.Api
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.api' to 'account.permissions.api'")
+	}
+
+	if !ud.Account.Permissions.Admin && ud.Permissions.Admin {
+		ud.Account.Permissions.Admin = ud.Permissions.Admin
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.admin' to 'account.permissions.admin'")
+	}
+
+	if !ud.Account.Permissions.Modify && ud.Permissions.Modify {
+		ud.Account.Permissions.Modify = ud.Permissions.Modify
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.modify' to 'account.permissions.modify'")
+	}
+
+	if !ud.Account.Permissions.Share && ud.Permissions.Share {
+		ud.Account.Permissions.Share = ud.Permissions.Share
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.share' to 'account.permissions.share'")
+	}
+
+	if !ud.Account.Permissions.Realtime && ud.Permissions.Realtime {
+		ud.Account.Permissions.Realtime = ud.Permissions.Realtime
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.realtime' to 'account.permissions.realtime'")
+	}
+
+	if !ud.Account.Permissions.Delete && ud.Permissions.Delete {
+		ud.Account.Permissions.Delete = ud.Permissions.Delete
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.delete' to 'account.permissions.delete'")
+	}
+
+	if !ud.Account.Permissions.Create && ud.Permissions.Create {
+		ud.Account.Permissions.Create = ud.Permissions.Create
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.create' to 'account.permissions.create'")
+	}
+
+	if isUnsetBoolPtr(ud.Account.Permissions.Download) && ud.Permissions.Download != nil {
+		ud.Account.Permissions.Download = ud.Permissions.Download
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.download' to 'account.permissions.download'")
+	}
+
+	if hasOldFields {
+		logger.Warning("userDefaults: Please update your configuration to use the new organized structure. See documentation for details.")
+	}
+}
+
 func loadConfigWithDefaults(configFile string, generate bool) error {
-	Config = setDefaults(generate)
+	Config = SetDefaults(generate)
 
 	// Check if config file exists
 	if _, err := os.Stat(configFile); err != nil {
@@ -657,7 +970,7 @@ func loadEnvConfig() {
 	}
 }
 
-func setDefaults(generate bool) Settings {
+func SetDefaults(generate bool) Settings {
 	// get number of CPUs available
 	numCpus := 4 // default to 4 CPUs if runtime.NumCPU() fails or is not available
 	cpus := runtime.NumCPU()
@@ -708,25 +1021,27 @@ func setDefaults(generate bool) Settings {
 			Name: "FileBrowser Quantum",
 		},
 		UserDefaults: UserDefaults{
-			DeleteAfterArchive:      true,
-			DisableOnlyOfficeExt:    ".md .txt .pdf .html .xml",
-			StickySidebar:           true,
-			HideFilesInTree:         false,
-			PreferEditorForMarkdown: false,
-			LockPassword:            false,
-			ShowHidden:              false,
-			DarkMode:                boolPtr(true),
-			DisableSettings:         false,
-			ViewMode:                "normal",
-			Locale:                  "en",
-			GallerySize:             3,
-			ThemeColor:              "var(--blue)",
-			Permissions: UserDefaultsPermissions{
-				Modify:   false,
-				Share:    false,
-				Admin:    false,
-				Api:      false,
-				Download: boolPtr(true), // defaults to true
+			// New organized structure
+			Sidebar: UserDefaultsSidebar{
+				DisableQuickToggles:  false,
+				HideFileActions:      false,
+				DisableHideOnPreview: false,
+				Sticky:               true,
+				HideFiles:            false,
+				ShowTools:            boolPtr(true),
+			},
+			Listing: UserDefaultsListing{
+				DeleteWithoutConfirming: false,
+				DateFormat:              false,
+				ShowHidden:              false,
+				QuickDownload:           false,
+				ShowSelectMultiple:      false,
+				SingleClick:             false,
+				HideFileExt:             "",
+				ShowCopyPath:            false,
+				DeleteAfterArchive:      true,
+				ViewMode:                "normal",
+				GallerySize:             3,
 			},
 			Preview: UserDefaultsPreview{
 				Image:              boolPtr(true),
@@ -735,15 +1050,50 @@ func setDefaults(generate bool) Settings {
 				MotionVideoPreview: boolPtr(true),
 				Office:             boolPtr(true),
 				PopUp:              boolPtr(true),
-				AutoplayMedia:      boolPtr(true),
+				DisablePreviewExt:  "",
+				HighQuality:        boolPtr(true),
 				Folder:             boolPtr(true),
 				Models:             boolPtr(true),
 			},
+			FileViewer: UserDefaultsFileViewer{
+				EditorQuickSave:         false,
+				AutoplayMedia:           boolPtr(true),
+				DisableViewingExt:       "",
+				DisableOnlyOfficeExt:    ".md .txt .pdf .html .xml",
+				PreferEditorForMarkdown: false,
+				DebugOffice:             false,
+				DefaultMediaPlayer:      false,
+			},
+			Search: UserDefaultsSearch{
+				DisableOptions: false,
+			},
+			UI: UserDefaultsUI{
+				DarkMode:    boolPtr(true),
+				ThemeColor:  "var(--blue)",
+				CustomTheme: "",
+				Locale:      "en",
+			},
 			FileLoading: users.FileLoading{
 				MaxConcurrent:     10,
 				UploadChunkSize:   10, // 10MB
 				DownloadChunkSize: 0,  // 0MB, default to no chunking
 			},
+			Account: UserDefaultsAccount{
+				Permissions: UserDefaultsAccountPermissions{
+					Api:      false,
+					Admin:    false,
+					Modify:   false,
+					Share:    false,
+					Realtime: false,
+					Delete:   false,
+					Create:   false,
+					Download: boolPtr(true), // defaults to true
+				},
+				LockPassword:               false,
+				DisableSettings:            false,
+				LoginMethod:                "",
+				DisableUpdateNotifications: false,
+			},
 		},
 	}
 	// Initialize ImagePreview map with defaults
@@ -826,6 +1176,19 @@ func PWAIconsCacheDir() string {
 	return filepath.Join(Config.Server.CacheDir, "icons")
 }
 
+// Where transient archives for multi-request (Range) downloads are stored to support chunked downloads.
+func DownloadCacheDir() string {
+	return filepath.Join(Config.Server.CacheDir, "downloads")
+}
+
+// PrepareDownloadSpoolDir creates the download spool directory and removes any leftover dl-archive-*
+func PrepareDownloadSpoolDir() error {
+	if err := os.MkdirAll(DownloadCacheDir(), fileutils.PermDir); err != nil {
+		return err
+	}
+	return fileutils.ClearDirectoryContents(DownloadCacheDir())
+}
+
 func loadLoginIcon() {
 	const imageName = "login icon"
 	allowedFormats := []string{".svg", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".ico"}

backend/common/settings/config_test.go

@@ -35,7 +35,7 @@ func Test_setDefaults(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := setDefaults(true); !reflect.DeepEqual(got, tt.want) {
+			if got := SetDefaults(true); !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("setDefaults() = %v, want %v", got, tt.want)
 			}
 		})
@@ -54,7 +54,7 @@ func TestConfigLoadChanged(t *testing.T) {
 		t.Fatalf("failed to write test config: %v", err)
 	}
 
-	defaultConfig := setDefaults(true)
+	defaultConfig := SetDefaults(true)
 	err = loadConfigWithDefaults(configFile, true)
 	if err != nil {
 		t.Fatalf("error loading config file: %v", err)
@@ -77,7 +77,7 @@ func TestConfigLoadEnvVars(t *testing.T) {
 		t.Fatalf("failed to write test config: %v", err)
 	}
 
-	defaultConfig := setDefaults(true)
+	defaultConfig := SetDefaults(true)
 	expectedKey := "MYKEY"
 	// mock environment variables
 	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
@@ -106,7 +106,7 @@ func TestConfigLoadSpecificValues(t *testing.T) {
 		t.Fatalf("failed to write test config: %v", err)
 	}
 
-	defaultConfig := setDefaults(true)
+	defaultConfig := SetDefaults(true)
 	err = loadConfigWithDefaults(configFile, true)
 	if err != nil {
 		t.Fatalf("error loading config file: %v", err)

backend/common/settings/generator.go

@@ -286,7 +286,7 @@ func buildPathMapRecursive(structType reflect.Type, structValue reflect.Value, c
 		fieldType := field.Type
 
 		// Handle pointers
-		if fieldType.Kind() == reflect.Ptr {
+		if fieldType.Kind() == reflect.Pointer {
 			if fieldValue.IsNil() {
 				// Skip nil pointers
 				continue
@@ -479,7 +479,7 @@ func CollectCommentsFromEmbeddedYaml(yamlContent string) (CommentsMap, SecretFie
 // parseDefaultsFromEmbeddedYaml creates a default config by parsing the embedded YAML template
 func parseDefaultsFromEmbeddedYaml(embeddedYaml string) (*Settings, error) {
 	// Start with baseline defaults from setDefaults to ensure all fields are initialized
-	defaultConfig := setDefaults(true)
+	defaultConfig := SetDefaults(true)
 	defaultConfig.Server.Sources = []*Source{{Path: "."}}
 
 	// Parse the embedded YAML to overlay the documented defaults
@@ -516,7 +516,7 @@ func BuildNode(v reflect.Value, comm CommentsMap) (*yaml.Node, error) {
 // buildNodeWithDefaults constructs a yaml.Node for any Go value, skipping fields that match defaults, redacting secrets, and filtering deprecated fields
 func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.Value, secrets SecretFieldsMap, deprecated DeprecatedFieldsMap) (*yaml.Node, error) {
 	// Dereference pointers
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		if v.IsNil() {
 			return &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!null", Value: "null"}, nil
 		}
@@ -790,7 +790,7 @@ func buildNodeWithDefaults(v reflect.Value, comm CommentsMap, defaults reflect.V
 		elemType := v.Type().Elem()
 		// Check if element is a struct or pointer to struct
 		isStructSlice := elemType.Kind() == reflect.Struct ||
-			(elemType.Kind() == reflect.Ptr && elemType.Elem().Kind() == reflect.Struct)
+			(elemType.Kind() == reflect.Pointer && elemType.Elem().Kind() == reflect.Struct)
 		if !isStructSlice {
 			seq.Style = yaml.FlowStyle
 		}
@@ -995,7 +995,7 @@ func GenerateConfigYamlWithEmbedded(config *Settings, showComments bool, showFul
 
 // identifySecretFieldsByReflection identifies secret fields by known field names
 func identifySecretFieldsByReflection(v reflect.Value, typeName string, secrets SecretFieldsMap) {
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		if v.IsNil() {
 			return
 		}
@@ -1030,9 +1030,9 @@ func identifySecretFieldsByReflection(v reflect.Value, typeName string, secrets
 
 		// Recursively check nested structs
 		fieldValue := v.Field(i)
-		if fieldValue.Kind() == reflect.Struct || (fieldValue.Kind() == reflect.Ptr && !fieldValue.IsNil() && fieldValue.Elem().Kind() == reflect.Struct) {
+		if fieldValue.Kind() == reflect.Struct || (fieldValue.Kind() == reflect.Pointer && !fieldValue.IsNil() && fieldValue.Elem().Kind() == reflect.Struct) {
 			nestedTypeName := field.Type.Name()
-			if field.Type.Kind() == reflect.Ptr {
+			if field.Type.Kind() == reflect.Pointer {
 				nestedTypeName = field.Type.Elem().Name()
 			}
 			identifySecretFieldsByReflection(fieldValue, nestedTypeName, secrets)
@@ -1042,7 +1042,7 @@ func identifySecretFieldsByReflection(v reflect.Value, typeName string, secrets
 
 // identifyDeprecatedFieldsByReflection identifies deprecated fields by known field names
 func identifyDeprecatedFieldsByReflection(v reflect.Value, typeName string, deprecated DeprecatedFieldsMap) {
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		if v.IsNil() {
 			return
 		}
@@ -1072,9 +1072,9 @@ func identifyDeprecatedFieldsByReflection(v reflect.Value, typeName string, depr
 
 		// Recursively check nested structs
 		fieldValue := v.Field(i)
-		if fieldValue.Kind() == reflect.Struct || (fieldValue.Kind() == reflect.Ptr && !fieldValue.IsNil() && fieldValue.Elem().Kind() == reflect.Struct) {
+		if fieldValue.Kind() == reflect.Struct || (fieldValue.Kind() == reflect.Pointer && !fieldValue.IsNil() && fieldValue.Elem().Kind() == reflect.Struct) {
 			nestedTypeName := field.Type.Name()
-			if field.Type.Kind() == reflect.Ptr {
+			if field.Type.Kind() == reflect.Pointer {
 				nestedTypeName = field.Type.Elem().Name()
 			}
 			identifyDeprecatedFieldsByReflection(fieldValue, nestedTypeName, deprecated)
@@ -1108,7 +1108,7 @@ func GenerateConfigYamlWithEmptyMaps(config *Settings, showFull bool) (string, e
 		}
 		if err != nil || readErr != nil {
 			// Fallback to setDefaults
-			defaultConfigValue := setDefaults(true)
+			defaultConfigValue := SetDefaults(true)
 			defaultConfigValue.Server.Sources = []*Source{{Path: "."}}
 			defaultConfig = &defaultConfigValue
 		}
@@ -1201,7 +1201,7 @@ func GenerateConfigYamlWithSource(config *Settings, showComments bool, showFull
 		}
 		if err != nil || readErr != nil {
 			// Fallback to setDefaults
-			defaultConfigValue := setDefaults(true)
+			defaultConfigValue := SetDefaults(true)
 			defaultConfigValue.Server.Sources = []*Source{{Path: "."}}
 			defaultConfig = &defaultConfigValue
 		}

backend/common/settings/migration_test.go

@@ -0,0 +1,221 @@
+package settings
+
+import (
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// TestMigrateUserDefaults_OldToNew verifies that deprecated fields are correctly migrated to new fields
+func TestMigrateUserDefaults_OldToNew(t *testing.T) {
+	// Setup: Create UserDefaults with old fields set
+	Config.UserDefaults = UserDefaults{
+		// Old deprecated fields
+		DarkMode:                   boolPtr(true),
+		DisableQuickToggles:        true,
+		HideSidebarFileActions:     true,
+		StickySidebar:              true,
+		SingleClick:                true,
+		HideFilesInTree:            true,
+		ShowToolsInSidebar:         boolPtr(false),
+		DeleteWithoutConfirming:    true,
+		DateFormat:                 true,
+		ShowHidden:                 true,
+		QuickDownload:              true,
+		ShowSelectMultiple:         true,
+		HideFileExt:                ".tmp",
+		ShowCopyPath:               true,
+		DeleteAfterArchive:         true,
+		DisablePreviewExt:          ".exe",
+		EditorQuickSave:            true,
+		DisableViewingExt:          ".bin",
+		DisableOnlyOfficeExt:       ".md",
+		PreferEditorForMarkdown:    true,
+		DebugOffice:                true,
+		DisableSearchOptions:       true,
+		ThemeColor:                 "var(--red)",
+		CustomTheme:                "dark",
+		Locale:                     "de",
+		LockPassword:               true,
+		DisableSettings:            true,
+		LoginMethod:                "oidc",
+		DisableUpdateNotifications: true,
+		Permissions: UserDefaultsPermissions{
+			Api:      true,
+			Admin:    true,
+			Modify:   true,
+			Share:    true,
+			Realtime: true,
+			Delete:   true,
+			Create:   true,
+			Download: boolPtr(false),
+		},
+		Preview: UserDefaultsPreview{
+			Image:              boolPtr(true),
+			Video:              boolPtr(true),
+			Audio:              boolPtr(true),
+			MotionVideoPreview: boolPtr(true),
+			Office:             boolPtr(true),
+			PopUp:              boolPtr(true),
+			HighQuality:        boolPtr(true),
+			Folder:             boolPtr(true),
+			Models:             boolPtr(true),
+			// Deprecated fields that should be migrated
+			DisableHideSidebar: true,
+			AutoplayMedia:      true,
+			DefaultMediaPlayer: true,
+		},
+		FileLoading: users.FileLoading{
+			MaxConcurrent:   5,
+			UploadChunkSize: 20,
+		},
+	}
+
+	// Execute: Run migration
+	migrateUserDefaults()
+
+	// Verify: Check that new fields are populated from old fields
+	ud := &Config.UserDefaults
+
+	// Sidebar fields
+	if !ud.Sidebar.DisableQuickToggles {
+		t.Error("sidebar.disableQuickToggles should be true")
+	}
+	if !ud.Sidebar.HideFileActions {
+		t.Error("sidebar.hideFileActions should be true")
+	}
+	if !ud.Sidebar.Sticky {
+		t.Error("sidebar.sticky should be true")
+	}
+	if !ud.Sidebar.HideFiles {
+		t.Error("sidebar.hideFiles should be true")
+	}
+	if ud.Sidebar.ShowTools == nil || *ud.Sidebar.ShowTools != false {
+		t.Error("sidebar.showTools should be false")
+	}
+	if !ud.Sidebar.DisableHideOnPreview {
+		t.Error("sidebar.disableHideOnPreview should be true")
+	}
+
+	// Listing fields
+	if !ud.Listing.DeleteWithoutConfirming {
+		t.Error("listing.deleteWithoutConfirming should be true")
+	}
+	if !ud.Listing.DateFormat {
+		t.Error("listing.dateFormat should be true")
+	}
+	if !ud.Listing.ShowHidden {
+		t.Error("listing.showHidden should be true")
+	}
+	if !ud.Listing.QuickDownload {
+		t.Error("listing.quickDownload should be true")
+	}
+	if !ud.Listing.ShowSelectMultiple {
+		t.Error("listing.showSelectMultiple should be true")
+	}
+	if !ud.Listing.SingleClick {
+		t.Error("listing.singleClick should be true")
+	}
+	if ud.Listing.HideFileExt != ".tmp" {
+		t.Errorf("listing.hideFileExt should be '.tmp', got '%s'", ud.Listing.HideFileExt)
+	}
+	if !ud.Listing.ShowCopyPath {
+		t.Error("listing.showCopyPath should be true")
+	}
+	if !ud.Listing.DeleteAfterArchive {
+		t.Error("listing.deleteAfterArchive should be true")
+	}
+
+	// Preview fields
+	if ud.Preview.Image == nil || *ud.Preview.Image != true {
+		t.Error("preview.image should be true")
+	}
+	if ud.Preview.Video == nil || *ud.Preview.Video != true {
+		t.Error("preview.video should be true")
+	}
+	if ud.Preview.Audio == nil || *ud.Preview.Audio != true {
+		t.Error("preview.audio should be true")
+	}
+	if ud.Preview.DisablePreviewExt != ".exe" {
+		t.Errorf("preview.disablePreviewExt should be '.exe', got '%s'", ud.Preview.DisablePreviewExt)
+	}
+
+	// FileViewer fields
+	if !ud.FileViewer.EditorQuickSave {
+		t.Error("fileViewer.editorQuickSave should be true")
+	}
+	if ud.FileViewer.AutoplayMedia == nil || *ud.FileViewer.AutoplayMedia != true {
+		t.Error("fileViewer.autoplayMedia should be true")
+	}
+	if ud.FileViewer.DisableViewingExt != ".bin" {
+		t.Errorf("fileViewer.disableViewingExt should be '.bin', got '%s'", ud.FileViewer.DisableViewingExt)
+	}
+	if ud.FileViewer.DisableOnlyOfficeExt != ".md" {
+		t.Errorf("fileViewer.disableOnlyOfficeExt should be '.md', got '%s'", ud.FileViewer.DisableOnlyOfficeExt)
+	}
+	if !ud.FileViewer.PreferEditorForMarkdown {
+		t.Error("fileViewer.preferEditorForMarkdown should be true")
+	}
+	if !ud.FileViewer.DebugOffice {
+		t.Error("fileViewer.debugOffice should be true")
+	}
+
+	// Search fields
+	if !ud.Search.DisableOptions {
+		t.Error("search.disableOptions should be true")
+	}
+
+	// UI fields
+	if ud.UI.DarkMode == nil || *ud.UI.DarkMode != true {
+		t.Error("ui.darkMode should be true")
+	}
+	if ud.UI.ThemeColor != "var(--red)" {
+		t.Errorf("ui.themeColor should be 'var(--red)', got '%s'", ud.UI.ThemeColor)
+	}
+	if ud.UI.CustomTheme != "dark" {
+		t.Errorf("ui.customTheme should be 'dark', got '%s'", ud.UI.CustomTheme)
+	}
+	if ud.UI.Locale != "de" {
+		t.Errorf("ui.locale should be 'de', got '%s'", ud.UI.Locale)
+	}
+
+	// Account fields
+	if !ud.Account.LockPassword {
+		t.Error("account.lockPassword should be true")
+	}
+	if !ud.Account.DisableSettings {
+		t.Error("account.disableSettings should be true")
+	}
+	if ud.Account.LoginMethod != "oidc" {
+		t.Errorf("account.loginMethod should be 'oidc', got '%s'", ud.Account.LoginMethod)
+	}
+	if !ud.Account.DisableUpdateNotifications {
+		t.Error("account.disableUpdateNotifications should be true")
+	}
+
+	// Account Permissions
+	if !ud.Account.Permissions.Api {
+		t.Error("account.permissions.api should be true")
+	}
+	if !ud.Account.Permissions.Admin {
+		t.Error("account.permissions.admin should be true")
+	}
+	if !ud.Account.Permissions.Modify {
+		t.Error("account.permissions.modify should be true")
+	}
+	if !ud.Account.Permissions.Share {
+		t.Error("account.permissions.share should be true")
+	}
+	if !ud.Account.Permissions.Realtime {
+		t.Error("account.permissions.realtime should be true")
+	}
+	if !ud.Account.Permissions.Delete {
+		t.Error("account.permissions.delete should be true")
+	}
+	if !ud.Account.Permissions.Create {
+		t.Error("account.permissions.create should be true")
+	}
+	if ud.Account.Permissions.Download == nil || *ud.Account.Permissions.Download != false {
+		t.Error("account.permissions.download should be false")
+	}
+}

backend/common/settings/settings.go

@@ -21,7 +21,7 @@ func boolValueOrDefault(ptr *bool, defaultValue bool) bool {
 }
 
 // ConvertPermissionsToUsers converts UserDefaultsPermissions to users.Permissions
-func ConvertPermissionsToUsers(p UserDefaultsPermissions) users.Permissions {
+func ConvertPermissionsToUsers(p UserDefaultsAccountPermissions) users.Permissions {
 	return users.Permissions{
 		Api:      p.Api,
 		Admin:    p.Admin,
@@ -57,10 +57,14 @@ func GetSettingsConfig(nameType string, Value string) string {
 
 func AdminPerms() users.Permissions {
 	return users.Permissions{
-		Modify: true,
-		Share:  true,
-		Admin:  true,
-		Api:    true,
+		Modify:   true,
+		Share:    true,
+		Admin:    true,
+		Api:      true,
+		Download: true,
+		Delete:   true,
+		Create:   true,
+		Realtime: false,
 	}
 }
 
@@ -70,70 +74,100 @@ func AdminPerms() users.Permissions {
 func ApplyUserDefaults(u *users.User) {
 	d := Config.UserDefaults
 
-	u.DisableSettings = d.DisableSettings
-	u.LockPassword = d.LockPassword
+	// Account settings
+	u.DisableSettings = d.Account.DisableSettings
+	u.LockPassword = d.Account.LockPassword
+	u.DisableUpdateNotifications = d.Account.DisableUpdateNotifications
 
-	u.EditorQuickSave = d.EditorQuickSave
-	u.HideSidebarFileActions = d.HideSidebarFileActions
-	u.DisableQuickToggles = d.DisableQuickToggles
-	u.DisableSearchOptions = d.DisableSearchOptions
-	u.StickySidebar = d.StickySidebar
-	u.HideFilesInTree = d.HideFilesInTree
-	u.DarkMode = boolValueOrDefault(d.DarkMode, true)
-	u.Locale = d.Locale
-	u.ViewMode = d.ViewMode
-	u.SingleClick = d.SingleClick
-	u.ShowHidden = d.ShowHidden
-	u.DateFormat = d.DateFormat
-	u.GallerySize = d.GallerySize
-	u.ThemeColor = d.ThemeColor
-	u.QuickDownload = d.QuickDownload
-	u.DisablePreviewExt = d.DisablePreviewExt
-	u.DisableViewingExt = d.DisableViewingExt
-	u.DisableUpdateNotifications = d.DisableUpdateNotifications
-	u.DisableOfficePreviewExt = d.DisableOfficePreviewExt
-	u.DisableOnlyOfficeExt = d.DisableOnlyOfficeExt
-	u.CustomTheme = d.CustomTheme
-	u.ShowSelectMultiple = d.ShowSelectMultiple
-	u.DebugOffice = d.DebugOffice
-	u.DeleteWithoutConfirming = d.DeleteWithoutConfirming
-	u.DeleteAfterArchive = d.DeleteAfterArchive
-	u.PreferEditorForMarkdown = d.PreferEditorForMarkdown
-	u.FileLoading = d.FileLoading
+	// Sidebar settings
+	u.DisableQuickToggles = d.Sidebar.DisableQuickToggles
+	u.HideSidebarFileActions = d.Sidebar.HideFileActions
+	u.StickySidebar = d.Sidebar.Sticky
+	u.HideFilesInTree = d.Sidebar.HideFiles
+	u.ShowToolsInSidebar = boolValueOrDefault(d.Sidebar.ShowTools, true)
 
-	u.Permissions.Api = d.Permissions.Api
-	u.Permissions.Admin = d.Permissions.Admin
-	u.Permissions.Modify = d.Permissions.Modify
-	u.Permissions.Share = d.Permissions.Share
-	u.Permissions.Realtime = d.Permissions.Realtime
-	u.Permissions.Delete = d.Permissions.Delete
-	u.Permissions.Create = d.Permissions.Create
-	u.Permissions.Download = boolValueOrDefault(d.Permissions.Download, true)
+	// Listing settings
+	u.DeleteWithoutConfirming = d.Listing.DeleteWithoutConfirming
+	u.DateFormat = d.Listing.DateFormat
+	u.ShowHidden = d.Listing.ShowHidden
+	u.QuickDownload = d.Listing.QuickDownload
+	u.ShowSelectMultiple = d.Listing.ShowSelectMultiple
+	u.SingleClick = d.Listing.SingleClick
+	u.HideFileExt = d.Listing.HideFileExt
+	u.ShowCopyPath = d.Listing.ShowCopyPath
+	u.DeleteAfterArchive = d.Listing.DeleteAfterArchive
+	u.ViewMode = d.Listing.ViewMode
+	u.GallerySize = d.Listing.GallerySize
 
-	u.Preview.DisableHideSidebar = d.Preview.DisableHideSidebar
+	// Preview settings
+	u.Preview.DisableHideSidebar = d.Sidebar.DisableHideOnPreview
 	u.Preview.Image = boolValueOrDefault(d.Preview.Image, true)
 	u.Preview.Video = boolValueOrDefault(d.Preview.Video, true)
 	u.Preview.Audio = boolValueOrDefault(d.Preview.Audio, true)
 	u.Preview.MotionVideoPreview = boolValueOrDefault(d.Preview.MotionVideoPreview, true)
 	u.Preview.Office = boolValueOrDefault(d.Preview.Office, true)
 	u.Preview.PopUp = boolValueOrDefault(d.Preview.PopUp, true)
-	u.Preview.AutoplayMedia = boolValueOrDefault(d.Preview.AutoplayMedia, true)
-	u.Preview.DefaultMediaPlayer = d.Preview.DefaultMediaPlayer
 	u.Preview.Folder = boolValueOrDefault(d.Preview.Folder, true)
 	u.Preview.Models = boolValueOrDefault(d.Preview.Models, true)
+	u.DisablePreviewExt = d.Preview.DisablePreviewExt
 
-	if u.LoginMethod == "" && d.LoginMethod != "" {
-		u.LoginMethod = users.LoginMethod(d.LoginMethod)
+	// FileViewer settings
+	u.EditorQuickSave = d.FileViewer.EditorQuickSave
+	u.Preview.AutoplayMedia = boolValueOrDefault(d.FileViewer.AutoplayMedia, true)
+	u.Preview.DefaultMediaPlayer = d.FileViewer.DefaultMediaPlayer
+	u.DisableViewingExt = d.FileViewer.DisableViewingExt
+	u.DisableOnlyOfficeExt = d.FileViewer.DisableOnlyOfficeExt
+	u.DisableOfficePreviewExt = d.FileViewer.DisableOnlyOfficeExt // deprecated field, map to same source
+	u.PreferEditorForMarkdown = d.FileViewer.PreferEditorForMarkdown
+	u.DebugOffice = d.FileViewer.DebugOffice
+
+	// Search settings
+	u.DisableSearchOptions = d.Search.DisableOptions
+
+	// UI settings
+	u.DarkMode = boolValueOrDefault(d.UI.DarkMode, true)
+	u.ThemeColor = d.UI.ThemeColor
+	u.CustomTheme = d.UI.CustomTheme
+	u.Locale = d.UI.Locale
+
+	// FileLoading settings
+	u.FileLoading = d.FileLoading
+
+	if u.Username == "anonymous" {
+		return
 	}
 
-	if len(u.Scopes) == 0 && u.Username != "anonymous" {
+	// Permissions
+	u.Permissions.Api = d.Account.Permissions.Api
+	u.Permissions.Admin = d.Account.Permissions.Admin
+	u.Permissions.Modify = d.Account.Permissions.Modify
+	u.Permissions.Share = d.Account.Permissions.Share
+	u.Permissions.Realtime = d.Account.Permissions.Realtime
+	u.Permissions.Delete = d.Account.Permissions.Delete
+	u.Permissions.Create = d.Account.Permissions.Create
+	u.Permissions.Download = boolValueOrDefault(d.Account.Permissions.Download, true)
+
+	if u.LoginMethod == "" && d.Account.LoginMethod != "" {
+		u.LoginMethod = users.LoginMethod(d.Account.LoginMethod)
+	}
+
+	if len(u.Scopes) == 0 {
 		for _, source := range Config.Server.Sources {
 			if source.Config.DefaultEnabled {
 				u.Scopes = append(u.Scopes, users.SourceScope{
 					Name:  source.Path, // backend name is path
 					Scope: source.Config.DefaultUserScope,
 				})
+				u.SidebarLinks = append(u.SidebarLinks, users.SidebarLink{
+					Name:       source.Name,
+					Category:   "source",
+					Target:     "/",
+					Icon:       "",
+					SourceName: source.Path,
+				})
 			}
 		}
 	}
+
+	u.Version = users.CurrentUserMigrationVersion
 }

backend/common/settings/storage.go

@@ -37,12 +37,12 @@ func (s *Storage) Save(set *Settings) error {
 		return errors.ErrEmptyKey
 	}
 
-	if set.UserDefaults.Locale == "" {
-		set.UserDefaults.Locale = "en"
+	if set.UserDefaults.UI.Locale == "" {
+		set.UserDefaults.UI.Locale = "en"
 	}
 
-	if set.UserDefaults.ViewMode == "" {
-		set.UserDefaults.ViewMode = "normal"
+	if set.UserDefaults.Listing.ViewMode == "" {
+		set.UserDefaults.Listing.ViewMode = "normal"
 	}
 
 	err := s.back.Save(set)

backend/common/settings/structs.go

@@ -20,6 +20,14 @@ type Settings struct {
 	Frontend     Frontend     `json:"frontend"`
 	UserDefaults UserDefaults `json:"userDefaults"`
 	Integrations Integrations `json:"integrations"`
+	Http         Http         `json:"http"`
+}
+type Http struct {
+	TrustedHeadersArray []string `json:"trustedHeaders"`   // list of headers to trust, useful when behind a reverse proxy.
+	DisableRateLimit    bool     `json:"disableRateLimit"` // turns off built-in auth route rate limiting and failed-login lockout (default false).
+
+	// internal map of trusted headers
+	TrustedHeaders map[string]bool `json:"-"`
 }
 
 type Environment struct {
@@ -191,9 +199,9 @@ type LogConfig struct {
 	Output    string `json:"output" yaml:"output"`       // output location. (eg. "stdout" or "path/to/file.log")
 	NoColors  bool   `json:"noColors" yaml:"noColors"`   // disable colors in the output
 	Json      bool   `json:"json" yaml:"json"`           // output in json format
-	Utc       bool   `json:"utc" yaml:"utc"`             // use UTC time in the output instead of local time
+	Utc       bool   `json:"utc" yaml:"utc"`             // use UTC time in the output instead of local time.
+	ApiFilter string `json:"apiFilter" yaml:"apiFilter"` // regex filter that excludes matching full api paths from being logged. (eg. '/user\?id\=self') Defaults to '^/health|^/favicon.ico|^/static|^/public/static'
 }
-
 type Source struct {
 	Path   string       `json:"path" validate:"required"` // file system path. (Can be relative)
 	Name   string       `json:"name"`                     // display name
@@ -203,14 +211,14 @@ type Source struct {
 type SourceConfig struct {
 	DenyByDefault    bool              `json:"denyByDefault,omitempty"`           // deny access unless an "allow" access rule was specifically created.
 	Private          bool              `json:"private"`                           // designate as source as private -- currently just means no sharing permitted.
+	ReadOnly         bool              `json:"readOnly,omitempty"`                // read-only source, changes from the UI, webdav, and API will be disabled.
 	Disabled         bool              `json:"disabled,omitempty"`                // disable the source, this is useful so you don't need to remove it from the config file
 	IndexingInterval uint32            `json:"indexingIntervalMinutes,omitempty"` // deprecated: create a rule with indexingIntervalMinutes to set the indexing interval for this source
-	DisableIndexing  bool              `json:"disableIndexing,omitempty"`         // deprecated: use indexingDisabled instead to disable the indexing of this source
 	Conditionals     ConditionalFilter `json:"conditionals"`                      // deprecated: use source.rules instead
 	Rules            []ConditionalRule `json:"rules"`                             // list of item rules to apply to specific paths
 	DefaultUserScope string            `json:"defaultUserScope"`                  // defaults to root of index "/" should match folders under path
 	DefaultEnabled   bool              `json:"defaultEnabled"`                    // should be added as a default source for new users?
-	CreateUserDir    bool              `json:"createUserDir"`                     // deprecated: create a user directory for each user under defaultUserScope + username (always true now)
+	CreateUserDir    bool              `json:"createUserDir"`                     // create a user directory for each user under defaultUserScope + username
 	UseLogicalSize   bool              `json:"useLogicalSize"`                    // calculate sizes based on logical size instead of disk utilization (du -sh), folders will be 0 bytes when empty.
 	// hidden but used internally - optimized map lookups for conditional rules
 	ResolvedRules ResolvedRulesConfig `json:"-"`
@@ -308,24 +316,99 @@ type ExternalLink struct {
 	Url   string `json:"url" validate:"required"`  // the url to link to
 }
 
-// UserDefaultsPreview holds preview settings with pointer types for defaults
-type UserDefaultsPreview struct {
-	DisableHideSidebar bool  `json:"disableHideSidebar"` // keep sidebar open when previewing files
-	HighQuality        *bool `json:"highQuality"`        // deprecated: always true in v1.3.0+
-	Image              *bool `json:"image"`              // show thumbnails for image files
-	Video              *bool `json:"video"`              // show thumbnails for video files
-	Audio              *bool `json:"audio"`              // show thumbnails for audio files
-	MotionVideoPreview *bool `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
-	Office             *bool `json:"office"`             // show thumbnails for office files
-	PopUp              *bool `json:"popup"`              // show larger popup preview when hovering over thumbnail
-	AutoplayMedia      *bool `json:"autoplayMedia"`      // autoplay media files in preview
-	DefaultMediaPlayer bool  `json:"defaultMediaPlayer"` // disable the styled feature-rich media player for browser default
-	Folder             *bool `json:"folder"`             // show thumbnails for folders that have previewable contents
-	Models             *bool `json:"models"`             // show live thumbnails for 3D models files
-}
-
 // UserDefaultsPermissions holds permission settings with pointer types for defaults
 type UserDefaultsPermissions struct {
+	Api      bool  `json:"api"`      // deprecated: use account.permissions.api instead. allow api access
+	Admin    bool  `json:"admin"`    // deprecated: use account.permissions.admin instead. allow admin access
+	Modify   bool  `json:"modify"`   // deprecated: use account.permissions.modify instead. allow modifying files
+	Share    bool  `json:"share"`    // deprecated: use account.permissions.share instead. allow sharing files
+	Realtime bool  `json:"realtime"` // deprecated: use account.permissions.realtime instead. allow realtime updates
+	Delete   bool  `json:"delete"`   // deprecated: use account.permissions.delete instead. allow deleting files
+	Create   bool  `json:"create"`   // deprecated: use account.permissions.create instead. allow creating or uploading files
+	Download *bool `json:"download"` // deprecated: use account.permissions.download instead. allow downloading files
+}
+
+// New organized structures for UserDefaults
+
+// UserDefaultsSidebar holds sidebar-related settings
+type UserDefaultsSidebar struct {
+	DisableQuickToggles  bool  `json:"disableQuickToggles"`  // disable the quick toggles in the sidebar
+	HideFileActions      bool  `json:"hideFileActions"`      // hide the file actions in the sidebar
+	DisableHideOnPreview bool  `json:"disableHideOnPreview"` // keep sidebar open when previewing files (was preview.disableHideSidebar)
+	Sticky               bool  `json:"sticky"`               // keep sidebar open when navigating
+	HideFiles            bool  `json:"hideFiles"`            // hide files in the sidebar tree navigation, when true, will show only directories
+	ShowTools            *bool `json:"showTools"`            // show sidebar links with category "tool"; default is true
+}
+
+// UserDefaultsListing holds file listing display settings
+type UserDefaultsListing struct {
+	DeleteWithoutConfirming bool   `json:"deleteWithoutConfirming"` // delete files without confirmation
+	DateFormat              bool   `json:"dateFormat"`              // when false, the date is relative, when true, the date is an exact timestamp
+	ShowHidden              bool   `json:"showHidden"`              // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	QuickDownload           bool   `json:"quickDownload"`           // show icon to download in one click
+	ShowSelectMultiple      bool   `json:"showSelectMultiple"`      // show select multiple files on desktop
+	SingleClick             bool   `json:"singleClick"`             // open directory on single click, also enables middle click to open in new tab
+	HideFileExt             string `json:"hideFileExt"`             // space separated list of file extensions to hide in UI
+	ShowCopyPath            bool   `json:"showCopyPath"`            // show copy path button in the context menu
+	DeleteAfterArchive      bool   `json:"deleteAfterArchive"`      // delete source files after successful creation/extraction of archives
+	ViewMode                string `json:"viewMode"`                // view mode to use: eg. normal, list, grid, or compact
+	GallerySize             int    `json:"gallerySize"`             // 0-9 - the size of the gallery thumbnails
+}
+
+// UserDefaultsPreview holds preview-related settings
+type UserDefaultsPreview struct {
+	Image              *bool  `json:"image"`              // show thumbnails for image files
+	Video              *bool  `json:"video"`              // show thumbnails for video files
+	Audio              *bool  `json:"audio"`              // show thumbnails for audio files
+	MotionVideoPreview *bool  `json:"motionVideoPreview"` // show multiple frames for videos in thumbnail preview when hovering
+	Office             *bool  `json:"office"`             // show thumbnails for office files
+	PopUp              *bool  `json:"popup"`              // show larger popup preview when hovering over thumbnail
+	DisablePreviewExt  string `json:"disablePreviewExt"`  // comma separated list of file extensions to disable preview for
+	HighQuality        *bool  `json:"highQuality"`        // high quality preview thumbnails
+	Folder             *bool  `json:"folder"`             // show thumbnails for folders that have previewable contents
+	Models             *bool  `json:"models"`             // show live thumbnails for 3D models files
+	// deprecated fields
+	DisableHideSidebar bool `json:"disableHideSidebar"` // deprecated: use sidebar.disableHideOnPreview instead. disable the hide sidebar preview for previews and editors
+	DefaultMediaPlayer bool `json:"defaultMediaPlayer"` // deprecated: use fileViewer.defaultMediaPlayer instead. disable the styled feature-rich media player for browser default
+	AutoplayMedia      bool `json:"autoplayMedia"`      // deprecated: use fileViewer.autoplayMedia instead. autoplay media files in preview
+}
+
+// UserDefaultsFileViewer holds file viewer/editor settings
+type UserDefaultsFileViewer struct {
+	EditorQuickSave         bool   `json:"editorQuickSave"`         // show quick save button in editor
+	AutoplayMedia           *bool  `json:"autoplayMedia"`           // autoplay media files in preview
+	DisableViewingExt       string `json:"disableViewingExt"`       // comma separated list of file extensions to disable viewing for
+	DisableOnlyOfficeExt    string `json:"disableOnlyOfficeExt"`    // list of file extensions to disable onlyoffice editor for
+	PreferEditorForMarkdown bool   `json:"preferEditorForMarkdown"` // prefer editor first for markdown files instead of the Markdown Viewer
+	DebugOffice             bool   `json:"debugOffice"`             // debug onlyoffice editor
+	DefaultMediaPlayer      bool   `json:"defaultMediaPlayer"`      // disable the styled feature-rich media player for browser default
+}
+
+// UserDefaultsSearch holds search-related settings
+type UserDefaultsSearch struct {
+	DisableOptions bool `json:"disableOptions"` // disable the search options in the search bar
+}
+
+// UserDefaultsUI holds UI/appearance settings
+type UserDefaultsUI struct {
+	DarkMode    *bool  `json:"darkMode"`    // should dark mode be enabled
+	ThemeColor  string `json:"themeColor"`  // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+	CustomTheme string `json:"customTheme"` // Name of theme to use chosen from custom themes config
+	Locale      string `json:"locale"`      // language to use: eg. de, en, or fr
+
+}
+
+// UserDefaultsAccount holds account/security settings
+type UserDefaultsAccount struct {
+	Permissions                UserDefaultsAccountPermissions `json:"permissions"`
+	LockPassword               bool                           `json:"lockPassword"`               // disable the user from changing their password
+	DisableSettings            bool                           `json:"disableSettings"`            // disable the user from viewing the settings page
+	LoginMethod                string                         `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
+	DisableUpdateNotifications bool                           `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
+}
+
+// UserDefaultsAccountPermissions holds permission settings
+type UserDefaultsAccountPermissions struct {
 	Api      bool  `json:"api"`      // allow api access
 	Admin    bool  `json:"admin"`    // allow admin access
 	Modify   bool  `json:"modify"`   // allow modifying files
@@ -336,40 +419,51 @@ type UserDefaultsPermissions struct {
 	Download *bool `json:"download"` // allow downloading files
 }
 
-// UserDefaults is a type that holds the default values
-// for some fields on User.
+// UserDefaults is a type that holds the default values for some fields on User.
 type UserDefaults struct {
-	EditorQuickSave            bool                    `json:"editorQuickSave"`           // show quick save button in editor
-	HideSidebarFileActions     bool                    `json:"hideSidebarFileActions"`    // hide the file actions in the sidebar
-	DisableQuickToggles        bool                    `json:"disableQuickToggles"`       // disable the quick toggles in the sidebar
-	DisableSearchOptions       bool                    `json:"disableSearchOptions"`      // disable the search options in the search bar
-	StickySidebar              bool                    `json:"stickySidebar"`             // keep sidebar open when navigating
-	HideFilesInTree            bool                    `json:"hideFilesInTree"`           // hide files in the sidebar tree navigation, when true, will show only directories.
-	DarkMode                   *bool                   `json:"darkMode"`                  // should dark mode be enabled
-	Locale                     string                  `json:"locale"`                    // language to use: eg. de, en, or fr
-	ViewMode                   string                  `json:"viewMode"`                  // view mode to use: eg. normal, list, grid, or compact
-	SingleClick                bool                    `json:"singleClick"`               // open directory on single click, also enables middle click to open in new tab
-	ShowHidden                 bool                    `json:"showHidden"`                // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-	DateFormat                 bool                    `json:"dateFormat"`                // when false, the date is relative, when true, the date is an exact timestamp
-	GallerySize                int                     `json:"gallerySize"`               // 0-9 - the size of the gallery thumbnails
-	ThemeColor                 string                  `json:"themeColor"`                // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-	QuickDownload              bool                    `json:"quickDownload"`             // show icon to download in one click
-	DisablePreviewExt          string                  `json:"disablePreviewExt"`         // space separated list of file extensions to disable preview for
-	DisableViewingExt          string                  `json:"disableViewingExt"`         // space separated list of file extensions to disable viewing for
-	LockPassword               bool                    `json:"lockPassword"`              // disable the user from changing their password
-	DisableSettings            bool                    `json:"disableSettings,omitempty"` // disable the user from viewing the settings page
-	Preview                    UserDefaultsPreview     `json:"preview"`
+	// New organized structure
+	Sidebar     UserDefaultsSidebar    `json:"sidebar,omitempty"`
+	Listing     UserDefaultsListing    `json:"listing,omitempty"`
+	Preview     UserDefaultsPreview    `json:"preview,omitempty"`
+	FileViewer  UserDefaultsFileViewer `json:"fileViewer,omitempty"`
+	Search      UserDefaultsSearch     `json:"search,omitempty"`
+	UI          UserDefaultsUI         `json:"ui,omitempty"`
+	FileLoading users.FileLoading      `json:"fileLoading,omitempty"`
+	Account     UserDefaultsAccount    `json:"account,omitempty"`
+
+	// Deprecated fields - kept for backwards compatibility
+	EditorQuickSave            bool                    `json:"editorQuickSave,omitempty"`        // deprecated: use fileViewer.editorQuickSave instead
+	HideSidebarFileActions     bool                    `json:"hideSidebarFileActions,omitempty"` // deprecated: use sidebar.hideSidebarFileActions instead
+	DisableQuickToggles        bool                    `json:"disableQuickToggles,omitempty"`    // deprecated: use sidebar.disableQuickToggles instead
+	DisableSearchOptions       bool                    `json:"disableSearchOptions,omitempty"`   // deprecated: use search.disableOptions instead
+	StickySidebar              bool                    `json:"stickySidebar,omitempty"`          // deprecated: use sidebar.stickySidebar instead
+	HideFilesInTree            bool                    `json:"hideFilesInTree,omitempty"`        // deprecated: use sidebar.hideFilesInTree instead
+	DarkMode                   *bool                   `json:"darkMode,omitempty"`               // deprecated: use sidebar.darkMode instead
+	Locale                     string                  `json:"locale,omitempty"`                 // deprecated: use ui.locale instead
+	ViewMode                   string                  `json:"viewMode,omitempty"`               // deprecated: use sidebar.viewMode instead
+	SingleClick                bool                    `json:"singleClick,omitempty"`            // deprecated: use sidebar.singleClick instead
+	ShowHidden                 bool                    `json:"showHidden,omitempty"`             // deprecated: use listing.showHidden instead
+	HideFileExt                string                  `json:"hideFileExt,omitempty"`            // deprecated: use listing.hideFileExt instead
+	DateFormat                 bool                    `json:"dateFormat,omitempty"`             // deprecated: use listing.dateFormat instead
+	GallerySize                int                     `json:"gallerySize,omitempty"`            // deprecated: use sidebar.gallerySize instead
+	ThemeColor                 string                  `json:"themeColor,omitempty"`             // deprecated: use ui.themeColor instead
+	QuickDownload              bool                    `json:"quickDownload,omitempty"`          // deprecated: use listing.quickDownload instead
+	DisablePreviewExt          string                  `json:"disablePreviewExt,omitempty"`      // deprecated: use preview.disablePreviewExt instead
+	DisableViewingExt          string                  `json:"disableViewingExt,omitempty"`      // deprecated: use fileViewer.disableViewingExt instead
+	LockPassword               bool                    `json:"lockPassword,omitempty"`           // deprecated: use account.lockPassword instead
+	DisableSettings            bool                    `json:"disableSettings,omitempty"`        // deprecated: use account.disableSettings instead
 	DefaultScopes              []users.SourceScope     `json:"-"`
-	Permissions                UserDefaultsPermissions `json:"permissions"`
-	LoginMethod                string                  `json:"loginMethod,omitempty"`      // login method to use: eg. password, proxy, oidc
-	DisableUpdateNotifications bool                    `json:"disableUpdateNotifications"` // disable update notifications banner for admin users
-	DeleteWithoutConfirming    bool                    `json:"deleteWithoutConfirming"`    // delete files without confirmation
-	DeleteAfterArchive         bool                    `json:"deleteAfterArchive"`         // delete source files after successful creation/extraction of archives
-	FileLoading                users.FileLoading       `json:"fileLoading"`                // upload and download settings
-	DisableOfficePreviewExt    string                  `json:"disableOfficePreviewExt"`    // deprecated: use disablePreviewExt instead
-	DisableOnlyOfficeExt       string                  `json:"disableOnlyOfficeExt"`       // list of file extensions to disable onlyoffice editor for
-	CustomTheme                string                  `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
-	ShowSelectMultiple         bool                    `json:"showSelectMultiple"`         // show select multiple files on desktop
-	DebugOffice                bool                    `json:"debugOffice"`                // debug onlyoffice editor
-	PreferEditorForMarkdown    bool                    `json:"preferEditorForMarkdown"`    // prefer editor first for markdown files instead of the Markdown Viewer.
+	Permissions                UserDefaultsPermissions `json:"permissions,omitempty"`                // deprecated: use account.permissions instead
+	LoginMethod                string                  `json:"loginMethod,omitempty"`                // deprecated: use account.loginMethod instead
+	DisableUpdateNotifications bool                    `json:"disableUpdateNotifications,omitempty"` // deprecated: use account.disableUpdateNotifications instead
+	DeleteWithoutConfirming    bool                    `json:"deleteWithoutConfirming,omitempty"`    // deprecated: use listing.deleteWithoutConfirming instead
+	DeleteAfterArchive         bool                    `json:"deleteAfterArchive,omitempty"`         // deprecated: use listing.deleteAfterArchive instead
+	DisableOfficePreviewExt    string                  `json:"disableOfficePreviewExt,omitempty"`    // deprecated: use disablePreviewExt instead
+	DisableOnlyOfficeExt       string                  `json:"disableOnlyOfficeExt,omitempty"`       // deprecated: use fileViewer.disableOnlyOfficeExt instead
+	CustomTheme                string                  `json:"customTheme,omitempty"`                // deprecated: use ui.customTheme instead
+	ShowSelectMultiple         bool                    `json:"showSelectMultiple,omitempty"`         // deprecated: use listing.showSelectMultiple instead
+	ShowToolsInSidebar         *bool                   `json:"showToolsInSidebar,omitempty"`         // deprecated: use sidebar.showToolsInSidebar instead
+	DebugOffice                bool                    `json:"debugOffice,omitempty"`                // deprecated: use fileViewer.debugOffice instead
+	PreferEditorForMarkdown    bool                    `json:"preferEditorForMarkdown,omitempty"`    // deprecated: use fileViewer.preferEditorForMarkdown instead
+	ShowCopyPath               bool                    `json:"showCopyPath,omitempty"`               // deprecated: use listing.showCopyPath instead
 }

backend/common/utils/crypto.go

@@ -3,11 +3,29 @@ package utils
 import (
 	"crypto/rand"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 
 	"golang.org/x/crypto/bcrypt"
 )
 
+func randomBytes(n int) ([]byte, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return nil, err
+	}
+	return b, nil
+}
+
+// RandomHex returns a hex-encoded string from byteLen bytes of crypto/rand (length 2*byteLen).
+func RandomHex(byteLen int) (string, error) {
+	b, err := randomBytes(byteLen)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
 var BcryptCost = bcrypt.DefaultCost
 var InvalidPasswordHash = ""
 
@@ -44,3 +62,13 @@ func GenerateKey() string {
 	}
 	return string(b)
 }
+
+// CSPNonce returns a base64-encoded random value suitable for Content-Security-Policy nonces
+// and matching HTML nonce="" attributes (cryptographically random, URL/header safe characters).
+func CSPNonce() (string, error) {
+	b, err := randomBytes(16)
+	if err != nil {
+		return "", err
+	}
+	return base64.StdEncoding.EncodeToString(b), nil
+}

backend/common/utils/file.go

@@ -57,6 +57,7 @@ type FileOptions struct {
 	ExtractEmbeddedSubtitles bool   // whether to extract embedded subtitles from media files
 	AlbumArt                 bool   // whether to get album art from media files
 	ShowHidden               bool   // whether to show hidden files (true = show, false = hide)
+	HideFileExt              string // Hide files based on extensions (eg: '.lrc' or '.srt')
 	FollowSymlinks           bool   // whether to follow symlinks
 	Only                     string // whether to only get files or folders
 	SkipExtendedAttrs        bool   // whether to skip extended attributes
@@ -86,3 +87,25 @@ func SanitizeUserPath(userPath string) (string, error) {
 
 	return clean, nil
 }
+
+// HideFileByExt will check if a filename matches any of the hidden extensions
+func HideFileByExt(filename, hideExt string) bool {
+	if hideExt == "" {
+		return false
+	}
+	exts := strings.Fields(hideExt)
+	nameLower := strings.ToLower(filename)
+	for _, ext := range exts {
+		ext = strings.TrimSpace(ext)
+		if ext == "" {
+			continue
+		}
+		if !strings.HasPrefix(ext, ".") {
+			ext = "." + ext
+		}
+		if strings.HasSuffix(nameLower, strings.ToLower(ext)) {
+			return true
+		}
+	}
+	return false
+}

backend/config.media.yaml

@@ -1,11 +1,10 @@
-server:
-  logging:
-    - levels: "info|warning|error"
-  sources:
-    - path: "/srv"
 userDefaults:
   preview:
     image: true
-    popup: true
     video: true
     audio: true
+    motionVideoPreview: true
+    office: true
+    popup: true
+    folder: true
+    models: true

backend/config.yaml

@@ -5,51 +5,84 @@ server:
     - levels: "info|warning|error"
   sources:
     - path: "/srv"
+auth:
+  key: "change-me-to-a-random-string"
+  totpSecret: "change-me-to-another-random-string"
+  methods:
+    password:
+      enabled: true
+      minLength: 5
+      signup: false
+    passkey:
+      enabled: false
 userDefaults:
-  editorQuickSave: false                  # show quick save button in editor
-  hideSidebarFileActions: false           # hide the file actions in the sidebar
-  disableQuickToggles: false              # disable the quick toggles in the sidebar
-  disableSearchOptions: false             # disable the search options in the search bar
-  stickySidebar: true                     # keep sidebar open when navigating
-  hideFilesInTree: false                  # hide files in the sidebar tree navigation, when true, will show only directories.
-  darkMode: true                          # should dark mode be enabled (defaults to true if not set)
-  viewMode: "normal"                      # view mode to use: eg. normal, list, grid, or compact
-  singleClick: false                      # open directory on single click, also enables middle click to open in new tab
-  showHidden: false                       # show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-  dateFormat: false                       # when false, the date is relative, when true, the date is an exact timestamp
-  gallerySize: 3                          # 0-9 - the size of the gallery thumbnails
-  themeColor: "var(--blue)"               # theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-  quickDownload: false                    # show icon to download in one click
-  disablePreviewExt: ""                   # space separated list of file extensions to disable preview for
-  disableViewingExt: ""                   # space separated list of file extensions to disable viewing for
-  lockPassword: false                     # disable the user from changing their password
-  disableSettings: false                  # disable the user from viewing the settings page
+  sidebar:
+    disableQuickToggles: false            # disable the quick toggles in the sidebar
+    hideFileActions: false                # hide the file actions in the sidebar
+    disableHideOnPreview: false           # keep sidebar open when previewing files
+    sticky: true                          # keep sidebar open when navigating
+    hideFiles: false                      # hide files in the sidebar tree navigation, when true, will show only directories
+    showTools: true                       # show sidebar links of category "tool"; when false they stay in the list but are hidden in the UI
+
+  listing:
+    deleteWithoutConfirming: false        # delete files without confirmation
+    dateFormat: false                     # when false, the date is relative, when true, the date is an exact timestamp
+    showHidden: false                     # show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+    quickDownload: false                  # show icon to download in one click
+    showSelectMultiple: false             # show select multiple files on desktop
+    singleClick: false                    # open directory on single click, also enables middle click to open in new tab
+    hideFileExt: ""                       # space separated list of file extensions to hide in UI
+    showCopyPath: false                   # show copy path button in the context menu
+    deleteAfterArchive: true              # delete source files after successful creation/extraction of archives
+    viewMode: "normal"                    # view mode to use: eg. normal, list, grid, or compact
+    gallerySize: 3                        # 0-9 - the size of the gallery thumbnails
+
   preview:
-    disableHideSidebar: false             # disable the hide sidebar preview for previews and editors
     image: true                           # show thumbnail preview image for image files (defaults to true if not set)
     video: true                           # show thumbnail preview image for video files (defaults to true if not set)
     audio: true                           # show thumbnail preview image for audio files (defaults to true if not set)
     motionVideoPreview: true              # show multiple frames for videos in thumbnail preview when hovering (defaults to true if not set)
     office: true                          # show thumbnail preview image for office files (defaults to true if not set)
     popup: true                           # show larger popup preview when hovering over thumbnail (defaults to true if not set)
-    autoplayMedia: true                   # autoplay media files in preview (defaults to true if not set)
-    defaultMediaPlayer: false             # disable html5 media player and use the default media player
+    disablePreviewExt: ""                 # space separated list of file extensions to disable preview for
+    highQuality: true                     # high quality preview thumbnails
     folder: true                          # show thumbnail preview image for folder files (defaults to true if not set)
     models: true                          # show live thumbnail preview for 3D Models files (defaults to true if not set)
-  permissions:
-    api: false                            # allow api access
-    admin: false                          # allow admin access
-    modify: false                         # allow modifying files
-    share: false                          # allow sharing files
-    realtime: false                       # allow realtime updates
-    delete: false                         # allow deleting files
-    create: false                         # allow creating or uploading files
-    download: true                        # allow downloading files (defaults to true if not set)
-  disableUpdateNotifications: false       # disable update notifications banner for admin users
-  deleteWithoutConfirming: false          # delete files without confirmation
-  deleteAfterArchive: true                # delete source files after successful creation/extraction of archives
-  disableOnlyOfficeExt: ".md .txt .pdf .html .xml"   # list of file extensions to disable onlyoffice editor for
-  customTheme: ""                         # Name of theme to use chosen from custom themes config.
-  showSelectMultiple: false               # show select multiple files on desktop
-  debugOffice: false                      # debug onlyoffice editor
-  preferEditorForMarkdown: false          # prefer editor first for markdown files instead of the Markdown Viewer
+
+  fileViewer:
+    editorQuickSave: false                # show quick save button in editor
+    autoplayMedia: true                   # autoplay media files in preview (defaults to true if not set)
+    disableViewingExt: ""                 # space separated list of file extensions to disable viewing for
+    disableOnlyOfficeExt: ".md .txt .pdf .html .xml"  # list of file extensions to disable onlyoffice editor for
+    preferEditorForMarkdown: false        # prefer editor first for markdown files instead of the Markdown Viewer
+    debugOffice: false                    # debug onlyoffice editor
+    defaultMediaPlayer: false             # disable html5 media player and use the default media player
+
+  search:
+    disableOptions: false                 # disable the search options in the search bar
+
+  ui:
+    darkMode: true                        # should dark mode be enabled (defaults to true if not set)
+    themeColor: "var(--blue)"             # theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+    customTheme: ""                       # Name of theme to use chosen from custom themes config
+    locale: "en"                          # language to use: eg. de, en, or fr
+
+  fileLoading:
+    maxConcurrentUpload: 10               # maximum number of concurrent uploads
+    uploadChunkSizeMb: 10                 # upload chunk size in MB
+    downloadChunkSizeMb: 0                # download chunk size in MB (0 = no chunking)
+
+  account:
+    permissions:
+      api: false                          # allow api access
+      admin: false                        # allow admin access
+      modify: false                       # allow modifying files
+      share: false                        # allow sharing files
+      realtime: false                     # allow realtime updates
+      delete: false                       # allow deleting files
+      create: false                       # allow creating or uploading files
+      download: true                      # allow downloading files (defaults to true if not set)
+    lockPassword: false                   # disable the user from changing their password
+    disableSettings: false                # disable the user from viewing the settings page
+    loginMethod: "password"               # login method to use: eg. password, proxy, oidc
+    disableUpdateNotifications: false     # disable update notifications banner for admin users

backend/database/dbindex/indexing.go

@@ -17,6 +17,11 @@ type IndexInfo struct {
 	NumDirs    uint64 `json:"numDirs"`
 	NumFiles   uint64 `json:"numFiles"`
 
+	// Disk usage (cached from periodic GetIndexInfo / partition probes; aligns with ReducedIndex Stats)
+	UsedAsIndexed uint64 `json:"used"`
+	UsedDisk      uint64 `json:"usedAlt"`
+	DiskTotal     uint64 `json:"total"`
+
 	// Scanner information - map of scanner path to scanner stats
 	Scanners map[string]*PersistedScannerInfo `json:"scanners"`
 }
@@ -31,4 +36,5 @@ type PersistedScannerInfo struct {
 	QuickScanTime   int       `json:"quickScanTime"`
 	FullScanTime    int       `json:"fullScanTime"`
 	LastScanned     time.Time `json:"lastScanned"`
+	FullScanCounter int       `json:"fullScanCounter"` // 0-4: position in 1 full + 4 quick cycle before next executeScan
 }

backend/database/share/share.go

@@ -43,8 +43,9 @@ type CommonShare struct {
 	AllowReplacements        bool                `json:"allowReplacements,omitempty"` // allow replacements of files
 	SidebarLinks             []users.SidebarLink `json:"sidebarLinks"`                // customizable sidebar links
 	HasPassword              bool                `json:"hasPassword,omitempty"`
-	ShowHidden               bool                `json:"showHidden,omitempty"` // show hidden files in share (true = show, false = hide)
-	DisableLoginOption       bool                `json:"disableLoginOption"`   // disable login option in share (true = hide, false = show)
+	ShowHidden               bool                `json:"showHidden,omitempty"`  // show hidden files in share (true = show, false = hide)
+	HideFileExt              string              `json:"hideFileExt,omitempty"` // show hidden files based on extensions in shares
+	DisableLoginOption       bool                `json:"disableLoginOption"`    // disable login option in share (true = hide, false = show)
 	SourceURL                string              `json:"sourceURL,omitempty"`
 	CanEditShare             bool                `json:"canEditShare,omitempty"`
 }

backend/database/sql/index.go

@@ -298,28 +298,70 @@ func (db *IndexDB) InsertItem(source, path string, info *iteminfo.FileInfo) erro
 	return err
 }
 
+// dbTransientOpAttempts is how many times to run a bulk DB op that may hit SQLITE_BUSY before giving up.
+const dbTransientOpAttempts = 2
+
+const dbTransientRetryBackoff = 50 * time.Millisecond
+
 // BulkInsertItems inserts multiple items in a single transaction for a specific source.
 // Database errors (busy/locked) are treated as soft failures - the filesystem is the source of truth.
 // Returns nil on success or soft failure (busy/locked), error only on hard failures.
+// Transient busy/locked errors retry once before giving up (see dbTransientOpAttempts).
 func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) error {
+	if len(items) == 0 {
+		return nil
+	}
 
 	startTime := time.Now()
+	for attempt := 1; attempt <= dbTransientOpAttempts; attempt++ {
+		ok, transient, err := db.attemptBulkInsert(source, items)
+		if err != nil {
+			return err
+		}
+		if ok {
+			if attempt > 1 {
+				logger.Infof("[DB_TX] BulkInsertItems: succeeded on retry (%d items, attempt %d, %v)",
+					len(items), attempt, time.Since(startTime))
+			}
+			return nil
+		}
+		if transient && attempt < dbTransientOpAttempts {
+			logger.Warningf("[DB_TX] BulkInsertItems: transient DB error (attempt %d/%d, %d items), retrying after %v",
+				attempt, dbTransientOpAttempts, len(items), dbTransientRetryBackoff)
+			time.Sleep(dbTransientRetryBackoff)
+			continue
+		}
+		if transient {
+			logger.Warningf("[DB_TX] BulkInsertItems: still failing after %d attempts (%d items, %v) — batch dropped",
+				dbTransientOpAttempts, len(items), time.Since(startTime))
+		}
+		return nil
+	}
+	return nil // defensive if dbTransientOpAttempts is ever 0 and loop never runs
+}
 
+// attemptBulkInsert runs one transactional bulk insert.
+// Returns success=true when committed; transient=true when SQLITE_BUSY-like errors allow a retry (mutex released).
+func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo) (success bool, transient bool, err error) {
 	tx, err := db.BeginTransaction()
 	if err != nil {
-		// Soft failure: DB is busy or locked, skip this update
 		if isBusyError(err) || isTransactionError(err) {
-			db.mu.Unlock() // Release mutex on error
-			logger.Debugf("[DB_TX] BulkInsertItems: BeginTransaction failed (DB busy/locked), skipping - took %v", time.Since(startTime))
-			return nil // Non-fatal: filesystem will be used as fallback
+			db.mu.Unlock()
+			logger.Debugf("[DB_TX] BulkInsertItems: BeginTransaction failed (DB busy/locked): %v", err)
+			return false, true, nil
 		}
-		db.mu.Unlock() // Release mutex on error
-		return err     // Hard failure: something is wrong with the DB
+		db.mu.Unlock()
+		return false, false, err
 	}
-	defer db.mu.Unlock() // Ensure mutex is always released
 
-	// Always update all fields including last_updated, even if nothing changed
-	// This ensures last_updated stays current for stale entry detection
+	committed := false
+	defer func() {
+		if !committed {
+			_ = tx.Rollback()
+		}
+		db.mu.Unlock()
+	}()
+
 	stmt, err := tx.Prepare(`
 	INSERT INTO index_items (source, path, parent_path, name, size, mod_time, type, is_dir, is_hidden, has_preview, last_updated)
 	VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -336,14 +378,12 @@ func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) er
 	`)
 	if err != nil {
 		if isBusyError(err) || isTransactionError(err) {
-			// With EXCLUSIVE locking and mutex, this shouldn't happen.
-			// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
-			logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Prepare: %v", err)
-			return nil
+			logger.Debugf("[DB_TX] BulkInsertItems: Prepare busy/locked: %v", err)
+			return false, true, nil
 		}
-		return err
+		return false, false, err
 	}
-	defer stmt.Close() // Ensure statement is always closed
+	defer stmt.Close()
 
 	nowUnix := time.Now().Unix()
 	for _, info := range items {
@@ -363,28 +403,23 @@ func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) er
 		)
 		if err != nil {
 			if isBusyError(err) || isTransactionError(err) {
-				// With EXCLUSIVE locking and mutex, this shouldn't happen.
-				// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
-				logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Exec: %v", err)
-				return nil
+				logger.Debugf("[DB_TX] BulkInsertItems: Exec busy/locked during insert: %v", err)
+				return false, true, nil
 			}
 			logger.Errorf("[DB] BulkInsertItems: Exec failed for path=%s, source=%s, error=%v", info.Path, source, err)
-			return err
+			return false, false, err
 		}
 	}
 
-	// Try to commit
 	if err := tx.Commit(); err != nil {
 		if isBusyError(err) || isTransactionError(err) {
-			// With EXCLUSIVE locking and mutex, this shouldn't happen.
-			// Log as warning to surface potential issues (another process accessing DB, bug, etc.)
-			logger.Errorf("[DB] BulkInsertItems: Unexpected busy/lock error during Commit: %v", err)
-			return nil
+			logger.Debugf("[DB_TX] BulkInsertItems: Commit busy/locked: %v", err)
+			return false, true, nil
 		}
-		return err
+		return false, false, err
 	}
-
-	return nil
+	committed = true
+	return true, false, nil
 }
 
 // isBusyError checks if an error is SQLITE_BUSY (error code 5)
@@ -474,51 +509,6 @@ func (db *IndexDB) GetItemsByPaths(source string, paths []string) (map[string]*i
 	return result, nil
 }
 
-// GetHasPreviewBatch retrieves hasPreview status for multiple directory paths in a single query.
-// This is optimized for the N+1 query pattern in GetDirInfo where we need hasPreview for all subdirectories.
-// Returns map[path]hasPreview. Missing paths in the result indicate they're not in the database yet.
-func (db *IndexDB) GetHasPreviewBatch(source string, paths []string) (map[string]bool, error) {
-	if len(paths) == 0 {
-		return make(map[string]bool), nil
-	}
-
-	// Build query with IN clause - only select path and has_preview for efficiency
-	placeholders := make([]string, len(paths))
-	args := make([]interface{}, len(paths)+1)
-	args[0] = source
-	for i, path := range paths {
-		placeholders[i] = "?"
-		args[i+1] = path
-	}
-
-	query := fmt.Sprintf(`
-	SELECT path, has_preview
-	FROM index_items WHERE source = ? AND path IN (%s) AND is_dir = 1
-	`, strings.Join(placeholders, ","))
-
-	rows, err := db.Query(query, args...)
-	if err != nil {
-		// Soft failure: DB is busy or locked, return empty map
-		if isBusyError(err) || isTransactionError(err) {
-			return make(map[string]bool), nil
-		}
-		return nil, err
-	}
-	defer rows.Close()
-
-	result := make(map[string]bool)
-	for rows.Next() {
-		var path string
-		var hasPreview bool
-		if err := rows.Scan(&path, &hasPreview); err != nil {
-			return nil, err
-		}
-		result[path] = hasPreview
-	}
-
-	return result, nil
-}
-
 // GetDirectoryChildren retrieves all children of a directory for a specific source.
 func (db *IndexDB) GetDirectoryChildren(source, dirPath string) ([]*iteminfo.FileInfo, error) {
 	query := `
@@ -1077,17 +1067,31 @@ func (db *IndexDB) UpdateFolderSizesIfChanged(source string, pathSizes map[strin
 		args = append(args, path)
 	}
 
-	result, err := db.Exec(query, args...)
-	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
-			logger.Debugf("[DB_TX] UpdateFolderSizesIfChanged: DB busy/locked, skipping update")
-			return 0, nil // Non-fatal: sizes will be synced on next scan
+	startTime := time.Now()
+	for attempt := 1; attempt <= dbTransientOpAttempts; attempt++ {
+		result, err := db.Exec(query, args...)
+		if err != nil {
+			if isBusyError(err) || isTransactionError(err) {
+				if attempt < dbTransientOpAttempts {
+					logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: busy/locked (attempt %d/%d), retrying after %v: %v",
+						attempt, dbTransientOpAttempts, dbTransientRetryBackoff, err)
+					time.Sleep(dbTransientRetryBackoff)
+					continue
+				}
+				logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: still busy after %d attempts (%d paths, %v) — skipped",
+					dbTransientOpAttempts, len(pathSizes), time.Since(startTime))
+				return 0, nil
+			}
+			return 0, err
 		}
-		return 0, err
+		n, _ := result.RowsAffected()
+		if attempt > 1 {
+			logger.Infof("[DB_TX] UpdateFolderSizesIfChanged: succeeded on retry (%d rows, attempt %d, %v)",
+				n, attempt, time.Since(startTime))
+		}
+		return n, nil
 	}
-
-	rowsAffected, _ := result.RowsAffected()
-	return rowsAffected, nil
+	return 0, nil // defensive: unreachable when dbTransientOpAttempts >= 1
 }
 
 // LoadFolderSizes loads all folder sizes for a source from the database
@@ -1320,6 +1324,7 @@ func scanItem(scanner interface{ Scan(...interface{}) error }) (*iteminfo.FileIn
 		return nil, err
 	}
 	info.ModTime = time.Unix(modTime, 0)
+	info.IsDir = isDir
 	return &info, nil
 }
 

backend/database/sql/search.go

@@ -18,9 +18,27 @@ type SearchItem struct {
 	HasPreview bool
 }
 
+// appendNameGlobSQL adds AND (name GLOB ? OR ...) or AND (name GLOB ? AND ...) when joinAnd is true.
+func appendNameGlobSQL(query string, args []interface{}, patterns []string, joinAnd bool) (string, []interface{}) {
+	if len(patterns) == 0 {
+		return query, args
+	}
+	parts := make([]string, len(patterns))
+	for i := range patterns {
+		parts[i] = "name GLOB ?"
+		args = append(args, patterns[i])
+	}
+	join := " OR "
+	if joinAnd {
+		join = " AND "
+	}
+	return query + " AND (" + strings.Join(parts, join) + ")", args
+}
+
 // SearchItems queries the database for items matching the search criteria for a single source.
+// When nameGlobPatterns is non-empty (and largest is false), rows are restricted with SQLite name GLOB ... OR ....
 // Returns rows that can be iterated to scan search results.
-func (db *IndexDB) SearchItems(source string, scope string, largest bool) (*sql.Rows, error) {
+func (db *IndexDB) SearchItems(source string, scope string, largest bool, nameGlobPatterns []string, nameGlobPatternsAnd bool) (*sql.Rows, error) {
 	query := `
 		SELECT path, name, size, mod_time, type, is_dir, has_preview 
 		FROM index_items 
@@ -35,6 +53,10 @@ func (db *IndexDB) SearchItems(source string, scope string, largest bool) (*sql.
 		args = append(args, scope+"*")
 	}
 
+	if !largest && len(nameGlobPatterns) > 0 {
+		query, args = appendNameGlobSQL(query, args, nameGlobPatterns, nameGlobPatternsAnd)
+	}
+
 	if largest {
 		query += " ORDER BY size DESC"
 	}
@@ -43,8 +65,9 @@ func (db *IndexDB) SearchItems(source string, scope string, largest bool) (*sql.
 }
 
 // SearchItemsMultiSource queries the database for items matching the search criteria across multiple sources.
+// When nameGlobPatterns is non-empty (and largest is false), restricts rows with SQLite name GLOB ... OR ....
 // Returns rows that can be iterated to scan search results.
-func (db *IndexDB) SearchItemsMultiSource(sources []string, sourceScopes map[string]string, largest bool) (*sql.Rows, error) {
+func (db *IndexDB) SearchItemsMultiSource(sources []string, sourceScopes map[string]string, largest bool, nameGlobPatterns []string, nameGlobPatternsAnd bool) (*sql.Rows, error) {
 	if len(sources) == 0 {
 		return nil, fmt.Errorf("at least one source is required")
 	}
@@ -95,6 +118,10 @@ func (db *IndexDB) SearchItemsMultiSource(sources []string, sourceScopes map[str
 		query += " WHERE " + strings.Join(whereClauses, " AND ")
 	}
 
+	if !largest && len(nameGlobPatterns) > 0 {
+		query, args = appendNameGlobSQL(query, args, nameGlobPatterns, nameGlobPatternsAnd)
+	}
+
 	if largest {
 		query += " ORDER BY size DESC"
 	}

backend/database/storage/bolt/users.go

@@ -251,7 +251,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 	if len(fields) == 0 || fields[0] == "all" {
 		fields = []string{}
 		v := reflect.ValueOf(user)
-		if v.Kind() == reflect.Ptr {
+		if v.Kind() == reflect.Pointer {
 			v = v.Elem()
 		}
 		t := v.Type()
@@ -270,7 +270,7 @@ func parseFields(user *users.User, fields []string, actorIsAdmin bool) ([]string
 			if field.Anonymous {
 				// Get the embedded struct type
 				embeddedType := field.Type
-				if embeddedType.Kind() == reflect.Ptr {
+				if embeddedType.Kind() == reflect.Pointer {
 					embeddedType = embeddedType.Elem()
 				}
 

backend/database/storage/storage.go

@@ -92,16 +92,10 @@ func quickSetup(store *bolt.BoltStore) {
 			settings.Config.Auth.AdminPassword = "admin"
 		}
 		user.Password = settings.Config.Auth.AdminPassword
-		user.Permissions.Admin = true
-		user.Scopes = []users.SourceScope{}
-		for _, val := range settings.Config.Server.Sources {
-			user.Scopes = append(user.Scopes, users.SourceScope{
-				Name:  val.Path, // backend name is path
-				Scope: "",
-			})
-		}
 		user.LockPassword = false
+		download := user.Permissions.Download
 		user.Permissions = settings.AdminPerms()
+		user.Permissions.Download = download
 		user.ShowFirstLogin = settings.Env.IsFirstLoad && user.Permissions.Admin
 		logger.Debugf("Creating user as admin: %v %v", user.Username, user.Password)
 		err = store.Users.Save(user, true, true)
@@ -130,6 +124,7 @@ func CreateUser(userInfo users.User, permissions users.Permissions) error {
 	}
 	settings.ApplyUserDefaults(newUser)
 	newUser.Permissions = permissions
+	newUser.Version = users.CurrentUserMigrationVersion
 	logger.Debugf("Creating user: %v %v", userInfo.Username, userInfo.Scopes)
 	// create new home directories
 	err := userStore.Save(newUser, true, false)

backend/database/users/conversions.go

@@ -5,6 +5,23 @@ import (
 	"strings"
 )
 
+// ResolveSourceKey maps a string that is either:
+//   - the configured source filesystem path (canonical Bolt / in-memory form for
+//     SourceScope.Name and source-type SidebarLink.SourceName), or
+//   - the source display name (JSON form from clients).
+//
+// Path is checked first so absolute paths are unambiguous. Used on write paths
+// (normalize to Path) and read paths (normalize API to display Name).
+func ResolveSourceKey(key string) (SourceInfo, bool) {
+	if sourceConfig == nil || key == "" {
+		return SourceInfo{}, false
+	}
+	if info, ok := sourceConfig.GetSourceByPath(key); ok {
+		return info, true
+	}
+	return sourceConfig.GetSourceByName(key)
+}
+
 // GetSourceNames returns all source names the user has access to (assumes backend-style scopes)
 func (u *User) GetSourceNames() []string {
 	if sourceConfig == nil {
@@ -24,10 +41,9 @@ func (u *User) GetSourceNames() []string {
 	return sources
 }
 
-// GetBackendScopes converts the user's scopes from frontend-style to backend-style
+// GetBackendScopes normalizes scopes for Bolt: SourceScope.Name is always the source filesystem path.
+// Incoming rows (API) may use display name or path; legacy rows may use either.
 func (u *User) GetBackendScopes() ([]SourceScope, error) {
-	// Only convert scopes if they are not empty
-	// Empty scopes during update should remain empty (not filled with defaults)
 	if len(u.Scopes) == 0 {
 		return []SourceScope{}, nil
 	}
@@ -37,24 +53,8 @@ func (u *User) GetBackendScopes() ([]SourceScope, error) {
 
 	newScopes := []SourceScope{}
 	for _, scope := range u.Scopes {
-		// First check if its already a path name and keep it
-		source, ok := sourceConfig.GetSourceByPath(scope.Name)
-		if ok {
-			if scope.Scope == "" {
-				scope.Scope = source.DefaultUserScope
-			}
-			scope.Scope = normalizeScope(scope.Scope)
-			newScopes = append(newScopes, SourceScope{
-				Name:  source.Path, // backend name is path
-				Scope: scope.Scope,
-			})
-			continue
-		}
-
-		// Check if its the name of a source and convert it to a path
-		source, ok = sourceConfig.GetSourceByName(scope.Name)
+		source, ok := ResolveSourceKey(scope.Name)
 		if !ok {
-			// source might no longer be configured
 			continue
 		}
 		if scope.Scope == "" {
@@ -62,15 +62,15 @@ func (u *User) GetBackendScopes() ([]SourceScope, error) {
 		}
 		scope.Scope = normalizeScope(scope.Scope)
 		newScopes = append(newScopes, SourceScope{
-			Name:  source.Path, // backend name is path
+			Name:  source.Path,
 			Scope: scope.Scope,
 		})
 	}
 	return newScopes, nil
 }
 
-// GetFrontendScopes converts the user's scopes from backend-style to frontend-style
-// Backend scopes use source paths, frontend scopes use source names
+// GetFrontendScopes converts scopes for JSON clients: SourceScope.Name is always the source display name.
+// Assumes Bolt stores paths (GetBackendScopes); unknown keys are omitted.
 func (u *User) GetFrontendScopes() []SourceScope {
 	if sourceConfig == nil {
 		return []SourceScope{}
@@ -78,19 +78,19 @@ func (u *User) GetFrontendScopes() []SourceScope {
 
 	newScopes := []SourceScope{}
 	for _, scope := range u.Scopes {
-		if source, ok := sourceConfig.GetSourceByPath(scope.Name); ok {
-			// Replace scope.Name with source.Name while keeping the same Scope value
-			newScopes = append(newScopes, SourceScope{
-				Name:  source.Name,
-				Scope: scope.Scope,
-			})
+		source, ok := ResolveSourceKey(scope.Name)
+		if !ok {
+			continue
 		}
+		newScopes = append(newScopes, SourceScope{
+			Name:  source.Name,
+			Scope: scope.Scope,
+		})
 	}
 	return newScopes
 }
 
-// GetBackendSidebarLinks converts the user's sidebar links from frontend-style to backend-style
-// Validates that sources exist and converts source names to paths
+// GetBackendSidebarLinks normalizes source links for Bolt: SourceName is the filesystem path.
 func (u *User) GetBackendSidebarLinks() ([]SidebarLink, error) {
 	if sourceConfig == nil {
 		return nil, fmt.Errorf("source config not initialized")
@@ -98,52 +98,27 @@ func (u *User) GetBackendSidebarLinks() ([]SidebarLink, error) {
 
 	newLinks := []SidebarLink{}
 	for _, link := range u.SidebarLinks {
-		// For source links, validate that the source exists using SourceName
 		if strings.HasPrefix(link.Category, "source") {
 			if link.SourceName == "" {
 				return nil, fmt.Errorf("source link missing sourceName (link name: %v)", link.Name)
 			}
 			// Validate source exists
 			sourceInfo, ok := sourceConfig.GetSourceByName(link.SourceName)
-			if !ok {
+			sourceInfo2, ok2 := sourceConfig.GetSourceByPath(link.SourceName)
+			if !ok && !ok2 {
 				return nil, fmt.Errorf("source not found: %v (link name: %v)", link.SourceName, link.Name)
 			}
-			link.SourceName = sourceInfo.Path // if name changes keep link alive
+			if ok {
+				link.SourceName = sourceInfo.Path
+			} else {
+				link.SourceName = sourceInfo2.Path
+			}
 		}
-		// Store the link as-is with all fields preserved
 		newLinks = append(newLinks, link)
 	}
 	return newLinks, nil
 }
 
-// GetFrontendSidebarLinks converts the user's sidebar links from backend-style to frontend-style
-// Converts source paths to source names for the frontend
-func (u *User) GetFrontendSidebarLinks() []SidebarLink {
-	if sourceConfig == nil {
-		return []SidebarLink{}
-	}
-
-	newLinks := []SidebarLink{}
-	for _, link := range u.SidebarLinks {
-		// For source links, validate that the source still exists
-		if strings.HasPrefix(link.Category, "source") {
-			if link.SourceName == "" {
-				continue
-			}
-			// Check if source exists
-			sourceInfo, ok := sourceConfig.GetSourceByPath(link.SourceName)
-			if !ok {
-				continue
-			}
-			link.SourceName = sourceInfo.Name
-		}
-		// For share links, just pass through (shares are validated separately)
-		// For all other links, pass through as-is
-		newLinks = append(newLinks, link)
-	}
-	return newLinks
-}
-
 // normalizeScope ensures scope starts with / and doesn't end with / (except for root)
 func normalizeScope(scope string) string {
 	if !strings.HasPrefix(scope, "/") {

backend/database/users/users.go

@@ -7,7 +7,8 @@ import (
 	jwt "github.com/golang-jwt/jwt/v4"
 )
 
-const ()
+// CurrentUserMigrationVersion is persisted for newly created accounts and after legacy migrations finish.
+const CurrentUserMigrationVersion = 3
 
 type LoginMethod string
 
@@ -19,6 +20,35 @@ const (
 	LoginMethodJwt      LoginMethod = "jwt"
 )
 
+// WebAuthnCredentialFlags mirrors the boolean flags from authenticator data.
+type WebAuthnCredentialFlags struct {
+	UserPresent    bool `json:"userPresent"`
+	UserVerified   bool `json:"userVerified"`
+	BackupEligible bool `json:"backupEligible"`
+	BackupState    bool `json:"backupState"`
+}
+
+// WebAuthnCredential stores a single passkey credential in BoltDB-friendly format.
+type WebAuthnCredential struct {
+	ID                string                  `json:"id"`
+	PublicKey         string                  `json:"publicKey"`
+	AttestationType   string                  `json:"attestationType"`
+	AttestationFormat string                  `json:"attestationFormat"`
+	Transport         []string                `json:"transport"`
+	Flags             WebAuthnCredentialFlags `json:"flags"`
+	AAGUID            string                  `json:"aaguid"`
+	SignCount         uint32                  `json:"signCount"`
+	CloneWarning      bool                    `json:"cloneWarning"`
+	Name              string                  `json:"name"`
+	CreatedAt         int64                   `json:"createdAt"`
+	LastUsedAt        int64                   `json:"lastUsedAt"`
+	ClientDataJSON    string                  `json:"clientDataJSON"`
+	ClientDataHash    string                  `json:"clientDataHash"`
+	AuthenticatorData string                  `json:"authenticatorData"`
+	PublicKeyAlg      int64                   `json:"publicKeyAlg"`
+	AttestationObj    string                  `json:"attestationObj"`
+}
+
 type AuthToken struct {
 	MinimalAuthToken
 	Key         string      `json:"key,omitempty"` // for backward compatibility
@@ -66,30 +96,31 @@ type Preview struct {
 	Models             bool `json:"models"`             // show live thumbnails for 3D models files
 }
 
-// User describes a user.
+// User describes a persisted account. Scopes and source sidebar links store filesystem paths in Name/SourceName;
+// JSON responses use display names only (see http prepForFrontend).
 type User struct {
 	NonAdminEditable
-	DisableSettings bool                 `json:"disableSettings"`
-	ID              uint                 `storm:"id,increment" json:"id"`
-	Username        string               `storm:"unique" json:"username"`
-	Scopes          []SourceScope        `json:"scopes"`
-	Scope           string               `json:"scope,omitempty"`
-	LockPassword    bool                 `json:"lockPassword"`
-	Permissions     Permissions          `json:"permissions"`
-	ApiKeys         map[string]AuthToken `json:"apiKeys,omitempty"` // deprecated: use Tokens instead
-	Tokens          map[string]AuthToken `json:"tokens,omitempty"`
-	TOTPSecret      string               `json:"totpSecret,omitempty"`
-	TOTPNonce       string               `json:"totpNonce,omitempty"`
-	LoginMethod     LoginMethod          `json:"loginMethod"`
-	OtpEnabled      bool                 `json:"otpEnabled"` // true if TOTP is enabled, false otherwise
-	Version         int                  `json:"version"`
+	DisableSettings      bool                  `json:"disableSettings"`
+	ID                   uint                  `storm:"id,increment" json:"id"`
+	Username             string                `storm:"unique" json:"username"`
+	Scopes               []SourceScope         `json:"scopes"`
+	Scope                string                `json:"scope,omitempty"`
+	LockPassword         bool                  `json:"lockPassword"`
+	Permissions          Permissions           `json:"permissions"`
+	ApiKeys              map[string]AuthToken  `json:"apiKeys,omitempty"` // deprecated: use Tokens instead
+	Tokens               map[string]AuthToken  `json:"tokens,omitempty"`
+	TOTPSecret           string                `json:"totpSecret,omitempty"`
+	TOTPNonce            string                `json:"totpNonce,omitempty"`
+	LoginMethod          LoginMethod           `json:"loginMethod"`
+	OtpEnabled           bool                  `json:"otpEnabled"` // true if TOTP is enabled, false otherwise
+	Version              int                   `json:"version"`
 	// legacy for migration purposes... og filebrowser has perm attribute
 	Perm Permissions `json:"perm,omitzero"` // deprecated: use Permissions instead
 }
 
 type SourceScope struct {
-	Name  string `json:"name"`
-	Scope string `json:"scope"`
+	Name  string `json:"name"`  // Bolt: filesystem path; JSON API: display name after prepForFrontend
+	Scope string `json:"scope"` // index path within that source
 }
 
 // json tags must match variable name with smaller case first letter
@@ -108,6 +139,7 @@ type NonAdminEditable struct {
 	SingleClick                bool          `json:"singleClick"` // open directory on single click, also enables middle click to open in new tab
 	Sorting                    Sorting       `json:"sorting"`
 	ShowHidden                 bool          `json:"showHidden"`                 // show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+	HideFileExt                string        `json:"hideFileExt"`                // space separated list of file extensions to hide in UI and API
 	DateFormat                 bool          `json:"dateFormat"`                 // when false, the date is relative, when true, the date is an exact timestamp
 	GallerySize                int           `json:"gallerySize"`                // 0-9 - the size of the gallery thumbnails
 	ThemeColor                 string        `json:"themeColor"`                 // theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
@@ -121,13 +153,15 @@ type NonAdminEditable struct {
 	CustomTheme                string        `json:"customTheme"`                // Name of theme to use chosen from custom themes config.
 	ShowSelectMultiple         bool          `json:"showSelectMultiple"`         // show select multiple files on desktop
 	ShowCopyPath               bool          `json:"showCopyPath"`               // show copy path action in the context menu
+	ShowToolsInSidebar         bool          `json:"showToolsInSidebar"`         // when false, sidebar hides links with category "tool" (default: true)
 	DebugOffice                bool          `json:"debugOffice"`                // debug onlyoffice editor
 	OtpEnabled                 bool          `json:"otpEnabled"`                 // allow non-admin users to disable their own OTP
 	SidebarLinks               []SidebarLink `json:"sidebarLinks"`               // customizable sidebar links
 	HideFilesInTree            bool          `json:"hideFilesInTree"`            // hide files in the sidebar tree navigation, when true, will show only directories.
 	DeleteAfterArchive         bool          `json:"deleteAfterArchive"`         // delete source files after successful creation/extraction of archives
 	PreferEditorForMarkdown    bool          `json:"preferEditorForMarkdown"`    // prefer editor first for markdown files instead of the Markdown Viewer
-	ShowFirstLogin             bool          `json:"showFirstLogin"`
+	ShowFirstLogin             bool                  `json:"showFirstLogin"`
+	PasskeyCredentials         []WebAuthnCredential  `json:"passkeyCredentials,omitempty"`
 }
 
 type FileLoading struct {
@@ -143,7 +177,7 @@ type SidebarLink struct {
 	Category   string `json:"category"`             // Category type: "source", "source-link", "share", "tool", "custom", etc.
 	Target     string `json:"target"`               // Target path/URL for the link (relative for source/share)
 	Icon       string `json:"icon"`                 // Material icon name
-	SourceName string `json:"sourceName,omitempty"` // Source identifier for source-type links
+	SourceName string `json:"sourceName,omitempty"` // Bolt: filesystem path. JSON out: display name (after prepForFrontend).
 }
 
 func CleanUsername(s string) string {
@@ -190,6 +224,11 @@ func SetSourceConfig(config *SourceConfigProvider) {
 	sourceConfig = config
 }
 
+// SourceConfigLoaded reports whether SetSourceConfig has been called (needed for ResolveSourceKey).
+func SourceConfigLoaded() bool {
+	return sourceConfig != nil
+}
+
 // GetScopeForSourcePath returns the scope for a given source path (backend-style)
 // This method works with backend-style scopes where Name is the source path
 func (u *User) GetScopeForSourcePath(sourcePath string) (string, error) {

backend/database/users/webauthn.go

@@ -0,0 +1,127 @@
+package users
+
+import (
+	"encoding/base64"
+	"fmt"
+	"time"
+
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/webauthn"
+)
+
+// WebAuthnID returns the user handle used by WebAuthn.
+func (u *User) WebAuthnID() []byte {
+	return []byte(fmt.Sprintf("%d", u.ID))
+}
+
+// WebAuthnName returns the human-readable name for the user.
+func (u *User) WebAuthnName() string {
+	return u.Username
+}
+
+// WebAuthnDisplayName returns the display name for the user.
+func (u *User) WebAuthnDisplayName() string {
+	return u.Username
+}
+
+// WebAuthnCredentials returns the stored credentials converted to the library's type.
+func (u *User) WebAuthnCredentials() []webauthn.Credential {
+	creds := make([]webauthn.Credential, len(u.PasskeyCredentials))
+	for i, c := range u.PasskeyCredentials {
+		creds[i] = *credentialToLibrary(&c)
+	}
+	return creds
+}
+
+// HasPasskeyMFA returns true if the user has at least one passkey credential configured.
+func (u *User) HasPasskeyMFA() bool {
+	return len(u.PasskeyCredentials) > 0
+}
+
+// credentialToLibrary converts our BoltDB-safe WebAuthnCredential to the library's Credential.
+func credentialToLibrary(c *WebAuthnCredential) *webauthn.Credential {
+	id, _ := base64.RawURLEncoding.DecodeString(c.ID)
+	pubKey, _ := base64.RawURLEncoding.DecodeString(c.PublicKey)
+	aaguid, _ := base64.RawURLEncoding.DecodeString(c.AAGUID)
+	cdj, _ := base64.RawURLEncoding.DecodeString(c.ClientDataJSON)
+	cdh, _ := base64.RawURLEncoding.DecodeString(c.ClientDataHash)
+	authData, _ := base64.RawURLEncoding.DecodeString(c.AuthenticatorData)
+	attObj, _ := base64.RawURLEncoding.DecodeString(c.AttestationObj)
+
+	transports := make([]protocol.AuthenticatorTransport, len(c.Transport))
+	for i, t := range c.Transport {
+		transports[i] = protocol.AuthenticatorTransport(t)
+	}
+
+	return &webauthn.Credential{
+		ID:                id,
+		PublicKey:         pubKey,
+		AttestationType:   c.AttestationType,
+		AttestationFormat: c.AttestationFormat,
+		Transport:         transports,
+		Flags: webauthn.CredentialFlags{
+			UserPresent:    c.Flags.UserPresent,
+			UserVerified:   c.Flags.UserVerified,
+			BackupEligible: c.Flags.BackupEligible,
+			BackupState:    c.Flags.BackupState,
+		},
+		Authenticator: webauthn.Authenticator{
+			AAGUID:       aaguid,
+			SignCount:    c.SignCount,
+			CloneWarning: c.CloneWarning,
+		},
+		Attestation: webauthn.CredentialAttestation{
+			ClientDataJSON:     cdj,
+			ClientDataHash:     cdh,
+			AuthenticatorData:  authData,
+			PublicKeyAlgorithm: c.PublicKeyAlg,
+			Object:             attObj,
+		},
+	}
+}
+
+// CredentialFromLibrary converts a library Credential to our BoltDB-safe format.
+func CredentialFromLibrary(name string, cred *webauthn.Credential) WebAuthnCredential {
+	transports := make([]string, len(cred.Transport))
+	for i, t := range cred.Transport {
+		transports[i] = string(t)
+	}
+
+	now := time.Now().Unix()
+
+	return WebAuthnCredential{
+		ID:                base64.RawURLEncoding.EncodeToString(cred.ID),
+		PublicKey:         base64.RawURLEncoding.EncodeToString(cred.PublicKey),
+		AttestationType:   cred.AttestationType,
+		AttestationFormat: cred.AttestationFormat,
+		Transport:         transports,
+		Flags: WebAuthnCredentialFlags{
+			UserPresent:    cred.Flags.UserPresent,
+			UserVerified:   cred.Flags.UserVerified,
+			BackupEligible: cred.Flags.BackupEligible,
+			BackupState:    cred.Flags.BackupState,
+		},
+		AAGUID:            base64.RawURLEncoding.EncodeToString(cred.Authenticator.AAGUID),
+		SignCount:         cred.Authenticator.SignCount,
+		CloneWarning:      cred.Authenticator.CloneWarning,
+		Name:              name,
+		CreatedAt:         now,
+		LastUsedAt:        now,
+		ClientDataJSON:    base64.RawURLEncoding.EncodeToString(cred.Attestation.ClientDataJSON),
+		ClientDataHash:    base64.RawURLEncoding.EncodeToString(cred.Attestation.ClientDataHash),
+		AuthenticatorData: base64.RawURLEncoding.EncodeToString(cred.Attestation.AuthenticatorData),
+		PublicKeyAlg:      cred.Attestation.PublicKeyAlgorithm,
+		AttestationObj:    base64.RawURLEncoding.EncodeToString(cred.Attestation.Object),
+	}
+}
+
+// UpdateCredentialFromLibrary updates an existing WebAuthnCredential from the library's Credential
+// (used after login to update sign count, flags, and last used time).
+func UpdateCredentialFromLibrary(c *WebAuthnCredential, cred *webauthn.Credential) {
+	c.SignCount = cred.Authenticator.SignCount
+	c.Flags.UserPresent = cred.Flags.UserPresent
+	c.Flags.UserVerified = cred.Flags.UserVerified
+	c.Flags.BackupEligible = cred.Flags.BackupEligible
+	c.Flags.BackupState = cred.Flags.BackupState
+	c.LastUsedAt = time.Now().Unix()
+}

backend/go.mod

@@ -11,33 +11,35 @@ require (
 	github.com/gen2brain/go-fitz v1.24.15
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/go-playground/validator/v10 v10.30.2
+	github.com/go-webauthn/webauthn v0.17.3
 	github.com/goccy/go-yaml v1.19.2
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/google/go-cmp v0.7.0
 	github.com/gtsteffaniak/go-cache v1.1.0
 	github.com/gtsteffaniak/go-logger v1.1.0
 	github.com/kovidgoyal/imaging v1.8.21
-	github.com/mattn/go-sqlite3 v1.14.42
+	github.com/mattn/go-sqlite3 v1.14.44
 	github.com/pquerna/otp v1.5.0
 	github.com/spf13/afero v1.15.0
 	github.com/stretchr/testify v1.11.1
 	github.com/swaggo/http-swagger v1.3.4
 	github.com/swaggo/swag v1.16.6
-	golang.org/x/crypto v0.50.0
-	golang.org/x/image v0.39.0
-	golang.org/x/mod v0.35.0
-	golang.org/x/net v0.53.0
+	golang.org/x/crypto v0.51.0
+	golang.org/x/image v0.40.0
+	golang.org/x/mod v0.36.0
+	golang.org/x/net v0.54.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sys v0.43.0
+	golang.org/x/sys v0.44.0
 	golang.org/x/time v0.15.0
-	golang.org/x/tools v0.44.0
+	golang.org/x/tools v0.45.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.50.0
+	modernc.org/sqlite v1.50.1
 )
 
 require (
 	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
 	4d63.com/gochecknoglobals v0.2.2 // indirect
+	charm.land/lipgloss/v2 v2.0.3 // indirect
 	codeberg.org/chavacava/garif v0.2.0 // indirect
 	codeberg.org/polyfloyd/go-errorlint v1.9.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
@@ -52,13 +54,14 @@ require (
 	github.com/Antonboom/testifylint v1.6.4 // indirect
 	github.com/Azure/go-ntlmssp v0.1.1 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/ClickHouse/clickhouse-go-linter v1.2.0 // indirect
 	github.com/Djarvur/go-err113 v0.1.1 // indirect
 	github.com/KyleBanks/depth v1.2.1 // indirect
-	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/MirrexOne/unqueryvet v1.5.4 // indirect
 	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
 	github.com/air-verse/air v1.65.1 // indirect
-	github.com/alecthomas/chroma/v2 v2.23.1 // indirect
+	github.com/alecthomas/chroma/v2 v2.24.1 // indirect
 	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
 	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
 	github.com/alexkohler/prealloc v1.1.0 // indirect
@@ -66,38 +69,40 @@ require (
 	github.com/alingse/asasalint v0.0.11 // indirect
 	github.com/alingse/nilnesserr v0.2.0 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
-	github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
-	github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
-	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/ashanbrown/forbidigo/v2 v2.3.1 // indirect
+	github.com/ashanbrown/makezero/v2 v2.2.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bep/godartsass/v2 v2.5.0 // indirect
 	github.com/bep/golibsass v1.2.0 // indirect
 	github.com/bkielbasa/cyclop v1.2.3 // indirect
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
 	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
-	github.com/bombsimon/wsl/v5 v5.6.0 // indirect
+	github.com/bombsimon/wsl/v5 v5.8.0 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
 	github.com/breml/bidichk v0.3.3 // indirect
 	github.com/breml/errchkjson v0.4.1 // indirect
-	github.com/butuzov/ireturn v0.4.0 // indirect
+	github.com/butuzov/ireturn v0.4.1 // indirect
 	github.com/butuzov/mirror v1.3.0 // indirect
 	github.com/catenacyber/perfsprint v0.10.1 // indirect
 	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charithe/durationcheck v0.0.11 // indirect
-	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
-	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.10.1 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/charmbracelet/colorprofile v0.4.3 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20251205161215-1948445e3318 // indirect
+	github.com/charmbracelet/x/ansi v0.11.7 // indirect
+	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/charmbracelet/x/termios v0.1.1 // indirect
+	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/ckaznocha/intrange v0.3.1 // indirect
+	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
 	github.com/curioswitch/go-reassign v0.3.0 // indirect
 	github.com/daixiang0/gci v0.13.7 // indirect
 	github.com/dave/dst v0.27.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
-	github.com/dlclark/regexp2 v1.11.5 // indirect
+	github.com/dlclark/regexp2 v1.12.0 // indirect
 	github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
 	github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
@@ -107,6 +112,7 @@ require (
 	github.com/fatih/structtag v1.2.0 // indirect
 	github.com/firefart/nonamedreturns v1.0.6 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/ghostiam/protogetter v0.3.20 // indirect
@@ -134,24 +140,28 @@ require (
 	github.com/go-toolsmith/strparse v1.1.0 // indirect
 	github.com/go-toolsmith/typep v1.1.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/go-webauthn/x v0.2.5 // indirect
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/godoc-lint/godoc-lint v0.11.2 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
 	github.com/gohugoio/hugo v0.149.1 // indirect
-	github.com/golang/geo v0.0.0-20260415063119-550b242b3150 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/golang/geo v0.0.0-20260512202753-e3c51de6d1b6 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golangci/asciicheck v0.5.0 // indirect
-	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
+	github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 // indirect
 	github.com/golangci/go-printf-func-name v0.1.1 // indirect
 	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
-	github.com/golangci/golangci-lint/v2 v2.11.4 // indirect
+	github.com/golangci/golangci-lint/v2 v2.12.2 // indirect
 	github.com/golangci/golines v0.15.0 // indirect
 	github.com/golangci/misspell v0.8.0 // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
 	github.com/golangci/revgrep v0.8.0 // indirect
+	github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba // indirect
 	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
 	github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gordonklaus/ineffassign v0.2.0 // indirect
 	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
@@ -159,17 +169,16 @@ require (
 	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
 	github.com/gostaticanalysis/nilerr v0.1.2 // indirect
 	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
-	github.com/hashicorp/go-version v1.8.0 // indirect
+	github.com/hashicorp/go-version v1.9.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jgautheron/goconst v1.8.2 // indirect
-	github.com/jingyugao/rowserrcheck v1.1.1 // indirect
+	github.com/jgautheron/goconst v1.10.0 // indirect
 	github.com/jjti/go-spancheck v0.6.5 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/julz/importas v0.2.0 // indirect
-	github.com/jupiterrider/ffi v0.6.0 // indirect
+	github.com/jupiterrider/ffi v0.7.0 // indirect
 	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
 	github.com/kisielk/errcheck v1.10.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
@@ -186,31 +195,32 @@ require (
 	github.com/ldez/usetesting v0.5.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/leonklingele/grouper v1.1.2 // indirect
-	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/macabu/inamedparam v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.9.1 // indirect
 	github.com/manuelarte/embeddedstructfieldcheck v0.4.0 // indirect
-	github.com/manuelarte/funcorder v0.5.0 // indirect
+	github.com/manuelarte/funcorder v0.6.0 // indirect
 	github.com/maratori/testableexamples v1.0.1 // indirect
 	github.com/maratori/testpackage v1.1.2 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.21 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/mattn/go-runewidth v0.0.23 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
 	github.com/mgechev/revive v1.15.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
 	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.12.1 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
@@ -228,16 +238,17 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
 	github.com/ryancurrah/gomodguard v1.4.1 // indirect
+	github.com/ryancurrah/gomodguard/v2 v2.1.3 // indirect
 	github.com/ryanrolds/sqlclosecheck v0.6.0 // indirect
 	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
-	github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 // indirect
+	github.com/securego/gosec/v2 v2.26.1 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
 	github.com/sonatard/noctx v0.5.1 // indirect
-	github.com/sourcegraph/go-diff v0.7.0 // indirect
+	github.com/sourcegraph/go-diff v0.8.0 // indirect
 	github.com/spf13/cast v1.9.2 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
@@ -249,16 +260,18 @@ require (
 	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/swaggo/files v1.0.1 // indirect
 	github.com/tdewolff/parse/v2 v2.8.3 // indirect
-	github.com/tetafro/godot v1.5.4 // indirect
-	github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 // indirect
+	github.com/tetafro/godot v1.5.6 // indirect
+	github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4 // indirect
 	github.com/timonwong/loggercheck v0.11.0 // indirect
+	github.com/tinylib/msgp v1.6.4 // indirect
 	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
 	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
 	github.com/ultraware/funlen v0.2.0 // indirect
 	github.com/ultraware/whitespace v0.2.0 // indirect
 	github.com/urfave/cli/v2 v2.3.0 // indirect
 	github.com/uudashr/gocognit v1.2.1 // indirect
-	github.com/uudashr/iface v1.4.1 // indirect
+	github.com/uudashr/iface v1.4.2 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xen0n/gosmopolitan v1.3.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yagipy/maintidx v1.0.0 // indirect
@@ -266,7 +279,7 @@ require (
 	github.com/ykadowak/zerologlint v0.1.5 // indirect
 	gitlab.com/bosi/decorder v0.4.2 // indirect
 	go-simpler.org/musttag v0.14.0 // indirect
-	go-simpler.org/sloglint v0.11.1 // indirect
+	go-simpler.org/sloglint v0.12.0 // indirect
 	go.augendre.info/arangolint v0.4.0 // indirect
 	go.augendre.info/fatcontext v0.9.0 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
@@ -276,12 +289,12 @@ require (
 	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
 	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
-	google.golang.org/protobuf v1.36.8 // indirect
+	golang.org/x/text v0.37.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	honnef.co/go/tools v0.7.0 // indirect
-	modernc.org/libc v1.72.1 // indirect
+	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	mvdan.cc/gofumpt v0.9.2 // indirect

backend/go.sum

@@ -2,6 +2,8 @@
 4d63.com/gocheckcompilerdirectives v1.3.0/go.mod h1:ofsJ4zx2QAuIP/NO/NAh1ig6R1Fb18/GI7RVMwz7kAY=
 4d63.com/gochecknoglobals v0.2.2 h1:H1vdnwnMaZdQW/N+NrkT1SZMTBmcwHe9Vq8lJcYYTtU=
 4d63.com/gochecknoglobals v0.2.2/go.mod h1:lLxwTQjL5eIesRbvnzIP3jZtG140FnTdz+AlMa+ogt0=
+charm.land/lipgloss/v2 v2.0.3 h1:yM2zJ4Cf5Y51b7RHIwioil4ApI/aypFXXVHSwlM6RzU=
+charm.land/lipgloss/v2 v2.0.3/go.mod h1:7myLU9iG/3xluAWzpY/fSxYYHCgoKTie7laxk6ATwXA=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -67,14 +69,16 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/ClickHouse/clickhouse-go-linter v1.2.0 h1:zbm174up3hTKjp0wKZVnTzRiG7tSF5XZF0FJG/MuCBI=
+github.com/ClickHouse/clickhouse-go-linter v1.2.0/go.mod h1:pLorS7ffPTfuUV9M0SJgfHA/h/WQPQUk2FWG9x74cQ4=
 github.com/DataDog/zstd v1.4.1 h1:3oxKN3wbHibqx897utPC2LTQU4J+IHWWJO+glkAkpFM=
 github.com/DataDog/zstd v1.4.1/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
 github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g=
 github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/MirrexOne/unqueryvet v1.5.4 h1:38QOxShO7JmMWT+eCdDMbcUgGCOeJphVkzzRgyLJgsQ=
 github.com/MirrexOne/unqueryvet v1.5.4/go.mod h1:fs9Zq6eh1LRIhsDIsxf9PONVUjYdFHdtkHIgZdJnyPU=
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsuj3piCMx4=
@@ -85,8 +89,8 @@ github.com/air-verse/air v1.65.1 h1:G4hy4YemKrIcGAvYMor+86PhxdtBEq0n9ebJ4RoYy8w=
 github.com/air-verse/air v1.65.1/go.mod h1:OaJZSfZqf7wyjS2oP/CcEVyIt0JmZuPh5x1gdtklmmY=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
-github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
+github.com/alecthomas/chroma/v2 v2.24.1 h1:m5ffpfZbIb++k8AqFEKy9uVgY12xIQtBsQlc6DfZJQM=
+github.com/alecthomas/chroma/v2 v2.24.1/go.mod h1:l+ohZ9xRXIbGe7cIW+YZgOGbvuVLjMps/FYN/CwuabI=
 github.com/alecthomas/go-check-sumtype v0.3.1 h1:u9aUvbGINJxLVXiFvHUlPEaD7VDULsrxJb4Aq31NLkU=
 github.com/alecthomas/go-check-sumtype v0.3.1/go.mod h1:A8TSiN3UPRw3laIgWEUOHHLPa6/r9MtoigdlP5h3K/E=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
@@ -114,12 +118,10 @@ github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c h1:651/eoCRnQ7YtS
 github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asdine/storm/v3 v3.2.1 h1:I5AqhkPK6nBZ/qJXySdI7ot5BlXSZ7qvDY1zAn5ZJac=
 github.com/asdine/storm/v3 v3.2.1/go.mod h1:LEpXwGt4pIqrE/XcTvCnZHT5MgZCV6Ub9q7yQzOFWr0=
-github.com/ashanbrown/forbidigo/v2 v2.3.0 h1:OZZDOchCgsX5gvToVtEBoV2UWbFfI6RKQTir2UZzSxo=
-github.com/ashanbrown/forbidigo/v2 v2.3.0/go.mod h1:5p6VmsG5/1xx3E785W9fouMxIOkvY2rRV9nMdWadd6c=
-github.com/ashanbrown/makezero/v2 v2.1.0 h1:snuKYMbqosNokUKm+R6/+vOPs8yVAi46La7Ck6QYSaE=
-github.com/ashanbrown/makezero/v2 v2.1.0/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/ashanbrown/forbidigo/v2 v2.3.1 h1:KAZijvQ7zeIBKbhikT4jCm0TLYXC4u78bTiLh/8JROI=
+github.com/ashanbrown/forbidigo/v2 v2.3.1/go.mod h1:2QDkLTzU6TV937eFROamXrW92M3paehdae4HCDCOZCM=
+github.com/ashanbrown/makezero/v2 v2.2.1 h1:A7uU8dgB1PA9aelTxHMfHIQ8Qev8AB3JLxJUBUsejqM=
+github.com/ashanbrown/makezero/v2 v2.2.1/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -160,8 +162,8 @@ github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ
 github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
 github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
 github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
-github.com/bombsimon/wsl/v5 v5.6.0 h1:4z+/sBqC5vUmSp1O0mS+czxwH9+LKXtCWtHH9rZGQL8=
-github.com/bombsimon/wsl/v5 v5.6.0/go.mod h1:Uqt2EfrMj2NV8UGoN1f1Y3m0NpUVCsUdrNCdet+8LvU=
+github.com/bombsimon/wsl/v5 v5.8.0 h1:JTkyfs4yl8SPejrCF2GdABXE+mO1WvM7iUYzRWlsxDs=
+github.com/bombsimon/wsl/v5 v5.8.0/go.mod h1:AbOLsulgkqP4ZnitHf9gwPtCOGlrzkk0jb0uNxRSY0o=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
 github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
@@ -169,8 +171,8 @@ github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
 github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE=
 github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg=
 github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s=
-github.com/butuzov/ireturn v0.4.0 h1:+s76bF/PfeKEdbG8b54aCocxXmi0wvYdOVsWxVO7n8E=
-github.com/butuzov/ireturn v0.4.0/go.mod h1:ghI0FrCmap8pDWZwfPisFD1vEc56VKH4NpQUxDHta70=
+github.com/butuzov/ireturn v0.4.1 h1:vWb3NO4t77iku/sjCQ/2pHTQeOmxEhjIriJqRLg1Y+I=
+github.com/butuzov/ireturn v0.4.1/go.mod h1:q+DXKzTDV5guNuXLnIab9fKXizTn2miZHLhxH7V/GB4=
 github.com/butuzov/mirror v1.3.0 h1:HdWCXzmwlQHdVhwvsfBb2Au0r3HyINry3bDWLYXiKoc=
 github.com/butuzov/mirror v1.3.0/go.mod h1:AEij0Z8YMALaq4yQj9CPPVYOyJQyiexpQEQgihajRfI=
 github.com/catenacyber/perfsprint v0.10.1 h1:u7Riei30bk46XsG8nknMhKLXG9BcXz3+3tl/WpKm0PQ=
@@ -184,16 +186,18 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1DidBcABctk=
 github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4=
-github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
-github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
-github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
-github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
-github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
-github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
-github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
+github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
+github.com/charmbracelet/ultraviolet v0.0.0-20251205161215-1948445e3318 h1:OqDqxQZliC7C8adA7KjelW3OjtAxREfeHkNcd66wpeI=
+github.com/charmbracelet/ultraviolet v0.0.0-20251205161215-1948445e3318/go.mod h1:Y6kE2GzHfkyQQVCSL9r2hwokSrIlHGzZG+71+wDYSZI=
+github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
+github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
+github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
+github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
+github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY=
+github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo=
+github.com/charmbracelet/x/windows v0.2.2 h1:IofanmuvaxnKHuV04sC0eBy/smG6kIKrWG2/jYn2GuM=
+github.com/charmbracelet/x/windows v0.2.2/go.mod h1:/8XtdKZzedat74NQFn0NGlGL4soHB0YQZrETF96h75k=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -202,6 +206,10 @@ github.com/ckaznocha/intrange v0.3.1/go.mod h1:QVepyz1AkUoFQkpEqksSYpNpUo3c5W7nW
 github.com/clbanning/mxj/v2 v2.7.0 h1:WA/La7UGCanFe5NpHF0Q3DNtnCsVoxbPKuyBNHWRyME=
 github.com/clbanning/mxj/v2 v2.7.0/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
 github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
@@ -227,8 +235,8 @@ github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8 h1:OtSeLS5y0Uy01jaKK4m
 github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8/go.mod h1:apkPC/CR3s48O2D7Y++n1XWEpgPNNCjXYga3PPbJe2E=
 github.com/disintegration/gift v1.2.1 h1:Y005a1X4Z7Uc+0gLpSAsKhWi4qLtsdEcMIbbdvdZ6pc=
 github.com/disintegration/gift v1.2.1/go.mod h1:Jh2i7f7Q2BM7Ezno3PhfezbR1xpUg9dUg3/RlKGr4HI=
-github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
-github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dsoprea/go-exif/v2 v2.0.0-20200321225314-640175a69fe4/go.mod h1:Lm2lMM2zx8p4a34ZemkaUV95AnMl4ZvLbCUbwOvLC2E=
 github.com/dsoprea/go-exif/v3 v3.0.0-20200717053412-08f1b6708903/go.mod h1:0nsO1ce0mh5czxGeLo4+OCZ/C6Eo6ZlMWsz7rH/Gxv8=
 github.com/dsoprea/go-exif/v3 v3.0.0-20210625224831-a6301f85c82b/go.mod h1:cg5SNYKHMmzxsr9X6ZeLh/nfBRHHp5PngtEPcujONtk=
@@ -269,6 +277,8 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
@@ -367,6 +377,10 @@ github.com/go-toolsmith/typep v1.1.0 h1:fIRYDyF+JywLfqzyhdiHzRop/GQDxxNhLGQ6gFUN
 github.com/go-toolsmith/typep v1.1.0/go.mod h1:fVIw+7zjdsMxDA3ITWnH1yOiw1rnTQKCsF/sk2H/qig=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-webauthn/webauthn v0.17.3 h1:XHZ0TXV7k8vChcE4TFgPitOPJ5cb7h1dpAeFDS0cjCo=
+github.com/go-webauthn/webauthn v0.17.3/go.mod h1:PlkMgmuL9McCT7dvgBj/Sz/fgs3V6ZID6/KnFkEcPvQ=
+github.com/go-webauthn/x v0.2.5 h1:wEVTfU04XFyPTXGQbKOQwMKhcDWfDAkdsDDBsDaG9yY=
+github.com/go-webauthn/x v0.2.5/go.mod h1:Qna/yJz9rV6lRzwl5BfYbmTJpVGxcBIds3gJtw2tlGg=
 github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY=
 github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
@@ -398,11 +412,13 @@ github.com/gohugoio/localescompressed v1.0.1 h1:KTYMi8fCWYLswFyJAeOtuk/EkXR/KPTH
 github.com/gohugoio/localescompressed v1.0.1/go.mod h1:jBF6q8D7a0vaEmcWPNcAjUZLJaIVNiwvM3WlmTvooB0=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/geo v0.0.0-20190916061304-5b978397cfec/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/geo v0.0.0-20200319012246-673a6f80352d/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/geo v0.0.0-20210211234256-740aa86cb551/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
-github.com/golang/geo v0.0.0-20260415063119-550b242b3150 h1:F5CQANtNulclG+xJt370ohUujAEHq2XNBBAjkoSukQI=
-github.com/golang/geo v0.0.0-20260415063119-550b242b3150/go.mod h1:Mymr9kRGDc64JPr03TSZmuIBODZ3KyswLzm1xL0HFA8=
+github.com/golang/geo v0.0.0-20260512202753-e3c51de6d1b6 h1:maAhA7cpighmEi96eTgDdmlhwnHYEgwhR6t+T7k3Png=
+github.com/golang/geo v0.0.0-20260512202753-e3c51de6d1b6/go.mod h1:Mymr9kRGDc64JPr03TSZmuIBODZ3KyswLzm1xL0HFA8=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -436,14 +452,14 @@ github.com/golang/snappy v0.0.1 h1:Qgr9rKW7uDUkrbSmQeiDsGa8SjGyCOGtuasMWwvp2P4=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golangci/asciicheck v0.5.0 h1:jczN/BorERZwK8oiFBOGvlGPknhvq0bjnysTj4nUfo0=
 github.com/golangci/asciicheck v0.5.0/go.mod h1:5RMNAInbNFw2krqN6ibBxN/zfRFa9S6tA1nPdM0l8qQ=
-github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 h1:WUvBfQL6EW/40l6OmeSBYQJNSif4O11+bmWEz+C7FYw=
-github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
+github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 h1:CbTB8KpqnViI6lIXxp03Oclc4VFHi3K4BWC1TacsZ+A=
+github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
 github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarogrvjO9AfiW3B4U=
 github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d h1:viFft9sS/dxoYY0aiOTsLKO2aZQAPT4nlQCsimGcSGE=
 github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d/go.mod h1:ivJ9QDg0XucIkmwhzCDsqcnxxlDStoTl89jDMIoNxKY=
-github.com/golangci/golangci-lint/v2 v2.11.4 h1:GK+UlZBN5y7rh2PBnHA93XLSX6RaF7uhzJQ3JwU1wuA=
-github.com/golangci/golangci-lint/v2 v2.11.4/go.mod h1:ODQDCASMA3VqfZYIbbQLpTRTzV7O/vjmIRF6u8NyFwI=
+github.com/golangci/golangci-lint/v2 v2.12.2 h1:7+d1uY0bq1MU2UV3R5pW5Q7QWdcoq4naMRXM+gsJKrs=
+github.com/golangci/golangci-lint/v2 v2.12.2/go.mod h1:opqHHuIcTG2R+4akzWMd4o1BnD9/1LcjICWOujr91U8=
 github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
 github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
 github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
@@ -452,6 +468,8 @@ github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3H
 github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
 github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
 github.com/golangci/revgrep v0.8.0/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k=
+github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba h1:lqtcnSMDuuJdu/LrKWi5RJzpSNLOJXYe/nzQutTI5kg=
+github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba/go.mod h1:sCBNcpRmhJCtbFGz49+IM3ETTFf7QdJ30AeYCd43NKk=
 github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e h1:ai0EfmVYE2bRA5htgAG9r7s3tHsfjIhN98WshBTJ9jM=
 github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e/go.mod h1:Vrn4B5oR9qRwM+f54koyeH3yzphlecwERs0el27Fr/s=
 github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqtt0ssnqSJNNndxe69DOQ24A5h7+i3KpM=
@@ -471,6 +489,10 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc=
+github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -515,8 +537,8 @@ github.com/hashicorp/go-immutable-radix/v2 v2.1.0/go.mod h1:hgdqLXA4f6NIjRVisM1T
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
-github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
+github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
@@ -544,10 +566,8 @@ github.com/jdkato/prose v1.2.1 h1:Fp3UnJmLVISmlc57BgKUzdjr0lOtjqTZicL3PaYy6cU=
 github.com/jdkato/prose v1.2.1/go.mod h1:AiRHgVagnEx2JbQRQowVBKjG0bcs/vtkGCH1dYAL1rA=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/jgautheron/goconst v1.8.2 h1:y0XF7X8CikZ93fSNT6WBTb/NElBu9IjaY7CCYQrCMX4=
-github.com/jgautheron/goconst v1.8.2/go.mod h1:A0oxgBCHy55NQn6sYpO7UdnA9p+h7cPtoOZUmvNIako=
-github.com/jingyugao/rowserrcheck v1.1.1 h1:zibz55j/MJtLsjP1OF4bSdgXxwL1b+Vn7Tjzq7gFzUs=
-github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
+github.com/jgautheron/goconst v1.10.0 h1:Ptt+OoE4NaEWKhLrWrrN3IpZdGLiqaf7WLnEX/iv4Jw=
+github.com/jgautheron/goconst v1.10.0/go.mod h1:0p+wv1lFOiUr0IlNNT1nrm6+8DB8u2sU6KHGzFRXHDc=
 github.com/jjti/go-spancheck v0.6.5 h1:lmi7pKxa37oKYIMScialXUK6hP3iY5F1gu+mLBPgYB8=
 github.com/jjti/go-spancheck v0.6.5/go.mod h1:aEogkeatBrbYsyW6y5TgDfihCulDYciL1B7rG2vSsrU=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
@@ -565,8 +585,8 @@ github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7V
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
 github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
-github.com/jupiterrider/ffi v0.6.0 h1:UX378KcZvH5c8qgLi9KL/bL82SZTHdRspZ+jj7bvBng=
-github.com/jupiterrider/ffi v0.6.0/go.mod h1:PqZ5Go6X9by8CIXgfprxfMPYmn8oT5m2O7AA56s64bY=
+github.com/jupiterrider/ffi v0.7.0 h1:RKsl6Ascal+3kyAqR5Qcbp83LceQMLc1VZbPfHWoNzs=
+github.com/jupiterrider/ffi v0.7.0/go.mod h1:9dauhpOfNqrqk28fxuu0kkdeFtT9Qr4vbfigiuIXN7c=
 github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
 github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
 github.com/kisielk/errcheck v1.10.0 h1:Lvs/YAHP24YKg08LA8oDw2z9fJVme090RAXd90S+rrw=
@@ -614,8 +634,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
 github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA=
-github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
-github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
+github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/macabu/inamedparam v0.2.0 h1:VyPYpOc10nkhI2qeNUdh3Zket4fcZjEWe35poddBCpE=
 github.com/macabu/inamedparam v0.2.0/go.mod h1:+Pee9/YfGe5LJ62pYXqB89lJ+0k5bsR8Wgz/C0Zlq3U=
 github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
@@ -626,8 +646,8 @@ github.com/makeworld-the-better-one/dither/v2 v2.4.0 h1:Az/dYXiTcwcRSe59Hzw4RI1r
 github.com/makeworld-the-better-one/dither/v2 v2.4.0/go.mod h1:VBtN8DXO7SNtyGmLiGA7IsFeKrBkQPze1/iAeM95arc=
 github.com/manuelarte/embeddedstructfieldcheck v0.4.0 h1:3mAIyaGRtjK6EO9E73JlXLtiy7ha80b2ZVGyacxgfww=
 github.com/manuelarte/embeddedstructfieldcheck v0.4.0/go.mod h1:z8dFSyXqp+fC6NLDSljRJeNQJJDWnY7RoWFzV3PC6UM=
-github.com/manuelarte/funcorder v0.5.0 h1:llMuHXXbg7tD0i/LNw8vGnkDTHFpTnWqKPI85Rknc+8=
-github.com/manuelarte/funcorder v0.5.0/go.mod h1:Yt3CiUQthSBMBxjShjdXMexmzpP8YGvGLjrxJNkO2hA=
+github.com/manuelarte/funcorder v0.6.0 h1:0hBngc4fa1IgNiI65A7sFGkMvoMCc878RjqB5V7rWP0=
+github.com/manuelarte/funcorder v0.6.0/go.mod h1:id3NDhXdQBmeqXH7eVC6Z89xS6JxvZ8kF9xUxpArU/g=
 github.com/maratori/testableexamples v1.0.1 h1:HfOQXs+XgfeRBJ+Wz0XfH+FHnoY9TVqL6Fcevpzy4q8=
 github.com/maratori/testableexamples v1.0.1/go.mod h1:XE2F/nQs7B9N08JgyRmdGjYVGqxWwClLPCGSQhXQSrQ=
 github.com/maratori/testpackage v1.1.2 h1:ffDSh+AgqluCLMXhM19f/cpvQAKygKAJXFl9aUjmbqs=
@@ -640,12 +660,12 @@ github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
 github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
-github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
-github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
+github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-sqlite3 v1.14.44 h1:3VSe+xafpbzsLbdr2AWlAZk9yRHiBhTBakioXaCKTF8=
+github.com/mattn/go-sqlite3 v1.14.44/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mgechev/revive v1.15.0 h1:vJ0HzSBzfNyPbHKolgiFjHxLek9KUijhqh42yGoqZ8Q=
@@ -665,10 +685,10 @@ github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/moricho/tparallel v0.3.2 h1:odr8aZVFA3NZrNybggMkYO3rgPRcqjeQUlBBFVxKHTI=
 github.com/moricho/tparallel v0.3.2/go.mod h1:OQ+K3b4Ln3l2TZveGCywybl68glfLEwFGqvnjok8b+U=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/smartcrop v0.3.0 h1:JTlSkmxWg/oQ1TcLDoypuirdE8Y/jzNirQeLkxpA6Oc=
 github.com/muesli/smartcrop v0.3.0/go.mod h1:i2fCI/UorTfgEpPPLWiFBv4pye+YAG78RwcQLUkocpI=
-github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
-github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U=
@@ -693,8 +713,8 @@ github.com/olekukonko/ll v0.0.9 h1:Y+1YqDfVkqMWuEQMclsF9HUR5+a82+dxJuL1HHSRpxI=
 github.com/olekukonko/ll v0.0.9/go.mod h1:En+sEW0JNETl26+K8eZ6/W4UQ7CYSrrgg/EdIYT2H8g=
 github.com/olekukonko/tablewriter v1.0.9 h1:XGwRsYLC2bY7bNd93Dk51bcPZksWZmLYuaTHR0FqfL8=
 github.com/olekukonko/tablewriter v1.0.9/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps=
+github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
 github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
 github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
@@ -708,10 +728,12 @@ github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 h1:onHthvaw9LFnH4t2D
 github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58/go.mod h1:DXv8WO4yhMYhSNPKjeNKa5WY9YCIEBRbNzFFPJbWO6Y=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
+github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
 github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -756,7 +778,6 @@ github.com/raeperd/recvcheck v0.2.0 h1:GnU+NsbiCqdC2XX5+vMZzP+jAJC5fht7rcVTAhX74
 github.com/raeperd/recvcheck v0.2.0/go.mod h1:n04eYkwIR0JbgD73wT8wL4JjPC3wm0nFtzBnWNocnYU=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
@@ -769,6 +790,8 @@ github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd h1:CmH9+J6ZSsIjUK
 github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
 github.com/ryancurrah/gomodguard v1.4.1 h1:eWC8eUMNZ/wM/PWuZBv7JxxqT5fiIKSIyTvjb7Elr+g=
 github.com/ryancurrah/gomodguard v1.4.1/go.mod h1:qnMJwV1hX9m+YJseXEBhd2s90+1Xn6x9dLz11ualI1I=
+github.com/ryancurrah/gomodguard/v2 v2.1.3 h1:E7sz3PJwE9Ba1reVxSpF6XLCPJZ74Kfw/LabTNM4GIA=
+github.com/ryancurrah/gomodguard/v2 v2.1.3/go.mod h1:CQicdLGatWMxLX53JzoBjYlsNZhHbmLv2AVa0s2aivU=
 github.com/ryanrolds/sqlclosecheck v0.6.0 h1:pEyL9okISdg1F1SEpJNlrEotkTGerv5BMk7U4AG0eVg=
 github.com/ryanrolds/sqlclosecheck v0.6.0/go.mod h1:xyX16hsDaCMXHrMJ3JMzGf5OpDfHTOTTQrT7HOFUmeU=
 github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0=
@@ -779,12 +802,10 @@ github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tM
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
-github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 h1:AoLtJX4WUtZkhhUUMFy3GgecAALp/Mb4S1iyQOA2s0U=
-github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08/go.mod h1:+XLCJiRE95ga77XInNELh2M6zQP+PdqiT9Zpm0D9Wpk=
+github.com/securego/gosec/v2 v2.26.1 h1:gdkttGhQFVehqRJ8grKH4DrpqM/QlPKNHBnl8QgcEC4=
+github.com/securego/gosec/v2 v2.26.1/go.mod h1:57UW4p0uoP3kxoTkhoo3axLdVAi+OWrLg/Ax/kdqtPE=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
-github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
@@ -795,8 +816,8 @@ github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+W
 github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
 github.com/sonatard/noctx v0.5.1 h1:wklWg9c9ZYugOAk7qG4yP4PBrlQsmSLPTvW1K4PRQMs=
 github.com/sonatard/noctx v0.5.1/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
-github.com/sourcegraph/go-diff v0.7.0 h1:9uLlrd5T46OXs5qpp8L/MTltk0zikUGi0sNNyCpA8G0=
-github.com/sourcegraph/go-diff v0.7.0/go.mod h1:iBszgVvyxdc8SFZ7gm69go2KDdt3ag071iBaWPF6cjs=
+github.com/sourcegraph/go-diff v0.8.0 h1:ipIyu4cTsLbIrln4l0qtHA3r0a7gyK4ntKjtQytHhvY=
+github.com/sourcegraph/go-diff v0.8.0/go.mod h1:hWlcO7Al+UZStZAP8rBumHpCK5ZHQ5BXsMls8p4+F5E=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.9.2 h1:SsGfm7M8QOFtEzumm7UZrZdLLquNdzFYfIbEXntcFbE=
@@ -842,14 +863,16 @@ github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA
 github.com/tenntenn/modver v1.0.1/go.mod h1:bePIyQPb7UeioSRkw3Q0XeMhYZSMx9B8ePqg6SAMGH0=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpRQGxTSkNYKJ51yaw6ChIqO+Je8UqsTKN/cDag=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
-github.com/tetafro/godot v1.5.4 h1:u1ww+gqpRLiIA16yF2PV1CV1n/X3zhyezbNXC3E14Sg=
-github.com/tetafro/godot v1.5.4/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
+github.com/tetafro/godot v1.5.6 h1:IEkrFCwXaYHlOn4mGzGS3F3dkP6m9t0jpwqBFPIkKiA=
+github.com/tetafro/godot v1.5.6/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
 github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
 github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
-github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 h1:9LPGD+jzxMlnk5r6+hJnar67cgpDIz/iyD+rfl5r2Vk=
-github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67/go.mod h1:mkjARE7Yr8qU23YcGMSALbIxTQ9r9QBVahQOBRfU460=
+github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4 h1:SiHe5XLTn9sFWJ5pBwJ5FN/4j34q9ZlOAD//kMoMYp0=
+github.com/timakin/bodyclose v0.0.0-20260129054331-73d1f95b84b4/go.mod h1:sDHLK7rb/59v/ZxZ7KtymgcoxuUMxjXq8gtu9VMOK8M=
 github.com/timonwong/loggercheck v0.11.0 h1:jdaMpYBl+Uq9mWPXv1r8jc5fC3gyXx4/WGwTnnNKn4M=
 github.com/timonwong/loggercheck v0.11.0/go.mod h1:HEAWU8djynujaAVX7QI65Myb8qgfcZ1uKbdpg3ZzKl8=
+github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
+github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is=
 github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw=
@@ -862,12 +885,14 @@ github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
 github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
 github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4=
 github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
-github.com/uudashr/iface v1.4.1 h1:J16Xl1wyNX9ofhpHmQ9h9gk5rnv2A6lX/2+APLTo0zU=
-github.com/uudashr/iface v1.4.1/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
+github.com/uudashr/iface v1.4.2 h1:06Vq5RKVYThBsj0Bnw4oasMjD1r+7CE/bcKOA8dVSvg=
+github.com/uudashr/iface v1.4.2/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/woodsbury/decimal128 v1.3.0 h1:8pffMNWIlC0O5vbyHWFZAt5yWvWcrHA+3ovIIjVWss0=
 github.com/woodsbury/decimal128 v1.3.0/go.mod h1:C5UTmyTjW3JftjUFzOVhC20BEQa2a4ZKOB5I6Zjb+ds=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM=
 github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
@@ -884,7 +909,6 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA=
@@ -897,8 +921,8 @@ go-simpler.org/assert v0.9.0 h1:PfpmcSvL7yAnWyChSjOz6Sp6m9j5lyK8Ok9pEL31YkQ=
 go-simpler.org/assert v0.9.0/go.mod h1:74Eqh5eI6vCK6Y5l3PI8ZYFXG4Sa+tkr70OIPJAUr28=
 go-simpler.org/musttag v0.14.0 h1:XGySZATqQYSEV3/YTy+iX+aofbZZllJaqwFWs+RTtSo=
 go-simpler.org/musttag v0.14.0/go.mod h1:uP8EymctQjJ4Z1kUnjX0u2l60WfUdQxCwSNKzE1JEOE=
-go-simpler.org/sloglint v0.11.1 h1:xRbPepLT/MHPTCA6TS/wNfZrDzkGvCCqUv4Bdwc3H7s=
-go-simpler.org/sloglint v0.11.1/go.mod h1:2PowwiCOK8mjiF+0KGifVOT8ZsCNiFzvfyJeJOIt8MQ=
+go-simpler.org/sloglint v0.12.0 h1:UzWDlLWNE5FLqsvyq3tWYHuQMbqrervOhT8qPl4Mmw4=
+go-simpler.org/sloglint v0.12.0/go.mod h1:jBjjC2bm8rYrs88oTRlFX497kWjJsyZWYoNaXkGRI6I=
 go.augendre.info/arangolint v0.4.0 h1:xSCZjRoS93nXazBSg5d0OGCi9APPLNMmmLrC995tR50=
 go.augendre.info/arangolint v0.4.0/go.mod h1:l+f/b4plABuFISuKnTGD4RioXiCCgghv2xqst/xOvAA=
 go.augendre.info/fatcontext v0.9.0 h1:Gt5jGD4Zcj8CDMVzjOJITlSb9cEch54hjRRlN3qDojE=
@@ -913,6 +937,8 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
 go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
@@ -926,10 +952,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -948,8 +972,8 @@ golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 h1:qWFG1Dj7TBjOjO
 golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
+golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -969,14 +993,11 @@ golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
+golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1009,18 +1030,14 @@ golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20221002022538-bcab6841153b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1042,8 +1059,6 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1081,9 +1096,7 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1094,17 +1107,11 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1113,10 +1120,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1166,14 +1171,11 @@ golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.1.1-0.20210205202024-ef80cdb6ec6d/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
 golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -1259,8 +1261,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
-google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1290,10 +1292,10 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.7.0 h1:w6WUp1VbkqPEgLz4rkBzH/CSU6HkoqNLp6GstyTx3lU=
 honnef.co/go/tools v0.7.0/go.mod h1:pm29oPxeP3P82ISxZDgIYeOaf9ta6Pi0EWvCFoLG2vc=
-modernc.org/cc/v4 v4.28.1 h1:XpLbkYVQ24E8tX5u8+yWGvaxerxkR/S4zqxI8ZoSBuc=
-modernc.org/cc/v4 v4.28.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.33.0 h1:dspBCm75jsj8Y/ufwAMVfe375L2iYdMyQ2QG/v3hL54=
-modernc.org/ccgo/v4 v4.33.0/go.mod h1:+RhXBoRYzRwaH21mV/aj6XvQRDtfjcZfAlPMsQo8CR0=
+modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
+modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=
+modernc.org/ccgo/v4 v4.34.0/go.mod h1:AS5WYMyBakQ+fhsHhtP8mWB82KTGPkNNJDGfGQCe0/A=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
@@ -1302,8 +1304,8 @@ modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
 modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.72.1 h1:db1xwJ6u1kE3KHTFTTbe2GCrczHPKzlURP0aDC4NGD0=
-modernc.org/libc v1.72.1/go.mod h1:HRMiC/PhPGLIPM7GzAFCbI+oSgE3dhZ8FWftmRrHVlY=
+modernc.org/libc v1.72.3 h1:ZnDF4tXn4NBXFutMMQC4vtbTFSXhhKzR73fv0beZEAU=
+modernc.org/libc v1.72.3/go.mod h1:dn0dZNnnn1clLyvRxLxYExxiKRZIRENOfqQ8XEeg4Qs=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -1312,8 +1314,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.50.0 h1:eMowQSWLK0MeiQTdmz3lqoF5dqclujdlIKeJA11+7oM=
-modernc.org/sqlite v1.50.0/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
+modernc.org/sqlite v1.50.1 h1:l+cQvn0sd0zJJtfygGHuQJ5AjlrwXmWPw4KP3ZMwr9w=
+modernc.org/sqlite v1.50.1/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

backend/http/archive.go

@@ -14,17 +14,159 @@ import (
 	"path"
 	"path/filepath"
 	"sort"
+	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/go-cache/cache"
 	"github.com/gtsteffaniak/go-logger/logger"
 	"golang.org/x/time/rate"
 )
 
+// archiveMultiRequestIdle is how long without another Range/HEAD on the same archiveToken before
+// the spooled file is removed (abandoned chunked download). Each chunk request extends this window.
+const archiveMultiRequestIdle = 5 * time.Minute
+
+// archiveSpoolPathCache maps archiveToken -> temp file path on disk for chunked archive downloads.
+var archiveSpoolPathCache = cache.NewCache[string](archiveMultiRequestIdle)
+
+// archiveSpoolIdleTimers implements a sliding idle deadline per token so temp files are deleted
+// after abandonment; the in-process cache alone does not remove on-disk spool files.
+var (
+	archiveSpoolIdleMu     sync.Mutex
+	archiveSpoolIdleTimers = make(map[string]*time.Timer) // guarded by archiveSpoolIdleMu
+)
+
+func randomArchiveToken() (string, error) {
+	return utils.RandomHex(16)
+}
+
+func stopArchiveSpoolIdleTimer(token string) {
+	archiveSpoolIdleMu.Lock()
+	t, ok := archiveSpoolIdleTimers[token]
+	if ok {
+		delete(archiveSpoolIdleTimers, token)
+	}
+	archiveSpoolIdleMu.Unlock()
+	if !ok {
+		return
+	}
+	if !t.Stop() {
+		select {
+		case <-t.C:
+		default:
+		}
+	}
+}
+
+// removeSpooledArchiveNow drops token state and deletes the temp file (idle timeout or final chunk served).
+func removeSpooledArchiveNow(token, tmpPath string) {
+	stopArchiveSpoolIdleTimer(token)
+	archiveSpoolPathCache.Delete(token)
+	if err := os.Remove(tmpPath); err != nil && !os.IsNotExist(err) {
+		logger.Debugf("archive spool remove %s: %v", tmpPath, err)
+	}
+}
+
+func rescheduleArchiveSpoolIdleCleanup(token, tmpPath string) {
+	stopArchiveSpoolIdleTimer(token)
+	timer := time.AfterFunc(archiveMultiRequestIdle, func() {
+		removeSpooledArchiveNow(token, tmpPath)
+	})
+	archiveSpoolIdleMu.Lock()
+	archiveSpoolIdleTimers[token] = timer
+	archiveSpoolIdleMu.Unlock()
+}
+
+// archiveGetDeliversThroughEOF reports whether this GET serves through the last byte (full body or Range that ends at size-1).
+func archiveGetDeliversThroughEOF(r *http.Request, size int64) bool {
+	if r.Method != http.MethodGet || size <= 0 {
+		return false
+	}
+	rg := r.Header.Get("Range")
+	if rg == "" {
+		return true
+	}
+	const prefix = "bytes="
+	if !strings.HasPrefix(rg, prefix) {
+		return false
+	}
+	rg = strings.TrimSpace(rg[len(prefix):])
+	if i := strings.IndexByte(rg, ','); i >= 0 {
+		rg = rg[:i]
+	}
+	dash := strings.IndexByte(rg, '-')
+	if dash < 0 {
+		return false
+	}
+	startStr := strings.TrimSpace(rg[:dash])
+	endStr := strings.TrimSpace(rg[dash+1:])
+	if endStr == "" {
+		// "bytes=N-": suffix through EOF
+		return true
+	}
+	if startStr == "" && endStr != "" {
+		// "bytes=-N": last-N suffix includes EOF when size > 0
+		return true
+	}
+	end, err := strconv.ParseInt(endStr, 10, 64)
+	if err != nil {
+		return false
+	}
+	return end >= size-1
+}
+
+// archiveAttachmentStem is the filename stem (no extension) for Content-Disposition on multi-item /
+// directory downloads. It prefers the client file path so names match the UI (e.g. "Desktop.zip"); the
+// old filepath.Dir(realPath)+Base trick can yield "/" at filesystem root or the wrong parent if index metadata lags.
+func archiveAttachmentStem(fileList []string, realPath string) string {
+	if len(fileList) == 0 {
+		return "download"
+	}
+	first := filepath.ToSlash(strings.TrimSuffix(strings.TrimSpace(fileList[0]), "/"))
+	var stem string
+	if len(fileList) == 1 {
+		stem = path.Base(first)
+	} else {
+		stem = path.Base(path.Dir(first))
+	}
+	if stem == "" || stem == "." || stem == "/" {
+		if len(fileList) == 1 {
+			stem = filepath.Base(realPath)
+		} else {
+			stem = filepath.Base(filepath.Dir(realPath))
+		}
+	}
+	if stem == "" || stem == "." || stem == "/" {
+		return "download"
+	}
+	return stem
+}
+
+// serveArchiveWithServeContent sends a built archive using ServeContent (Range-capable).
+// For share links with MaxBandwidth > 0, outbound data is throttled via newThrottledReadSeeker (same limit as single-file download).
+func serveArchiveWithServeContent(w http.ResponseWriter, r *http.Request, d *requestContext, rs io.ReadSeeker, fi os.FileInfo, originalFileName string) (int, error) {
+	setContentDisposition(w, r, originalFileName)
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Header().Set("Cache-Control", "private")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+
+	reader := rs
+	if d.share != nil && d.share.MaxBandwidth > 0 {
+		limit := rate.Limit(d.share.MaxBandwidth * 1024)
+		burst := d.share.MaxBandwidth * 1024
+		reader = newThrottledReadSeeker(rs, limit, burst, r.Context())
+	}
+	http.ServeContent(w, r, originalFileName, fi.ModTime(), reader)
+	return 0, nil
+}
+
 // archiveCreateHandler creates an archive on the server at the given destination.
 // POST /resources/archive — server-side only; does not return archive data.
 //
@@ -562,14 +704,20 @@ func createTarGzWithLevel(d *requestContext, source string, w io.Writer, level i
 	return nil
 }
 
-// BuildAndStreamArchive resolves paths, creates a zip or tar.gz archive, and streams it to w.
-// It respects access rules. Used only by the raw handler for multi-file/directory download.
+// BuildAndStreamArchive builds a zip or tar.gz for multi-file/directory download.
+// Plain GET without Range streams the archive straight to the response (no temp file), matching
+// clients with chunked downloads disabled. HEAD or Range builds a temp file under cacheDir downloads,
+// returns X-Archive-Token on the first response, and serves via ServeContent for Range/resume;
+// follow-up GETs use ?archiveToken=.... Idle chunked sessions delete the spool file after
+// archiveMultiRequestIdle without another request.
+//
+// server.maxArchiveSizeGB is enforced only for the HEAD/Range spool path.
 func BuildAndStreamArchive(w http.ResponseWriter, r *http.Request, d *requestContext, source string, fileList []string) (int, error) {
 	idx := indexing.GetIndex(source)
 	if idx == nil {
 		return http.StatusInternalServerError, fmt.Errorf("source %s is not available", source)
 	}
-	realPath, isDir, err := idx.GetRealPath(fileList[0])
+	realPath, _, err := idx.GetRealPath(fileList[0])
 	if err != nil {
 		return http.StatusInternalServerError, fmt.Errorf("failed to get real path for %s: %v", fileList[0], err)
 	}
@@ -585,35 +733,142 @@ func BuildAndStreamArchive(w http.ResponseWriter, r *http.Request, d *requestCon
 		return http.StatusInternalServerError, errors.New("format not implemented")
 	}
 
-	baseDirName := filepath.Base(filepath.Dir(realPath))
-	if baseDirName == "" || baseDirName == "/" {
-		baseDirName = "download"
-	}
-	if len(fileList) == 1 && isDir {
-		baseDirName = filepath.Base(realPath)
-	}
-	originalFileName := baseDirName + extension
+	originalFileName := archiveAttachmentStem(fileList, realPath) + extension
 
-	setContentDisposition(w, r, originalFileName)
-	w.Header().Set("Content-Type", "application/octet-stream")
-
-	var writer io.Writer = w
-	if d.share != nil && d.share.MaxBandwidth > 0 {
-		limit := rate.Limit(d.share.MaxBandwidth * 1024)
-		burst := d.share.MaxBandwidth * 1024
-		writer = newThrottledWriter(w, limit, burst, r.Context())
+	token := r.URL.Query().Get("archiveToken")
+	if token != "" {
+		tmpPath, ok := archiveSpoolPathCache.Get(token)
+		if !ok {
+			return http.StatusGone, fmt.Errorf("invalid or expired archiveToken")
+		}
+		archiveSpoolPathCache.SetWithExp(token, tmpPath, archiveMultiRequestIdle)
+		rescheduleArchiveSpoolIdleCleanup(token, tmpPath)
+		if _, err = os.Stat(tmpPath); err != nil {
+			archiveSpoolPathCache.Delete(token)
+			return http.StatusGone, fmt.Errorf("archive no longer available")
+		}
+		var fd *os.File
+		fd, err = os.Open(tmpPath)
+		if err != nil {
+			return http.StatusGone, err
+		}
+		var fi os.FileInfo
+		fi, err = fd.Stat()
+		if err != nil {
+			_ = fd.Close()
+			return http.StatusInternalServerError, err
+		}
+		code, srvErr := serveArchiveWithServeContent(w, r, d, fd, fi, originalFileName)
+		if closeErr := fd.Close(); closeErr != nil && srvErr == nil {
+			srvErr = closeErr
+		}
+		if srvErr == nil && archiveGetDeliversThroughEOF(r, fi.Size()) {
+			removeSpooledArchiveNow(token, tmpPath)
+		}
+		return code, srvErr
 	}
 
+	// HEAD or Range: same condition as chunked archive probing / retained spool (X-Archive-Token).
+	needMultiRequestSession := r.Method == http.MethodHead || r.Header.Get("Range") != ""
+
+	if needMultiRequestSession && config.Server.MaxArchiveSizeGB > 0 {
+		var estimatedSize int64
+		estimatedSize, err = computeArchiveSize(source, fileList, d)
+		if err != nil {
+			return http.StatusInternalServerError, fmt.Errorf("failed to compute archive size: %v", err)
+		}
+		maxSizeBytes := config.Server.MaxArchiveSizeGB * 1024 * 1024 * 1024
+		if estimatedSize > maxSizeBytes {
+			return http.StatusRequestEntityTooLarge, fmt.Errorf("archive size would exceed the maximum allowed size (maxArchiveSize: %d GB)", config.Server.MaxArchiveSizeGB)
+		}
+	}
+
+	// Direct streaming: no temp file (typical browser download when chunked downloads are disabled).
+	if !needMultiRequestSession {
+		if r.Method != http.MethodGet {
+			return http.StatusMethodNotAllowed, fmt.Errorf("method not allowed")
+		}
+		setContentDisposition(w, r, originalFileName)
+		w.Header().Set("Content-Type", "application/octet-stream")
+		w.Header().Set("Cache-Control", "private")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+
+		writer := io.Writer(w)
+		if d.share != nil && d.share.MaxBandwidth > 0 {
+			limit := rate.Limit(d.share.MaxBandwidth * 1024)
+			burst := d.share.MaxBandwidth * 1024
+			writer = newThrottledWriter(w, limit, burst, r.Context())
+		}
+		if extension == ".zip" {
+			err = createZip(d, source, writer, fileList...)
+		} else {
+			err = createTarGz(d, source, writer, fileList...)
+		}
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+		return 0, nil
+	}
+
+	dlDir := settings.DownloadCacheDir()
+	tmpF, err := os.CreateTemp(dlDir, "dl-archive-*"+extension)
+	if err != nil {
+		return http.StatusInternalServerError, fmt.Errorf("create temp archive: %w", err)
+	}
+	tmpPath := tmpF.Name()
+
 	if extension == ".zip" {
-		err = createZip(d, source, writer, fileList...)
+		err = createZip(d, source, tmpF, fileList...)
 	} else {
-		err = createTarGz(d, source, writer, fileList...)
+		err = createTarGz(d, source, tmpF, fileList...)
 	}
 	if err != nil {
+		_ = tmpF.Close()
+		_ = os.Remove(tmpPath)
 		return http.StatusInternalServerError, err
 	}
 
-	return 0, nil
+	if _, err = tmpF.Seek(0, 0); err != nil {
+		_ = tmpF.Close()
+		_ = os.Remove(tmpPath)
+		return http.StatusInternalServerError, fmt.Errorf("seek temp archive: %w", err)
+	}
+	fi, err := tmpF.Stat()
+	if err != nil {
+		_ = tmpF.Close()
+		_ = os.Remove(tmpPath)
+		return http.StatusInternalServerError, err
+	}
+
+	sizeInMB := fi.Size() / 1024 / 1024
+	if sizeInMB > 500 {
+		logger.Debugf("User %v is downloading large (%d MB) archive: %v", d.user.Username, sizeInMB, originalFileName)
+	}
+
+	// needMultiRequestSession: HEAD or Range — always spool and use ServeContent (+ token for follow-ups).
+	if err = tmpF.Close(); err != nil {
+		_ = os.Remove(tmpPath)
+		return http.StatusInternalServerError, err
+	}
+	newTok, err := randomArchiveToken()
+	if err != nil {
+		_ = os.Remove(tmpPath)
+		return http.StatusInternalServerError, err
+	}
+	archiveSpoolPathCache.SetWithExp(newTok, tmpPath, archiveMultiRequestIdle)
+	rescheduleArchiveSpoolIdleCleanup(newTok, tmpPath)
+	w.Header().Set("X-Archive-Token", newTok)
+
+	fd, err := os.Open(tmpPath)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	defer fd.Close()
+	fi2, err := fd.Stat()
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	return serveArchiveWithServeContent(w, r, d, fd, fi2, originalFileName)
 }
 
 // archiveCreateRequest is the body for POST /resources/archive (server-side create).

backend/http/auth.go

@@ -132,7 +132,7 @@ func setupJwtUser(r *http.Request, data *requestContext, username string, claims
 			Username:    username,
 		}
 		settings.ApplyUserDefaults(&user)
-		
+
 		// Check if user should be admin based on groups
 		if config.Auth.Methods.JwtAuth.AdminGroup != "" {
 			groups := auth.ExtractGroupsFromClaims(claims, config.Auth.Methods.JwtAuth.GroupsClaim)
@@ -143,12 +143,12 @@ func setupJwtUser(r *http.Request, data *requestContext, username string, claims
 				}
 			}
 		}
-		
+
 		// Also check if username matches admin username
 		if user.Username == config.Auth.AdminUsername {
 			user.Permissions.Admin = true
 		}
-		
+
 		err = storage.CreateUser(user, user.Permissions)
 		if err != nil {
 			return nil, err
@@ -158,12 +158,12 @@ func setupJwtUser(r *http.Request, data *requestContext, username string, claims
 			return nil, err
 		}
 	}
-	
+
 	// Verify login method matches
 	if data.user.LoginMethod != users.LoginMethodJwt {
 		return nil, errors.ErrWrongLoginMethod
 	}
-	
+
 	// Check if user is in allowed groups (if UserGroups is configured)
 	if len(config.Auth.Methods.JwtAuth.UserGroups) > 0 {
 		groups := auth.ExtractGroupsFromClaims(claims, config.Auth.Methods.JwtAuth.GroupsClaim)
@@ -183,7 +183,7 @@ func setupJwtUser(r *http.Request, data *requestContext, username string, claims
 			return nil, fmt.Errorf("user is not in allowed groups")
 		}
 	}
-	
+
 	// Update admin status if needed
 	shouldBeAdmin := false
 	if config.Auth.Methods.JwtAuth.AdminGroup != "" {
@@ -198,7 +198,7 @@ func setupJwtUser(r *http.Request, data *requestContext, username string, claims
 	if data.user.Username == config.Auth.AdminUsername {
 		shouldBeAdmin = true
 	}
-	
+
 	if shouldBeAdmin != data.user.Permissions.Admin {
 		data.user.Permissions.Admin = shouldBeAdmin
 		err = store.Users.Update(data.user, true, "Permissions")
@@ -206,7 +206,7 @@ func setupJwtUser(r *http.Request, data *requestContext, username string, claims
 			return nil, err
 		}
 	}
-	
+
 	return data.user, nil
 }
 
@@ -221,7 +221,9 @@ func setupJwtUser(r *http.Request, data *requestContext, username string, claims
 // @Param X-Password header string true "URL-encoded password"
 // @Param X-Secret header string false "TOTP code (if 2FA is enabled)"
 // @Success 200 {string} string "JWT token for authentication"
+// @Failure 401 {object} map[string]string "Unauthorized - authentication failed"
 // @Failure 403 {object} map[string]string "Forbidden - authentication failed"
+// @Failure 429 {object} map[string]string "Too many requests - rate limited or temporarily locked out after failed attempts"
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Router /api/auth/login [post]
 func loginHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
@@ -231,6 +233,9 @@ func loginHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (in
 	if passwordUser && enforcedOtp && missingOtp {
 		return http.StatusForbidden, errors.ErrNoTotpConfigured
 	}
+	if d.user.HasPasskeyMFA() && d.user.TOTPSecret == "" {
+		return http.StatusForbidden, errors.ErrPasskeyMFARequired
+	}
 	return printToken(w, r, d.user)
 }
 
@@ -317,7 +322,7 @@ func logoutHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Router /api/auth/signup [post]
 func signupHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	if !settings.Config.Auth.Methods.PasswordAuth.Signup {
+	if !config.Auth.Methods.PasswordAuth.Signup {
 		return http.StatusMethodNotAllowed, fmt.Errorf("signup is disabled")
 	}
 
@@ -337,7 +342,7 @@ func signupHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 		},
 		LoginMethod: users.LoginMethodPassword,
 	}
-	err := storage.CreateUser(user, settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Permissions))
+	err := storage.CreateUser(user, settings.ConvertPermissionsToUsers(config.UserDefaults.Account.Permissions))
 	if err != nil {
 		logger.Debug(err.Error())
 		// Return the actual error message instead of a generic one

backend/http/auth_ratelimit.go

@@ -0,0 +1,269 @@
+package http
+
+import (
+	"fmt"
+	"math"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/gtsteffaniak/go-cache/cache"
+	"golang.org/x/time/rate"
+)
+
+// Built-in auth rate limits (per process). Toggle all off with http.disableRateLimit.
+//
+// Credential tier (login, OTP verify): dual token buckets (per IP + per username) plus
+// failed-login lockout (per IP+username). Tune burst ≤ maxAttempts so rapid floods hit
+// HTTP 429 from the bucket before lockout; lockout covers paced attacks that stay under RPM.
+const (
+	authCredentialRPM          = 10 // sustained ~1 attempt / 6s per IP and per username
+	authCredentialBurst        = 8  // rapid burst; 9th immediate attempt gets 429
+	authModerateRPM            = 30 // signup, logout, OTP generate
+	authModerateBurst          = 10
+	authOIDCRPM                = 60 // OIDC redirects (browser-driven, higher ceiling)
+	authOIDCBurst              = 20
+	authAuthenticatedRPM       = 180 // session/token management for logged-in users
+	authAuthenticatedBurst     = 60
+	authFailedLoginMaxAttempts = 8 // lockout after N consecutive 401s (same IP + username)
+	authFailedLoginLockoutMins = 15
+	// Evict idle per-key token buckets so unique IPs/usernames cannot grow without bound.
+	authLimiterEntryTTL = 24 * time.Hour
+)
+
+// In-memory failed-attempt counters and lockout flags (per server process).
+var (
+	authFailCounts = cache.NewCache[int](time.Minute, 10*time.Minute)
+	authLockouts   = cache.NewCache[bool](time.Minute, 10*time.Minute)
+)
+
+// Per-route-class token buckets (keys: IP or username). Expired entries are dropped by go-cache.
+var (
+	authRateLimitCredentialByIP       = cache.NewCache[*rate.Limiter](authLimiterEntryTTL)
+	authRateLimitCredentialByUsername = cache.NewCache[*rate.Limiter](authLimiterEntryTTL)
+	authRateLimitModerateByIP         = cache.NewCache[*rate.Limiter](authLimiterEntryTTL)
+	authRateLimitOIDCByIP             = cache.NewCache[*rate.Limiter](authLimiterEntryTTL)
+	authRateLimitAuthenticatedByUser  = cache.NewCache[*rate.Limiter](authLimiterEntryTTL)
+)
+
+const authRateKeySep = "\x1e"
+
+// AuthRateLimitKind selects which /api/auth rate limit tier applies (see withRateLimit and withRateLimitChain).
+type AuthRateLimitKind int
+
+const (
+	// AuthRateLimitCredential: strict per-IP and per-username limits; no failed-login lockout.
+	AuthRateLimitCredential AuthRateLimitKind = iota
+	// AuthRateLimitCredentialLockout: same limits as Credential, plus lockout after repeated 401s.
+	AuthRateLimitCredentialLockout
+	AuthRateLimitModerate
+	AuthRateLimitOIDC
+	// AuthRateLimitAuthenticated: per logged-in username (compose: withUser(withRateLimitChain(AuthRateLimitAuthenticated, h))).
+	AuthRateLimitAuthenticated
+)
+
+// withRateLimitChain applies a rate limit tier then fn for nesting inside withUser / withOrWithoutUser / withoutUser.
+func withRateLimitChain(kind AuthRateLimitKind, fn handleFunc) handleFunc {
+	switch kind {
+	case AuthRateLimitCredential:
+		return withAuthRateLimitCredential(false, fn)
+	case AuthRateLimitCredentialLockout:
+		return withAuthRateLimitCredential(true, fn)
+	case AuthRateLimitModerate:
+		return withAuthRateLimitModerate(fn)
+	case AuthRateLimitOIDC:
+		return withAuthRateLimitOIDC(fn)
+	case AuthRateLimitAuthenticated:
+		return withAuthRateLimitAuthenticated(fn)
+	default:
+		return fn
+	}
+}
+
+// withRateLimit registers a rate-limited route (same shape as withTimeout: option first, handler second).
+func withRateLimit(kind AuthRateLimitKind, fn handleFunc) http.HandlerFunc {
+	return wrapHandler(withRateLimitChain(kind, fn))
+}
+
+func authRateLimitActive() bool {
+	if config.Http.DisableRateLimit {
+		return false
+	}
+	if config.Auth.Methods.NoAuth {
+		return false
+	}
+	return true
+}
+
+func tokenBucketLimiter(c *cache.KeyCache[*rate.Limiter], key string, requestsPerMinute, burst int) *rate.Limiter {
+	if requestsPerMinute < 1 {
+		requestsPerMinute = 1
+	}
+	if burst < 1 {
+		burst = 1
+	}
+	if lim, ok := c.Get(key); ok && lim != nil {
+		c.SetWithExp(key, lim, authLimiterEntryTTL)
+		return lim
+	}
+	lim := rate.NewLimiter(rate.Limit(float64(requestsPerMinute))/60.0, burst)
+	c.SetWithExp(key, lim, authLimiterEntryTTL)
+	return lim
+}
+
+func retryAfterSeconds(lim *rate.Limiter) int {
+	res := lim.Reserve()
+	delay := res.Delay()
+	res.Cancel()
+	secs := int(math.Ceil(delay.Seconds()))
+	if secs < 1 {
+		secs = 1
+	}
+	return secs
+}
+
+func allowCredential(r *http.Request, loginUsername string) (retryAfter int, ok bool) {
+	ip := getRemoteIP(r)
+	limIP := tokenBucketLimiter(authRateLimitCredentialByIP, ip, authCredentialRPM, authCredentialBurst)
+	if !limIP.Allow() {
+		return retryAfterSeconds(limIP), false
+	}
+	if loginUsername != "" {
+		limUser := tokenBucketLimiter(authRateLimitCredentialByUsername, loginUsername, authCredentialRPM, authCredentialBurst)
+		if !limUser.Allow() {
+			return retryAfterSeconds(limUser), false
+		}
+	}
+	return 0, true
+}
+
+func allowModerate(r *http.Request) (retryAfter int, ok bool) {
+	ip := getRemoteIP(r)
+	lim := tokenBucketLimiter(authRateLimitModerateByIP, ip, authModerateRPM, authModerateBurst)
+	if !lim.Allow() {
+		return retryAfterSeconds(lim), false
+	}
+	return 0, true
+}
+
+func allowOIDC(r *http.Request) (retryAfter int, ok bool) {
+	ip := getRemoteIP(r)
+	lim := tokenBucketLimiter(authRateLimitOIDCByIP, ip, authOIDCRPM, authOIDCBurst)
+	if !lim.Allow() {
+		return retryAfterSeconds(lim), false
+	}
+	return 0, true
+}
+
+func allowAuthenticated(username string) (retryAfter int, ok bool) {
+	lim := tokenBucketLimiter(authRateLimitAuthenticatedByUser, username, authAuthenticatedRPM, authAuthenticatedBurst)
+	if !lim.Allow() {
+		return retryAfterSeconds(lim), false
+	}
+	return 0, true
+}
+
+func authFailKey(ip, username string) string {
+	return "fail" + authRateKeySep + ip + authRateKeySep + username
+}
+
+func authLockKey(ip, username string) string {
+	return "lock" + authRateKeySep + ip + authRateKeySep + username
+}
+
+func authLockoutRetryAfterSecs() int {
+	return authFailedLoginLockoutMins * 60
+}
+
+func isAuthLockout(ip, username string) bool {
+	locked, ok := authLockouts.Get(authLockKey(ip, username))
+	return ok && locked
+}
+
+func clearAuthLockout(ip, username string) {
+	authLockouts.Delete(authLockKey(ip, username))
+	authFailCounts.Delete(authFailKey(ip, username))
+}
+
+func recordAuthFailure(ip, username string) {
+	if username == "" {
+		return
+	}
+	window := time.Duration(authFailedLoginLockoutMins) * time.Minute
+	fk := authFailKey(ip, username)
+	n := 0
+	if v, ok := authFailCounts.Get(fk); ok {
+		n = v
+	}
+	n++
+	authFailCounts.SetWithExp(fk, n, window)
+	if n >= authFailedLoginMaxAttempts {
+		authLockouts.SetWithExp(authLockKey(ip, username), true, window)
+	}
+}
+
+// withRateLimitInternal applies token-bucket allow checks: when inactive, calls fn; when denied, 429 + Retry-After.
+func withRateLimitInternal(fn handleFunc, allow func(*http.Request, *requestContext) (retryAfter int, ok bool)) handleFunc {
+	return func(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+		if !authRateLimitActive() {
+			return fn(w, r, d)
+		}
+		if after, ok := allow(r, d); !ok {
+			w.Header().Set("Retry-After", strconv.Itoa(after))
+			return http.StatusTooManyRequests, fmt.Errorf("too many requests")
+		}
+		return fn(w, r, d)
+	}
+}
+
+// withAuthRateLimitCredential enforces the credential tier (and optional per-username limits).
+// When trackFailures is true, 401 responses increment failed-attempt state for lockout; success clears it.
+func withAuthRateLimitCredential(trackFailures bool, fn handleFunc) handleFunc {
+	return func(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+		if !authRateLimitActive() {
+			return fn(w, r, d)
+		}
+		username := r.URL.Query().Get("username")
+		if isAuthLockout(getRemoteIP(r), username) {
+			w.Header().Set("Retry-After", strconv.Itoa(authLockoutRetryAfterSecs()))
+			return http.StatusTooManyRequests, fmt.Errorf("too many failed authentication attempts")
+		}
+		if after, ok := allowCredential(r, username); !ok {
+			w.Header().Set("Retry-After", strconv.Itoa(after))
+			return http.StatusTooManyRequests, fmt.Errorf("too many requests")
+		}
+		status, err := fn(w, r, d)
+		if !trackFailures {
+			return status, err
+		}
+		ip := getRemoteIP(r)
+		if status == http.StatusUnauthorized && username != "" {
+			recordAuthFailure(ip, username)
+		}
+		if err == nil && (status == 0 || status == http.StatusOK) {
+			clearAuthLockout(ip, username)
+		}
+		return status, err
+	}
+}
+
+func withAuthRateLimitModerate(fn handleFunc) handleFunc {
+	return withRateLimitInternal(fn, func(r *http.Request, _ *requestContext) (int, bool) {
+		return allowModerate(r)
+	})
+}
+
+func withAuthRateLimitOIDC(fn handleFunc) handleFunc {
+	return withRateLimitInternal(fn, func(r *http.Request, _ *requestContext) (int, bool) {
+		return allowOIDC(r)
+	})
+}
+
+func withAuthRateLimitAuthenticated(fn handleFunc) handleFunc {
+	return withRateLimitInternal(fn, func(_ *http.Request, d *requestContext) (int, bool) {
+		if d.user == nil || d.user.Username == "" || d.user.Username == "anonymous" {
+			return 0, true
+		}
+		return allowAuthenticated(d.user.Username)
+	})
+}

backend/http/download.go

@@ -18,19 +18,14 @@ import (
 )
 
 // throttledReadSeeker is a wrapper around an io.ReadSeeker that throttles the reading speed.
+// Used for single-file downloads and for share archive downloads (see serveArchiveWithServeContent);
+// archives are built to a temp file first, then bytes to the client are limited on read.
 type throttledReadSeeker struct {
 	rs      io.ReadSeeker
 	limiter *rate.Limiter
 	ctx     context.Context
 }
 
-// throttledWriter is a wrapper around an io.Writer that throttles the writing speed.
-type throttledWriter struct {
-	w       io.Writer
-	limiter *rate.Limiter
-	ctx     context.Context
-}
-
 // newThrottledReadSeeker creates a new throttledReadSeeker.
 func newThrottledReadSeeker(rs io.ReadSeeker, limit rate.Limit, burst int, ctx context.Context) *throttledReadSeeker {
 	return &throttledReadSeeker{
@@ -58,7 +53,13 @@ func (r *throttledReadSeeker) Seek(offset int64, whence int) (int64, error) {
 	return r.rs.Seek(offset, whence)
 }
 
-// newThrottledWriter creates a new throttledWriter.
+// throttledWriter wraps an io.Writer and rate-limits outbound bytes (streaming archives to the client).
+type throttledWriter struct {
+	w       io.Writer
+	limiter *rate.Limiter
+	ctx     context.Context
+}
+
 func newThrottledWriter(w io.Writer, limit rate.Limit, burst int, ctx context.Context) *throttledWriter {
 	return &throttledWriter{
 		w:       w,
@@ -67,13 +68,11 @@ func newThrottledWriter(w io.Writer, limit rate.Limit, burst int, ctx context.Co
 	}
 }
 
-func (w *throttledWriter) Write(p []byte) (n int, err error) {
-	n, err = w.w.Write(p)
+func (tw *throttledWriter) Write(p []byte) (n int, err error) {
+	n, err = tw.w.Write(p)
 	if n > 0 {
-		if waitErr := w.limiter.WaitN(w.ctx, n); waitErr != nil {
-			if err != nil {
-				// The original error (like io.EOF) is potentially more important
-				// than the context error.
+		if waitErr := tw.limiter.WaitN(tw.ctx, n); waitErr != nil {
+			if err == nil {
 				err = waitErr
 			}
 		}
@@ -99,6 +98,8 @@ func setContentDisposition(w http.ResponseWriter, r *http.Request, fileName stri
 	dispositionType := "attachment"
 	if r.URL.Query().Get("inline") == "true" {
 		dispositionType = "inline"
+		// Inline SVG (and similar) can execute embedded scripts when opened as a top-level document; match upstream filebrowser mitigation.
+		w.Header().Set("Content-Security-Policy", "script-src 'none'")
 	}
 
 	// standard: ASCII-only safe fallback
@@ -274,12 +275,10 @@ func rawFilesHandler(w http.ResponseWriter, r *http.Request, d *requestContext,
 				fmt.Sprintf("OnlyOffice Server downloading file: %s", firstFilePath))
 		}
 
-		// Set headers
+		// ServeContent sets Content-Length (full resource or range); avoid pre-setting so partial/range responses stay consistent.
 		setContentDisposition(w, r, fileName)
 		w.Header().Set("Cache-Control", "private")
 		w.Header().Set("X-Content-Type-Options", "nosniff")
-		w.Header().Set("Content-Length", fmt.Sprintf("%d", fileInfo.Size()))
-		// serve content allows for range requests.
 		// video scrubbing, etc.
 		// Note: http.ServeContent will respect our already-set Content-Disposition header
 		var reader io.ReadSeeker = fd

backend/http/httpRouter.go

@@ -80,6 +80,10 @@ func StartHttp(ctx context.Context, storage *bolt.BoltStore, shutdownComplete ch
 	publicRoutes := http.NewServeMux()
 	publicApi := http.NewServeMux()
 
+	// health routes
+	api.HandleFunc("GET /health", healthHandler)
+	publicApi.HandleFunc("GET /health", healthHandler)
+
 	// ========================================
 	// User Routes - /api/users/ (with public routes)
 	// ========================================
@@ -92,18 +96,23 @@ func StartHttp(ctx context.Context, storage *bolt.BoltStore, shutdownComplete ch
 	// ========================================
 	// Auth Routes - /api/auth/
 	// ========================================
-	api.HandleFunc("POST /auth/login", loginHelper(loginHandler))
-	api.HandleFunc("POST /auth/logout", withOrWithoutUser(logoutHandler))
-	api.HandleFunc("POST /auth/signup", withoutUser(signupHandler))
-	api.HandleFunc("POST /auth/otp/generate", withOrWithoutUser(generateOTPHandler))
-	api.HandleFunc("POST /auth/otp/verify", withOrWithoutUser(verifyOTPHandler))
-	api.HandleFunc("POST /auth/renew", withUser(renewHandler))
-	api.HandleFunc("POST /auth/token", withUser(createApiTokenHandler))
-	api.HandleFunc("DELETE /auth/token", withUser(deleteApiTokenHandler))
-	api.HandleFunc("GET /auth/token/list", withUser(listApiTokensHandler))
-	api.HandleFunc("GET /auth/token", withUser(getApiTokenHandler))
-	api.HandleFunc("GET /auth/oidc/callback", wrapHandler(oidcCallbackHandler))
-	api.HandleFunc("GET /auth/oidc/login", wrapHandler(oidcLoginHandler))
+	api.HandleFunc("POST /auth/login", withRateLimit(AuthRateLimitCredentialLockout, loginHelper(loginHandler)))
+	api.HandleFunc("POST /auth/logout", withOrWithoutUser(withRateLimitChain(AuthRateLimitModerate, logoutHandler)))
+	api.HandleFunc("POST /auth/signup", withoutUser(withRateLimitChain(AuthRateLimitModerate, signupHandler)))
+	api.HandleFunc("POST /auth/otp/generate", withOrWithoutUser(withRateLimitChain(AuthRateLimitModerate, generateOTPHandler)))
+	api.HandleFunc("POST /auth/otp/verify", withOrWithoutUser(withRateLimitChain(AuthRateLimitCredentialLockout, verifyOTPHandler)))
+	api.HandleFunc("POST /auth/renew", withUser(withRateLimitChain(AuthRateLimitAuthenticated, renewHandler)))
+	api.HandleFunc("POST /auth/token", withUser(withRateLimitChain(AuthRateLimitAuthenticated, createApiTokenHandler)))
+	api.HandleFunc("DELETE /auth/token", withUser(withRateLimitChain(AuthRateLimitAuthenticated, deleteApiTokenHandler)))
+	api.HandleFunc("GET /auth/token/list", withUser(withRateLimitChain(AuthRateLimitAuthenticated, listApiTokensHandler)))
+	api.HandleFunc("GET /auth/token", withUser(withRateLimitChain(AuthRateLimitAuthenticated, getApiTokenHandler)))
+	api.HandleFunc("GET /auth/oidc/callback", withRateLimit(AuthRateLimitOIDC, oidcCallbackHandler))
+	api.HandleFunc("GET /auth/oidc/login", withRateLimit(AuthRateLimitOIDC, oidcLoginHandler))
+	api.HandleFunc("POST /auth/webauthn/begin-login", withoutUser(withRateLimitChain(AuthRateLimitCredential, beginPasskeyLoginHandler)))
+	api.HandleFunc("POST /auth/webauthn/finish-login", withoutUser(withRateLimitChain(AuthRateLimitCredential, finishPasskeyLoginHandler)))
+	api.HandleFunc("POST /auth/webauthn/begin-register", withUser(withRateLimitChain(AuthRateLimitAuthenticated, beginPasskeyRegistrationHandler)))
+	api.HandleFunc("POST /auth/webauthn/finish-register", withUser(withRateLimitChain(AuthRateLimitAuthenticated, finishPasskeyRegistrationHandler)))
+	api.HandleFunc("DELETE /auth/webauthn/{id}", withUser(withRateLimitChain(AuthRateLimitAuthenticated, deletePasskeyCredentialHandler)))
 
 	// ========================================
 	// Resources Routes - /api/resources/ (with public routes)
@@ -150,7 +159,7 @@ func StartHttp(ctx context.Context, storage *bolt.BoltStore, shutdownComplete ch
 	// ========================================
 	api.HandleFunc("GET /share/list", withPermShare(shareListHandler))
 	api.HandleFunc("GET /share/direct", withPermShare(shareDirectDownloadHandler))
-	api.HandleFunc("GET /share", withPermShare(shareGetHandler))
+	api.HandleFunc("GET /share", withUser(shareGetHandler))
 	api.HandleFunc("POST /share", withPermShare(sharePostHandler))
 	api.HandleFunc("PATCH /share", withPermShare(sharePatchHandler))
 	api.HandleFunc("DELETE /share", withPermShare(shareDeleteHandler))
@@ -177,7 +186,9 @@ func StartHttp(ctx context.Context, storage *bolt.BoltStore, shutdownComplete ch
 	// ========================================
 	api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))
 	api.HandleFunc("GET /media/metadata", withUser(metadataHandler))
+	api.HandleFunc("GET /media/lyrics", withUser(lyricsHandler))
 	publicApi.HandleFunc("GET /media/metadata", withHashFile(publicMetadataHandler))
+	publicApi.HandleFunc("GET /media/lyrics", withHashFile(publicLyricsHandler))
 
 	// ========================================
 	// OnlyOffice Routes - /api/office/ (with public routes)
@@ -192,7 +203,6 @@ func StartHttp(ctx context.Context, storage *bolt.BoltStore, shutdownComplete ch
 	// ========================================
 	// Misc Routes
 	// ========================================
-	api.HandleFunc("GET /health", healthHandler)
 	api.HandleFunc("GET /events", withUser(sseHandler))
 	if settings.Env.IsDevMode {
 		api.HandleFunc("GET /inspectIndex", inspectIndex)

backend/http/ldap.go

@@ -26,7 +26,7 @@ func AuthenticateLDAPUser(username, password string) (*users.User, error) {
 	}
 
 	// Use the configured UserIdentifier if available, otherwise use the login username
-	ldapCfg := settings.Config.Auth.Methods.LdapAuth
+	ldapCfg := config.Auth.Methods.LdapAuth
 	mappedUsername := username
 	if ldapCfg.UserIdentifier != "" {
 		if val, ok := userAttributes[ldapCfg.UserIdentifier]; ok && val != "" {
@@ -42,7 +42,7 @@ func AuthenticateLDAPUser(username, password string) (*users.User, error) {
 }
 
 func authenticateLDAP(username, password string) ([]string, map[string]string, error) {
-	c := settings.Config.Auth.Methods.LdapAuth
+	c := config.Auth.Methods.LdapAuth
 	logger.Debugf("ldap: connecting to %s", c.Server)
 
 	var opts []ldap.DialOpt
@@ -229,7 +229,7 @@ func getOrCreateLdapUser(username string, groups []string) (*users.User, error)
 		}
 		// Auto-create user on first LDAP authentication
 		if ldapCfg.AdminGroup == "" {
-			isAdmin = config.UserDefaults.Permissions.Admin
+			isAdmin = config.UserDefaults.Account.Permissions.Admin
 		}
 		user = &users.User{
 			Username:    username,

backend/http/media.go

@@ -2,6 +2,7 @@ package http
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -9,7 +10,6 @@ import (
 	"time"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
@@ -128,8 +128,9 @@ func metadataHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 		Content:                  false,
 		Metadata:                 true,
 		AlbumArt:                 albumArt,
-		ExtractEmbeddedSubtitles: settings.Config.Integrations.Media.ExtractEmbeddedSubtitles,
+		ExtractEmbeddedSubtitles: config.Integrations.Media.ExtractEmbeddedSubtitles,
 		ShowHidden:               d.user.ShowHidden,
+		HideFileExt:              d.user.HideFileExt,
 		SkipExtendedAttrs:        false,
 		ShowSharedAttr:           true,
 	}, store.Access, d.user, store.Share)
@@ -165,8 +166,9 @@ func publicMetadataHandler(w http.ResponseWriter, r *http.Request, d *requestCon
 		Content:                  false,
 		Metadata:                 true,
 		AlbumArt:                 albumArt,
-		ExtractEmbeddedSubtitles: settings.Config.Integrations.Media.ExtractEmbeddedSubtitles && d.share.ExtractEmbeddedSubtitles,
+		ExtractEmbeddedSubtitles: config.Integrations.Media.ExtractEmbeddedSubtitles && d.share.ExtractEmbeddedSubtitles,
 		ShowHidden:               d.share.ShowHidden,
+		HideFileExt:              d.user.HideFileExt,
 		FollowSymlinks:           false,
 	}, store.Access, d.shareUser, store.Share)
 	if err != nil {
@@ -175,3 +177,70 @@ func publicMetadataHandler(w http.ResponseWriter, r *http.Request, d *requestCon
 	fileInfo.Path = utils.AddTrailingSlashIfNotExists(path)
 	return renderJSON(w, r, fileInfo)
 }
+
+// lyricsHandler returns synced/unsynced lyrics (with or without timestamps) for an audio file (embedded or from .lrc files).
+// @Summary Get lyrics for an audio file
+// @Description Returns parsed lyrics with optional timestamps from embedded tags or sidecar .lrc files.
+// @Tags Resources
+// @Accept json
+// @Produce json
+// @Param path query string true "Path to the directory or file"
+// @Param source query string true "Source name"
+// @Success 200 {object} map[string]interface{} "Lyrics array"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Failure 404 {object} map[string]string "Not found"
+// @Router /api/media/lyrics [get]
+func lyricsHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	path := r.URL.Query().Get("path")
+	source := r.URL.Query().Get("source")
+	if path == "" || source == "" {
+		return http.StatusBadRequest, fmt.Errorf("path and source are required")
+	}
+	userscope, err := d.user.GetScopeForSourceName(source)
+	if err != nil {
+		return http.StatusForbidden, err
+	}
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		return http.StatusNotFound, fmt.Errorf("source %s not found", source)
+	}
+	realPath, _, err := idx.GetRealPath(userscope, path)
+	if err != nil {
+		return http.StatusNotFound, err
+	}
+	lyrics, err := files.ExtractLyrics(realPath)
+	if err != nil {
+		return http.StatusInternalServerError, fmt.Errorf("failed to extract lyrics: %v", err)
+	}
+	return renderJSON(w, r, map[string]any{"lyrics": lyrics})
+}
+
+// publicLyricsHandler is the share-link variant of lyricsHandler.
+// @Summary Get lyrics for an audio file (public share)
+// @Tags Shares
+// @Produce json
+// @Param hash query string true "Share hash"
+// @Param path query string false "Path within the share"
+// @Success 200 {object} map[string]interface{} "Lyrics array"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Failure 404 {object} map[string]string "Not found"
+// @Router /public/api/media/lyrics [get]
+func publicLyricsHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	sourceCfg, ok := config.Server.SourceMap[d.share.Source]
+	if !ok {
+		return http.StatusNotFound, fmt.Errorf("source not found")
+	}
+	idx := indexing.GetIndex(sourceCfg.Name)
+	if idx == nil {
+		return http.StatusNotFound, fmt.Errorf("source not found")
+	}
+	realPath, _, err := idx.GetRealPath(d.IndexPath)
+	if err != nil {
+		return http.StatusNotFound, errors.New("could not find real path for file")
+	}
+	lyrics, err := files.ExtractLyrics(realPath)
+	if err != nil {
+		return http.StatusInternalServerError, errors.New("failed to extract lyrics")
+	}
+	return renderJSON(w, r, map[string]any{"lyrics": lyrics})
+}

backend/http/middleware.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"path/filepath"
 	"runtime"
 	"slices"
 	"strings"
@@ -31,7 +32,6 @@ type requestContext struct {
 	fileInfo     iteminfo.ExtendedFileInfo
 	token        string
 	share        *share.Link
-	shareValid   bool
 	ctx          context.Context
 	MaxBandwidth int
 	Data         interface{}
@@ -53,7 +53,12 @@ type handleFunc func(w http.ResponseWriter, r *http.Request, data *requestContex
 func withHashFileHelper(fn handleFunc) handleFunc {
 	return withOrWithoutUserHelper(func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
 		hash := r.URL.Query().Get("hash")
-		path := r.URL.Query().Get("path")
+		inputPath := r.URL.Query().Get("path")
+		path, err := utils.SanitizeUserPath(inputPath)
+		if err != nil && inputPath != "" {
+			return http.StatusBadRequest, err
+		}
+		path = filepath.ToSlash(path)
 
 		// Get the file link by hash
 		link, err := store.Share.GetByHash(hash)
@@ -128,8 +133,9 @@ func withHashFileHelper(fn handleFunc) handleFunc {
 			Content:                  getContent,
 			Metadata:                 getMetadata,
 			AlbumArt:                 strings.Contains(r.URL.Path, "/preview"),
-			ExtractEmbeddedSubtitles: settings.Config.Integrations.Media.ExtractEmbeddedSubtitles && link.ExtractEmbeddedSubtitles,
+			ExtractEmbeddedSubtitles: config.Integrations.Media.ExtractEmbeddedSubtitles && link.ExtractEmbeddedSubtitles,
 			ShowHidden:               link.ShowHidden,
+			HideFileExt:              link.HideFileExt,
 			FollowSymlinks:           true,
 		}, store.Access, data.shareUser, store.Share)
 		if err != nil {
@@ -222,57 +228,19 @@ func extractUserFromExpiredToken(r *http.Request, data *requestContext) *users.U
 // If authentication fails, the request continues without a user.
 func withOrWithoutUserHelper(fn handleFunc) handleFunc {
 	return func(w http.ResponseWriter, r *http.Request, data *requestContext) (int, error) {
-		var link *share.Link
-		var isShareRequest bool
-		var shareHash string
-
 		hash := r.URL.Query().Get("hash")
 		if hash != "" {
-			// Get the file link by hash
-			isShareRequest = true
-			shareHash = hash
-			link, _ = store.Share.GetByHash(hash)
-		} else {
-			prefix := config.Server.BaseURL + "public/share/"
-			reconstructed := config.Server.BaseURL + "public" + r.URL.Path
-			if strings.HasPrefix(reconstructed, prefix) {
-				remaining := strings.TrimPrefix(reconstructed, prefix)
-				if remaining != "" {
-					if idx := strings.IndexByte(remaining, '/'); idx >= 0 {
-						remaining = remaining[:idx]
-					}
-					if remaining != "" {
-						isShareRequest = true
-						shareHash = remaining
-						var err error
-						link, err = store.Share.GetByHash(remaining)
-						if err != nil {
-							logger.Debugf("error getting share by hash: %v", err)
-						}
-					}
-				}
-			}
-		}
-
-		// If this is a share request, always create a share context (even if invalid)
-		if isShareRequest {
-			if link != nil {
-				data.share = link
-				data.shareValid = true
-			} else {
-				// Create an empty share with just the hash for invalid shares
-				data.share = &share.Link{Hash: shareHash}
-				data.shareValid = false
+			_, err := store.Share.GetByHash(hash)
+			if err != nil {
+				return http.StatusNotFound, fmt.Errorf("share hash not found")
 			}
 		}
 
 		// Try to authenticate user first
 		status, err := withUserHelper(nil)(w, r, data)
 		if err == nil && status < 400 {
-			if data.share != nil && data.shareValid {
-				if data.user != nil {
-					data.user.CustomTheme = data.share.ShareTheme
-				}
+			if data.share != nil && data.user != nil {
+				data.user.CustomTheme = data.share.ShareTheme
 			}
 			return fn(w, r, data)
 		}
@@ -283,7 +251,7 @@ func withOrWithoutUserHelper(fn handleFunc) handleFunc {
 			userFromExpiredToken := extractUserFromExpiredToken(r, data)
 			if userFromExpiredToken != nil {
 				data.user = userFromExpiredToken
-				if data.share != nil && data.shareValid {
+				if data.share != nil {
 					data.user.CustomTheme = data.share.ShareTheme
 				}
 				setUserInResponseWriter(w, data.user)
@@ -295,7 +263,7 @@ func withOrWithoutUserHelper(fn handleFunc) handleFunc {
 			settings.ApplyUserDefaults(data.user)
 			// Clear any user data that might have been partially set
 			data.token = ""
-			if data.share != nil && data.shareValid {
+			if data.share != nil {
 				data.user.CustomTheme = data.share.ShareTheme
 			}
 			// Call the handler function without user context
@@ -659,8 +627,8 @@ func withoutUser(fn handleFunc) http.HandlerFunc {
 	return wrapHandler(withoutUserHelper(fn))
 }
 
-func loginHelper(fn handleFunc) http.HandlerFunc {
-	return wrapHandler(LoginHelper(false, fn))
+func loginHelper(fn handleFunc) handleFunc {
+	return LoginHelper(false, fn)
 }
 
 func withSelfOrAdmin(fn handleFunc) http.HandlerFunc {
@@ -755,7 +723,7 @@ func setUserInResponseWriter(w http.ResponseWriter, user *users.User) {
 func getRemoteIP(r *http.Request) string {
 	// 1. Check X-Forwarded-For
 	xff := r.Header.Get("X-Forwarded-For")
-	if xff != "" {
+	if config.Http.TrustedHeaders["x-forwarded-for"] && xff != "" {
 		// The first IP is the original client
 		ips := strings.Split(xff, ",")
 		return strings.TrimSpace(ips[0])
@@ -763,7 +731,7 @@ func getRemoteIP(r *http.Request) string {
 
 	// 2. Check X-Real-IP
 	xri := r.Header.Get("X-Real-IP")
-	if xri != "" {
+	if config.Http.TrustedHeaders["x-real-ip"] && xri != "" {
 		return xri
 	}
 
@@ -830,8 +798,8 @@ func LoggingMiddleware(next http.Handler) http.Handler {
 		}
 		duration := time.Since(start)
 
-		// Use the StatusCode from wrappedWriter, which might have been set to 500 by the recover logic
-		logger.Api(wrappedWriter.StatusCode,
+		// ApiPathExclude is applied per logging sink inside go-logger (logger.ApiPath).
+		logger.ApiPath(wrappedWriter.StatusCode, fullURL,
 			fmt.Sprintf("%-7s | %3d | %-15s | %-12s | %-12s | \"%s\"",
 				r.Method,
 				wrappedWriter.StatusCode,

backend/http/oidc.go

@@ -159,7 +159,7 @@ func parseOIDCGroupsValue(groupsVal interface{}) []string {
 // @Success 302 {string} string "Redirect to OIDC provider"
 // @Router /api/auth/oidc/login [get]
 func oidcLoginHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	oidcCfg := settings.Config.Auth.Methods.OidcAuth
+	oidcCfg := config.Auth.Methods.OidcAuth
 	if !oidcCfg.Enabled {
 		return http.StatusForbidden, fmt.Errorf("oidc authentication is not enabled")
 	}
@@ -197,7 +197,7 @@ func oidcLoginHandler(w http.ResponseWriter, r *http.Request, d *requestContext)
 // @Router /api/auth/oidc/callback [get]
 func oidcCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
 	ctx := r.Context()
-	oidcCfg := settings.Config.Auth.Methods.OidcAuth
+	oidcCfg := config.Auth.Methods.OidcAuth
 	if oidcCfg.Provider == nil || oidcCfg.Verifier == nil {
 		// Ensure Provider and Verifier are initialized on application startup
 		// This check is good, keep it.
@@ -255,8 +255,6 @@ func oidcCallbackHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 
 	// --- Attempt to process ID Token ---
 	if ok && rawIDToken != "" {
-		logger.Debugf("ID token found in token response, attempting verification. Raw ID Token: %s", rawIDToken)
-
 		// Verify the ID token
 		// This uses the verifier initialized with the provider's JWKS endpoint and client ID
 		idToken, verify_err := oidcCfg.Verifier.Verify(ctx, rawIDToken)

backend/http/onlyOffice.go

@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"time"
 
 	jwt "github.com/golang-jwt/jwt/v4"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
@@ -28,8 +29,16 @@ const (
 	onlyOfficeStatusDocumentClosedWithNoChanges     = 4
 	onlyOfficeStatusForceSaveWhileDocumentStillOpen = 6
 	onlyOfficeStatusForceSaveError                  = 7
+
+	onlyOfficeDownloadTimeout = 10 * time.Second
 )
 
+// onlyOfficeDownloadClient fetches saved documents from the OnlyOffice document server.
+// A bounded timeout avoids hanging goroutines when the server is unreachable.
+var onlyOfficeDownloadClient = &http.Client{
+	Timeout: onlyOfficeDownloadTimeout,
+}
+
 type OnlyOfficeCallback struct {
 	Actions       []OnlyOfficeAction `json:"actions,omitempty"`
 	ChangesURL    string             `json:"changesurl,omitempty"`
@@ -81,7 +90,7 @@ type OnlyOfficeJWTPayload struct {
 // @Router /api/office/config [get]
 // @Security ApiKeyAuth
 func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
-	if settings.Config.Integrations.OnlyOffice.Url == "" {
+	if config.Integrations.OnlyOffice.Url == "" {
 		return http.StatusInternalServerError, errors.New("only-office integration must be configured in settings")
 	}
 
@@ -107,13 +116,13 @@ func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d
 	var sourceInfo *settings.Source
 	var ok bool
 	if hash != "" {
-		sourceInfo, ok = settings.Config.Server.SourceMap[d.share.Source]
+		sourceInfo, ok = config.Server.SourceMap[d.share.Source]
 		if !ok {
 			logger.Error("OnlyOffice: source not found")
 			return http.StatusInternalServerError, fmt.Errorf("source not found")
 		}
 	} else {
-		sourceInfo, ok = settings.Config.Server.NameToSource[source]
+		sourceInfo, ok = config.Server.NameToSource[source]
 		if !ok {
 			logger.Error("OnlyOffice: source not found")
 			return http.StatusInternalServerError, fmt.Errorf("source not found")
@@ -210,7 +219,7 @@ func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d
 			"title":    d.fileInfo.Name,
 			"url":      downloadURL,
 			"permissions": map[string]interface{}{
-				"edit":     utils.Ternary(settings.Config.Integrations.OnlyOffice.ViewOnly, "view", canEditMode),
+				"edit":     utils.Ternary(config.Integrations.OnlyOffice.ViewOnly, "view", canEditMode),
 				"download": true,
 				"print":    true,
 			},
@@ -227,14 +236,14 @@ func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d
 				"uiTheme":   themeMode,
 			},
 			"lang": d.user.Locale,
-			"mode": utils.Ternary(settings.Config.Integrations.OnlyOffice.ViewOnly, "view", canEditMode),
+			"mode": utils.Ternary(config.Integrations.OnlyOffice.ViewOnly, "view", canEditMode),
 		},
 	}
 
 	// Sign configuration with JWT if secret is configured
-	if settings.Config.Integrations.OnlyOffice.Secret != "" {
+	if config.Integrations.OnlyOffice.Secret != "" {
 		token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(clientConfig))
-		signature, err := token.SignedString([]byte(settings.Config.Integrations.OnlyOffice.Secret))
+		signature, err := token.SignedString([]byte(config.Integrations.OnlyOffice.Secret))
 		if err != nil {
 			logger.Errorf("OnlyOffice: failed to sign JWT: %v", err)
 			return http.StatusInternalServerError, fmt.Errorf("failed to sign configuration")
@@ -249,10 +258,10 @@ func onlyofficeClientConfigGetHandler(w http.ResponseWriter, r *http.Request, d
 func buildOnlyOfficeDownloadURL(r *http.Request, source, path, hash, token string) string {
 	// Determine base URL (internal URL takes priority for OnlyOffice server communication)
 	var baseURL string
-	if settings.Config.Server.InternalUrl != "" {
+	if config.Server.InternalUrl != "" {
 		// InternalUrl is a full URL (e.g., http://localhost:8080), so use it directly
-		internalURL := strings.TrimSuffix(settings.Config.Server.InternalUrl, "/")
-		baseURLPath := strings.TrimPrefix(settings.Config.Server.BaseURL, "/")
+		internalURL := strings.TrimSuffix(config.Server.InternalUrl, "/")
+		baseURLPath := strings.TrimPrefix(config.Server.BaseURL, "/")
 		if baseURLPath != "" {
 			baseURL = internalURL + "/" + baseURLPath
 		} else {
@@ -276,7 +285,7 @@ func buildOnlyOfficeDownloadURL(r *http.Request, source, path, hash, token strin
 			host = r.Host
 			scheme = getScheme(r)
 		}
-		baseURL = fmt.Sprintf("%s://%s%s", scheme, host, settings.Config.Server.BaseURL)
+		baseURL = fmt.Sprintf("%s://%s%s", scheme, host, config.Server.BaseURL)
 	}
 
 	escapedPath := url.QueryEscape(path)
@@ -293,10 +302,10 @@ func buildOnlyOfficeDownloadURL(r *http.Request, source, path, hash, token strin
 func buildOnlyOfficeCallbackURL(r *http.Request, source, path, hash, token string) string {
 	// Determine base URL (internal URL takes priority for OnlyOffice server communication)
 	var baseURL string
-	if settings.Config.Server.InternalUrl != "" {
+	if config.Server.InternalUrl != "" {
 		// InternalUrl is a full URL (e.g., http://localhost:8080), so use it directly
-		internalURL := strings.TrimSuffix(settings.Config.Server.InternalUrl, "/")
-		baseURLPath := strings.TrimPrefix(settings.Config.Server.BaseURL, "/")
+		internalURL := strings.TrimSuffix(config.Server.InternalUrl, "/")
+		baseURLPath := strings.TrimPrefix(config.Server.BaseURL, "/")
 		if baseURLPath != "" {
 			baseURL = internalURL + "/" + baseURLPath
 		} else {
@@ -320,7 +329,7 @@ func buildOnlyOfficeCallbackURL(r *http.Request, source, path, hash, token strin
 			host = r.Host
 			scheme = getScheme(r)
 		}
-		baseURL = fmt.Sprintf("%s://%s%s", scheme, host, settings.Config.Server.BaseURL)
+		baseURL = fmt.Sprintf("%s://%s%s", scheme, host, config.Server.BaseURL)
 	}
 
 	var callbackURL string
@@ -347,6 +356,97 @@ func buildOnlyOfficeCallbackURL(r *http.Request, source, path, hash, token strin
 	return callbackURL
 }
 
+// resolveOnlyOfficeDownloadURL validates a callback document URL against
+// integrations.office.url and optionally rewrites the origin to integrations.office.internalUrl.
+// Returns an empty string when the URL is missing, malformed, or not hosted on the configured
+// OnlyOffice server (SSRF protection).
+func resolveOnlyOfficeDownloadURL(rawURL string) string {
+	if rawURL == "" {
+		return ""
+	}
+
+	publicBase := config.Integrations.OnlyOffice.Url
+	if publicBase == "" {
+		logger.Warningf("OnlyOffice callback: integrations.office.url is not configured")
+		return ""
+	}
+
+	parsedURL, err := url.Parse(rawURL)
+	if err != nil {
+		logger.Warningf("OnlyOffice callback: could not parse document URL (%q): %v", rawURL, err)
+		return ""
+	}
+
+	publicURL, err := url.Parse(publicBase)
+	if err != nil {
+		logger.Warningf("OnlyOffice callback: could not parse integrations.office.url (%q): %v", publicBase, err)
+		return ""
+	}
+
+	if !onlyOfficeURLHostsMatch(parsedURL, publicURL) {
+		logger.Warningf("OnlyOffice callback: rejecting document URL with untrusted host %q (expected %q)",
+			parsedURL.Host, publicURL.Host)
+		return ""
+	}
+
+	internalBase := config.Integrations.OnlyOffice.InternalUrl
+	if internalBase == "" {
+		return rawURL
+	}
+
+	internalURL, err := url.Parse(internalBase)
+	if err != nil {
+		logger.Warningf("OnlyOffice callback: could not parse integrations.office.internalUrl (%q): %v", internalBase, err)
+		return ""
+	}
+	if !isAllowedOnlyOfficeScheme(internalURL.Scheme) || internalURL.Host == "" {
+		logger.Warningf("OnlyOffice callback: invalid integrations.office.internalUrl (%q)", internalBase)
+		return ""
+	}
+
+	rewritten := *parsedURL
+	rewritten.Scheme = internalURL.Scheme
+	rewritten.Host = internalURL.Host
+	result := rewritten.String()
+	if result != rawURL {
+		logger.Debugf("OnlyOffice callback: rewrote URL from %s to %s", rawURL, result)
+	}
+	return result
+}
+
+func isAllowedOnlyOfficeScheme(scheme string) bool {
+	return scheme == "http" || scheme == "https"
+}
+
+func onlyOfficeEffectivePort(u *url.URL) string {
+	if port := u.Port(); port != "" {
+		return port
+	}
+	switch u.Scheme {
+	case "https":
+		return "443"
+	case "http":
+		return "80"
+	default:
+		return ""
+	}
+}
+
+// onlyOfficeURLHostsMatch reports whether callback and configured URLs refer to the same
+// OnlyOffice host, comparing hostname and effective port (so office.local matches office.local:80).
+func onlyOfficeURLHostsMatch(callback, configured *url.URL) bool {
+	if !isAllowedOnlyOfficeScheme(callback.Scheme) || !isAllowedOnlyOfficeScheme(configured.Scheme) {
+		return false
+	}
+	if callback.Hostname() == "" || configured.Hostname() == "" {
+		return false
+	}
+	if !strings.EqualFold(callback.Hostname(), configured.Hostname()) {
+		return false
+	}
+	return onlyOfficeEffectivePort(callback) == onlyOfficeEffectivePort(configured)
+}
+
 // processOnlyOfficeCallback handles the common callback processing logic for both GET and POST requests
 func processOnlyOfficeCallback(w http.ResponseWriter, r *http.Request, d *requestContext, data *OnlyOfficeCallback) (int, error) {
 	// Extract clean parameters from query string
@@ -492,7 +592,12 @@ func processOnlyOfficeCallback(w http.ResponseWriter, r *http.Request, d *reques
 		}
 
 		// Download the updated document from OnlyOffice server
-		doc, err := http.Get(data.URL)
+		downloadURL := resolveOnlyOfficeDownloadURL(data.URL)
+		if downloadURL == "" {
+			logger.Errorf("OnlyOffice callback: missing or untrusted document URL in callback payload")
+			return returnOnlyOfficeError(w, r, 500, "missing or untrusted document URL in callback payload")
+		}
+		doc, err := onlyOfficeDownloadClient.Get(downloadURL)
 		if err != nil {
 			logger.Errorf("OnlyOffice callback: failed to download updated document: %v", err)
 			return returnOnlyOfficeError(w, r, 500, "failed to download updated document")

backend/http/onlyOffice_test.go

@@ -0,0 +1,102 @@
+package http
+
+import (
+	"net/url"
+	"testing"
+)
+
+func TestResolveOnlyOfficeDownloadURL(t *testing.T) {
+	orig := config.Integrations.OnlyOffice
+	t.Cleanup(func() {
+		config.Integrations.OnlyOffice = orig
+	})
+
+	config.Integrations.OnlyOffice.Url = "http://192.168.88.100:8282"
+	config.Integrations.OnlyOffice.InternalUrl = "http://onlyoffice"
+
+	cachePath := "/cache/files/data/doc_1/output.ods/output.ods?md5=abc&expires=1"
+	publicURL := "http://192.168.88.100:8282" + cachePath
+	internalURL := "http://onlyoffice" + cachePath
+
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "rewrites public cache URL to internal host",
+			input: publicURL,
+			want:  internalURL,
+		},
+		{
+			name:  "empty URL",
+			input: "",
+			want:  "",
+		},
+		{
+			name:  "untrusted host rejected",
+			input: "http://other-host:8282" + cachePath,
+			want:  "",
+		},
+		{
+			name:  "non-http scheme rejected",
+			input: "ftp://192.168.88.100:8282" + cachePath,
+			want:  "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := resolveOnlyOfficeDownloadURL(tt.input)
+			if got != tt.want {
+				t.Errorf("resolveOnlyOfficeDownloadURL() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+
+	t.Run("pass through public URL when internalUrl unset", func(t *testing.T) {
+		config.Integrations.OnlyOffice.InternalUrl = ""
+		got := resolveOnlyOfficeDownloadURL(publicURL)
+		if got != publicURL {
+			t.Errorf("resolveOnlyOfficeDownloadURL() = %q, want %q", got, publicURL)
+		}
+	})
+
+	t.Run("hostname match with default http port", func(t *testing.T) {
+		config.Integrations.OnlyOffice.Url = "http://office.local"
+		config.Integrations.OnlyOffice.InternalUrl = "http://onlyoffice"
+		input := "http://office.local:80" + cachePath
+		want := "http://onlyoffice" + cachePath
+		got := resolveOnlyOfficeDownloadURL(input)
+		if got != want {
+			t.Errorf("resolveOnlyOfficeDownloadURL() = %q, want %q", got, want)
+		}
+	})
+
+	t.Run("reject when public url not configured", func(t *testing.T) {
+		config.Integrations.OnlyOffice.Url = ""
+		config.Integrations.OnlyOffice.InternalUrl = "http://onlyoffice"
+		got := resolveOnlyOfficeDownloadURL(publicURL)
+		if got != "" {
+			t.Errorf("resolveOnlyOfficeDownloadURL() = %q, want empty", got)
+		}
+	})
+}
+
+func TestOnlyOfficeURLHostsMatch(t *testing.T) {
+	mustParse := func(raw string) *url.URL {
+		t.Helper()
+		u, err := url.Parse(raw)
+		if err != nil {
+			t.Fatalf("url.Parse(%q): %v", raw, err)
+		}
+		return u
+	}
+
+	if !onlyOfficeURLHostsMatch(mustParse("http://office.local:80/x"), mustParse("http://office.local/x")) {
+		t.Fatal("expected office.local:80 to match office.local with default port")
+	}
+	if onlyOfficeURLHostsMatch(mustParse("http://evil.example/x"), mustParse("http://office.local/x")) {
+		t.Fatal("expected different hostnames not to match")
+	}
+}

backend/http/preview.go

@@ -14,7 +14,6 @@ import (
 	"time"
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
@@ -105,7 +104,7 @@ func getDirectoryPreview(r *http.Request, d *requestContext, frameIndex int) (*i
 	// Build list of previewable item names in stable order (same as d.fileInfo.Files)
 	var previewableNames []string
 	for _, item := range d.fileInfo.Files {
-		if !item.HasPreview || !iteminfo.ShouldBubbleUpToFolderPreview(item.ItemInfo) {
+		if !iteminfo.ShouldBubbleUpToFolderPreview(item.ItemInfo) {
 			continue
 		}
 		previewableNames = append(previewableNames, item.Name)
@@ -121,7 +120,7 @@ func getDirectoryPreview(r *http.Request, d *requestContext, frameIndex int) (*i
 	path := utils.JoinPathAsUnix(d.fileInfo.Path, name)
 	user := d.user
 	if d.share != nil {
-		sourceInfo, ok := settings.Config.Server.SourceMap[d.share.Source]
+		sourceInfo, ok := config.Server.SourceMap[d.share.Source]
 		if !ok {
 			return nil, fmt.Errorf("source not found for share")
 		}
@@ -214,7 +213,7 @@ func previewHelperFunc(w http.ResponseWriter, r *http.Request, d *requestContext
 	if d.fileInfo.OnlyOfficeId != "" {
 		pathUrl := fmt.Sprintf("/api/resources/download?file=%s&source=%s", url.QueryEscape(d.fileInfo.Path), url.QueryEscape(d.fileInfo.Source))
 		pathUrl = pathUrl + "&auth=" + d.token
-		if settings.Config.Server.InternalUrl != "" {
+		if config.Server.InternalUrl != "" {
 			officeUrl = config.Server.InternalUrl + pathUrl
 		} else {
 			scheme := "http"

backend/http/public.go

@@ -8,7 +8,6 @@ import (
 
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
 	"github.com/gtsteffaniak/go-logger/logger"
@@ -80,7 +79,7 @@ func publicDownloadHandler(w http.ResponseWriter, r *http.Request, d *requestCon
 	}
 
 	// Get the actual source name from the share's source mapping
-	sourceInfo, ok := settings.Config.Server.SourceMap[d.share.Source]
+	sourceInfo, ok := config.Server.SourceMap[d.share.Source]
 	if !ok {
 		return http.StatusInternalServerError, fmt.Errorf("source not found for share")
 	}
@@ -368,10 +367,19 @@ func publicPatchHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 	// Note: Share paths are absolute, so we don't strip user scope here
 	// resourcePatchHandler will skip adding scope for shares
 	for i := range req.Items {
+		var sanitizedPath string
+		sanitizedPath, err = utils.SanitizeUserPath(req.Items[i].FromPath)
+		if err != nil {
+			return http.StatusBadRequest, fmt.Errorf("invalid from path: %w", err)
+		}
 		req.Items[i].FromSource = sourceName
-		req.Items[i].FromPath = utils.JoinPathAsUnix(d.share.Path, req.Items[i].FromPath)
+		req.Items[i].FromPath = utils.JoinPathAsUnix(d.share.Path, sanitizedPath)
+		sanitizedPath, err = utils.SanitizeUserPath(req.Items[i].ToPath)
+		if err != nil {
+			return http.StatusBadRequest, fmt.Errorf("invalid to path: %w", err)
+		}
 		req.Items[i].ToSource = sourceName
-		req.Items[i].ToPath = utils.JoinPathAsUnix(d.share.Path, req.Items[i].ToPath)
+		req.Items[i].ToPath = utils.JoinPathAsUnix(d.share.Path, sanitizedPath)
 	}
 	d.Data = req
 

backend/http/resource.go

@@ -18,7 +18,6 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
@@ -99,8 +98,9 @@ func resourceGetHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 		Expand:                   true,
 		Content:                  getContent,
 		Metadata:                 getMetadata,
-		ExtractEmbeddedSubtitles: settings.Config.Integrations.Media.ExtractEmbeddedSubtitles,
+		ExtractEmbeddedSubtitles: config.Integrations.Media.ExtractEmbeddedSubtitles,
 		ShowHidden:               d.user.ShowHidden,
+		HideFileExt:              d.user.HideFileExt,
 		SkipExtendedAttrs:        skipExtendedAttrs,
 		ShowSharedAttr:           true,
 	}, store.Access, d.user, store.Share)
@@ -145,18 +145,28 @@ func resourceDeleteHandler(w http.ResponseWriter, r *http.Request, d *requestCon
 	if !d.user.Permissions.Delete {
 		return http.StatusForbidden, fmt.Errorf("user is not allowed to delete")
 	}
-
 	path := r.URL.Query().Get("path")
 	source := r.URL.Query().Get("source")
 
 	if path == "/" {
 		return http.StatusForbidden, fmt.Errorf("cannot delete your user's root directory")
 	}
+
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		return http.StatusNotFound, fmt.Errorf("source %s not found", source)
+	}
+
+	if idx.Config.ReadOnly {
+		return http.StatusForbidden, fmt.Errorf("source is read-only")
+	}
+
 	fileInfo, err := files.FileInfoFaster(utils.FileOptions{
-		Path:       path,
-		Source:     source,
-		Expand:     false,
-		ShowHidden: d.user.ShowHidden,
+		Path:        path,
+		Source:      source,
+		Expand:      false,
+		ShowHidden:  d.user.ShowHidden,
+		HideFileExt: d.user.HideFileExt,
 	}, store.Access, d.user, store.Share)
 	if err != nil {
 		return errToStatus(err), err
@@ -251,43 +261,78 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 
 	// Process each item one at a time
 	for _, item := range items {
+		rawPath := item.Path
 		// Validate item
-		if item.Path == "" {
+		if rawPath == "" {
 			response.Failed = append(response.Failed, BulkDeleteItem{
 				Source:  item.Source,
-				Path:    item.Path,
+				Path:    rawPath,
 				Message: "path was empty",
 			})
 			continue
 		}
 
 		// Prevent deletion of root
-		if item.Path == "/" {
+		if rawPath == "/" {
 			response.Failed = append(response.Failed, BulkDeleteItem{
 				Source:  item.Source,
-				Path:    item.Path,
+				Path:    rawPath,
 				Message: "cannot delete root directory",
 			})
 			continue
 		}
+		sanitizedPath, err := utils.SanitizeUserPath(rawPath)
+		if err != nil {
+			response.Failed = append(response.Failed, BulkDeleteItem{
+				Source:  item.Source,
+				Path:    sanitizedPath,
+				Message: err.Error(),
+			})
+			continue
+		}
 
 		if d.share != nil {
 			sourceName := d.share.GetSourceName()
 			if sourceName == "" {
-				return http.StatusNotFound, fmt.Errorf("source not available")
+				response.Failed = append(response.Failed, BulkDeleteItem{
+					Source:  item.Source,
+					Path:    sanitizedPath,
+					Message: "source name is empty",
+				})
+				continue
 			}
+
+			idx := indexing.GetIndex(sourceName)
+			if idx == nil {
+				response.Failed = append(response.Failed, BulkDeleteItem{
+					Source:  item.Source,
+					Path:    sanitizedPath,
+					Message: "source not found",
+				})
+				continue
+			}
+
+			if idx.Config.ReadOnly {
+				response.Failed = append(response.Failed, BulkDeleteItem{
+					Source:  item.Source,
+					Path:    sanitizedPath,
+					Message: "source is read-only",
+				})
+				continue
+			}
+
 			// get user scope path from share
 			userScope, err := d.shareUser.GetScopeForSourceName(sourceName)
 			if err != nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    item.Path,
+					Path:    sanitizedPath,
 					Message: "user does not have access",
 				})
 				continue
 			}
 			withoutUserScope := strings.TrimPrefix(d.share.Path, userScope)
-			indexPath := utils.JoinPathAsUnix(withoutUserScope, item.Path)
+			indexPath := utils.JoinPathAsUnix(withoutUserScope, sanitizedPath)
 
 			fileInfo, err := files.FileInfoFaster(utils.FileOptions{
 				FollowSymlinks: true,
@@ -305,7 +350,7 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 				logger.Errorf("resource bulk delete handler: error deleting file/directory: %v", err)
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    item.Path,
+					Path:    sanitizedPath,
 					Message: "error deleting file/directory, admin must check the logs",
 				})
 				continue
@@ -317,7 +362,7 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			if item.Source == "" {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    item.Path,
+					Path:    sanitizedPath,
 					Message: "source was empty, source is required",
 				})
 				continue
@@ -328,7 +373,7 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			if err != nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    item.Path,
+					Path:    sanitizedPath,
 					Message: fmt.Sprintf("user does not have access: %v", err),
 				})
 				continue
@@ -338,23 +383,32 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			if idx == nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    item.Path,
+					Path:    sanitizedPath,
 					Message: "source not found",
 				})
 				continue
 			}
 
+			if idx.Config.ReadOnly {
+				response.Failed = append(response.Failed, BulkDeleteItem{
+					Source:  item.Source,
+					Path:    sanitizedPath,
+					Message: "source is read-only",
+				})
+				continue
+			}
+
 			// Get file info
 			fileInfo, err := files.FileInfoFaster(utils.FileOptions{
 				FollowSymlinks: true,
-				Path:           item.Path,
+				Path:           sanitizedPath,
 				Source:         item.Source,
 				ShowHidden:     true,
 			}, store.Access, filePermUser, store.Share)
 			if err != nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    item.Path,
+					Path:    sanitizedPath,
 					Message: err.Error(),
 				})
 				continue
@@ -363,7 +417,7 @@ func resourceBulkDeleteHandler(w http.ResponseWriter, r *http.Request, d *reques
 			if err != nil {
 				response.Failed = append(response.Failed, BulkDeleteItem{
 					Source:  item.Source,
-					Path:    item.Path,
+					Path:    sanitizedPath,
 					Message: err.Error(),
 				})
 				continue
@@ -481,6 +535,17 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 	if d.share == nil && !d.user.Permissions.Create {
 		return http.StatusForbidden, fmt.Errorf("user is not allowed to create or modify")
 	}
+
+	idx := indexing.GetIndex(source)
+	if idx == nil {
+		logger.Debugf("source %s not found", source)
+		return http.StatusNotFound, fmt.Errorf("source %s not found", source)
+	}
+
+	if idx.Config.ReadOnly {
+		return http.StatusForbidden, fmt.Errorf("source is read-only")
+	}
+
 	filePermUser := d.user
 	if d.share != nil {
 		filePermUser = d.shareUser
@@ -492,11 +557,6 @@ func resourcePostHandler(w http.ResponseWriter, r *http.Request, d *requestConte
 		Expand:         false,
 		FollowSymlinks: true,
 	}
-	idx := indexing.GetIndex(source)
-	if idx == nil {
-		logger.Debugf("source %s not found", source)
-		return http.StatusNotFound, fmt.Errorf("source %s not found", source)
-	}
 
 	userscope, err := filePermUser.GetScopeForSourceName(source)
 	if err != nil {
@@ -710,6 +770,9 @@ func resourcePutHandler(w http.ResponseWriter, r *http.Request, d *requestContex
 	if idx == nil {
 		return http.StatusNotFound, fmt.Errorf("source %s not found", source)
 	}
+	if idx.Config.ReadOnly {
+		return http.StatusForbidden, fmt.Errorf("source is read-only")
+	}
 	if store.Access != nil && !store.Access.Permitted(idx.Path, fullIndexPath, d.user.Username) {
 		logger.Debugf("user %s denied access to path %s", d.user.Username, fullIndexPath)
 		return http.StatusForbidden, fmt.Errorf("access denied to path %s", path)
@@ -843,6 +906,28 @@ func resourcePatchHandler(w http.ResponseWriter, r *http.Request, d *requestCont
 			continue
 		}
 
+		if srcIdx.Config.ReadOnly && req.Action == "move" {
+			item.Message = "source source is read-only"
+			if d.share != nil {
+				response.Failed = append(response.Failed, MoveCopyItem{
+					Message: item.Message,
+				})
+				continue
+			}
+		}
+
+		if dstIdx.Config.ReadOnly {
+			item.Message = "destination source is read-only"
+			if d.share != nil {
+				response.Failed = append(response.Failed, MoveCopyItem{
+					Message: item.Message,
+				})
+				continue
+			}
+			response.Failed = append(response.Failed, item)
+			continue
+		}
+
 		// Build full index paths for access control
 		fullSrcIndexPath := utils.JoinPathAsUnix(userscopeSrc, item.FromPath)
 		fullDstIndexPath := utils.JoinPathAsUnix(userscopeDst, item.ToPath)
@@ -1039,6 +1124,7 @@ func patchAction(ctx context.Context, params patchActionParams) error {
 			Source:         params.srcIndex,
 			IsDir:          params.isSrcDir,
 			ShowHidden:     params.d.user.ShowHidden,
+			HideFileExt:    params.d.user.HideFileExt,
 		}, store.Access, params.d.user, store.Share)
 
 		if err != nil {

backend/http/search.go

@@ -8,22 +8,31 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )
 
 type searchOptions struct {
-	query         string
+	parsed        iteminfo.SearchOptions
 	sources       []string
 	searchScope   string
 	combinedPath  map[string]string // source -> combinedPath
 	sessionId     string
 	largest       bool
+	useWildcard   bool
 	olderThanUnix int64 // optional; 0 = unset. Modified time must be strictly before this Unix second.
 	newerThanUnix int64 // optional; 0 = unset. Modified time must be >= this Unix second.
 }
 
+// scopedSourcePath is one repeated "scope" query value using "sourceName:relativePath"
+// (split on the first ':'). Path is relative within the user's scope for that source; an
+// empty path after ':' means "/" . Example: scope=mydisk:/photos&scope=backup:/archive
+type scopedSourcePath struct {
+	source  string
+	relPath string
+}
+
 // searchHandler handles search requests for files based on the provided query.
 //
 // This endpoint processes a search query, retrieves relevant file paths, and
@@ -31,28 +40,43 @@ type searchOptions struct {
 // against the file index, which is built from the root directory specified in
 // the server's configuration. The results are filtered based on the user's scope.
 //
-// The handler supports searching a single source (using the 'source' parameter)
-// or multiple sources (using the 'sources' parameter). When multiple sources
-// are specified, the scope is always set to the user's scope for each source.
+// Per-source search scope (preferred for multi-source):
+//
+//	Repeated query parameter "scope" with the value "sourceName:relativePath",
+//	split on the first colon. The path is user-relative (same as the legacy single-scope
+//	path). Encode the whole value with the normal query string rules (e.g. %3A for ':' if needed).
+//	Examples:
+//	  ?scope=mydisk:/&scope=backup:/Photos
+//	Duplicate source names: the last repeated scope for that source wins.
+//
+// Legacy (still supported):
+//
+//   - source / sources: which catalogues to search
+//   - scope: a single path (no 'source:' prefix) applied only when exactly one source is specified.
+//     When multiple sources are listed and no "source:path" scopes are used, each source is searched
+//     from the root of the user's scope (same as before).
 //
 // The handler expects the following headers in the request:
 // - SessionId: A unique identifier for the user's session.
 //
 // The request URL should include query parameters:
-// - query: The search terms to use (required)
+// - query: Structured filter prefix only, or full legacy search string when "terms" parameters are not used
+// - terms: Repeated query parameter; each value is one literal search term. OR-combined by default; use termJoin=and for AND.
+// - termJoin: Optional; "and" requires every term to match; any other value keeps OR semantics (default).
 // - source: Source name (deprecated, use 'sources' instead)
-// - sources: Comma-separated list of source names (e.g., "source1,source2")
-// - scope: Optional path within user scope to search
+// - sources: Comma-separated list of source names (e.g., "source1,source2") when not using scoped scope=source:path params
+// - scope: Either (1) repeated "sourceName:relativePath" as above, or (2) legacy single path within user scope for a single-source search
 // - olderThan: Optional Unix time in seconds; only items modified strictly before this instant
 // - newerThan: Optional Unix time in seconds; only items modified on or after this instant
+// - useWildcard: Optional; when true, file names are matched with SQLite GLOB (wildcards) instead of substring search. Legacy query params glob and useGlob are accepted as aliases.
 //
 // Example request (single source):
 //
 //	GET api/tools/search?query=myfile&source=mysource
 //
-// Example request (multiple sources):
+// Example request (multiple sources with per-source folders):
 //
-//	GET api/tools/search?query=myfile&sources=source1,source2
+//	GET api/tools/search?query=myfile&scope=source1:/&scope=source2:/documents
 //
 // Example response:
 // [
@@ -75,13 +99,17 @@ type searchOptions struct {
 // @Tags Tools
 // @Accept json
 // @Produce json
-// @Param query query string true "Search query"
+// @Param query query string false "Filter prefix or full legacy search text (required when no terms are supplied)"
+// @Param terms query []string false "Repeated: one literal search term per parameter; combined with OR unless termJoin=and"
 // @Param source query string false "Source name for the desired source (deprecated, use 'sources' instead)"
-// @Param sources query string false "Comma-separated list of source names to search across multiple sources. When multiple sources are specified, scope is always the user's scope for each source."
-// @Param scope query string false "path within user scope to search, for example '/first/second' to search within the second directory only. Ignored when multiple sources are specified."
+// @Param sources query string false "Comma-separated source names when not using repeated scope=source:path"
+// @Param scope query []string false "Repeated: either 'sourceName:relativePath' per source, or legacy single path when one source"
 // @Param olderThan query int false "Unix seconds; only results modified strictly before this time"
 // @Param newerThan query int false "Unix seconds; only results modified on or after this time"
-// @Param SessionId header string false "User session ID, add unique value to prevent collisions"
+// @Param useWildcard query bool false "When true, match indexed file names with SQLite GLOB (wildcard patterns)"
+// @Param glob query bool false "Deprecated: alias for useWildcard"
+// @Param useGlob query bool false "Deprecated: alias for useWildcard"
+// @Param termJoin query string false "Optional: 'and' to require all repeated 'terms' match; default is OR"
 // @Success 200 {array} indexing.SearchResult "List of search results with source field populated"
 // @Failure 400 {object} map[string]string "Bad Request"
 // @Router /api/tools/search [get]
@@ -104,10 +132,10 @@ func searchHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 			return http.StatusBadRequest, fmt.Errorf("index not found for source %s", searchOptions.sources[0])
 		}
 		combinedPath := searchOptions.combinedPath[searchOptions.sources[0]]
-		response = index.Search(searchOptions.query, combinedPath, searchOptions.sessionId, searchOptions.largest, searchSize, searchOptions.olderThanUnix, searchOptions.newerThanUnix)
+		response = index.SearchParsed(searchOptions.parsed, combinedPath, searchOptions.sessionId, searchOptions.largest, searchSize, searchOptions.olderThanUnix, searchOptions.newerThanUnix, searchOptions.useWildcard)
 	} else {
 		// Multiple sources - use the new SearchMultiSources function
-		response = indexing.SearchMultiSources(searchOptions.query, searchOptions.sources, searchOptions.combinedPath, searchOptions.sessionId, searchOptions.largest, searchSize, searchOptions.olderThanUnix, searchOptions.newerThanUnix)
+		response = indexing.SearchMultiSourcesParsed(searchOptions.parsed, searchOptions.sources, searchOptions.combinedPath, searchOptions.sessionId, searchOptions.largest, searchSize, searchOptions.olderThanUnix, searchOptions.newerThanUnix, searchOptions.useWildcard)
 	}
 
 	// Filter out items that are not permitted according to access rules and trim user scope from paths
@@ -125,16 +153,85 @@ func searchHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 			result.Path = "/"
 		}
 		filteredResponse = append(filteredResponse, result)
+		// This is to filter the ext-hidden files from search results, like the ones with the hidden property
+		if d.user.HideFileExt != "" {
+			filtered := filteredResponse[:0]
+			for _, res := range filteredResponse {
+				if res.Type == "directory" {
+					filtered = append(filtered, res)
+					continue
+				}
+				baseName := filepath.Base(res.Path)
+				if !utils.HideFileByExt(baseName, d.user.HideFileExt) {
+					filtered = append(filtered, res)
+				}
+			}
+			filteredResponse = filtered
+		}
 	}
 	return renderJSON(w, r, filteredResponse)
 }
 
+// parseRepeatedScopeParams interprets repeated "scope" query values.
+// If a value contains ':', it is "sourceName:relativePath" (first ':' separates source and path).
+// Otherwise it is a legacy single path (at most one such value across all scope params).
+func parseRepeatedScopeParams(scopeQueryValues []string) ([]scopedSourcePath, string, error) {
+	var clauses []scopedSourcePath
+	legacyPath := ""
+	for _, raw := range scopeQueryValues {
+		raw = strings.TrimSpace(raw)
+		if raw == "" {
+			continue
+		}
+		idx := strings.IndexByte(raw, ':')
+		if idx > 0 {
+			src := strings.TrimSpace(raw[:idx])
+			if src == "" {
+				return nil, "", fmt.Errorf("invalid scope parameter %q: empty source name before ':'", raw)
+			}
+			pathPart := strings.TrimSpace(raw[idx+1:])
+			if pathPart == "" {
+				pathPart = "/"
+			}
+			cleanPath, err := utils.SanitizeUserPath(pathPart)
+			if err != nil {
+				return nil, "", fmt.Errorf("invalid path in scope parameter %q: %v", raw, err)
+			}
+			clauses = append(clauses, scopedSourcePath{source: src, relPath: cleanPath})
+			continue
+		}
+		if idx == 0 {
+			return nil, "", fmt.Errorf("invalid scope parameter %q: source name must precede ':'", raw)
+		}
+		if legacyPath != "" {
+			return nil, "", fmt.Errorf("multiple legacy scope paths without a source prefix are not allowed; use scope=sourceName:path for each source")
+		}
+		clean, err := utils.SanitizeUserPath(raw)
+		if err != nil {
+			return nil, "", fmt.Errorf("invalid scope: %v", err)
+		}
+		legacyPath = clean
+	}
+	return clauses, legacyPath, nil
+}
+
 func prepSearchOptions(r *http.Request, d *requestContext) (*searchOptions, error) {
 	query := r.URL.Query().Get("query")
+	rawTerms := r.URL.Query()["terms"]
+	termJoin := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("termJoin")))
+	matchAllTerms := termJoin == "and"
 	sourcesParam := r.URL.Query().Get("sources")
 	sourceParam := r.URL.Query().Get("source") // deprecated, but still supported
-	scope := r.URL.Query().Get("scope")        // Go automatically decodes query params
+	scopeValues := r.URL.Query()["scope"]      // repeated; use slice, not Get (first only)
 	largest := r.URL.Query().Get("largest") == "true"
+	wildRaw := strings.TrimSpace(r.URL.Query().Get("useWildcard"))
+	if wildRaw == "" {
+		wildRaw = strings.TrimSpace(r.URL.Query().Get("glob"))
+	}
+	if wildRaw == "" {
+		wildRaw = strings.TrimSpace(r.URL.Query().Get("useGlob"))
+	}
+	useWildcard := strings.EqualFold(wildRaw, "true") || wildRaw == "1"
 	olderThanUnix, err := parseOptionalUnixQueryParam("olderThan", r.URL.Query().Get("olderThan"))
 	if err != nil {
 		return nil, err
@@ -143,64 +240,116 @@ func prepSearchOptions(r *http.Request, d *requestContext) (*searchOptions, erro
 	if err != nil {
 		return nil, err
 	}
-	if scope == "" {
-		scope = "/"
-	}
-	cleanScope, err := utils.SanitizeUserPath(scope)
+
+	scopedClauses, legacyScopeOnly, err := parseRepeatedScopeParams(scopeValues)
 	if err != nil {
-		return nil, fmt.Errorf("invalid scope: %v", err)
-	}
-	scope = cleanScope
-
-	var sources []string
-	if sourcesParam != "" {
-		sources = strings.Split(sourcesParam, ",")
-	} else if sourceParam != "" {
-		sources = []string{sourceParam}
-	} else {
-		return nil, fmt.Errorf("either 'source' or 'sources' query parameter is required")
+		return nil, err
 	}
 
-	// Validate all sources exist
-	for _, source := range sources {
-		index := indexing.GetIndex(source)
-		if index == nil {
-			return nil, fmt.Errorf("index not found for source %s", source)
+	normalizedTerms := make([]string, 0, len(rawTerms))
+	for _, t := range rawTerms {
+		t = strings.TrimSpace(t)
+		if t != "" {
+			normalizedTerms = append(normalizedTerms, t)
 		}
 	}
 
-	if len(query) < settings.Config.Server.MinSearchLength && !largest {
-		return nil, fmt.Errorf("query is too short, minimum length is %d", settings.Config.Server.MinSearchLength)
-	}
-	searchScope := strings.TrimPrefix(scope, ".")
+	parsed := iteminfo.BuildSearchOptionsFromQuery(query, normalizedTerms, matchAllTerms)
 
-	// If multiple sources, always use user scope (ignore searchScope)
-	if len(sources) > 1 {
-		searchScope = ""
+	minLen := config.Server.MinSearchLength
+	if !largest {
+		if len(normalizedTerms) > 0 {
+			for _, t := range normalizedTerms {
+				if len(t) < minLen {
+					return nil, fmt.Errorf("each term is too short, minimum length is %d", minLen)
+				}
+			}
+		} else if len(strings.TrimSpace(query)) < minLen {
+			return nil, fmt.Errorf("query is too short, minimum length is %d", minLen)
+		}
 	}
 
-	// Retrieve the User-Agent and X-Auth headers from the request
 	sessionId := r.Header.Get("SessionId")
 
-	// Build combinedPath map for each source
+	var sources []string
 	combinedPathMap := make(map[string]string)
-	for _, source := range sources {
-		index := indexing.GetIndex(source)
-		userscope, err := d.user.GetScopeForSourceName(source)
-		if err != nil {
-			return nil, err
+	var searchScopeOut string
+
+	if len(scopedClauses) > 0 {
+		if legacyScopeOnly != "" {
+			return nil, fmt.Errorf("cannot mix legacy scope path with scope=sourceName:path parameters")
+		}
+		pathBySource := make(map[string]string)
+		for _, c := range scopedClauses {
+			if _, ok := pathBySource[c.source]; !ok {
+				sources = append(sources, c.source)
+			}
+			pathBySource[c.source] = c.relPath
+		}
+		for _, source := range sources {
+			index := indexing.GetIndex(source)
+			if index == nil {
+				return nil, fmt.Errorf("index not found for source %s", source)
+			}
+			userscope, err := d.user.GetScopeForSourceName(source)
+			if err != nil {
+				return nil, err
+			}
+			rel := strings.TrimPrefix(pathBySource[source], ".")
+			combinedPathMap[source] = index.MakeIndexPath(filepath.Join(userscope, rel), true)
+		}
+	} else {
+		if sourcesParam != "" {
+			sources = strings.Split(sourcesParam, ",")
+		} else if sourceParam != "" {
+			sources = []string{sourceParam}
+		} else {
+			return nil, fmt.Errorf("either 'source', 'sources', or repeated scope=sourceName:path query parameters are required")
+		}
+		for i := range sources {
+			sources[i] = strings.TrimSpace(sources[i])
+		}
+
+		for _, source := range sources {
+			index := indexing.GetIndex(source)
+			if index == nil {
+				return nil, fmt.Errorf("index not found for source %s", source)
+			}
+		}
+
+		scope := legacyScopeOnly
+		if scope == "" {
+			scope = "/"
+		}
+		cleanScope, err := utils.SanitizeUserPath(scope)
+		if err != nil {
+			return nil, fmt.Errorf("invalid scope: %v", err)
+		}
+		searchScopeOut = strings.TrimPrefix(cleanScope, ".")
+
+		if len(sources) > 1 {
+			searchScopeOut = ""
+		}
+
+		for _, source := range sources {
+			index := indexing.GetIndex(source)
+			userscope, err := d.user.GetScopeForSourceName(source)
+			if err != nil {
+				return nil, err
+			}
+			combinedPath := index.MakeIndexPath(filepath.Join(userscope, searchScopeOut), true)
+			combinedPathMap[source] = combinedPath
 		}
-		combinedPath := index.MakeIndexPath(filepath.Join(userscope, searchScope), true) // searchScope is a directory
-		combinedPathMap[source] = combinedPath
 	}
 
 	return &searchOptions{
-		query:         query,
+		parsed:        parsed,
 		sources:       sources,
-		searchScope:   searchScope,
+		searchScope:   searchScopeOut,
 		combinedPath:  combinedPathMap,
 		sessionId:     sessionId,
 		largest:       largest,
+		useWildcard:   useWildcard,
 		olderThanUnix: olderThanUnix,
 		newerThanUnix: newerThanUnix,
 	}, nil

backend/http/share.go

@@ -206,6 +206,12 @@ func sharePatchHandler(w http.ResponseWriter, r *http.Request, d *requestContext
 		return http.StatusBadRequest, fmt.Errorf("hash and path are required")
 	}
 
+	sanitizedPath, err := utils.SanitizeUserPath(body.Path)
+	if err != nil {
+		return http.StatusBadRequest, fmt.Errorf("invalid path: %w", err)
+	}
+	body.Path = sanitizedPath
+
 	// only allow users to update their own shares
 	thisShare, err := store.Share.GetByHash(body.Hash)
 	if err != nil {
@@ -215,7 +221,7 @@ func sharePatchHandler(w http.ResponseWriter, r *http.Request, d *requestContext
 		return http.StatusForbidden, fmt.Errorf("you are not allowed to update this share")
 	}
 	// Update the share path
-	err = store.Share.UpdateSharePath(body.Hash, body.Path)
+	err = store.Share.UpdateSharePath(body.Hash, sanitizedPath)
 	if err != nil {
 		return http.StatusInternalServerError, err
 	}

backend/http/static.go

@@ -95,8 +95,8 @@ func handleWithStaticData(w http.ResponseWriter, r *http.Request, d *requestCont
 	favicon := staticURL + "/favicon" + faviconExt
 	shareHash := ""
 	data := make(map[string]interface{})
-	disableNavButtons := settings.Config.Frontend.DisableNavButtons
-	if d.share != nil && d.shareValid {
+	disableNavButtons := config.Frontend.DisableNavButtons
+	if d.share != nil {
 		if d.share.Favicon != "" {
 			if strings.HasPrefix(d.share.Favicon, "http") {
 				favicon = d.share.Favicon
@@ -185,39 +185,41 @@ func handleWithStaticData(w http.ResponseWriter, r *http.Request, d *requestCont
 		"pwaIcon512":         pwaIcon512,
 		"manifestURL":        staticURL + "/site.webmanifest",
 	}
-	// variables consumed by frontend as json
+
 	data["globalVars"] = map[string]interface{}{
-		"name":                 config.Frontend.Name,
-		"minSearchLength":      config.Server.MinSearchLength,
-		"disableExternal":      config.Frontend.DisableDefaultLinks,
-		"darkMode":             settings.Config.UserDefaults.DarkMode,
-		"baseURL":              config.Server.BaseURL,
-		"version":              versionString,
-		"commitSHA":            commitSHAString,
-		"signup":               settings.Config.Auth.Methods.PasswordAuth.Signup,
-		"noAuth":               config.Auth.Methods.NoAuth,
-		"enableThumbs":         !config.Server.DisablePreviews,
-		"externalLinks":        externalLinks,
-		"externalUrl":          strings.TrimSuffix(config.Server.ExternalUrl, "/"),
-		"onlyOfficeUrl":        settings.Config.Integrations.OnlyOffice.Url,
-		"oidcAvailable":        config.Auth.Methods.OidcAuth.Enabled,
-		"jwtAvailable":         config.Auth.Methods.JwtAuth.Enabled,
-		"proxyAvailable":       config.Auth.Methods.ProxyAuth.Enabled,
-		"passwordAvailable":    config.Auth.Methods.PasswordAuth.Enabled,
-		"ldapAvailable":        config.Auth.Methods.LdapAuth.Enabled,
-		"mediaAvailable":       settings.MediaEnabled(),
-		"exiftoolAvailable":    settings.Config.Integrations.Media.ExiftoolPath != "",
-		"muPdfAvailable":       settings.Env.MuPdfAvailable,
-		"updateAvailable":      utils.GetUpdateAvailableUrl(),
-		"disableNavButtons":    disableNavButtons,
-		"userSelectableThemes": config.Frontend.Styling.CustomThemeOptions,
-		"enableHeicConversion": settings.CanConvertImage("heic"),
-		"eventBasedThemes":     !config.Frontend.Styling.DisableEventBasedThemes,
-		"loginIcon":            loginIcon,
-		"disableSidebar":       disableSidebar,
-		"shareHash":            shareHash,
-		"oidcLoginButtonText":  config.Frontend.OIDCLoginButtonText,
-		"loginButtonText":      config.Frontend.LoginButtonText,
+		"name":                   config.Frontend.Name,
+		"minSearchLength":        config.Server.MinSearchLength,
+		"disableExternal":        config.Frontend.DisableDefaultLinks,
+		"darkMode":               config.UserDefaults.UI.DarkMode,
+		"baseURL":                config.Server.BaseURL,
+		"version":                versionString,
+		"commitSHA":              commitSHAString,
+		"signup":                 config.Auth.Methods.PasswordAuth.Signup,
+		"noAuth":                 config.Auth.Methods.NoAuth,
+		"enableThumbs":           !config.Server.DisablePreviews,
+		"externalLinks":          externalLinks,
+		"externalUrl":            strings.TrimSuffix(config.Server.ExternalUrl, "/"),
+		"onlyOfficeUrl":          config.Integrations.OnlyOffice.Url,
+		"oidcAvailable":          config.Auth.Methods.OidcAuth.Enabled,
+		"jwtAvailable":           config.Auth.Methods.JwtAuth.Enabled,
+		"proxyAvailable":         config.Auth.Methods.ProxyAuth.Enabled,
+		"passwordAvailable":      config.Auth.Methods.PasswordAuth.Enabled,
+		"ldapAvailable":          config.Auth.Methods.LdapAuth.Enabled,
+		"mediaAvailable":         settings.MediaEnabled(),
+		"exiftoolAvailable":      config.Integrations.Media.ExiftoolPath != "",
+		"muPdfAvailable":         settings.Env.MuPdfAvailable,
+		"updateAvailable":        utils.GetUpdateAvailableUrl(),
+		"disableNavButtons":      disableNavButtons,
+		"userSelectableThemes":   config.Frontend.Styling.CustomThemeOptions,
+		"enableHeicConversion":   settings.CanConvertImage("heic"),
+		"eventBasedThemes":       !config.Frontend.Styling.DisableEventBasedThemes,
+		"loginIcon":              loginIcon,
+		"disableSidebar":         disableSidebar,
+		"shareHash":              shareHash,
+		"oidcLoginButtonText":    config.Frontend.OIDCLoginButtonText,
+		"loginButtonText":        config.Frontend.LoginButtonText,
+		"passkeyAvailable":       config.Auth.Methods.PasskeyAuth.Enabled,
+		"passkeyLoginButtonText": config.Auth.Methods.PasskeyAuth.LoginButtonText,
 	}
 
 	// Marshal each variable to JSON strings for direct template usage

backend/http/users.go

@@ -90,6 +90,7 @@ func userGetHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (
 	return renderJSON(w, r, u)
 }
 
+// prepForFrontend strips secrets and maps source identifiers to display names for JSON (never expose paths).
 func prepForFrontend(u *users.User) {
 	u.Password = ""
 	u.ApiKeys = nil
@@ -98,8 +99,58 @@ func prepForFrontend(u *users.User) {
 	u.TOTPSecret = ""
 	u.TOTPNonce = ""
 	u.Scopes = u.GetFrontendScopes()
-	u.SidebarLinks = u.GetFrontendSidebarLinks()
+	u.SidebarLinks = GetFrontendSidebarLinks(u.SidebarLinks, u.ShowToolsInSidebar)
 	u.Locale = normalizeLocale(u.Locale)
+	for i := range u.PasskeyCredentials {
+		u.PasskeyCredentials[i].PublicKey = ""
+		u.PasskeyCredentials[i].AttestationType = ""
+		u.PasskeyCredentials[i].AttestationFormat = ""
+		u.PasskeyCredentials[i].Flags = users.WebAuthnCredentialFlags{}
+		u.PasskeyCredentials[i].SignCount = 0
+		u.PasskeyCredentials[i].ClientDataJSON = ""
+		u.PasskeyCredentials[i].ClientDataHash = ""
+		u.PasskeyCredentials[i].AuthenticatorData = ""
+		u.PasskeyCredentials[i].PublicKeyAlg = 0
+		u.PasskeyCredentials[i].AttestationObj = ""
+	}
+}
+
+// GetFrontendSidebarLinks converts the user's sidebar links from backend-style to frontend-style:
+func GetFrontendSidebarLinks(links []users.SidebarLink, showToolsInSidebar bool) []users.SidebarLink {
+	if !users.SourceConfigLoaded() {
+		return []users.SidebarLink{}
+	}
+	hasTools := false
+	newLinks := []users.SidebarLink{}
+	for _, link := range links {
+		if strings.HasPrefix(link.Category, "source") {
+			if link.SourceName == "" {
+				continue
+			}
+			source, ok := users.ResolveSourceKey(link.SourceName)
+			if !ok {
+				continue
+			}
+			if full, ok := config.Server.SourceMap[source.Path]; ok {
+				if full.Config.ResolvedRules.IndexingDisabled && link.Category != "source-minimal" {
+					link.Category = "source-alt"
+				}
+			}
+			link.SourceName = source.Name
+		} else if link.Category == "tool" && link.Target == "/tools" {
+			hasTools = true
+		}
+		newLinks = append(newLinks, link)
+	}
+	if !hasTools && showToolsInSidebar {
+		newLinks = append(newLinks, users.SidebarLink{
+			Name:     "Tools",
+			Category: "tool",
+			Target:   "/tools",
+			Icon:     "build",
+		})
+	}
+	return newLinks
 }
 
 // normalizeLocale converts various locale formats (xx_xx, xx-xx, xxxx) to camelCase format (xxXX)

backend/http/webauthn.go

@@ -0,0 +1,240 @@
+package http
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+)
+
+// @Summary Begin passkey MFA login
+// @Description Verifies the user's password and returns a WebAuthn assertion challenge for passkey MFA.
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Param username query string true "Username"
+// @Param X-Password header string true "URL-encoded password"
+// @Success 200 {object} map[string]interface{} "Passkey assertion options"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /api/auth/webauthn/begin-login [post]
+func beginPasskeyLoginHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !auth.IsWebAuthnEnabled() {
+		return http.StatusForbidden, errors.ErrPasskeyNotEnabled
+	}
+
+	if err := validateRequestOrigin(r); err != nil {
+		return http.StatusForbidden, err
+	}
+
+	username := r.URL.Query().Get("username")
+	password := r.Header.Get("X-Password")
+	password, err := url.QueryUnescape(password)
+	if err != nil {
+		return http.StatusBadRequest, err
+	}
+
+	rpID := deriveRPID(r)
+	svc := auth.GetWebAuthn()
+	sessionID, assertion, err := svc.BeginMFALogin(username, password, rpID, store.Users)
+	if err != nil {
+		if err == errors.ErrPasskeyNoCredential {
+			return http.StatusForbidden, err
+		}
+		return http.StatusForbidden, err
+	}
+
+	response := map[string]interface{}{
+		"sessionID": sessionID,
+		"publicKey": assertion.Response,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	return http.StatusOK, json.NewEncoder(w).Encode(response)
+}
+
+// @Summary Finish passkey MFA login
+// @Description Verifies the WebAuthn assertion and returns a JWT token.
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Param session_id query string true "Passkey session ID from begin-login"
+// @Success 200 {string} string "JWT token"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /api/auth/webauthn/finish-login [post]
+func finishPasskeyLoginHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !auth.IsWebAuthnEnabled() {
+		return http.StatusForbidden, errors.ErrPasskeyNotEnabled
+	}
+
+	if err := validateRequestOrigin(r); err != nil {
+		return http.StatusForbidden, err
+	}
+
+	sessionID := r.URL.Query().Get("session_id")
+	if sessionID == "" {
+		return http.StatusBadRequest, errors.ErrPasskeyInvalidSession
+	}
+
+	svc := auth.GetWebAuthn()
+	user, err := svc.FinishMFALogin(sessionID, r, store.Users)
+	if err != nil {
+		return http.StatusForbidden, err
+	}
+
+	d.user = user
+	return printToken(w, r, d.user)
+}
+
+// @Summary Begin passkey registration
+// @Description Returns WebAuthn credential creation options for adding a new passkey.
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Success 200 {object} map[string]interface{} "Passkey creation options"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /api/auth/webauthn/begin-register [post]
+func beginPasskeyRegistrationHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !auth.IsWebAuthnEnabled() {
+		return http.StatusForbidden, errors.ErrPasskeyNotEnabled
+	}
+
+	if err := validateRequestOrigin(r); err != nil {
+		return http.StatusForbidden, err
+	}
+
+	rpID := deriveRPID(r)
+	svc := auth.GetWebAuthn()
+	sessionID, creation, err := svc.BeginRegistration(d.user, rpID)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	response := map[string]interface{}{
+		"sessionID": sessionID,
+		"publicKey": creation.Response,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	return http.StatusOK, json.NewEncoder(w).Encode(response)
+}
+
+// @Summary Finish passkey registration
+// @Description Verifies the attestation and stores the new passkey credential.
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Param session_id query string true "Registration session ID"
+// @Param name query string true "Display name for the passkey"
+// @Success 200 {object} map[string]string "Success"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /api/auth/webauthn/finish-register [post]
+func finishPasskeyRegistrationHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !auth.IsWebAuthnEnabled() {
+		return http.StatusForbidden, errors.ErrPasskeyNotEnabled
+	}
+
+	if err := validateRequestOrigin(r); err != nil {
+		return http.StatusForbidden, err
+	}
+
+	sessionID := r.URL.Query().Get("session_id")
+	credentialName := r.URL.Query().Get("name")
+	if sessionID == "" {
+		return http.StatusBadRequest, errors.ErrPasskeyInvalidSession
+	}
+	if credentialName == "" {
+		credentialName = "Passkey"
+	}
+
+	svc := auth.GetWebAuthn()
+	if err := svc.FinishRegistration(d.user, sessionID, credentialName, r); err != nil {
+		return http.StatusForbidden, err
+	}
+
+	if err := store.Users.Update(d.user, false, "PasskeyCredentials"); err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	if err := json.NewEncoder(w).Encode(map[string]string{"status": "ok"}); err != nil {
+		return http.StatusInternalServerError, err
+	}
+	return http.StatusOK, nil
+}
+
+// @Summary Delete a passkey credential
+// @Description Removes a passkey credential by its ID.
+// @Tags Auth
+// @Param id path string true "Base64-encoded credential ID"
+// @Success 200 {object} map[string]string "Success"
+// @Failure 403 {object} map[string]string "Forbidden"
+// @Router /api/auth/webauthn/{id} [delete]
+func deletePasskeyCredentialHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (int, error) {
+	if !auth.IsWebAuthnEnabled() {
+		return http.StatusForbidden, errors.ErrPasskeyNotEnabled
+	}
+
+	credentialID := r.PathValue("id")
+	if credentialID == "" {
+		return http.StatusBadRequest, nil
+	}
+
+	svc := auth.GetWebAuthn()
+	if err := svc.DeleteCredential(d.user, credentialID); err != nil {
+		return http.StatusNotFound, err
+	}
+
+	if err := store.Users.Update(d.user, false, "PasskeyCredentials"); err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	if err := json.NewEncoder(w).Encode(map[string]string{"status": "ok"}); err != nil {
+		return http.StatusInternalServerError, err
+	}
+	return http.StatusOK, nil
+}
+
+func deriveRPID(r *http.Request) string {
+	host := r.Header.Get("X-Forwarded-Host")
+	if host == "" {
+		host = r.Host
+	}
+	if i := strings.LastIndex(host, ":"); i != -1 {
+		host = host[:i]
+	}
+	return host
+}
+
+// validateRequestOrigin validates that the request's origin is in the configured whitelist.
+// Returns an error if the origin is not allowed.
+func validateRequestOrigin(r *http.Request) error {
+	scheme := "http"
+	if r.TLS != nil {
+		scheme = "https"
+	} else if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" {
+		scheme = strings.ToLower(proto)
+	}
+	host := r.Header.Get("X-Forwarded-Host")
+	if host == "" {
+		host = r.Host
+	}
+	origin := fmt.Sprintf("%s://%s", scheme, host)
+	
+	svc := auth.GetWebAuthn()
+	if svc != nil {
+		if !svc.ValidateOrigin(origin) {
+			return fmt.Errorf("origin %s is not in the configured whitelist", origin)
+		}
+	}
+	return nil
+}

backend/http/webdav.go

@@ -84,6 +84,7 @@ func (ffs *filteredFileSystem) getFileInfo(requestPath string, expand bool) (*it
 		Source:            ffs.source,
 		Expand:            expand,
 		ShowHidden:        ffs.user.ShowHidden,
+		HideFileExt:       ffs.user.HideFileExt,
 		SkipExtendedAttrs: true,
 		FollowSymlinks:    true,
 	}, store.Access, ffs.user, store.Share)
@@ -382,6 +383,7 @@ func webDAVHandler(w http.ResponseWriter, r *http.Request, d *requestContext) (i
 		Path:           requestPath,
 		Source:         source,
 		ShowHidden:     d.user.ShowHidden,
+		HideFileExt:    d.user.HideFileExt,
 	}, store.Access, d.user)
 	if err != nil {
 		return http.StatusForbidden, err

backend/http/webdav_test.go

@@ -12,9 +12,9 @@ import (
 
 	storm "github.com/asdine/storm/v3"
 	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/files"
+	commonerrors "github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	commonerrors "github.com/gtsteffaniak/filebrowser/backend/common/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
 	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
@@ -41,7 +41,7 @@ func setupWebDAVTestEnv(t *testing.T) (string, string) {
 		filepath.Join(dockerPath, "data"),
 		filepath.Join(source2Path, "shared"),
 	}
-	
+
 	for _, dir := range dirs {
 		if err := os.MkdirAll(dir, 0755); err != nil {
 			t.Fatal(err)
@@ -50,12 +50,12 @@ func setupWebDAVTestEnv(t *testing.T) (string, string) {
 
 	// Create test files
 	testFiles := map[string]string{
-		filepath.Join(source1Path, "public", "readme.txt"):         "public content",
-		filepath.Join(source1Path, "private", "secret.txt"):        "private content",
-		filepath.Join(source1Path, "viewable-only", "data.txt"):    "viewable content",
-		filepath.Join(source1Path, "not-viewable", "hidden.txt"):   "hidden content",
-		filepath.Join(dockerPath, "data", "config.yml"):            "docker config",
-		filepath.Join(source2Path, "shared", "document.txt"):       "shared content",
+		filepath.Join(source1Path, "public", "readme.txt"):       "public content",
+		filepath.Join(source1Path, "private", "secret.txt"):      "private content",
+		filepath.Join(source1Path, "viewable-only", "data.txt"):  "viewable content",
+		filepath.Join(source1Path, "not-viewable", "hidden.txt"): "hidden content",
+		filepath.Join(dockerPath, "data", "config.yml"):          "docker config",
+		filepath.Join(source2Path, "shared", "document.txt"):     "shared content",
 	}
 
 	for path, content := range testFiles {
@@ -74,18 +74,18 @@ func setupWebDAVTestEnv(t *testing.T) (string, string) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	
+
 	// Clear any previous access rules
 	store.Access.AllRules = make(access.SourceRuleMap)
 	store.Access.Groups = make(access.GroupMap)
 
 	// Set cache directory for index database
-	settings.Config.Server.CacheDir = tempDir
-	
-	// Setup config with sources - update both the local config var AND the global settings.Config
+	config.Server.CacheDir = tempDir
+
+	// Setup config with sources - update both the local config var AND the global config
 	config = &settings.Settings{
 		Server: settings.Server{
-			BaseURL: "/", // Use / for tests to avoid prefix mismatch
+			BaseURL:  "/", // Use / for tests to avoid prefix mismatch
 			CacheDir: tempDir,
 			SourceMap: map[string]*settings.Source{
 				source1Path: {
@@ -109,8 +109,8 @@ func setupWebDAVTestEnv(t *testing.T) (string, string) {
 			},
 		},
 	}
-	
-	// CRITICAL: Also update the global settings.Config so access.Permitted can find sources
+
+	// CRITICAL: Also update the global config so access.Permitted can find sources
 	settings.Config.Server.SourceMap = config.Server.SourceMap
 	settings.Config.Server.NameToSource = config.Server.NameToSource
 
@@ -136,11 +136,11 @@ func setupWebDAVTestEnv(t *testing.T) (string, string) {
 // mockCheckPermissions mocks the CheckPermissions function to bypass index lookups
 func mockCheckPermissions(t *testing.T, source1Path, source2Path string) {
 	t.Helper()
-	
+
 	// Store original function
 	originalCheckPermissions := files.CheckPermissionsFunc
 	t.Cleanup(func() { files.CheckPermissionsFunc = originalCheckPermissions })
-	
+
 	// Mock the function
 	files.CheckPermissionsFunc = func(opts utils.FileOptions, access *access.Storage, user *users.User) (string, string, error) {
 		// Get the source path
@@ -152,7 +152,7 @@ func mockCheckPermissions(t *testing.T, source1Path, source2Path string) {
 		} else {
 			return "", "", fmt.Errorf("unknown source: %s", opts.Source)
 		}
-		
+
 		// Get user scope for this source - match by source PATH, not name
 		userScope := "/"
 		hasScope := false
@@ -163,26 +163,26 @@ func mockCheckPermissions(t *testing.T, source1Path, source2Path string) {
 				break
 			}
 		}
-		
+
 		// If user has no scope for this source, deny access
 		if !hasScope && len(user.Scopes) > 0 {
 			return "", "", fmt.Errorf("user has no access to source: %s", opts.Source)
 		}
-		
+
 		// Sanitize path
 		safePath, err := utils.SanitizeUserPath(opts.Path)
 		if err != nil {
 			return "", "", commonerrors.ErrAccessDenied
 		}
-		
+
 		// Combine scope + sanitized path
 		indexPath := utils.JoinPathAsUnix(userScope, safePath)
-		
+
 		// Check access control
 		if access != nil && !access.Permitted(sourcePath, indexPath, user.Username) {
 			return "", "", commonerrors.ErrAccessDenied
 		}
-		
+
 		return indexPath, userScope, nil
 	}
 }
@@ -203,7 +203,7 @@ func mockWebDAVIndexing(t *testing.T, source1Path, source2Path string) {
 		} else {
 			return nil, fmt.Errorf("unknown source: %s", opts.Source)
 		}
-		
+
 		// Simulate access control
 		if access != nil && user != nil {
 			// Simple scope check based on user's configured scopes (which use source PATH)
@@ -214,7 +214,7 @@ func mockWebDAVIndexing(t *testing.T, source1Path, source2Path string) {
 					// Check if path is within user's scope
 					userScope := scope.Scope
 					fullPath := utils.JoinPathAsUnix(userScope, opts.Path)
-					
+
 					// Check if user has permission using the access storage
 					if !access.Permitted(sourcePath, fullPath, user.Username) {
 						return nil, commonerrors.ErrAccessDenied
@@ -229,12 +229,12 @@ func mockWebDAVIndexing(t *testing.T, source1Path, source2Path string) {
 
 		// Simulate indexing rules
 		path := opts.Path
-		
+
 		// Paths containing "not-viewable" are not indexed and not viewable
 		if strings.Contains(path, "not-viewable") {
 			return nil, commonerrors.ErrNotViewable
 		}
-		
+
 		// Paths containing "viewable-only" are not indexed but viewable
 		if strings.Contains(path, "viewable-only") {
 			return nil, commonerrors.ErrNotIndexed
@@ -333,12 +333,12 @@ func TestWebDAV_PROPFIND_UserScopes(t *testing.T) {
 	}
 
 	testCases := []struct {
-		name               string
-		user               *users.User
-		source             string
-		path               string
-		expectedStatus     int
-		shouldHaveContent  bool
+		name              string
+		user              *users.User
+		source            string
+		path              string
+		expectedStatus    int
+		shouldHaveContent bool
 	}{
 		{
 			name:              "Admin can access root of source1",
@@ -353,7 +353,7 @@ func TestWebDAV_PROPFIND_UserScopes(t *testing.T) {
 			user:              scopedUser,
 			source:            "source1",
 			path:              "/",
-			expectedStatus:    207, // PROPFIND returns 207 Multi-Status
+			expectedStatus:    207,   // PROPFIND returns 207 Multi-Status
 			shouldHaveContent: false, // Empty because _docker is not viewable
 		},
 		{
@@ -390,19 +390,19 @@ func TestWebDAV_PROPFIND_UserScopes(t *testing.T) {
 			req := httptest.NewRequest("PROPFIND", "/dav/"+tc.source+tc.path, nil)
 			req.SetPathValue("source", tc.source)
 			req.SetPathValue("path", tc.path)
-			
+
 			w := httptest.NewRecorder()
 			ctx := &requestContext{user: tc.user}
 
 			status, err := webDAVHandler(w, req, ctx)
-			
+
 			// If handler returned an error status, use that instead of response code
 			if status != 0 && status != http.StatusOK {
 				if w.Code == 0 || w.Code == http.StatusOK {
 					w.Code = status
 				}
 			}
-			
+
 			// Check the actual HTTP response status code from ResponseWriter
 			if w.Code != tc.expectedStatus {
 				t.Errorf("expected status %d, got %d (err: %v)", tc.expectedStatus, w.Code, err)
@@ -529,7 +529,7 @@ func TestWebDAV_WriteOperations(t *testing.T) {
 			name:           "Scoped user can write in their scope",
 			user:           scopedUser,
 			method:         http.MethodPut,
-			path:           "/scopedfile.txt", // Path relative to scope (/public)
+			path:           "/scopedfile.txt",  // Path relative to scope (/public)
 			expectedStatus: http.StatusCreated, // 201 for new file
 		},
 		{
@@ -551,19 +551,19 @@ func TestWebDAV_WriteOperations(t *testing.T) {
 			req := httptest.NewRequest(tc.method, "/dav/source1"+tc.path, body)
 			req.SetPathValue("source", "source1")
 			req.SetPathValue("path", tc.path)
-			
+
 			w := httptest.NewRecorder()
 			ctx := &requestContext{user: tc.user}
 
 			status, err := webDAVHandler(w, req, ctx)
-			
+
 			// If handler returned an error status, use that instead of response code
 			if status != 0 && status != http.StatusOK {
 				if w.Code == 0 || w.Code == http.StatusOK {
 					w.Code = status
 				}
 			}
-			
+
 			// Check the actual HTTP response status code from ResponseWriter
 			if w.Code != tc.expectedStatus {
 				t.Errorf("expected status %d, got %d (err: %v)", tc.expectedStatus, w.Code, err)
@@ -611,7 +611,7 @@ func TestWebDAV_AccessControl(t *testing.T) {
 
 	// Initialize index
 	initTestIndex(t, "source1", source1Path)
-	
+
 	// Create access rules by using the internal structure
 	// User1 can access /private, user2 cannot
 	// Set up a deny rule for user2 at /private
@@ -621,7 +621,7 @@ func TestWebDAV_AccessControl(t *testing.T) {
 			Users: access.StringSet{"user2": struct{}{}},
 		},
 	}
-	
+
 	// Add the rule to the access storage
 	if store.Access.AllRules == nil {
 		store.Access.AllRules = make(access.SourceRuleMap)
@@ -668,19 +668,19 @@ func TestWebDAV_AccessControl(t *testing.T) {
 			req := httptest.NewRequest("PROPFIND", "/dav/source1"+tc.path, nil)
 			req.SetPathValue("source", "source1")
 			req.SetPathValue("path", tc.path)
-			
+
 			w := httptest.NewRecorder()
 			ctx := &requestContext{user: tc.user}
 
 			status, err := webDAVHandler(w, req, ctx)
-			
+
 			// If handler returned an error status, use that instead of response code
 			if status != 0 && status != http.StatusOK {
 				if w.Code == 0 || w.Code == http.StatusOK {
 					w.Code = status
 				}
 			}
-			
+
 			// Check the actual HTTP response status code from ResponseWriter
 			if w.Code != tc.expectedStatus {
 				t.Errorf("expected status %d, got %d (err: %v)", tc.expectedStatus, w.Code, err)
@@ -775,19 +775,19 @@ func TestWebDAV_IndexingStates(t *testing.T) {
 			req := httptest.NewRequest(tc.method, "/dav/source1"+tc.path, body)
 			req.SetPathValue("source", "source1")
 			req.SetPathValue("path", tc.path)
-			
+
 			w := httptest.NewRecorder()
 			ctx := &requestContext{user: user}
 
 			status, err := webDAVHandler(w, req, ctx)
-			
+
 			// If handler returned an error status, use that instead of response code
 			if status != 0 && status != http.StatusOK {
 				if w.Code == 0 || w.Code == http.StatusOK {
 					w.Code = status
 				}
 			}
-			
+
 			// Check the actual HTTP response status code from ResponseWriter
 			if w.Code != tc.expectedStatus {
 				t.Errorf("%s: expected status %d, got %d (err: %v)", tc.description, tc.expectedStatus, w.Code, err)

backend/indexing/conditionalRules_test.go

@@ -14,8 +14,7 @@ func setupConditionalTestIndex(conditionals settings.ConditionalFilter) *Index {
 		Name: "test",
 		Path: "/test/path",
 		Config: settings.SourceConfig{
-			DisableIndexing: false,
-			Conditionals:    conditionals,
+			Conditionals: conditionals,
 		},
 	}
 

backend/indexing/deletion_test.go

@@ -26,11 +26,9 @@ func setupTestIndexForDeletion(t *testing.T) *Index {
 	// Create index with mock data
 	idx := &Index{
 		Source: settings.Source{
-			Name: "test_delete",
-			Path: "/mock/path",
-			Config: settings.SourceConfig{
-				DisableIndexing: false,
-			},
+			Name:   "test_delete",
+			Path:   "/mock/path",
+			Config: settings.SourceConfig{},
 		},
 		db:   indexDB,
 		mock: true, // Enable mock mode

backend/indexing/getDirInfoCore_test.go

@@ -16,44 +16,26 @@ func TestFetchExtendedAttributes(t *testing.T) {
 	tests := []struct {
 		name              string
 		adjustedPath      string
-		combinedPath      string
-		files             []os.FileInfo
 		opts              Options
-		expectHasPreview  bool
 		expectMapNotEmpty bool
 	}{
 		{
-			name:         "SkipExtendedAttrs returns empty",
-			adjustedPath: "/test/",
-			combinedPath: "/test/",
-			files:        []os.FileInfo{},
-			opts: Options{
-				SkipExtendedAttrs: true,
-				Recursive:         false,
-			},
-			expectHasPreview:  false,
+			name:              "SkipExtendedAttrs returns empty",
+			adjustedPath:      "/test/",
+			opts:              Options{SkipExtendedAttrs: true, Recursive: false},
 			expectMapNotEmpty: false,
 		},
 		{
-			name:         "Recursive returns empty",
-			adjustedPath: "/test/",
-			combinedPath: "/test/",
-			files:        []os.FileInfo{},
-			opts: Options{
-				SkipExtendedAttrs: false,
-				Recursive:         true,
-			},
-			expectHasPreview:  false,
+			name:              "Recursive returns empty",
+			adjustedPath:      "/test/",
+			opts:              Options{SkipExtendedAttrs: false, Recursive: true},
 			expectMapNotEmpty: false,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			hasPreview, subdirMap := idx.fetchExtendedAttributes(tt.adjustedPath, tt.files, tt.opts)
-			if hasPreview != tt.expectHasPreview {
-				t.Errorf("expected hasPreview=%v, got %v", tt.expectHasPreview, hasPreview)
-			}
+			subdirMap := idx.fetchExtendedAttributes(tt.adjustedPath, tt.opts)
 			if (len(subdirMap) > 0) != tt.expectMapNotEmpty {
 				t.Errorf("expected mapNotEmpty=%v, got %v", tt.expectMapNotEmpty, len(subdirMap) > 0)
 			}
@@ -61,6 +43,28 @@ func TestFetchExtendedAttributes(t *testing.T) {
 	}
 }
 
+// TestFetchExtendedAttributes_subdirHasPreviewFromMetadata checks folder hasPreview comes from one GetMetadataInfo (non-shallow).
+func TestFetchExtendedAttributes_subdirHasPreviewFromMetadata(t *testing.T) {
+	idx, _, cleanup := setupTestIndex(t)
+	defer cleanup()
+
+	deepdir, err := idx.db.GetItem("test", "/subdir/deepdir/")
+	if err != nil || deepdir == nil {
+		t.Fatalf("deepdir row: err=%v", err)
+	}
+	deepdir.HasPreview = true
+	_ = idx.db.InsertItem("test", "/subdir/deepdir/", deepdir)
+
+	subdirMap := idx.fetchExtendedAttributes("/subdir/", Options{
+		SkipExtendedAttrs: false,
+		Recursive:         false,
+	})
+
+	if !subdirMap["/subdir/deepdir/"] {
+		t.Errorf("expected hasPreview map for /subdir/deepdir/, got %v", subdirMap)
+	}
+}
+
 // TestGetDirectoryName tests the directory name extraction logic
 func TestGetDirectoryName(t *testing.T) {
 	tests := []struct {

backend/indexing/indexingFiles.go

@@ -29,7 +29,7 @@ var (
 // This is a simplified helper for shallow calculations and API calls
 // For scanning with hardlink detection, use handleFile instead
 // If useLogicalSize is true, returns the logical file size instead
-func getDiskUsage(fileInfo os.FileInfo, realPath string, useLogicalSize bool) int64 {
+func getDiskUsage(fileInfo os.FileInfo, useLogicalSize bool) int64 {
 	// If useLogicalSize is true, return logical size (no block alignment)
 	if useLogicalSize {
 		if fileInfo.IsDir() {
@@ -63,9 +63,10 @@ type Options struct {
 	IsRoutineScan bool // whether this is a routine/scheduled scan (vs initial indexing)
 
 	// Filesystem info retrieval options
-	SkipExtendedAttrs bool // Skip hasPreview and other extended attributes
-	FollowSymlinks    bool // Whether to follow symlinks or return symlink info
-	ShowHidden        bool // Whether to include hidden files/directories
+	SkipExtendedAttrs bool   // Skip hasPreview and other extended attributes
+	FollowSymlinks    bool   // Whether to follow symlinks or return symlink info
+	ShowHidden        bool   // Whether to include hidden files/directories
+	HideFileExt       string // Hide files based on extensions
 }
 
 // ScannerInfo is the exposed scanner information for the client
@@ -94,20 +95,27 @@ type Stats struct {
 type ReducedIndex struct {
 	Stats
 	IdxName  string         `json:"name"`
+	ReadOnly bool           `json:"readOnly"`
+	Private  bool           `json:"private"`
 	Status   IndexStatus    `json:"status"`
 	Scanners []*ScannerInfo `json:"scanners,omitempty"`
 }
 
 type Index struct {
 	ReducedIndex
-	settings.Source  `json:"-"`
-	db               *dbsql.IndexDB
-	previousNumDirs  uint64              // Track previous NumDirs to use when scan in progress (computed value is 0)
-	previousNumFiles uint64              // Track previous NumFiles to use when scan in progress (computed value is 0)
-	scanners         map[string]*Scanner // path -> scanner
-	mock             bool
-	mu               sync.RWMutex
-	childScanMutex   sync.Mutex // Serializes child scanner execution (only one child scanner runs at a time)
+	settings.Source   `json:"-"`
+	db                *dbsql.IndexDB
+	previousNumDirs   uint64              // Track previous NumDirs to use when scan in progress (computed value is 0)
+	previousNumFiles  uint64              // Track previous NumFiles to use when scan in progress (computed value is 0)
+	scanners          map[string]*Scanner // path -> scanner
+	mock              bool
+	mu                sync.RWMutex
+	activeScannerPath string
+	schedulerStop     chan struct{}
+	schedulerStopOnce sync.Once
+	schedulerBatch    int // >0: serial pass in progress; suppresses PostScan inside executeScan
+	// Adaptive scheduler: run one serial scan on process start (then normal slot cadence).
+	schedulerStartupPassPending bool
 	// In-memory folder size tracking (not stored in SQLite)
 	folderSizes         map[string]uint64   // path -> size (in-memory only, calculated from children)
 	folderSizesUnsynced map[string]struct{} // Tracks which folder sizes have changed since last DB sync
@@ -117,6 +125,10 @@ type Index struct {
 	scanUpdatedPaths     map[string]bool // Tracks directories updated by the scan (to distinguish from API updates)
 	// WebDAV lock system for this source (isolated per source)
 	WebdavLock webdav.LockSystem
+
+	// Adaptive scheduler: shared slot map (UTC unix seconds -> scanners). Only used when IndexingInterval == 0.
+	scheduleSlotsMu sync.Mutex
+	scheduleSlots   map[int64][]*Scanner
 }
 
 var (
@@ -304,18 +316,14 @@ func (idx *Index) getStatusUnlocked() IndexStatus {
 	}
 
 	allScannedAtLeastOnce := true
-	anyScannerActive := false
 
 	for _, scanner := range idx.scanners {
 		if scanner.lastScanned.IsZero() {
 			allScannedAtLeastOnce = false
 		}
-		if scanner.isScanning {
-			anyScannerActive = true
-		}
 	}
 
-	if anyScannerActive || idx.getActiveScannerPathUnlocked() != "" {
+	if idx.getActiveScannerPathUnlocked() != "" {
 		return INDEXING
 	} else if allScannedAtLeastOnce {
 		return READY
@@ -356,11 +364,7 @@ func StopAllScanners() {
 	indexesMutex.Lock()
 	defer indexesMutex.Unlock()
 	for _, idx := range indexes {
-		idx.mu.Lock()
-		for _, scanner := range idx.scanners {
-			scanner.stop()
-		}
-		idx.mu.Unlock()
+		idx.stopScheduler()
 	}
 }
 
@@ -401,7 +405,7 @@ func Initialize(source *settings.Source, mock bool, isNewDb bool) {
 	}
 	indexes[newIndex.Name] = &newIndex
 	indexesMutex.Unlock()
-	if !newIndex.Config.DisableIndexing {
+	if !newIndex.Config.ResolvedRules.IndexingDisabled {
 		logger.Infof("initializing index: [%v]", newIndex.Name)
 		// Start multi-scanner system (each scanner will do its own initial scan)
 		// Pass isNewDb flag so setupMultiScanner knows whether to load persisted complexity
@@ -429,9 +433,10 @@ type FileInfoRequest struct {
 	IndexPath         string
 	FollowSymlinks    bool
 	ShowHidden        bool
-	Expand            bool // get child items for directories
-	IsRoutineScan     bool // scanner vs API call
-	SkipExtendedAttrs bool // whether to skip extended attributes
+	HideFileExt       string // Hide files based on their extension
+	Expand            bool   // get child items for directories
+	IsRoutineScan     bool   // scanner vs API call
+	SkipExtendedAttrs bool   // whether to skip extended attributes
 }
 
 // resolvePathContext resolves all path characteristics in a SINGLE stat call
@@ -535,7 +540,7 @@ func (idx *Index) GetFileInfo(req FileInfoRequest) (*iteminfo.FileInfo, error) {
 
 // getFileInfoFromContext returns info for a single file
 func (idx *Index) getFileInfoFromContext(ctx *PathContext, isIndexable bool) (*iteminfo.FileInfo, error) {
-	size := idx.getFileSizeForDisplay(ctx.FileInfo, ctx.RealPath)
+	size := idx.getFileSizeForDisplay(ctx.FileInfo)
 	fileInfo := &iteminfo.FileInfo{
 		Path: ctx.IndexPath,
 		ItemInfo: iteminfo.ItemInfo{
@@ -568,6 +573,7 @@ func (idx *Index) getDirInfoFromContext(ctx *PathContext, isViewable, isIndexabl
 		SkipExtendedAttrs: req.SkipExtendedAttrs || !isIndexable,
 		FollowSymlinks:    req.FollowSymlinks,
 		ShowHidden:        req.ShowHidden,
+		HideFileExt:       req.HideFileExt,
 	}
 
 	return idx.GetDirInfoCore(dir, ctx.FileInfo, ctx.IndexPath, opts, nil)
@@ -734,50 +740,26 @@ func (idx *Index) GetFsInfoViewableOnly(adjustedPath string, followSymlinks bool
 	})
 }
 
-// fetchExtendedAttributes fetches hasPreview for the current directory and batch fetches for subdirectories
-func (idx *Index) fetchExtendedAttributes(indexPath string, files []os.FileInfo, opts Options) (bool, map[string]bool) {
-	hasPreview := false
+// fetchExtendedAttributes loads indexed subfolder has_preview for the current directory from GetMetadataInfo (database).
+// The listed directory's own HasPreview is derived only in GetDirInfoCore from children (never from a stale parent DB row).
+func (idx *Index) fetchExtendedAttributes(indexPath string, opts Options) map[string]bool {
 	subdirHasPreviewMap := make(map[string]bool)
 
 	if opts.SkipExtendedAttrs || opts.Recursive {
-		return hasPreview, subdirHasPreviewMap
+		return subdirHasPreviewMap
 	}
 
-	// Fetch hasPreview for current directory
-	realDirInfo, exists := idx.GetMetadataInfo(indexPath, true, true)
-	if exists {
-		hasPreview = realDirInfo.HasPreview
+	realDirInfo, exists := idx.GetMetadataInfo(indexPath, true, false)
+	if !exists {
+		return subdirHasPreviewMap
 	}
 
-	// Batch fetch hasPreview for all subdirectories
-	var subdirPaths []string
-	for _, file := range files {
-		if !iteminfo.IsDirectory(file) {
-			continue
-		}
-		baseName := file.Name()
-		if indexPath == "/" {
-			if !idx.shouldInclude(baseName) {
-				continue
-			}
-		}
-		if omitList[baseName] {
-			continue
-		}
-		dirPath := indexPath + baseName
-		childIndexPath := utils.AddTrailingSlashIfNotExists(dirPath)
-		subdirPaths = append(subdirPaths, childIndexPath)
+	for _, folder := range realDirInfo.Folders {
+		key := utils.AddTrailingSlashIfNotExists(indexPath + folder.Name)
+		subdirHasPreviewMap[key] = folder.HasPreview
 	}
 
-	if len(subdirPaths) > 0 {
-		var err error
-		subdirHasPreviewMap, err = idx.db.GetHasPreviewBatch(idx.Name, subdirPaths)
-		if err != nil {
-			subdirHasPreviewMap = make(map[string]bool)
-		}
-	}
-
-	return hasPreview, subdirHasPreviewMap
+	return subdirHasPreviewMap
 }
 
 // processDirectoryItem processes a directory item and returns the itemInfo, size, and whether it should be counted
@@ -825,11 +807,7 @@ func (idx *Index) processDirectoryItem(file os.FileInfo, indexPath string, subdi
 	if !opts.SkipExtendedAttrs && subdirHasPreviewMap != nil {
 		if hasPreviewValue, exists := subdirHasPreviewMap[childIndexPath]; exists {
 			itemInfo.HasPreview = hasPreviewValue
-		} else {
-			itemInfo.HasPreview = false
 		}
-	} else {
-		itemInfo.HasPreview = false
 	}
 
 	return itemInfo, itemInfo.Size, true
@@ -851,7 +829,7 @@ func (idx *Index) processFileItem(file os.FileInfo, indexPath string, opts Optio
 	var size uint64
 	var shouldCountSize bool
 	if !opts.Recursive && scanner == nil {
-		size = uint64(idx.getFileSizeForDisplay(file, fullCombined))
+		size = uint64(idx.getFileSizeForDisplay(file))
 		shouldCountSize = true
 	} else {
 		size, shouldCountSize = idx.handleFile(file, indexPath, fullCombined, opts.IsRoutineScan, scanner)
@@ -862,7 +840,7 @@ func (idx *Index) processFileItem(file os.FileInfo, indexPath string, opts Optio
 	bubblesUpHasPreview := false
 	if !opts.SkipExtendedAttrs {
 		usedCachedPreview := false
-		if !idx.Config.DisableIndexing && opts.Recursive {
+		if !idx.Config.ResolvedRules.IndexingDisabled && opts.Recursive {
 			simpleType := strings.Split(itemInfo.Type, "/")[0]
 			if simpleType == "audio" {
 				previousInfo, exists := idx.GetReducedMetadata(fullCombined, false)
@@ -875,9 +853,7 @@ func (idx *Index) processFileItem(file os.FileInfo, indexPath string, opts Optio
 		if !usedCachedPreview {
 			setFilePreviewFlags(itemInfo, fullCombined)
 		}
-		if itemInfo.HasPreview && iteminfo.ShouldBubbleUpToFolderPreview(*itemInfo) {
-			bubblesUpHasPreview = true
-		}
+		bubblesUpHasPreview = iteminfo.ShouldBubbleUpToFolderPreview(*itemInfo)
 	} else {
 		itemInfo.HasPreview = false
 	}
@@ -894,8 +870,7 @@ func (idx *Index) GetDirInfoCore(dirInfo *os.File, stat os.FileInfo, indexPath s
 	if err != nil {
 		return nil, err
 	}
-	// Fetch extended attributes (hasPreview for current dir and subdirs)
-	hasPreview, subdirHasPreviewMap := idx.fetchExtendedAttributes(indexPath, files, opts)
+	subdirHasPreviewMap := idx.fetchExtendedAttributes(indexPath, opts)
 
 	baseName := filepath.Base(indexPath)
 	if indexPath == "/" {
@@ -906,6 +881,7 @@ func (idx *Index) GetDirInfoCore(dirInfo *os.File, stat os.FileInfo, indexPath s
 	fileInfos := []iteminfo.ExtendedItemInfo{}
 	dirInfos := []iteminfo.ItemInfo{}
 	processedCount := 0
+	hasPreview := false
 
 	for _, file := range files {
 		subfileBaseName := file.Name()
@@ -960,12 +936,12 @@ func (idx *Index) GetDirInfoCore(dirInfo *os.File, stat os.FileInfo, indexPath s
 			}
 		} else {
 			itemInfo, size, shouldCount, bubblesUp := idx.processFileItem(file, indexPath, opts, scanner)
-			if shouldCount {
-				totalSize += size
-			}
 			if bubblesUp {
 				hasPreview = true
 			}
+			if shouldCount {
+				totalSize += size
+			}
 			fileInfos = append(fileInfos, iteminfo.ExtendedItemInfo{ItemInfo: *itemInfo})
 			if opts.IsRoutineScan {
 				idx.incrementScannerFiles()
@@ -1054,6 +1030,10 @@ func (idx *Index) RefreshFileInfo(opts utils.FileOptions) error {
 // Use recursive=true for copy/move operations to capture entire tree
 // Use recursive=false for simple metadata updates (like after file edits)
 func (idx *Index) RefreshDirectory(indexPath string, recursive bool) error {
+	if idx.Config.ResolvedRules.IndexingDisabled {
+		return nil
+	}
+
 	if !strings.HasSuffix(indexPath, "/") {
 		indexPath = indexPath + "/"
 	}
@@ -1132,6 +1112,7 @@ func (idx *Index) updateFolderSizeAndParents(path string, newSize uint64, previo
 		if parentDir == "" {
 			break // Reached the top
 		}
+		// Keys in folderSizes match indexing paths (trailing slash for non-root dirs; root stays "/").
 		if parentDir != "/" {
 			parentDir = utils.AddTrailingSlashIfNotExists(parentDir)
 		}
@@ -1178,28 +1159,14 @@ func (idx *Index) GetFolderSizeForDisplay(path string) int64 {
 }
 
 // getFileSizeForDisplay returns file size with appropriate calculation based on config
-func (idx *Index) getFileSizeForDisplay(file os.FileInfo, realPath string) int64 {
+func (idx *Index) getFileSizeForDisplay(file os.FileInfo) int64 {
 	if idx.Config.UseLogicalSize {
 		// Logical size mode: return actual bytes
 		return file.Size()
 	}
 
 	// Disk usage mode: use getDiskUsage helper
-	return getDiskUsage(file, realPath, false)
-}
-
-// RecursiveUpdateDirSizes is now a wrapper for backwards compatibility
-// This maintains API compatibility while using the new optimized approach
-func (idx *Index) RecursiveUpdateDirSizes(path string, previousSize uint64) {
-	currentSize, exists := idx.GetFolderSize(path)
-	if !exists {
-		logger.Debugf("[FOLDER_SIZE] Path %s not found in folderSizes map", path)
-		return
-	}
-
-	if currentSize != previousSize {
-		idx.updateFolderSizeAndParents(path, currentSize, previousSize, false) // updateTarget=false, only update parents
-	}
+	return getDiskUsage(file, false)
 }
 
 // SyncFolderSizesToDB syncs in-memory folder sizes to the database after a scan completes
@@ -1389,7 +1356,7 @@ func (idx *Index) IsViewable(isDir bool, indexPath string, isSymlink bool, isHid
 // IsViewableWithParentCheck checks if a path is viewable by walking up the directory tree
 // Used for API requests where we need to check inherited rules from parent folders
 func (idx *Index) IsViewableWithParentCheck(isDir bool, indexPath string, isSymlink bool, isHidden bool) bool {
-	if idx.Config.DisableIndexing || idx.Config.ResolvedRules.NoRules {
+	if idx.Config.ResolvedRules.IndexingDisabled || idx.Config.ResolvedRules.NoRules {
 		return true
 	}
 
@@ -1412,7 +1379,7 @@ func (idx *Index) IsViewableWithParentCheck(isDir bool, indexPath string, isSyml
 // ShouldSkip checks if a path should be skipped from indexing
 // isRoutineScan: true for scanner (no parent checks), false for API (check parents)
 func (idx *Index) ShouldSkip(isDir bool, adjustedPath string, isHidden bool, isSymlink bool, isRoutineScan bool) bool {
-	if idx.Config.DisableIndexing {
+	if idx.Config.ResolvedRules.IndexingDisabled {
 		return true
 	}
 	rules := idx.Config.ResolvedRules
@@ -1544,32 +1511,7 @@ func (idx *Index) getActiveScannerPath() string {
 
 // getActiveScannerPathUnlocked returns the path of the currently active scanner, or empty string if none
 func (idx *Index) getActiveScannerPathUnlocked() string {
-	for path, scanner := range idx.scanners {
-		if scanner.isScanning {
-			return path
-		}
-	}
-	return ""
-}
-
-// getRunningScannerCount returns the number of scanners currently running
-// Assumes mutex is NOT held - will acquire its own lock
-func (idx *Index) getRunningScannerCount() int {
-	idx.mu.RLock()
-	defer idx.mu.RUnlock()
-	return idx.getRunningScannerCountUnlocked()
-}
-
-// getRunningScannerCountUnlocked returns the number of scanners currently running
-// Assumes mutex IS already held (RLock or Lock)
-func (idx *Index) getRunningScannerCountUnlocked() int {
-	count := 0
-	for _, scanner := range idx.scanners {
-		if scanner.isScanning {
-			count++
-		}
-	}
-	return count
+	return idx.activeScannerPath
 }
 
 // input should be non-index path.
@@ -1609,14 +1551,29 @@ func (idx *Index) shouldInclude(baseName string) bool {
 	return false
 }
 
-// Save persists the index and scanner information to the database
+// useAdaptiveScheduling is true when the index uses tiered/aligned scheduling (IndexingInterval == 0).
+func (idx *Index) useAdaptiveScheduling() bool {
+	return idx.Config.IndexingInterval == 0
+}
+
+// Save persists the index and scanner information to the database and notifies clients via SSE.
 func (idx *Index) Save() error {
+	if err := idx.writePersistedIndexInfo(); err != nil {
+		return err
+	}
+	if err := idx.SendSourceUpdateEvent(); err != nil {
+		logger.Errorf("[%s] Failed to send source update event: %v", idx.Name, err)
+	}
+	return nil
+}
+
+// writePersistedIndexInfo writes scanners, stats, and disk totals to Bolt (no SSE broadcast).
+func (idx *Index) writePersistedIndexInfo() error {
 	if indexingStorage == nil {
-		return nil // No storage available, skip persistence
+		return nil
 	}
 
 	idx.mu.RLock()
-	// Collect scanner information
 	scanners := make(map[string]*dbindex.PersistedScannerInfo)
 	for path, scanner := range idx.scanners {
 		scanners[path] = &dbindex.PersistedScannerInfo{
@@ -1631,33 +1588,27 @@ func (idx *Index) Save() error {
 		}
 	}
 
-	// Get current index stats
 	complexity := idx.getComplexityUnlocked()
 	numDirs := idx.getNumDirsUnlocked()
 	numFiles := idx.getNumFilesUnlocked()
+	usedAsIndexed := idx.UsedAsIndexed
+	usedDisk := idx.UsedDisk
+	diskTotal := idx.DiskTotal
 	idx.mu.RUnlock()
 
-	// Create IndexInfo for persistence
 	info := &dbindex.IndexInfo{
-		Path:       idx.Path, // Use real filesystem path as key
-		Source:     idx.Name,
-		Complexity: complexity,
-		NumDirs:    numDirs,
-		NumFiles:   numFiles,
-		Scanners:   scanners,
+		Path:          idx.Path,
+		Source:        idx.Name,
+		Complexity:    complexity,
+		NumDirs:       numDirs,
+		NumFiles:      numFiles,
+		UsedAsIndexed: usedAsIndexed,
+		UsedDisk:      usedDisk,
+		DiskTotal:     diskTotal,
+		Scanners:      scanners,
 	}
 
-	err := indexingStorage.Save(info)
-	if err != nil {
-		return err
-	}
-
-	// Send SSE update event after successful save
-	if err := idx.SendSourceUpdateEvent(); err != nil {
-		logger.Errorf("[%s] Failed to send source update event: %v", idx.Name, err)
-	}
-
-	return nil
+	return indexingStorage.Save(info)
 }
 
 // Load restores index and scanner information from the database
@@ -1684,6 +1635,9 @@ func (idx *Index) Load() error {
 	idx.Complexity = info.Complexity
 	idx.NumDirs = info.NumDirs
 	idx.NumFiles = info.NumFiles
+	idx.UsedAsIndexed = info.UsedAsIndexed
+	idx.UsedDisk = info.UsedDisk
+	idx.DiskTotal = info.DiskTotal
 
 	// Restore scanner information (will be applied when scanners are created)
 	// Store in a temporary map that setupMultiScanner can use

backend/indexing/indexingFiles_test.go

@@ -29,8 +29,7 @@ func setupTestIndex(t *testing.T) (*Index, string, func()) {
 			Name: "test",
 			Path: "/mock/path",
 			Config: settings.SourceConfig{
-				DisableIndexing: false,
-				UseLogicalSize:  true,
+				UseLogicalSize: true,
 			},
 		},
 		mock:                true, // Enable mock mode

backend/indexing/indexingScanner.go

@@ -1,6 +1,7 @@
 package indexing
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -15,21 +16,24 @@ import (
 type Scanner struct {
 	scanPath string
 
+	// Adaptive scheduling (see Index.useAdaptiveScheduling)
 	currentSchedule int
-	smartModifier   time.Duration
-	complexity      uint
-	fullScanCounter int
-	nextSleepTime   time.Duration
+	calendarSlotSec int64     // UTC unix second in idx.scheduleSlots; 0 if not enrolled
+	nextRun         time.Time // next slot time; zero if not scheduled / due immediately
+	fullScanCounter int       // quick vs full cadence per folder
 	filesChanged    bool
-	lastScanned     time.Time
-	quickScanTime   int
-	fullScanTime    int
-	statsMu         sync.RWMutex
-	scanStartTime   int64
-	isScanning      bool // True when scanner is actively scanning or waiting for mutex
 
-	numDirs  uint64
-	numFiles uint64
+	// Stats (API and persistence)
+	complexity    uint
+	lastScanned   time.Time
+	quickScanTime int
+	fullScanTime  int
+	numDirs       uint64
+	numFiles      uint64
+	statsMu       sync.RWMutex
+
+	// Active scan session
+	scanStartTime int64
 
 	// Per-scanner state (not shared with other scanners)
 	processedInodes map[uint64]struct{}  // Track inodes to detect hardlinks
@@ -37,9 +41,6 @@ type Scanner struct {
 	batchItems      []*iteminfo.FileInfo // Accumulates items for bulk insert
 
 	idx *Index
-
-	stopChan chan struct{}
-	stopOnce sync.Once // Ensures stopChan is only closed once
 }
 
 func (s *Scanner) withStatsLock(fn func()) {
@@ -54,72 +55,51 @@ func (s *Scanner) withStatsRLock(fn func()) {
 	fn()
 }
 
-// start begins the scanner's main loop
-func (s *Scanner) start() {
-	// Wait a bit to stagger child scanner initial scans (root goes first)
-	if s.scanPath != "/" {
-		time.Sleep(500 * time.Millisecond)
-	}
-	s.tryAcquireAndScan()
-
-	for {
-		// Check if directory still exists (for non-root scanners)
-		if s.scanPath != "/" && !s.directoryExists() {
-			logger.Debugf("Scanner [%s] stopping: directory no longer exists", s.scanPath)
-			s.removeSelf()
-			return
-		}
-
-		// Use the sleep time calculated by updateSchedule() (based on OLD schedule before increment)
-		sleepTime := s.nextSleepTime
-		if sleepTime == 0 {
-			// Fallback for first run or if not set
-			sleepTime = s.calculateSleepTime()
-		}
-
-		select {
-		case <-s.stopChan:
-			return
-
-		case <-time.After(sleepTime):
-			s.tryAcquireAndScan()
-		}
-	}
-}
-
-// tryAcquireAndScan attempts to acquire the global scan mutex and run a scan
-func (s *Scanner) tryAcquireAndScan() {
-	// Ensure isScanning is cleared even if we panic
+// executeScan runs one scan for this scanner (invoked only from the per-index scheduler).
+func (s *Scanner) executeScan() {
 	defer func() {
 		if r := recover(); r != nil {
 			logger.Errorf("[%s] Scanner panic recovered: %v", s.scanPath, r)
 		}
 		s.idx.mu.Lock()
-		s.isScanning = false
+		s.idx.activeScannerPath = ""
+		batch := s.idx.schedulerBatch > 0
 		s.idx.mu.Unlock()
-		err := s.idx.PostScan()
-		if err != nil {
-			logger.Errorf("Failed to post scan: %v", err)
+		if !batch {
+			err := s.idx.PostScan()
+			if err != nil {
+				logger.Errorf("Failed to post scan: %v", err)
+			}
 		}
 	}()
 
-	// Set isScanning flag for all scanners
+	if s.scanPath != "/" && !s.directoryExists() {
+		s.handlePathGone("pre-scan check")
+		return
+	}
+
+	s.prepareScanState()
+
 	s.idx.mu.Lock()
-	s.isScanning = true
+	s.idx.activeScannerPath = s.scanPath
 	s.idx.mu.Unlock()
 
-	// Root scanner can run independently since it's non-recursive
-	// Child scanners must acquire mutex to prevent concurrent child scans
-	if s.scanPath != "/" {
-		s.idx.childScanMutex.Lock()
-		defer s.idx.childScanMutex.Unlock()
-	}
-
-	quick := s.fullScanCounter > 0 && s.fullScanCounter < 5
-	s.fullScanCounter++
-	if s.fullScanCounter >= 5 {
-		s.fullScanCounter = 0
+	// Cadence per scanner path: full when counter==0, then four quick scans, then wrap (5 runs per cycle).
+	var pre int
+	var quick bool
+	s.withStatsLock(func() {
+		pre = s.fullScanCounter
+		quick = pre > 0 && pre < 5
+		s.fullScanCounter++
+		if s.fullScanCounter >= 5 {
+			s.fullScanCounter = 0
+		}
+	})
+	scanMode := "full"
+	if quick {
+		scanMode = "quick"
 	}
+	logger.Debugf("[%s] scanner [%s] starting %s scan (full/quick cadence step %d of 5)", s.idx.Name, s.scanPath, scanMode, pre+1)
 
 	s.runIndexing(quick)
 	s.updateSchedule()
@@ -195,13 +175,14 @@ func (s *Scanner) runFullScanRoot() {
 	s.purgeStaleEntries(true, false) // isRoot=true, isQuickScan=false
 	s.syncStatsWithDB()
 
-	if s.processedInodes != nil {
-		s.processedInodes = nil
-		s.foundHardLinks = nil
-	}
+	s.resetHardlinkTracking()
 
 	s.idx.mu.Lock()
-	s.idx.scanUpdatedPaths = make(map[string]bool)
+	if s.idx.scanUpdatedPaths == nil {
+		s.idx.scanUpdatedPaths = make(map[string]bool)
+	} else {
+		clear(s.idx.scanUpdatedPaths)
+	}
 	s.idx.mu.Unlock()
 }
 
@@ -299,6 +280,10 @@ func (s *Scanner) runFullScanChild() {
 
 	_, _, err := s.idx.indexDirectory(s.scanPath, config, s)
 	if err != nil {
+		if isPathGone(err) {
+			s.handlePathGone("full scan")
+			return
+		}
 		logger.Errorf("Scanner [%s] error: %v", s.scanPath, err)
 	} else if config.Recursive && config.IsRoutineScan {
 		s.idx.mu.Lock()
@@ -316,10 +301,7 @@ func (s *Scanner) runFullScanChild() {
 		}
 	}
 
-	if s.processedInodes != nil {
-		s.processedInodes = nil
-		s.foundHardLinks = nil
-	}
+	s.resetHardlinkTracking()
 
 	s.idx.mu.Lock()
 	for path := range s.idx.scanUpdatedPaths {
@@ -339,6 +321,9 @@ func (s *Scanner) runQuickScanChild() {
 	// Get folders in this scanner's scope from folderSizes map
 	s.idx.folderSizesMu.RLock()
 	var foldersToCheck []string
+	// Scanner root must be modtime-checked: the loop below skips path == scanPath, but only
+	// checkFolderModtime compares modtime to lastScanned and re-reads the directory for new children.
+	foldersToCheck = append(foldersToCheck, s.scanPath)
 	for path := range s.idx.folderSizes {
 		// Child scanner: check all paths under its scope
 		if strings.HasPrefix(path, s.scanPath) && path != s.scanPath {
@@ -350,25 +335,6 @@ func (s *Scanner) runQuickScanChild() {
 	batchSize := s.idx.db.BatchSize
 	s.batchItems = make([]*iteminfo.FileInfo, 0, batchSize)
 
-	// Update the scanner's own root folder to prevent it from being purged
-	// (child folders are updated via checkFolderModtime, but the scanner's root needs explicit update)
-	fullScanPath := filepath.Join(s.idx.Path, s.scanPath)
-	if info, err := os.Stat(fullScanPath); err == nil {
-		rootFolderInfo := &iteminfo.FileInfo{
-			Path: s.scanPath,
-			ItemInfo: iteminfo.ItemInfo{
-				Name:       filepath.Base(strings.TrimSuffix(s.scanPath, "/")),
-				Size:       0, // Folder size managed in-memory via folderSizes map
-				ModTime:    info.ModTime(),
-				Type:       "directory",
-				Hidden:     false,
-				HasPreview: false,
-			},
-		}
-		// Add to batch for bulk update
-		s.batchItems = append(s.batchItems, rootFolderInfo)
-	}
-
 	// Track stats
 	unchangedCount := 0
 	changedCount := 0
@@ -416,11 +382,9 @@ func (s *Scanner) checkForNewChildDirectories() {
 	}
 	s.idx.mu.RUnlock()
 
-	for path, scanner := range existingScanners {
+	for path := range existingScanners {
 		if !currentDirsMap[path] {
-			logger.Debugf("Directory [%s] no longer exists, stopping scanner", path)
-			scanner.stop()
-			// Remove from map immediately to prevent stale scanner references
+			logger.Debugf("Directory [%s] no longer exists, removing scanner", path)
 			s.idx.mu.Lock()
 			delete(s.idx.scanners, path)
 			s.idx.mu.Unlock()
@@ -437,8 +401,6 @@ func (s *Scanner) checkForNewChildDirectories() {
 			s.idx.mu.Lock()
 			s.idx.scanners[dirPath] = newScanner
 			s.idx.mu.Unlock()
-
-			go newScanner.start()
 		}
 	}
 }
@@ -486,85 +448,99 @@ func (s *Scanner) getTopLevelDirs() []string {
 	return dirs
 }
 
-// calculateSleepTime determines how long to wait before the next scan
-func (s *Scanner) calculateSleepTime() time.Duration {
-	var sleepTime time.Duration
-	s.withStatsRLock(func() {
-		sleepTime = scanSchedule[s.currentSchedule] + s.smartModifier
-	})
-	if s.idx.Config.IndexingInterval > 0 {
-		sleepTime = time.Duration(s.idx.Config.IndexingInterval) * time.Minute
-	}
-
-	return sleepTime
-}
-
-// updateSchedule adjusts the scanner's schedule based on whether files changed
+// updateSchedule adjusts the scanner's schedule based on whether files changed (adaptive mode only).
 func (s *Scanner) updateSchedule() {
-	s.statsMu.Lock()
-	defer s.statsMu.Unlock()
-
-	// Calculate sleep time BEFORE updating schedule (based on current/old schedule)
-	s.nextSleepTime = scanSchedule[s.currentSchedule] + s.smartModifier
-	if s.idx.Config.IndexingInterval > 0 {
-		s.nextSleepTime = time.Duration(s.idx.Config.IndexingInterval) * time.Minute
+	if !s.idx.useAdaptiveScheduling() {
+		return
 	}
 
+	s.statsMu.Lock()
+
 	// Adjust schedule based on file changes
 	if s.filesChanged {
 		logger.Debugf("Scanner [%s] detected changes, adjusting schedule", s.scanPath)
-		// Move to at least schedule index 3 or reduce interval
+		// Floor at 40-minute tier (index 3)
 		if s.currentSchedule > 3 {
 			s.currentSchedule = 3
 		} else if s.currentSchedule > 0 {
 			s.currentSchedule--
 		}
 	} else {
-		// Increment toward the longest interval if no changes
-		if s.currentSchedule < len(scanSchedule)-1 {
+		if s.currentSchedule < len(scanScheduleTiers)-1 {
 			s.currentSchedule++
 		}
 	}
 
-	// Cap simple complexity (1) at schedule 4
-	// Don't apply this cap if complexity is still unknown (0)
-	if s.complexity == 1 && s.currentSchedule > 4 {
-		s.currentSchedule = 4
-	}
+	minTier, maxTier := scheduleTierBoundsForComplexity(s.complexity)
+	s.currentSchedule = utils.Clamp(s.currentSchedule, minTier, maxTier)
+	// Next slot must use the tier *after* adjustment; using the pre-change interval ignored
+	// speed-ups on filesChanged and could schedule the next run in the far future.
+	intervalForNext := scanScheduleDuration(s.currentSchedule)
+	lastScanned := s.lastScanned
+	s.statsMu.Unlock()
 
-	// Ensure currentSchedule stays within bounds
-	if s.currentSchedule < 0 {
-		s.currentSchedule = 0
-	} else if s.currentSchedule >= len(scanSchedule) {
-		s.currentSchedule = len(scanSchedule) - 1
-	}
+	now := time.Now()
+	nextRun := computeNextSlotTime(lastScanned, now, intervalForNext)
 
-	// Persist index after schedule update (happens after each scan)
-	if err := s.idx.Save(); err != nil {
-		logger.Errorf("Failed to save index after schedule update: %v", err)
-	}
+	s.statsMu.Lock()
+	s.nextRun = nextRun
+	s.statsMu.Unlock()
+
+	s.idx.registerScannerNextRun(s, nextRun)
 }
 
 // updateComplexity calculates the complexity level (1-10) for this scanner's directory
 // 0: unknown
 func (s *Scanner) updateComplexity() {
 	s.statsMu.Lock()
-	defer s.statsMu.Unlock()
-
 	s.complexity = calculateComplexity(s.fullScanTime, s.numDirs)
+	s.statsMu.Unlock()
 
-	// Set smartModifier based on complexity level
-	if modifier, ok := complexityModifier[s.complexity]; ok {
-		s.smartModifier = modifier
-	} else {
-		s.smartModifier = 0
-	}
-	// Persist index after complexity update (happens after full scans)
+	// Persist after full scans — release statsMu before Save (same ordering as updateSchedule).
 	if err := s.idx.Save(); err != nil {
 		logger.Errorf("Failed to save index after complexity update: %v", err)
 	}
 }
 
+// ensureScanUpdatedPaths initializes scan path tracking for the current scan session.
+func (idx *Index) ensureScanUpdatedPaths() {
+	idx.mu.Lock()
+	defer idx.mu.Unlock()
+	if idx.scanUpdatedPaths == nil {
+		idx.scanUpdatedPaths = make(map[string]bool)
+	}
+}
+
+// prepareScanState initializes per-scan maps. Quick scans previously skipped this and could
+// panic with "assignment to entry in nil map" when writing scanUpdatedPaths or hardlink tracking.
+func (s *Scanner) prepareScanState() {
+	s.idx.ensureScanUpdatedPaths()
+	if s.processedInodes == nil {
+		s.processedInodes = make(map[uint64]struct{})
+	}
+	if s.foundHardLinks == nil {
+		s.foundHardLinks = make(map[string]uint64)
+	}
+}
+
+func (s *Scanner) resetHardlinkTracking() {
+	s.processedInodes = nil
+	s.foundHardLinks = nil
+}
+
+func isPathGone(err error) bool {
+	return err != nil && (os.IsNotExist(err) || errors.Is(err, os.ErrNotExist))
+}
+
+// handlePathGone removes a child scanner whose root directory was deleted.
+func (s *Scanner) handlePathGone(context string) {
+	if s.scanPath == "/" {
+		return
+	}
+	logger.Infof("Scanner [%s] stopping (%s): directory no longer exists", s.scanPath, context)
+	s.removeSelf()
+}
+
 // directoryExists checks if the scanner's directory still exists
 func (s *Scanner) directoryExists() bool {
 	realPath := strings.TrimRight(s.idx.Path, "/") + s.scanPath
@@ -576,6 +552,10 @@ func (s *Scanner) directoryExists() bool {
 
 // removeSelf removes this scanner from the index's scanner map
 func (s *Scanner) removeSelf() {
+	s.idx.scheduleSlotsMu.Lock()
+	s.idx.removeScannerFromSlotLocked(s)
+	s.idx.scheduleSlotsMu.Unlock()
+
 	s.idx.mu.Lock()
 	defer s.idx.mu.Unlock()
 
@@ -583,14 +563,6 @@ func (s *Scanner) removeSelf() {
 	logger.Infof("Removed scanner [%s] from active scanners", s.scanPath)
 }
 
-// stop gracefully stops the scanner
-// Uses sync.Once to ensure the channel is only closed once, preventing panic from "close of closed channel"
-func (s *Scanner) stop() {
-	s.stopOnce.Do(func() {
-		close(s.stopChan)
-	})
-}
-
 func (s *Scanner) syncStatsWithDB() {
 	var dirs, files uint64
 	var err error
@@ -624,7 +596,10 @@ func (s *Scanner) checkFolderModtime(folderPath string) (bool, error) {
 	info, err := os.Stat(realPath)
 	if err != nil {
 		if os.IsNotExist(err) {
-			// Folder was deleted - will be caught by purge
+			if folderPath == s.scanPath {
+				s.handlePathGone("quick scan")
+			}
+			// Subfolder deleted — stale entries are removed by purge
 			return false, nil
 		}
 		logger.Errorf("[QUICK_SCAN] Error stating %s: %v", folderPath, err)
@@ -664,6 +639,9 @@ func (s *Scanner) checkFolderModtime(folderPath string) (bool, error) {
 
 		// Track this directory as having been updated (for file purge logic)
 		s.idx.mu.Lock()
+		if s.idx.scanUpdatedPaths == nil {
+			s.idx.scanUpdatedPaths = make(map[string]bool)
+		}
 		s.idx.scanUpdatedPaths[folderPath] = true
 		s.idx.mu.Unlock()
 
@@ -672,11 +650,16 @@ func (s *Scanner) checkFolderModtime(folderPath string) (bool, error) {
 
 	// Modtime unchanged - update last_updated to prevent folder from being purged
 	// Note: we DON'T add this folder to scanUpdatedPaths, so Phase 2 won't check its files
+	// Use cached aggregate size: BulkInsertItems overwrites DB size;0 would corrupt LoadFolderSizes on restart.
+	var sizeForDB int64
+	if cached, ok := s.idx.GetFolderSize(folderPath); ok {
+		sizeForDB = int64(cached)
+	}
 	fileInfo := &iteminfo.FileInfo{
 		Path: folderPath,
 		ItemInfo: iteminfo.ItemInfo{
 			Name:       filepath.Base(strings.TrimSuffix(folderPath, "/")),
-			Size:       0, // Folder size is managed in-memory via folderSizes map
+			Size:       sizeForDB,
 			ModTime:    info.ModTime(),
 			Type:       "directory",
 			Hidden:     false,

backend/indexing/indexingScanner_test.go

@@ -0,0 +1,35 @@
+package indexing
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+)
+
+func TestPrepareScanStateInitializesMaps(t *testing.T) {
+	idx := &Index{
+		Source: settings.Source{Name: "test", Path: t.TempDir()},
+	}
+	s := &Scanner{scanPath: "/music/", idx: idx}
+
+	s.prepareScanState()
+
+	idx.mu.Lock()
+	idx.scanUpdatedPaths["/music/"] = true
+	idx.mu.Unlock()
+
+	if s.processedInodes == nil {
+		t.Fatal("processedInodes should be initialized")
+	}
+	s.processedInodes[1] = struct{}{}
+}
+
+func TestIsPathGone(t *testing.T) {
+	if isPathGone(nil) {
+		t.Fatal("nil error should not be path gone")
+	}
+	if !isPathGone(os.ErrNotExist) {
+		t.Fatal("os.ErrNotExist should be path gone")
+	}
+}

backend/indexing/indexingSchedule.go

@@ -5,38 +5,57 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	indexingdb "github.com/gtsteffaniak/filebrowser/backend/database/dbindex"
 	"github.com/gtsteffaniak/filebrowser/backend/events"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
-// schedule in minutes
-var scanSchedule = map[int]time.Duration{
-	0: 5 * time.Minute, // 5 minute scan
-	1: 10 * time.Minute,
-	2: 20 * time.Minute,
-	3: 40 * time.Minute, // schedule index 3 for file changes
-	4: 1 * time.Hour,
-	5: 2 * time.Hour,
-	6: 3 * time.Hour,
-	7: 4 * time.Hour,
-	8: 8 * time.Hour,
-	9: 12 * time.Hour,
+// scanScheduleTiers is the only set of adaptive scan intervals (index = currentSchedule tier).
+// Fastest tier is 5 minutes so consecutive runs for a path are at least ~5 minutes apart on the grid.
+//
+// On filesChanged: if current tier is slower than 40 minutes (index > 3), jump to tier 3; otherwise
+// step one tier faster (index--). High-complexity scanners are clamped to scheduleTierBoundsForComplexity.
+var scanScheduleTiers = []time.Duration{
+	5 * time.Minute,
+	10 * time.Minute,
+	20 * time.Minute,
+	40 * time.Minute,
+	1 * time.Hour,
+	2 * time.Hour,
+	3 * time.Hour,
+	4 * time.Hour,
+	8 * time.Hour,
+	12 * time.Hour,
 }
 
-// complexityModifier defines time adjustments based on complexity level (0-10)
-var complexityModifier = map[uint]time.Duration{
-	0:  0 * time.Minute,  // unknown: no modifier
-	1:  -4 * time.Minute, // simple: scan more frequently
-	2:  -2 * time.Minute, // normal (lightest)
-	3:  -1 * time.Minute,
-	4:  0 * time.Minute, // baseline normal
-	5:  1 * time.Minute,
-	6:  2 * time.Minute, // normal (heaviest)
-	7:  4 * time.Minute, // complex (lightest)
-	8:  8 * time.Minute,
-	9:  12 * time.Minute,
-	10: 16 * time.Minute, // highlyComplex: scan less frequently
+func scanScheduleDuration(tier int) time.Duration {
+	return scanScheduleTiers[utils.Clamp(tier, 0, len(scanScheduleTiers)-1)]
+}
+
+// scheduleTierBoundsForComplexity limits how aggressive or idle a scanner may be scheduled.
+// minTier: fastest allowed interval (low index); maxTier: slowest allowed (high index).
+// Complexity 0 = unknown (e.g. before first full scan): no bounds. Complexity 1: never slower than 1h.
+func scheduleTierBoundsForComplexity(c uint) (minTier, maxTier int) {
+	maxTier = len(scanScheduleTiers) - 1
+	minTier = 0
+	if c == 1 {
+		maxTier = 4 // index 4 = 1 hour; trivial trees should not stretch to multi-hour tiers
+	}
+	switch {
+	case c >= 10:
+		minTier = 4 // at least 1h between runs
+	case c >= 8:
+		minTier = 3 // at least 40m
+	case c >= 6:
+		minTier = 2 // at least 20m
+	case c >= 4:
+		minTier = 1 // at least 10m
+	}
+	if minTier > maxTier {
+		minTier = maxTier
+	}
+	return minTier, maxTier
 }
 
 // calculateTimeScore returns a 1-10 score based on scan time
@@ -172,13 +191,11 @@ func (idx *Index) incrementScannerFiles() {
 	}
 }
 
-func (idx *Index) PreScan() error {
-	return idx.SetStatus(INDEXING)
-}
-
 func (idx *Index) PostScan() error {
-	// Only do expensive operations when ALL scanners are done
-	if idx.getRunningScannerCount() == 0 {
+	idx.mu.RLock()
+	idle := idx.activeScannerPath == ""
+	idx.mu.RUnlock()
+	if idle {
 		// All scanners completed
 		err := idx.db.ShrinkMemory()
 		if err != nil {
@@ -205,7 +222,9 @@ func (idx *Index) SendSourceUpdateEvent() error {
 	if idx.mock {
 		return nil
 	}
-	reducedIndex, err := GetIndexInfo(idx.Name, true)
+	// Avoid force=true: otherwise GetIndexInfo invalidates DiskUsageCache, recomputes, and writePersistedIndexInfo
+	// nests under Save recursion; false uses cached probe / current idx totals for the broadcast payload.
+	reducedIndex, err := GetIndexInfo(idx.Name, false)
 	if err != nil {
 		logger.Errorf("[%s] Error getting index info: %v", idx.Name, err)
 		return err
@@ -226,7 +245,8 @@ func (idx *Index) SendSourceUpdateEvent() error {
 // setupMultiScanner creates and starts the multi-scanner system
 // isNewDb: if true, skip loading persisted complexity values (database is new or recreated)
 func (idx *Index) setupMultiScanner(isNewDb bool) {
-	// Load persisted index and scanner information
+	// Load persisted index-level stats from Bolt (complexity, numDirs/Files, used/usedAlt/total, etc.)
+	// Scanner-level stats below use a second GetByPath only for the Scanners map.
 	if err := idx.Load(); err != nil {
 		logger.Errorf("Failed to load persisted index data for [%v]: %v", idx.Name, err)
 	}
@@ -246,23 +266,27 @@ func (idx *Index) setupMultiScanner(isNewDb bool) {
 
 	// Create and start root scanner
 	rootScanner := idx.createScanner("/")
+	adaptive := idx.useAdaptiveScheduling()
 	if persistedScanners != nil {
 		if rootInfo, ok := persistedScanners["/"]; ok {
 			rootScanner.withStatsLock(func() {
 				rootScanner.complexity = rootInfo.Complexity
-				rootScanner.currentSchedule = rootInfo.CurrentSchedule
+				if adaptive {
+					rootScanner.currentSchedule = utils.Clamp(rootInfo.CurrentSchedule, 0, len(scanScheduleTiers)-1)
+				}
 				rootScanner.quickScanTime = rootInfo.QuickScanTime
 				rootScanner.fullScanTime = rootInfo.FullScanTime
 				rootScanner.numDirs = rootInfo.NumDirs
 				rootScanner.numFiles = rootInfo.NumFiles
 				rootScanner.lastScanned = rootInfo.LastScanned
+				rootScanner.fullScanCounter = utils.Clamp(rootInfo.FullScanCounter, 0, 4)
 			})
 		}
 	}
 	idx.mu.Lock()
 	idx.scanners["/"] = rootScanner
+	idx.schedulerStop = make(chan struct{})
 	idx.mu.Unlock()
-	go rootScanner.start()
 
 	// Discover existing top-level directories (root scanner will create scanners for new ones dynamically)
 	topLevelDirs := rootScanner.getTopLevelDirs()
@@ -276,12 +300,15 @@ func (idx *Index) setupMultiScanner(isNewDb bool) {
 			if childInfo, ok := persistedScanners[dirPath]; ok {
 				childScanner.withStatsLock(func() {
 					childScanner.complexity = childInfo.Complexity
-					childScanner.currentSchedule = childInfo.CurrentSchedule
+					if adaptive {
+						childScanner.currentSchedule = utils.Clamp(childInfo.CurrentSchedule, 0, len(scanScheduleTiers)-1)
+					}
 					childScanner.quickScanTime = childInfo.QuickScanTime
 					childScanner.fullScanTime = childInfo.FullScanTime
 					childScanner.numDirs = childInfo.NumDirs
 					childScanner.numFiles = childInfo.NumFiles
 					childScanner.lastScanned = childInfo.LastScanned
+					childScanner.fullScanCounter = utils.Clamp(childInfo.FullScanCounter, 0, 4)
 				})
 			}
 		}
@@ -289,10 +316,17 @@ func (idx *Index) setupMultiScanner(isNewDb bool) {
 		idx.mu.Lock()
 		idx.scanners[dirPath] = childScanner
 		idx.mu.Unlock()
-
-		go childScanner.start()
 	}
 
+	if idx.useAdaptiveScheduling() {
+		idx.mu.Lock()
+		idx.schedulerStartupPassPending = true
+		idx.mu.Unlock()
+	}
+
+	idx.restoreScannerNextRuns()
+	go idx.runIndexScheduler()
+
 	logger.Debugf("Created %d scanners for [%v] (1 root + %d children)", len(topLevelDirs)+1, idx.Name, len(topLevelDirs))
 }
 
@@ -301,7 +335,6 @@ func (idx *Index) createScanner(dirPath string) *Scanner {
 	return &Scanner{
 		scanPath:        dirPath,
 		idx:             idx,
-		stopChan:        make(chan struct{}),
 		currentSchedule: 0,
 		fullScanCounter: 0,
 		complexity:      0, // 0 = unknown until first full scan completes
@@ -335,7 +368,10 @@ func (idx *Index) GetScannerStatus() map[string]interface{} {
 			scannerInfo["numDirs"] = scanner.numDirs
 			scannerInfo["numFiles"] = scanner.numFiles
 			scannerInfo["filesChanged"] = scanner.filesChanged
-			scannerInfo["smartModifier"] = scanner.smartModifier.String()
+			scannerInfo["fullScanCounter"] = scanner.fullScanCounter
+			if !scanner.nextRun.IsZero() {
+				scannerInfo["nextRun"] = scanner.nextRun.Format(time.RFC3339)
+			}
 		})
 		scannerStats = append(scannerStats, scannerInfo)
 	}

backend/indexing/indexingSchedulerLoop.go

@@ -0,0 +1,359 @@
+package indexing
+
+import (
+	"sort"
+	"time"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// alignCeilToInterval rounds t up (UTC) to the next boundary where Unix time is a multiple of interval.
+func alignCeilToInterval(t time.Time, interval time.Duration) time.Time {
+	if interval < time.Minute {
+		interval = time.Minute
+	}
+	stepNs := interval.Nanoseconds()
+	total := t.UTC().UnixNano()
+	aligned := (total + stepNs - 1) / stepNs * stepNs
+	return time.Unix(0, aligned).UTC()
+}
+
+// computeNextSlotTime returns the next scheduled slot after a scan completes.
+// interval must be one of scanScheduleTiers; alignment uses that interval as the grid step.
+func computeNextSlotTime(lastScanned, ref time.Time, interval time.Duration) time.Time {
+	minStep := scanScheduleTiers[0]
+	if interval < minStep {
+		interval = minStep
+	}
+	minNext := lastScanned.Add(interval)
+	if minNext.Before(ref) {
+		minNext = ref
+	}
+	return alignCeilToInterval(minNext, interval)
+}
+
+func (idx *Index) removeScannerFromSlotLocked(s *Scanner) {
+	sec := s.calendarSlotSec
+	if sec == 0 {
+		return
+	}
+	if idx.scheduleSlots == nil {
+		s.calendarSlotSec = 0
+		return
+	}
+	lst := idx.scheduleSlots[sec]
+	out := lst[:0]
+	for _, x := range lst {
+		if x != s {
+			out = append(out, x)
+		}
+	}
+	if len(out) == 0 {
+		delete(idx.scheduleSlots, sec)
+	} else {
+		idx.scheduleSlots[sec] = out
+	}
+	s.calendarSlotSec = 0
+}
+
+// registerScannerNextRun removes the scanner from any previous slot and adds it at the given UTC time.
+func (idx *Index) registerScannerNextRun(s *Scanner, when time.Time) {
+	if !idx.useAdaptiveScheduling() {
+		return
+	}
+	when = when.UTC().Truncate(time.Second)
+	sec := when.Unix()
+	idx.scheduleSlotsMu.Lock()
+	defer idx.scheduleSlotsMu.Unlock()
+	if idx.scheduleSlots == nil {
+		idx.scheduleSlots = make(map[int64][]*Scanner)
+	}
+	idx.removeScannerFromSlotLocked(s)
+	idx.scheduleSlots[sec] = append(idx.scheduleSlots[sec], s)
+	s.calendarSlotSec = sec
+}
+
+func (idx *Index) takeDueScannerBatch(now time.Time) []*Scanner {
+	idx.scheduleSlotsMu.Lock()
+	defer idx.scheduleSlotsMu.Unlock()
+	if idx.scheduleSlots == nil {
+		return nil
+	}
+	var dueSec int64 = -1
+	nowSec := now.Unix()
+	for sec := range idx.scheduleSlots {
+		if sec <= nowSec {
+			if dueSec < 0 || sec < dueSec {
+				dueSec = sec
+			}
+		}
+	}
+	if dueSec < 0 {
+		return nil
+	}
+	lst := idx.scheduleSlots[dueSec]
+	delete(idx.scheduleSlots, dueSec)
+	for _, s := range lst {
+		s.calendarSlotSec = 0
+	}
+	return lst
+}
+
+func (idx *Index) earliestSlotWake(now time.Time) time.Time {
+	idx.scheduleSlotsMu.Lock()
+	defer idx.scheduleSlotsMu.Unlock()
+	if len(idx.scheduleSlots) == 0 {
+		return now.Add(time.Minute)
+	}
+	nowSec := now.Unix()
+	var earliest int64 = -1
+	for sec := range idx.scheduleSlots {
+		if sec <= nowSec {
+			return now
+		}
+		if earliest < 0 || sec < earliest {
+			earliest = sec
+		}
+	}
+	if earliest < 0 {
+		return now.Add(time.Minute)
+	}
+	return time.Unix(earliest, 0).UTC()
+}
+
+func (idx *Index) restoreScannerNextRuns() {
+	if !idx.useAdaptiveScheduling() {
+		return
+	}
+	idx.scheduleSlotsMu.Lock()
+	idx.scheduleSlots = make(map[int64][]*Scanner)
+	idx.scheduleSlotsMu.Unlock()
+
+	idx.mu.RLock()
+	n := len(idx.scanners)
+	idx.mu.RUnlock()
+	now := time.Now()
+	for _, s := range idx.scanners {
+		var next time.Time
+		s.withStatsLock(func() {
+			if s.lastScanned.IsZero() {
+				s.nextRun = time.Time{}
+				return
+			}
+			tier := utils.Clamp(s.currentSchedule, 0, len(scanScheduleTiers)-1)
+			d := scanScheduleDuration(tier)
+			next = computeNextSlotTime(s.lastScanned, now, d)
+			s.nextRun = next
+		})
+		if !next.IsZero() {
+			idx.registerScannerNextRun(s, next)
+		}
+	}
+	logger.Debugf("[%s] scheduler: restored nextRun for %d scanners (adaptive)", idx.Name, n)
+}
+
+func sortedScannerPaths(idx *Index) []string {
+	idx.mu.RLock()
+	defer idx.mu.RUnlock()
+	paths := make([]string, 0, len(idx.scanners))
+	for p := range idx.scanners {
+		paths = append(paths, p)
+	}
+	sort.Strings(paths)
+	return paths
+}
+
+func (idx *Index) pruneGoneChildScanners() {
+	idx.mu.RLock()
+	var gone []string
+	for path, s := range idx.scanners {
+		if path == "/" {
+			continue
+		}
+		if !s.directoryExists() {
+			gone = append(gone, path)
+		}
+	}
+	idx.mu.RUnlock()
+
+	for _, path := range gone {
+		idx.mu.RLock()
+		s, ok := idx.scanners[path]
+		idx.mu.RUnlock()
+		if !ok {
+			continue
+		}
+		idx.scheduleSlotsMu.Lock()
+		idx.removeScannerFromSlotLocked(s)
+		idx.scheduleSlotsMu.Unlock()
+		idx.mu.Lock()
+		delete(idx.scanners, path)
+		idx.mu.Unlock()
+		logger.Debugf("Scheduler removed scanner [%s]: path gone", path)
+	}
+}
+
+func (idx *Index) needsAdaptiveBootstrap() bool {
+	idx.mu.RLock()
+	defer idx.mu.RUnlock()
+	if idx.schedulerStartupPassPending {
+		return true
+	}
+	for _, s := range idx.scanners {
+		if s.lastScanned.IsZero() {
+			return true
+		}
+	}
+	return false
+}
+
+func (idx *Index) runSerialScanPass() {
+	idx.pruneGoneChildScanners()
+	paths := sortedScannerPaths(idx)
+	idx.mu.Lock()
+	idx.schedulerBatch++
+	batchDepth := idx.schedulerBatch
+	idx.mu.Unlock()
+	logger.Debugf("[%s] scheduler: serialPass start paths=%d batchDepth=%d adaptive=%v",
+		idx.Name, len(paths), batchDepth, idx.useAdaptiveScheduling())
+
+	defer func() {
+		idx.mu.Lock()
+		idx.schedulerBatch--
+		idx.mu.Unlock()
+		if err := idx.PostScan(); err != nil {
+			logger.Errorf("PostScan after serial pass: %v", err)
+		}
+		logger.Debugf("[%s] scheduler: serialPass done", idx.Name)
+	}()
+
+	for _, p := range paths {
+		idx.mu.RLock()
+		s, ok := idx.scanners[p]
+		idx.mu.RUnlock()
+		if !ok {
+			continue
+		}
+		if s.scanPath != "/" && !s.directoryExists() {
+			s.removeSelf()
+			continue
+		}
+		s.executeScan()
+	}
+}
+
+func (idx *Index) schedulerAdaptiveTick() {
+	idx.pruneGoneChildScanners()
+	if idx.needsAdaptiveBootstrap() {
+		idx.mu.Lock()
+		startupPass := idx.schedulerStartupPassPending
+		idx.mu.Unlock()
+		if startupPass {
+			logger.Debugf("[%s] scheduler: adaptive startup (serial pass all scanners)", idx.Name)
+		} else {
+			logger.Debugf("[%s] scheduler: adaptive tick bootstrap (serial pass all scanners)", idx.Name)
+		}
+		idx.runSerialScanPass()
+		if startupPass {
+			idx.mu.Lock()
+			idx.schedulerStartupPassPending = false
+			idx.mu.Unlock()
+		}
+		return
+	}
+	drainedAny := false
+	for {
+		batch := idx.takeDueScannerBatch(time.Now())
+		if len(batch) == 0 {
+			break
+		}
+		drainedAny = true
+		sort.Slice(batch, func(i, j int) bool {
+			return batch[i].scanPath < batch[j].scanPath
+		})
+		firstPath := batch[0].scanPath
+		logger.Debugf("[%s] scheduler: adaptive slot scanners=%d first=%s", idx.Name, len(batch), firstPath)
+		for _, s := range batch {
+			var nextRunStr string
+			s.withStatsRLock(func() {
+				if s.nextRun.IsZero() {
+					nextRunStr = "zero(immediate)"
+				} else {
+					nextRunStr = s.nextRun.UTC().Format(time.RFC3339)
+				}
+			})
+			logger.Debugf("[%s] scheduler: adaptive run path=%s nextRun=%s", idx.Name, s.scanPath, nextRunStr)
+			if s.scanPath != "/" && !s.directoryExists() {
+				s.removeSelf()
+				continue
+			}
+			s.executeScan()
+		}
+	}
+	if !drainedAny {
+		idx.mu.RLock()
+		n := len(idx.scanners)
+		idx.mu.RUnlock()
+		now := time.Now()
+		logger.Debugf("[%s] scheduler: adaptive tick no due slot (now=%v scanners=%d)", idx.Name, now.UTC().Format(time.RFC3339), n)
+	}
+}
+
+func (idx *Index) runIndexScheduler() {
+	defer func() {
+		if r := recover(); r != nil {
+			logger.Errorf("[%s] index scheduler panic recovered: %v", idx.Name, r)
+		}
+	}()
+
+	if !idx.useAdaptiveScheduling() {
+		idx.mu.RLock()
+		n := len(idx.scanners)
+		idx.mu.RUnlock()
+		interval := time.Duration(idx.Config.IndexingInterval) * time.Minute
+		logger.Debugf("[%s] scheduler: started fixed interval=%v scanners=%d", idx.Name, interval, n)
+		idx.runSerialScanPass()
+		for {
+			select {
+			case <-idx.schedulerStop:
+				logger.Debugf("[%s] scheduler: fixed loop stopped", idx.Name)
+				return
+			case <-time.After(interval):
+				logger.Debugf("[%s] scheduler: fixed interval wake", idx.Name)
+				idx.runSerialScanPass()
+			}
+		}
+	}
+
+	idx.mu.RLock()
+	n := len(idx.scanners)
+	idx.mu.RUnlock()
+	logger.Debugf("[%s] scheduler: started adaptive scanners=%d", idx.Name, n)
+	idx.schedulerAdaptiveTick()
+	for {
+		now := time.Now()
+		next := idx.earliestSlotWake(now)
+		d := time.Until(next)
+		if d < time.Second {
+			d = time.Second
+		}
+		logger.Debugf("[%s] scheduler: adaptive sleep until=%v (in %v)", idx.Name, next.UTC().Format(time.RFC3339), d)
+		select {
+		case <-idx.schedulerStop:
+			logger.Debugf("[%s] scheduler: adaptive loop stopped", idx.Name)
+			return
+		case <-time.After(d):
+			idx.schedulerAdaptiveTick()
+		}
+	}
+}
+
+func (idx *Index) stopScheduler() {
+	idx.schedulerStopOnce.Do(func() {
+		if idx.schedulerStop != nil {
+			logger.Debugf("[%s] scheduler: stop channel closed", idx.Name)
+			close(idx.schedulerStop)
+		}
+	})
+}

backend/indexing/indexingSchedulerLoop_test.go

@@ -0,0 +1,69 @@
+package indexing
+
+import (
+	"testing"
+	"time"
+)
+
+func TestAlignCeilToFiveMinutes(t *testing.T) {
+	loc := time.UTC
+	base := time.Date(2026, 4, 14, 12, 35, 0, 0, loc)
+	step := 5 * time.Minute
+	if got := alignCeilToInterval(base, step); !got.Equal(base) {
+		t.Fatalf("on boundary: got %v want %v", got, base)
+	}
+	withSec := time.Date(2026, 4, 14, 12, 35, 1, 0, loc)
+	want := time.Date(2026, 4, 14, 12, 40, 0, 0, loc)
+	if got := alignCeilToInterval(withSec, step); !got.Equal(want) {
+		t.Fatalf("ceil: got %v want %v", got, want)
+	}
+}
+
+func TestComputeNextSlotTimeTenMinuteGrid(t *testing.T) {
+	loc := time.UTC
+	last := time.Date(2026, 4, 14, 12, 0, 0, 0, loc)
+	ref := time.Date(2026, 4, 14, 12, 0, 30, 0, loc)
+	interval := 10 * time.Minute
+	got := computeNextSlotTime(last, ref, interval)
+	want := time.Date(2026, 4, 14, 12, 10, 0, 0, loc)
+	if !got.Equal(want) {
+		t.Fatalf("got %v want %v", got, want)
+	}
+}
+
+func TestScheduleTierBoundsForComplexity(t *testing.T) {
+	n := len(scanScheduleTiers) - 1
+	tests := []struct {
+		c       uint
+		min, max int
+	}{
+		{0, 0, n},
+		{1, 0, 4},
+		{3, 0, n},
+		{4, 1, n},
+		{6, 2, n},
+		{8, 3, n},
+		{10, 4, n},
+	}
+	for _, tt := range tests {
+		min, max := scheduleTierBoundsForComplexity(tt.c)
+		if min != tt.min || max != tt.max {
+			t.Fatalf("complexity %d: got min=%d max=%d want min=%d max=%d", tt.c, min, max, tt.min, tt.max)
+		}
+	}
+}
+
+func TestComputeNextSlotTimeHourUsesHourGrid(t *testing.T) {
+	loc := time.UTC
+	last := time.Date(2026, 4, 14, 12, 0, 0, 0, loc)
+	ref := time.Date(2026, 4, 14, 12, 3, 0, 0, loc)
+	interval := 1 * time.Hour
+	got := computeNextSlotTime(last, ref, interval)
+	step := int64(interval / time.Second)
+	if got.Unix()%step != 0 {
+		t.Fatalf("expected multiple of %v, got %v", interval, got)
+	}
+	if got.Before(ref) {
+		t.Fatalf("got %v before ref %v", got, ref)
+	}
+}

backend/indexing/indexing_test.go

@@ -67,15 +67,13 @@ func TestMultiScannerMutex(t *testing.T) {
 	// Create a mock index with multi-scanner support
 	idx := &Index{
 		Source: settings.Source{
-			Name: "test-multiscanner",
-			Path: "/tmp/test",
-			Config: settings.SourceConfig{
-				DisableIndexing: false,
-			},
+			Name:   "test-multiscanner",
+			Path:   "/tmp/test",
+			Config: settings.SourceConfig{},
 		},
-		mock:       true,
-		db:         indexDB,
-		scanners:   make(map[string]*Scanner),
+		mock:     true,
+		db:       indexDB,
+		scanners: make(map[string]*Scanner),
 	}
 
 	// Create multiple scanners
@@ -113,8 +111,8 @@ func TestMultiScannerMutex(t *testing.T) {
 	}
 
 	// Verify scanner counters can be updated
-	// Test with active scanner - mark scanner2 as scanning
-	scanner2.isScanning = true
+	// Test with active scanner
+	idx.activeScannerPath = "/test1/"
 	idx.scanners = map[string]*Scanner{"/test1/": scanner2}
 	idx.incrementScannerDirs()
 	idx.incrementScannerFiles()

backend/indexing/iteminfo/fileinfo.go

@@ -30,18 +30,28 @@ type FileInfo struct {
 	Files   []ExtendedItemInfo `json:"files,omitempty"`   // files in the directory with optional metadata
 	Folders []ItemInfo         `json:"folders,omitempty"` // folders in the directory
 	Path    string             `json:"path,omitempty"`    // path scoped to the associated index
+	// IsDir is the index DB is_dir column; Type alone can disagree (legacy or malformed rows).
+	IsDir bool `json:"-"`
+}
+
+// Lyric is a single line of lyrics with timestamps (if available)
+type Lyric struct {
+	Text      string `json:"text"`
+	Timestamp int64  `json:"timestamp"` // milliseconds
 }
 
 // MediaMetadata contains metadata extracted from audio and video files
 type MediaMetadata struct {
-	Title    string `json:"title,omitempty"`    // track/video title
-	Artist   string `json:"artist,omitempty"`   // track artist
-	Album    string `json:"album,omitempty"`    // album name
-	Year     int    `json:"year,omitempty"`     // release year
-	Genre    string `json:"genre,omitempty"`    // music/video genre
-	Track    int    `json:"track,omitempty"`    // track number
-	Duration int    `json:"duration,omitempty"` // duration in seconds
-	AlbumArt []byte `json:"albumArt,omitempty"` // album art image data (automatically base64-encoded in JSON)
+	Title     string  `json:"title,omitempty"`     // track/video title
+	Artist    string  `json:"artist,omitempty"`    // track artist
+	Album     string  `json:"album,omitempty"`     // album name
+	Year      int     `json:"year,omitempty"`      // release year
+	Genre     string  `json:"genre,omitempty"`     // music/video genre
+	Track     int     `json:"track,omitempty"`     // track number
+	Duration  int     `json:"duration,omitempty"`  // duration in seconds
+	AlbumArt  []byte  `json:"albumArt,omitempty"`  // album art image data (automatically base64-encoded in JSON)
+	Lyrics    []Lyric `json:"lyrics,omitempty"`    // lyrics (from embedded tags or .lrc files)
+	HasLyrics bool    `json:"hasLyrics,omitempty"` // checks if lyrics are available without parse them
 }
 
 // for efficiency, a response will be a pointer to the data

backend/indexing/iteminfo/mediaMeta.go

@@ -317,28 +317,33 @@ func DetectTypeByHeader(realPath string) string {
 // returns file type if the file name contains the search term
 // returns size of file/dir if the file name contains the search term
 func (fi ItemInfo) ContainsSearchTerm(searchTerm string, options SearchOptions) bool {
+	conditions := options.Conditions
+	lowerFileName := strings.ToLower(fi.Name)
 
+	st := searchTerm
+	if !conditions["exact"] {
+		st = strings.ToLower(st)
+	}
+
+	if !strings.Contains(lowerFileName, st) {
+		return false
+	}
+
+	return fi.MatchesSearchAuxiliaryFilters(options)
+}
+
+// MatchesSearchAuxiliaryFilters applies type/size/date constraints from SearchOptions without checking the file name.
+// Used when SQLite has already filtered names (e.g. name GLOB patterns).
+func (fi ItemInfo) MatchesSearchAuxiliaryFilters(options SearchOptions) bool {
 	fileTypes := map[string]bool{}
 	largerThan := int64(options.LargerThan) * 1024 * 1024
 	smallerThan := int64(options.SmallerThan) * 1024 * 1024
 	conditions := options.Conditions
 	lowerFileName := strings.ToLower(fi.Name)
 
-	// Convert to lowercase if not exact match
-	if !conditions["exact"] {
-		searchTerm = strings.ToLower(searchTerm)
-	}
-
-	// Check if the file name contains the search term
-	if !strings.Contains(lowerFileName, searchTerm) {
-		return false
-	}
-
-	// Initialize file size and fileTypes map
 	var fileSize int64
 	extension := filepath.Ext(lowerFileName)
 
-	// Collect file types using the actual detected MIME type, not just extension
 	for _, k := range AllFiletypeOptions {
 		if IsMatchingDetectedType(fi.Type, extension, k) {
 			fileTypes[k] = true
@@ -348,7 +353,6 @@ func (fi ItemInfo) ContainsSearchTerm(searchTerm string, options SearchOptions)
 	fileTypes["dir"] = isDir
 	fileSize = fi.Size
 
-	// Evaluate all conditions
 	for t, v := range conditions {
 		if t == "exact" {
 			continue
@@ -367,7 +371,6 @@ func (fi ItemInfo) ContainsSearchTerm(searchTerm string, options SearchOptions)
 				}
 			}
 		default:
-			// Handle other file type conditions
 			notMatchType := v != fileTypes[t]
 			if notMatchType {
 				return false
@@ -405,6 +408,9 @@ func IsDirectory(fileInfo os.FileInfo) bool {
 // Text files, office documents, and PDFs should NOT bubble up to folder previews.
 // This ensures consistency between indexing and preview generation.
 func ShouldBubbleUpToFolderPreview(item ItemInfo) bool {
+	if item.Type == "directory" || !item.HasPreview {
+		return false
+	}
 	// Get the simple type (e.g., "image", "video", "text")
 	simpleType := strings.Split(item.Type, "/")[0]
 	// Text files should NOT bubble up

backend/indexing/iteminfo/mediaMeta_test.go

@@ -0,0 +1,69 @@
+package iteminfo
+
+import "testing"
+
+func TestShouldBubbleUpToFolderPreview(t *testing.T) {
+	tests := []struct {
+		name string
+		item ItemInfo
+		want bool
+	}{
+		{
+			name: "directory type never bubbles",
+			item: ItemInfo{Name: "sub", Type: "directory"},
+			want: false,
+		},
+		{
+			name: "text markdown does not bubble",
+			item: ItemInfo{Name: "README.md", Type: "text/markdown"},
+			want: false,
+		},
+		{
+			name: "plain text does not bubble",
+			item: ItemInfo{Name: "LICENSE", Type: "text/plain; charset=utf-8"},
+			want: false,
+		},
+		{
+			name: "image does not bubble without HasPreview",
+			item: ItemInfo{Name: "a.png", Type: "image/png", HasPreview: false},
+			want: false,
+		},
+		{
+			name: "image bubbles when HasPreview",
+			item: ItemInfo{Name: "a.png", Type: "image/png", HasPreview: true},
+			want: true,
+		},
+		{
+			name: "video bubbles when HasPreview",
+			item: ItemInfo{Name: "clip.mp4", Type: "video/mp4", HasPreview: true},
+			want: true,
+		},
+		{
+			name: "audio bubbles when HasPreview (e.g. album art)",
+			item: ItemInfo{Name: "track.mp3", Type: "audio/mpeg", HasPreview: true},
+			want: true,
+		},
+		{
+			name: "OnlyOffice-backed extension does not bubble",
+			item: ItemInfo{Name: "report.docx", Type: "application/vnd.openxmlformats-officedocument.wordprocessingml.document"},
+			want: false,
+		},
+		{
+			name: "unknown blob type does not bubble",
+			item: ItemInfo{Name: "data.bin", Type: "application/octet-stream"},
+			want: false,
+		},
+		{
+			name: "empty type does not bubble",
+			item: ItemInfo{Name: "weird", Type: ""},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := ShouldBubbleUpToFolderPreview(tt.item); got != tt.want {
+				t.Fatalf("ShouldBubbleUpToFolderPreview() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

backend/indexing/iteminfo/searchQuery.go

@@ -16,7 +16,30 @@ type SearchOptions struct {
 	ModifiedOlderThan int64
 	// ModifiedNewerThan is Unix seconds (UTC start of day). If > 0, item must have ModTime >= this instant.
 	ModifiedNewerThan int64
-	Terms             []string
+	Terms []string
+	// MatchAllTerms, when true and non-wildcard search, an item must contain every term (AND). When false (default), any term matches (OR).
+	// For name GLOB wildcard search, name must match every pattern when true; when false, patterns are OR-combined in SQL.
+	MatchAllTerms bool
+}
+
+// BuildSearchOptionsFromQuery merges optional repeated literal terms (HTTP "terms" parameters) with structured filter text ("query" prefix).
+// When termValues has no non-empty entries, parses prefixQuery only (legacy behavior, including | for OR within the string).
+func BuildSearchOptionsFromQuery(prefixQuery string, termValues []string, termJoinAnd bool) SearchOptions {
+	prefixQuery = strings.TrimSpace(prefixQuery)
+	normalized := make([]string, 0, len(termValues))
+	for _, t := range termValues {
+		t = strings.TrimSpace(t)
+		if t != "" {
+			normalized = append(normalized, t)
+		}
+	}
+	if len(normalized) == 0 {
+		return ParseSearch(prefixQuery)
+	}
+	opts := ParseSearch(prefixQuery)
+	opts.Terms = normalized
+	opts.MatchAllTerms = termJoinAnd
+	return opts
 }
 
 func ParseSearch(value string) SearchOptions {
@@ -99,7 +122,15 @@ func ParseSearch(value string) SearchOptions {
 		return opts
 	}
 	value = strings.TrimSpace(value)
-	opts.Terms = strings.Split(value, "|")
+	parts := strings.Split(value, "|")
+	terms := make([]string, 0, len(parts))
+	for _, p := range parts {
+		t := strings.TrimSpace(p)
+		if t != "" {
+			terms = append(terms, t)
+		}
+	}
+	opts.Terms = terms
 	return opts
 }
 

backend/indexing/mutate.go

@@ -12,8 +12,8 @@ import (
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
-// UpdateFileMetadata updates the FileInfo for the specified directory in the index.
-// scanner parameter is optional - if nil (API refresh), directly inserts to database
+// UpdateMetadata persists a completed directory listing to the index. The directory row's has_preview
+// scanner is optional — if nil (API refresh), inserts run immediately; otherwise items batch until flush.
 func (idx *Index) UpdateMetadata(info *iteminfo.FileInfo, scanner *Scanner) bool {
 	items := make([]*iteminfo.FileInfo, 0, len(info.Files)+len(info.Folders)+1)
 	dirItem := *info
@@ -71,6 +71,9 @@ func (idx *Index) UpdateMetadata(info *iteminfo.FileInfo, scanner *Scanner) bool
 		// Track that this directory was updated by the scan (for timestamp conflict detection)
 		normalizedPath := utils.AddTrailingSlashIfNotExists(info.Path)
 		idx.mu.Lock()
+		if idx.scanUpdatedPaths == nil {
+			idx.scanUpdatedPaths = make(map[string]bool)
+		}
 		idx.scanUpdatedPaths[normalizedPath] = true
 		idx.mu.Unlock()
 
@@ -297,7 +300,8 @@ func GetIndexInfo(sourceName string, forceCacheRefresh bool) (ReducedIndex, erro
 	}
 
 	// Only update disk total if cache is missing or explicitly forced.
-	// Indexed "used" bytes for the UI come from the SQLite root row (see below), not in-memory scan state.
+	// Indexed "used" sums root-level files from SQLite; top-level folders use idx.folderSizes (scanned rollup)
+	// because directory size columns in SQLite can lag folderSizes/SyncFolderSizesToDB.
 	sourcePath := idx.Path
 	cacheKey := "usageCache-" + sourceName
 	if forceCacheRefresh {
@@ -313,11 +317,21 @@ func GetIndexInfo(sourceName string, forceCacheRefresh bool) (ReducedIndex, erro
 		}
 		itemInfo, dbErr := idx.db.GetDirectoryChildren(idx.Name, "/")
 		if dbErr != nil {
-			logger.Debugf("GetIndexInfo: could not read root folder size from index DB for %s: %v", sourceName, dbErr)
+			logger.Debugf("GetIndexInfo: could not read root listing from index DB for %s: %v", sourceName, dbErr)
 		}
-		indexedSizeFromDB := uint64(0)
+		var indexedSizeFromDB uint64
 		for _, item := range itemInfo {
-			indexedSizeFromDB += uint64(item.Size)
+			isFolder := item.IsDir || item.Type == "directory"
+			if !isFolder {
+				indexedSizeFromDB += uint64(item.Size)
+				continue
+			}
+			folderKey := utils.AddTrailingSlashIfNotExists(item.Path)
+			if agg, ok := idx.GetFolderSize(folderKey); ok {
+				indexedSizeFromDB += agg
+			} else {
+				indexedSizeFromDB += uint64(item.Size)
+			}
 		}
 		// Also fetch OS-reported partition used space (total - free)
 		partitionUsed, err := fileutils.GetPartitionUsed(sourcePath)
@@ -326,15 +340,25 @@ func GetIndexInfo(sourceName string, forceCacheRefresh bool) (ReducedIndex, erro
 		}
 		idx.SetUsage(totalPartitionSize, partitionUsed, indexedSizeFromDB)
 		utils.DiskUsageCache.Set(cacheKey, true)
+		if indexingStorage != nil {
+			if err := idx.writePersistedIndexInfo(); err != nil {
+				logger.Warningf("GetIndexInfo: failed to persist index disk stats for %s: %v", sourceName, err)
+			}
+		}
 	}
 
 	// Build scanner info for client
 	idx.mu.RLock()
+	adaptiveSched := idx.useAdaptiveScheduling()
 	scannerInfos := make([]*ScannerInfo, 0, len(idx.scanners))
 	for _, scanner := range idx.scanners {
+		schedule := 0
+		if adaptiveSched {
+			schedule = scanner.currentSchedule
+		}
 		scannerInfos = append(scannerInfos, &ScannerInfo{
 			Path:            scanner.scanPath,
-			CurrentSchedule: scanner.currentSchedule,
+			CurrentSchedule: schedule,
 			Stats: Stats{
 				LastScanned:   scanner.lastScanned,
 				Complexity:    scanner.complexity,
@@ -359,6 +383,8 @@ func GetIndexInfo(sourceName string, forceCacheRefresh bool) (ReducedIndex, erro
 	reducedIdx.LastScanned = lastIndexed
 	reducedIdx.LastIndexedUnix = lastIndexed.Unix()
 	reducedIdx.Status = idx.getStatusUnlocked()
+	reducedIdx.ReadOnly = idx.Config.ReadOnly
+	reducedIdx.Private = idx.Config.Private
 	idx.mu.RUnlock()
 	return reducedIdx, nil
 }

backend/indexing/search.go

@@ -28,34 +28,43 @@ type SearchResult struct {
 	Source     string `json:"source"`
 }
 
-func (idx *Index) Search(search string, scope string, sourceSession string, largest bool, limit int, olderThanUnix, newerThanUnix int64) []*SearchResult {
-	// Ensure scope has consistent trailing slash for directory matching
+// Search parses query and delegates to SearchParsed (legacy / tests).
+func (idx *Index) Search(search string, scope string, sourceSession string, largest bool, limit int, olderThanUnix, newerThanUnix int64, useWildcard bool) []*SearchResult {
+	return idx.SearchParsed(iteminfo.ParseSearch(search), scope, sourceSession, largest, limit, olderThanUnix, newerThanUnix, useWildcard)
+}
+
+// SearchParsed runs indexing search using pre-built options (e.g. repeated HTTP term parameters plus filter prefix).
+func (idx *Index) SearchParsed(baseOpts iteminfo.SearchOptions, scope string, sourceSession string, largest bool, limit int, olderThanUnix, newerThanUnix int64, useWildcard bool) []*SearchResult {
 	scope = utils.AddTrailingSlashIfNotExists(scope)
 
 	runningHash := utils.InsecureRandomIdentifier(4)
-	sessionInProgress.Store(sourceSession, runningHash) // Store the value in the sync.Map
-	searchOptions := iteminfo.ParseSearch(search)
+	sessionInProgress.Store(sourceSession, runningHash)
+
+	searchOptions := baseOpts
 	if olderThanUnix > 0 {
 		searchOptions.ModifiedOlderThan = olderThanUnix
 	}
 	if newerThanUnix > 0 {
 		searchOptions.ModifiedNewerThan = newerThanUnix
 	}
-	results := make(map[string]*SearchResult, 0)
+
+	results := make(map[string]*SearchResult)
 	count := 0
 
-	// When largest=true and no search terms, ensure we run at least once
 	if largest && len(searchOptions.Terms) == 0 {
 		searchOptions.Terms = []string{""}
 	}
 
-	rows, err := idx.db.SearchItems(idx.Name, scope, largest)
+	nameGlobPatterns := nameGlobPatternsForSearch(searchOptions, useWildcard, largest)
+	globAnd := useWildcard && searchOptions.MatchAllTerms
+
+	rows, err := idx.db.SearchItems(idx.Name, scope, largest, nameGlobPatterns, globAnd)
 	if err != nil {
 		return []*SearchResult{}
 	}
 	defer rows.Close()
+
 	for rows.Next() {
-		// Check for cancellation
 		value, found := sessionInProgress.Load(sourceSession)
 		if !found || value != runningHash {
 			return []*SearchResult{}
@@ -78,7 +87,6 @@ func (idx *Index) Search(search string, scope string, sourceSession string, larg
 			continue
 		}
 
-		// Create ItemInfo for matching
 		item := iteminfo.ItemInfo{
 			Name:       name,
 			Size:       size,
@@ -87,61 +95,30 @@ func (idx *Index) Search(search string, scope string, sourceSession string, larg
 			HasPreview: hasPreview,
 		}
 
-		// Check against all search terms
-		for _, searchTerm := range searchOptions.Terms {
-			if searchTerm == "" && !largest {
-				continue
+		matches := itemMatchesSearchFilters(item, isDir, searchOptions, largest, useWildcard, nameGlobPatterns)
+
+		if matches {
+			resType := mimeType
+			if isDir {
+				resType = "directory"
 			}
 
-			var matches bool
-			if largest {
-				// When largest=true, check size and type conditions, skip name matching
-				largerThan := int64(searchOptions.LargerThan) * 1024 * 1024
-				sizeMatches := largerThan == 0 || item.Size > largerThan
-				// Check if directories should be excluded (when type:file is specified)
-				dirCondition, hasDirCondition := searchOptions.Conditions["dir"]
-				// For directories: match if dir condition is explicitly true
-				// For files: match if no dir condition, or if dir condition is false
-				var typeMatches bool
-				if isDir {
-					typeMatches = hasDirCondition && dirCondition
-				} else {
-					typeMatches = !hasDirCondition || (hasDirCondition && !dirCondition)
-				}
-				dateMatches := searchDateMatches(item.ModTime.Unix(), searchOptions)
-				matches = sizeMatches && typeMatches && dateMatches
-			} else {
-				matches = item.ContainsSearchTerm(searchTerm, searchOptions)
-			}
-
-			if matches {
-				// Determine type string for response
-				resType := mimeType
-				if isDir {
-					resType = "directory"
-				}
-
-				results[path] = &SearchResult{
-					Path:       path,
-					Type:       resType,
-					Size:       size,
-					Modified:   item.ModTime.Format(time.RFC3339),
-					HasPreview: hasPreview,
-					Source:     idx.Name,
-				}
-				count++
-				// Break inner loop (terms) if matched, move to next row
-				break
+			results[path] = &SearchResult{
+				Path:       path,
+				Type:       resType,
+				Size:       size,
+				Modified:   item.ModTime.Format(time.RFC3339),
+				HasPreview: hasPreview,
+				Source:     idx.Name,
 			}
+			count++
 		}
 	}
 
-	// Sort keys based on the number of elements in the path after splitting by "/"
 	sortedKeys := make([]*SearchResult, 0, len(results))
 	for _, v := range results {
 		sortedKeys = append(sortedKeys, v)
 	}
-	// Sort the strings based on the number of elements after splitting by "/"
 	sort.Slice(sortedKeys, func(i, j int) bool {
 		parts1 := strings.Split(sortedKeys[i].Path, "/")
 		parts2 := strings.Split(sortedKeys[j].Path, "/")
@@ -150,6 +127,64 @@ func (idx *Index) Search(search string, scope string, sourceSession string, larg
 	return sortedKeys
 }
 
+func itemMatchesSearchFilters(item iteminfo.ItemInfo, isDir bool, searchOptions iteminfo.SearchOptions, largest, useWildcard bool, nameGlobPatterns []string) bool {
+	if largest {
+		largerThan := int64(searchOptions.LargerThan) * 1024 * 1024
+		sizeMatches := largerThan == 0 || item.Size > largerThan
+		dirCondition, hasDirCondition := searchOptions.Conditions["dir"]
+		var typeMatches bool
+		if isDir {
+			typeMatches = hasDirCondition && dirCondition
+		} else {
+			typeMatches = !hasDirCondition || (hasDirCondition && !dirCondition)
+		}
+		dateMatches := searchDateMatches(item.ModTime.Unix(), searchOptions)
+		return sizeMatches && typeMatches && dateMatches
+	}
+	if useWildcard && len(nameGlobPatterns) > 0 {
+		return item.MatchesSearchAuxiliaryFilters(searchOptions)
+	}
+	if searchOptions.MatchAllTerms {
+		sawNonempty := false
+		for _, searchTerm := range searchOptions.Terms {
+			if searchTerm == "" {
+				continue
+			}
+			sawNonempty = true
+			if !item.ContainsSearchTerm(searchTerm, searchOptions) {
+				return false
+			}
+		}
+		return sawNonempty
+	}
+	for _, searchTerm := range searchOptions.Terms {
+		if searchTerm == "" {
+			continue
+		}
+		if item.ContainsSearchTerm(searchTerm, searchOptions) {
+			return true
+		}
+	}
+	return false
+}
+
+// nameGlobPatternsForSearch builds non-empty parsed terms for SQLite name GLOB OR clauses.
+func nameGlobPatternsForSearch(opts iteminfo.SearchOptions, useWildcard, largest bool) []string {
+	if largest || !useWildcard || len(opts.Terms) == 0 {
+		return nil
+	}
+	var patterns []string
+	for _, t := range opts.Terms {
+		if t != "" {
+			patterns = append(patterns, t)
+		}
+	}
+	if len(patterns) == 0 {
+		return nil
+	}
+	return patterns
+}
+
 func searchDateMatches(modUnix int64, opts iteminfo.SearchOptions) bool {
 	if opts.ModifiedNewerThan > 0 && modUnix < opts.ModifiedNewerThan {
 		return false
@@ -160,23 +195,22 @@ func searchDateMatches(modUnix int64, opts iteminfo.SearchOptions) bool {
 	return true
 }
 
-// SearchMultiSources searches across multiple sources in a single database query.
-// sources is a list of source names to search.
-// sourceScopes is a map from source name to the scope path for that source.
-// sourceSession is used for cancellation tracking.
-// largest and limit work the same as in Search.
-func SearchMultiSources(search string, sources []string, sourceScopes map[string]string, sourceSession string, largest bool, limit int, olderThanUnix, newerThanUnix int64) []*SearchResult {
+// SearchMultiSources parses query and delegates to SearchMultiSourcesParsed.
+func SearchMultiSources(search string, sources []string, sourceScopes map[string]string, sourceSession string, largest bool, limit int, olderThanUnix, newerThanUnix int64, useWildcard bool) []*SearchResult {
+	return SearchMultiSourcesParsed(iteminfo.ParseSearch(search), sources, sourceScopes, sourceSession, largest, limit, olderThanUnix, newerThanUnix, useWildcard)
+}
+
+// SearchMultiSourcesParsed searches multiple sources using pre-built options.
+func SearchMultiSourcesParsed(baseOpts iteminfo.SearchOptions, sources []string, sourceScopes map[string]string, sourceSession string, largest bool, limit int, olderThanUnix, newerThanUnix int64, useWildcard bool) []*SearchResult {
 	if len(sources) == 0 {
 		return []*SearchResult{}
 	}
 
-	// Get the shared database
 	db := GetIndexDB()
 	if db == nil {
 		return []*SearchResult{}
 	}
 
-	// Ensure all scopes have consistent trailing slash
 	normalizedScopes := make(map[string]string)
 	for source, scope := range sourceScopes {
 		normalizedScopes[source] = utils.AddTrailingSlashIfNotExists(scope)
@@ -184,29 +218,32 @@ func SearchMultiSources(search string, sources []string, sourceScopes map[string
 
 	runningHash := utils.InsecureRandomIdentifier(4)
 	sessionInProgress.Store(sourceSession, runningHash)
-	searchOptions := iteminfo.ParseSearch(search)
+
+	searchOptions := baseOpts
 	if olderThanUnix > 0 {
 		searchOptions.ModifiedOlderThan = olderThanUnix
 	}
 	if newerThanUnix > 0 {
 		searchOptions.ModifiedNewerThan = newerThanUnix
 	}
-	results := make(map[string]*SearchResult, 0)
+
+	results := make(map[string]*SearchResult)
 	count := 0
 
-	// When largest=true and no search terms, ensure we run at least once
 	if largest && len(searchOptions.Terms) == 0 {
 		searchOptions.Terms = []string{""}
 	}
 
-	rows, err := db.SearchItemsMultiSource(sources, normalizedScopes, largest)
+	nameGlobPatterns := nameGlobPatternsForSearch(searchOptions, useWildcard, largest)
+	globAnd := useWildcard && searchOptions.MatchAllTerms
+
+	rows, err := db.SearchItemsMultiSource(sources, normalizedScopes, largest, nameGlobPatterns, globAnd)
 	if err != nil {
 		return []*SearchResult{}
 	}
 	defer rows.Close()
 
 	for rows.Next() {
-		// Check for cancellation
 		value, found := sessionInProgress.Load(sourceSession)
 		if !found || value != runningHash {
 			return []*SearchResult{}
@@ -230,7 +267,6 @@ func SearchMultiSources(search string, sources []string, sourceScopes map[string
 			continue
 		}
 
-		// Create ItemInfo for matching
 		item := iteminfo.ItemInfo{
 			Name:       name,
 			Size:       size,
@@ -239,63 +275,31 @@ func SearchMultiSources(search string, sources []string, sourceScopes map[string
 			HasPreview: hasPreview,
 		}
 
-		// Check against all search terms
-		for _, searchTerm := range searchOptions.Terms {
-			if searchTerm == "" && !largest {
-				continue
+		matches := itemMatchesSearchFilters(item, isDir, searchOptions, largest, useWildcard, nameGlobPatterns)
+
+		if matches {
+			resType := mimeType
+			if isDir {
+				resType = "directory"
 			}
 
-			var matches bool
-			if largest {
-				// When largest=true, check size and type conditions, skip name matching
-				largerThan := int64(searchOptions.LargerThan) * 1024 * 1024
-				sizeMatches := largerThan == 0 || item.Size > largerThan
-				// Check if directories should be excluded (when type:file is specified)
-				dirCondition, hasDirCondition := searchOptions.Conditions["dir"]
-				// For directories: match if dir condition is explicitly true
-				// For files: match if no dir condition, or if dir condition is false
-				var typeMatches bool
-				if isDir {
-					typeMatches = hasDirCondition && dirCondition
-				} else {
-					typeMatches = !hasDirCondition || (hasDirCondition && !dirCondition)
-				}
-				dateMatches := searchDateMatches(item.ModTime.Unix(), searchOptions)
-				matches = sizeMatches && typeMatches && dateMatches
-			} else {
-				matches = item.ContainsSearchTerm(searchTerm, searchOptions)
-			}
-
-			if matches {
-				// Determine type string for response
-				resType := mimeType
-				if isDir {
-					resType = "directory"
-				}
-
-				// Use source+path as key to handle same path in different sources
-				key := source + ":" + path
-				results[key] = &SearchResult{
-					Path:       path,
-					Type:       resType,
-					Size:       size,
-					Modified:   item.ModTime.Format(time.RFC3339),
-					HasPreview: hasPreview,
-					Source:     source,
-				}
-				count++
-				// Break inner loop (terms) if matched, move to next row
-				break
+			key := source + ":" + path
+			results[key] = &SearchResult{
+				Path:       path,
+				Type:       resType,
+				Size:       size,
+				Modified:   item.ModTime.Format(time.RFC3339),
+				HasPreview: hasPreview,
+				Source:     source,
 			}
+			count++
 		}
 	}
 
-	// Sort keys based on the number of elements in the path after splitting by "/"
 	sortedKeys := make([]*SearchResult, 0, len(results))
 	for _, v := range results {
 		sortedKeys = append(sortedKeys, v)
 	}
-	// Sort the strings based on the number of elements after splitting by "/"
 	sort.Slice(sortedKeys, func(i, j int) bool {
 		parts1 := strings.Split(sortedKeys[i].Path, "/")
 		parts2 := strings.Split(sortedKeys[j].Path, "/")

backend/indexing/search_test.go

@@ -62,7 +62,7 @@ func BenchmarkSearchAllIndexes(b *testing.B) {
 	for i := 0; i < b.N; i++ {
 		// Execute the SearchAllIndexes function
 		for _, term := range searchTerms {
-			idx.Search(term, "/", "test", false, DefaultSearchResults, 0, 0)
+			idx.Search(term, "/", "test", false, DefaultSearchResults, 0, 0, false)
 		}
 	}
 }
@@ -86,6 +86,20 @@ func TestParseSearch(t *testing.T) {
 				Terms:      []string{"my", "test", "search"},
 			},
 		},
+		{
+			input: "house | *car",
+			want: iteminfo.SearchOptions{
+				Conditions: map[string]bool{"exact": false},
+				Terms:      []string{"house", "*car"},
+			},
+		},
+		{
+			input: "a||b",
+			want: iteminfo.SearchOptions{
+				Conditions: map[string]bool{"exact": false},
+				Terms:      []string{"a", "b"},
+			},
+		},
 		{
 			input: "type:largerThan=100 type:smallerThan=1000 test",
 			want: iteminfo.SearchOptions{
@@ -174,7 +188,7 @@ func TestSearchWhileIndexing(t *testing.T) {
 			wg.Add(1)
 			go func(searchTerm string) {
 				defer wg.Done()
-				idx.Search(searchTerm, "/", "test", false, DefaultSearchResults, 0, 0)
+				idx.Search(searchTerm, "/", "test", false, DefaultSearchResults, 0, 0, false)
 			}(term)
 		}
 
@@ -452,7 +466,7 @@ func TestSearchIndexes(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.search, func(t *testing.T) {
-			result := index.Search(tt.search, tt.scope, "", false, DefaultSearchResults, 0, 0)
+			result := index.Search(tt.search, tt.scope, "", false, DefaultSearchResults, 0, 0, false)
 			// Convert results to comparable format (without Modified field)
 			expected := make([]SearchResult, len(tt.expectedResult))
 			for i, r := range tt.expectedResult {
@@ -544,7 +558,7 @@ func TestSearchLargestModeExcludesRoot(t *testing.T) {
 	}
 
 	// Test that when largest=true and scope="/", the root directory "/" is NOT included
-	result := index.Search("", "/", "test-session", true, DefaultSearchResults, 0, 0)
+	result := index.Search("", "/", "test-session", true, DefaultSearchResults, 0, 0, false)
 
 	// Verify that "/" is NOT in the results
 	rootFound := false
@@ -640,7 +654,7 @@ func TestSearchLargestModeExcludesScopeDirectory(t *testing.T) {
 	}
 
 	// Test that when largest=true and scope="/test/", the scope directory "/test/" is NOT included
-	result := index.Search("", "/test/", "test-session", true, DefaultSearchResults, 0, 0)
+	result := index.Search("", "/test/", "test-session", true, DefaultSearchResults, 0, 0, false)
 
 	// Verify that "/test/" is NOT in the results
 	scopeDirFound := false

backend/reduce-rounded-corners.css

@@ -12,7 +12,8 @@ input,
 #search-input,
 .floating-tooltip,
 .settings-items>.item,
-.button-group {
+.button-group,
+.border-radius {
     border-radius: 0.25em !important;
 }
 

backend/swagger/docs/swagger.yaml

@@ -176,6 +176,9 @@ definitions:
         type: boolean
       hash:
         type: string
+      hideFileExt:
+        description: show hidden files based on extensions in shares
+        type: string
       hideNavButtons:
         type: boolean
       keepAfterExpiration:
@@ -514,6 +517,14 @@ definitions:
         description: type of the file, either "directory" or a file mimetype
         type: string
     type: object
+  iteminfo.Lyric:
+    properties:
+      text:
+        type: string
+      timestamp:
+        description: milliseconds
+        type: integer
+    type: object
   iteminfo.MediaMetadata:
     properties:
       album:
@@ -533,6 +544,14 @@ definitions:
       genre:
         description: music/video genre
         type: string
+      hasLyrics:
+        description: checks if lyrics are available without parse them
+        type: boolean
+      lyrics:
+        description: lyrics (from embedded tags or .lrc files)
+        items:
+          $ref: '#/definitions/iteminfo.Lyric'
+        type: array
       title:
         description: track/video title
         type: string
@@ -739,6 +758,18 @@ definitions:
       styling:
         $ref: '#/definitions/settings.StylingConfig'
     type: object
+  settings.Http:
+    properties:
+      disableRateLimit:
+        description: turns off built-in auth route rate limiting and failed-login
+          lockout (default false).
+        type: boolean
+      trustedHeaders:
+        description: list of headers to trust, useful when behind a reverse proxy.
+        items:
+          type: string
+        type: array
+    type: object
   settings.IndexSqlConfig:
     properties:
       batchSize:
@@ -801,8 +832,8 @@ definitions:
           to logout url. Custom logout query params are respected.
         type: string
       secret:
-        description: Shared secret key/bytes for verifying JWT token signatures (required,
-          eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
+        description: 'secret: Shared secret key/bytes for verifying JWT token signatures
+          (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)'
         type: string
       userGroups:
         description: if set, only users in these groups are allowed to log in. Blocks
@@ -867,6 +898,10 @@ definitions:
     type: object
   settings.LogConfig:
     properties:
+      apiFilter:
+        description: regex filter that excludes matching full api paths from being
+          logged. (eg. '/user\?id\=self') Defaults to '^/health|^/favicon.ico|^/static|^/public/static'
+        type: string
       apiLevels:
         description: separated list of log levels to enable for the API. (eg. "info|warning|error")
         type: string
@@ -883,7 +918,7 @@ definitions:
         description: output location. (eg. "stdout" or "path/to/file.log")
         type: string
       utc:
-        description: use UTC time in the output instead of local time
+        description: use UTC time in the output instead of local time.
         type: boolean
     type: object
   settings.LoginMethods:
@@ -898,6 +933,8 @@ definitions:
         type: boolean
       oidc:
         $ref: '#/definitions/settings.OidcConfig'
+      passkey:
+        $ref: '#/definitions/settings.PasskeyAuthConfig'
       password:
         $ref: '#/definitions/settings.PasswordAuthConfig'
       proxy:
@@ -989,6 +1026,26 @@ definitions:
     - secret
     - url
     type: object
+  settings.PasskeyAuthConfig:
+    properties:
+      enabled:
+        description: whether to enable passkey MFA
+        type: boolean
+      loginButtonText:
+        description: custom text for the passkey login button
+        type: string
+      rpDisplayName:
+        description: the Relying Party display name (defaults to frontend name)
+        type: string
+      rpId:
+        description: the Relying Party ID; if empty, auto-derived from base URL host
+        type: string
+      rpOrigins:
+        description: allowed origins; if empty, auto-derived from base URL
+        items:
+          type: string
+        type: array
+    type: object
   settings.PasswordAuthConfig:
     properties:
       enabled:
@@ -1150,6 +1207,8 @@ definitions:
         $ref: '#/definitions/settings.Auth'
       frontend:
         $ref: '#/definitions/settings.Frontend'
+      http:
+        $ref: '#/definitions/settings.Http'
       integrations:
         $ref: '#/definitions/settings.Integrations'
       server:
@@ -1177,8 +1236,8 @@ definitions:
         - $ref: '#/definitions/settings.ConditionalFilter'
         description: 'deprecated: use source.rules instead'
       createUserDir:
-        description: 'deprecated: create a user directory for each user under defaultUserScope
-          + username (always true now)'
+        description: create a user directory for each user under defaultUserScope
+          + username
         type: boolean
       defaultEnabled:
         description: should be added as a default source for new users?
@@ -1189,10 +1248,6 @@ definitions:
       denyByDefault:
         description: deny access unless an "allow" access rule was specifically created.
         type: boolean
-      disableIndexing:
-        description: 'deprecated: use indexingDisabled instead to disable the indexing
-          of this source'
-        type: boolean
       disabled:
         description: disable the source, this is useful so you don't need to remove
           it from the config file
@@ -1205,6 +1260,10 @@ definitions:
         description: designate as source as private -- currently just means no sharing
           permitted.
         type: boolean
+      readOnly:
+        description: read-only source, changes from the UI, webdav, and API will be
+          disabled.
+        type: boolean
       rules:
         description: list of item rules to apply to specific paths
         items:
@@ -1242,69 +1301,133 @@ definitions:
     type: object
   settings.UserDefaults:
     properties:
+      account:
+        $ref: '#/definitions/settings.UserDefaultsAccount'
       customTheme:
-        description: Name of theme to use chosen from custom themes config.
+        description: 'deprecated: use ui.customTheme instead'
         type: string
       darkMode:
-        description: should dark mode be enabled
+        description: 'deprecated: use sidebar.darkMode instead'
         type: boolean
       dateFormat:
-        description: when false, the date is relative, when true, the date is an exact
-          timestamp
+        description: 'deprecated: use listing.dateFormat instead'
         type: boolean
       debugOffice:
-        description: debug onlyoffice editor
+        description: 'deprecated: use fileViewer.debugOffice instead'
         type: boolean
       deleteAfterArchive:
-        description: delete source files after successful creation/extraction of archives
+        description: 'deprecated: use listing.deleteAfterArchive instead'
         type: boolean
       deleteWithoutConfirming:
-        description: delete files without confirmation
+        description: 'deprecated: use listing.deleteWithoutConfirming instead'
         type: boolean
       disableOfficePreviewExt:
         description: 'deprecated: use disablePreviewExt instead'
         type: string
       disableOnlyOfficeExt:
-        description: list of file extensions to disable onlyoffice editor for
+        description: 'deprecated: use fileViewer.disableOnlyOfficeExt instead'
         type: string
       disablePreviewExt:
-        description: space separated list of file extensions to disable preview for
+        description: 'deprecated: use preview.disablePreviewExt instead'
         type: string
       disableQuickToggles:
-        description: disable the quick toggles in the sidebar
+        description: 'deprecated: use sidebar.disableQuickToggles instead'
         type: boolean
       disableSearchOptions:
-        description: disable the search options in the search bar
+        description: 'deprecated: use search.disableOptions instead'
         type: boolean
+      disableSettings:
+        description: 'deprecated: use account.disableSettings instead'
+        type: boolean
+      disableUpdateNotifications:
+        description: 'deprecated: use account.disableUpdateNotifications instead'
+        type: boolean
+      disableViewingExt:
+        description: 'deprecated: use fileViewer.disableViewingExt instead'
+        type: string
+      editorQuickSave:
+        description: Deprecated fields - kept for backwards compatibility
+        type: boolean
+      fileLoading:
+        $ref: '#/definitions/users.FileLoading'
+      fileViewer:
+        $ref: '#/definitions/settings.UserDefaultsFileViewer'
+      gallerySize:
+        description: 'deprecated: use sidebar.gallerySize instead'
+        type: integer
+      hideFileExt:
+        description: 'deprecated: use listing.hideFileExt instead'
+        type: string
+      hideFilesInTree:
+        description: 'deprecated: use sidebar.hideFilesInTree instead'
+        type: boolean
+      hideSidebarFileActions:
+        description: 'deprecated: use sidebar.hideSidebarFileActions instead'
+        type: boolean
+      listing:
+        $ref: '#/definitions/settings.UserDefaultsListing'
+      locale:
+        description: 'deprecated: use ui.locale instead'
+        type: string
+      lockPassword:
+        description: 'deprecated: use account.lockPassword instead'
+        type: boolean
+      loginMethod:
+        description: 'deprecated: use account.loginMethod instead'
+        type: string
+      permissions:
+        allOf:
+        - $ref: '#/definitions/settings.UserDefaultsPermissions'
+        description: 'deprecated: use account.permissions instead'
+      preferEditorForMarkdown:
+        description: 'deprecated: use fileViewer.preferEditorForMarkdown instead'
+        type: boolean
+      preview:
+        $ref: '#/definitions/settings.UserDefaultsPreview'
+      quickDownload:
+        description: 'deprecated: use listing.quickDownload instead'
+        type: boolean
+      search:
+        $ref: '#/definitions/settings.UserDefaultsSearch'
+      showCopyPath:
+        description: 'deprecated: use listing.showCopyPath instead'
+        type: boolean
+      showHidden:
+        description: 'deprecated: use listing.showHidden instead'
+        type: boolean
+      showSelectMultiple:
+        description: 'deprecated: use listing.showSelectMultiple instead'
+        type: boolean
+      showToolsInSidebar:
+        description: 'deprecated: use sidebar.showToolsInSidebar instead'
+        type: boolean
+      sidebar:
+        allOf:
+        - $ref: '#/definitions/settings.UserDefaultsSidebar'
+        description: New organized structure
+      singleClick:
+        description: 'deprecated: use sidebar.singleClick instead'
+        type: boolean
+      stickySidebar:
+        description: 'deprecated: use sidebar.stickySidebar instead'
+        type: boolean
+      themeColor:
+        description: 'deprecated: use ui.themeColor instead'
+        type: string
+      ui:
+        $ref: '#/definitions/settings.UserDefaultsUI'
+      viewMode:
+        description: 'deprecated: use sidebar.viewMode instead'
+        type: string
+    type: object
+  settings.UserDefaultsAccount:
+    properties:
       disableSettings:
         description: disable the user from viewing the settings page
         type: boolean
       disableUpdateNotifications:
         description: disable update notifications banner for admin users
         type: boolean
-      disableViewingExt:
-        description: space separated list of file extensions to disable viewing for
-        type: string
-      editorQuickSave:
-        description: show quick save button in editor
-        type: boolean
-      fileLoading:
-        allOf:
-        - $ref: '#/definitions/users.FileLoading'
-        description: upload and download settings
-      gallerySize:
-        description: 0-9 - the size of the gallery thumbnails
-        type: integer
-      hideFilesInTree:
-        description: hide files in the sidebar tree navigation, when true, will show
-          only directories.
-        type: boolean
-      hideSidebarFileActions:
-        description: hide the file actions in the sidebar
-        type: boolean
-      locale:
-        description: 'language to use: eg. de, en, or fr'
-        type: string
       lockPassword:
         description: disable the user from changing their password
         type: boolean
@@ -1312,39 +1435,9 @@ definitions:
         description: 'login method to use: eg. password, proxy, oidc'
         type: string
       permissions:
-        $ref: '#/definitions/settings.UserDefaultsPermissions'
-      preferEditorForMarkdown:
-        description: prefer editor first for markdown files instead of the Markdown
-          Viewer.
-        type: boolean
-      preview:
-        $ref: '#/definitions/settings.UserDefaultsPreview'
-      quickDownload:
-        description: show icon to download in one click
-        type: boolean
-      showHidden:
-        description: show hidden files in the UI. On windows this includes files starting
-          with a dot and windows hidden files
-        type: boolean
-      showSelectMultiple:
-        description: show select multiple files on desktop
-        type: boolean
-      singleClick:
-        description: open directory on single click, also enables middle click to
-          open in new tab
-        type: boolean
-      stickySidebar:
-        description: keep sidebar open when navigating
-        type: boolean
-      themeColor:
-        description: 'theme color to use: eg. #ff0000, or var(--red), var(--purple),
-          etc'
-        type: string
-      viewMode:
-        description: 'view mode to use: eg. normal, list, grid, or compact'
-        type: string
+        $ref: '#/definitions/settings.UserDefaultsAccountPermissions'
     type: object
-  settings.UserDefaultsPermissions:
+  settings.UserDefaultsAccountPermissions:
     properties:
       admin:
         description: allow admin access
@@ -1371,25 +1464,128 @@ definitions:
         description: allow sharing files
         type: boolean
     type: object
+  settings.UserDefaultsFileViewer:
+    properties:
+      autoplayMedia:
+        description: autoplay media files in preview
+        type: boolean
+      debugOffice:
+        description: debug onlyoffice editor
+        type: boolean
+      defaultMediaPlayer:
+        description: disable the styled feature-rich media player for browser default
+        type: boolean
+      disableOnlyOfficeExt:
+        description: list of file extensions to disable onlyoffice editor for
+        type: string
+      disableViewingExt:
+        description: comma separated list of file extensions to disable viewing for
+        type: string
+      editorQuickSave:
+        description: show quick save button in editor
+        type: boolean
+      preferEditorForMarkdown:
+        description: prefer editor first for markdown files instead of the Markdown
+          Viewer
+        type: boolean
+    type: object
+  settings.UserDefaultsListing:
+    properties:
+      dateFormat:
+        description: when false, the date is relative, when true, the date is an exact
+          timestamp
+        type: boolean
+      deleteAfterArchive:
+        description: delete source files after successful creation/extraction of archives
+        type: boolean
+      deleteWithoutConfirming:
+        description: delete files without confirmation
+        type: boolean
+      gallerySize:
+        description: 0-9 - the size of the gallery thumbnails
+        type: integer
+      hideFileExt:
+        description: space separated list of file extensions to hide in UI
+        type: string
+      quickDownload:
+        description: show icon to download in one click
+        type: boolean
+      showCopyPath:
+        description: show copy path button in the context menu
+        type: boolean
+      showHidden:
+        description: show hidden files in the UI. On windows this includes files starting
+          with a dot and windows hidden files
+        type: boolean
+      showSelectMultiple:
+        description: show select multiple files on desktop
+        type: boolean
+      singleClick:
+        description: open directory on single click, also enables middle click to
+          open in new tab
+        type: boolean
+      viewMode:
+        description: 'view mode to use: eg. normal, list, grid, or compact'
+        type: string
+    type: object
+  settings.UserDefaultsPermissions:
+    properties:
+      admin:
+        description: 'deprecated: use account.permissions.admin instead. allow admin
+          access'
+        type: boolean
+      api:
+        description: 'deprecated: use account.permissions.api instead. allow api access'
+        type: boolean
+      create:
+        description: 'deprecated: use account.permissions.create instead. allow creating
+          or uploading files'
+        type: boolean
+      delete:
+        description: 'deprecated: use account.permissions.delete instead. allow deleting
+          files'
+        type: boolean
+      download:
+        description: 'deprecated: use account.permissions.download instead. allow
+          downloading files'
+        type: boolean
+      modify:
+        description: 'deprecated: use account.permissions.modify instead. allow modifying
+          files'
+        type: boolean
+      realtime:
+        description: 'deprecated: use account.permissions.realtime instead. allow
+          realtime updates'
+        type: boolean
+      share:
+        description: 'deprecated: use account.permissions.share instead. allow sharing
+          files'
+        type: boolean
+    type: object
   settings.UserDefaultsPreview:
     properties:
       audio:
         description: show thumbnails for audio files
         type: boolean
       autoplayMedia:
-        description: autoplay media files in preview
+        description: 'deprecated: use fileViewer.autoplayMedia instead. autoplay media
+          files in preview'
         type: boolean
       defaultMediaPlayer:
-        description: disable the styled feature-rich media player for browser default
+        description: 'deprecated: use fileViewer.defaultMediaPlayer instead. disable
+          the styled feature-rich media player for browser default'
         type: boolean
       disableHideSidebar:
-        description: keep sidebar open when previewing files
+        description: deprecated fields
         type: boolean
+      disablePreviewExt:
+        description: comma separated list of file extensions to disable preview for
+        type: string
       folder:
         description: show thumbnails for folders that have previewable contents
         type: boolean
       highQuality:
-        description: 'deprecated: always true in v1.3.0+'
+        description: high quality preview thumbnails
         type: boolean
       image:
         description: show thumbnails for image files
@@ -1410,6 +1606,50 @@ definitions:
         description: show thumbnails for video files
         type: boolean
     type: object
+  settings.UserDefaultsSearch:
+    properties:
+      disableOptions:
+        description: disable the search options in the search bar
+        type: boolean
+    type: object
+  settings.UserDefaultsSidebar:
+    properties:
+      disableHideOnPreview:
+        description: keep sidebar open when previewing files (was preview.disableHideSidebar)
+        type: boolean
+      disableQuickToggles:
+        description: disable the quick toggles in the sidebar
+        type: boolean
+      hideFileActions:
+        description: hide the file actions in the sidebar
+        type: boolean
+      hideFiles:
+        description: hide files in the sidebar tree navigation, when true, will show
+          only directories
+        type: boolean
+      showTools:
+        description: show sidebar links with category "tool"; default is true
+        type: boolean
+      sticky:
+        description: keep sidebar open when navigating
+        type: boolean
+    type: object
+  settings.UserDefaultsUI:
+    properties:
+      customTheme:
+        description: Name of theme to use chosen from custom themes config
+        type: string
+      darkMode:
+        description: should dark mode be enabled
+        type: boolean
+      locale:
+        description: 'language to use: eg. de, en, or fr'
+        type: string
+      themeColor:
+        description: 'theme color to use: eg. #ff0000, or var(--red), var(--purple),
+          etc'
+        type: string
+    type: object
   share.CommonShare:
     properties:
       allowCreate:
@@ -1470,6 +1710,9 @@ definitions:
         type: string
       hasPassword:
         type: boolean
+      hideFileExt:
+        description: show hidden files based on extensions in shares
+        type: string
       hideNavButtons:
         type: boolean
       keepAfterExpiration:
@@ -1575,6 +1818,9 @@ definitions:
         type: boolean
       hash:
         type: string
+      hideFileExt:
+        description: show hidden files based on extensions in shares
+        type: string
       hideNavButtons:
         type: boolean
       keepAfterExpiration:
@@ -1686,6 +1932,9 @@ definitions:
         type: boolean
       hash:
         type: string
+      hideFileExt:
+        description: show hidden files based on extensions in shares
+        type: string
       hideNavButtons:
         type: boolean
       keepAfterExpiration:
@@ -1863,7 +2112,7 @@ definitions:
         description: Display name of the link
         type: string
       sourceName:
-        description: Source identifier for source-type links
+        description: 'Bolt: filesystem path. JSON out: display name (after prepForFrontend).'
         type: string
       target:
         description: Target path/URL for the link (relative for source/share)
@@ -1879,8 +2128,10 @@ definitions:
   users.SourceScope:
     properties:
       name:
+        description: 'Bolt: filesystem path; JSON API: display name after prepForFrontend'
         type: string
       scope:
+        description: index path within that source
         type: string
     type: object
   users.User:
@@ -1942,6 +2193,9 @@ definitions:
       gallerySize:
         description: 0-9 - the size of the gallery thumbnails
         type: integer
+      hideFileExt:
+        description: space separated list of file extensions to hide in UI and API
+        type: string
       hideFilesInTree:
         description: hide files in the sidebar tree navigation, when true, will show
           only directories.
@@ -1961,6 +2215,10 @@ definitions:
       otpEnabled:
         description: true if TOTP is enabled, false otherwise
         type: boolean
+      passkeyCredentials:
+        items:
+          $ref: '#/definitions/users.WebAuthnCredential'
+        type: array
       password:
         type: string
       perm:
@@ -1996,6 +2254,10 @@ definitions:
       showSelectMultiple:
         description: show select multiple files on desktop
         type: boolean
+      showToolsInSidebar:
+        description: 'when false, sidebar hides links with category "tool" (default:
+          true)'
+        type: boolean
       sidebarLinks:
         description: customizable sidebar links
         items:
@@ -2030,6 +2292,56 @@ definitions:
         description: 'view mode to use: eg. normal, list, grid, or compact'
         type: string
     type: object
+  users.WebAuthnCredential:
+    properties:
+      aaguid:
+        type: string
+      attestationFormat:
+        type: string
+      attestationObj:
+        type: string
+      attestationType:
+        type: string
+      authenticatorData:
+        type: string
+      clientDataHash:
+        type: string
+      clientDataJSON:
+        type: string
+      cloneWarning:
+        type: boolean
+      createdAt:
+        type: integer
+      flags:
+        $ref: '#/definitions/users.WebAuthnCredentialFlags'
+      id:
+        type: string
+      lastUsedAt:
+        type: integer
+      name:
+        type: string
+      publicKey:
+        type: string
+      publicKeyAlg:
+        type: integer
+      signCount:
+        type: integer
+      transport:
+        items:
+          type: string
+        type: array
+    type: object
+  users.WebAuthnCredentialFlags:
+    properties:
+      backupEligible:
+        type: boolean
+      backupState:
+        type: boolean
+      userPresent:
+        type: boolean
+      userVerified:
+        type: boolean
+    type: object
   utils.SubtitleTrack:
     properties:
       codec:
@@ -2392,12 +2704,25 @@ paths:
           description: JWT token for authentication
           schema:
             type: string
+        "401":
+          description: Unauthorized - authentication failed
+          schema:
+            additionalProperties:
+              type: string
+            type: object
         "403":
           description: Forbidden - authentication failed
           schema:
             additionalProperties:
               type: string
             type: object
+        "429":
+          description: Too many requests - rate limited or temporarily locked out
+            after failed attempts
+          schema:
+            additionalProperties:
+              type: string
+            type: object
         "500":
           description: Internal server error
           schema:
@@ -2768,6 +3093,188 @@ paths:
       summary: List API tokens
       tags:
       - Auth
+  /api/auth/webauthn/{id}:
+    delete:
+      description: Removes a passkey credential by its ID.
+      parameters:
+      - description: Base64-encoded credential ID
+        in: path
+        name: id
+        required: true
+        type: string
+      responses:
+        "200":
+          description: Success
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Delete a passkey credential
+      tags:
+      - Auth
+  /api/auth/webauthn/begin-login:
+    post:
+      consumes:
+      - application/json
+      description: Verifies the user's password and returns a WebAuthn assertion challenge
+        for passkey MFA.
+      parameters:
+      - description: Username
+        in: query
+        name: username
+        required: true
+        type: string
+      - description: URL-encoded password
+        in: header
+        name: X-Password
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Passkey assertion options
+          schema:
+            additionalProperties: true
+            type: object
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Begin passkey MFA login
+      tags:
+      - Auth
+  /api/auth/webauthn/begin-register:
+    post:
+      consumes:
+      - application/json
+      description: Returns WebAuthn credential creation options for adding a new passkey.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Passkey creation options
+          schema:
+            additionalProperties: true
+            type: object
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Begin passkey registration
+      tags:
+      - Auth
+  /api/auth/webauthn/finish-login:
+    post:
+      consumes:
+      - application/json
+      description: Verifies the WebAuthn assertion and returns a JWT token.
+      parameters:
+      - description: Passkey session ID from begin-login
+        in: query
+        name: session_id
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: JWT token
+          schema:
+            type: string
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Finish passkey MFA login
+      tags:
+      - Auth
+  /api/auth/webauthn/finish-register:
+    post:
+      consumes:
+      - application/json
+      description: Verifies the attestation and stores the new passkey credential.
+      parameters:
+      - description: Registration session ID
+        in: query
+        name: session_id
+        required: true
+        type: string
+      - description: Display name for the passkey
+        in: query
+        name: name
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Success
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Finish passkey registration
+      tags:
+      - Auth
+  /api/media/lyrics:
+    get:
+      consumes:
+      - application/json
+      description: Returns parsed lyrics with optional timestamps from embedded tags
+        or sidecar .lrc files.
+      parameters:
+      - description: Path to the directory or file
+        in: query
+        name: path
+        required: true
+        type: string
+      - description: Source name
+        in: query
+        name: source
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Lyrics array
+          schema:
+            additionalProperties: true
+            type: object
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "404":
+          description: Not found
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Get lyrics for an audio file
+      tags:
+      - Resources
   /api/media/metadata:
     get:
       consumes:
@@ -4080,28 +4587,36 @@ paths:
         and metadata based on the user's session and scope. Supports searching across
         multiple sources when using the 'sources' parameter.
       parameters:
-      - description: Search query
+      - description: Filter prefix or full legacy search text (required when no terms
+          are supplied)
         in: query
         name: query
-        required: true
         type: string
+      - collectionFormat: csv
+        description: 'Repeated: one literal search term per parameter; combined with
+          OR unless termJoin=and'
+        in: query
+        items:
+          type: string
+        name: terms
+        type: array
       - description: Source name for the desired source (deprecated, use 'sources'
           instead)
         in: query
         name: source
         type: string
-      - description: Comma-separated list of source names to search across multiple
-          sources. When multiple sources are specified, scope is always the user's
-          scope for each source.
+      - description: Comma-separated source names when not using repeated scope=source:path
         in: query
         name: sources
         type: string
-      - description: path within user scope to search, for example '/first/second'
-          to search within the second directory only. Ignored when multiple sources
-          are specified.
+      - collectionFormat: csv
+        description: 'Repeated: either ''sourceName:relativePath'' per source, or
+          legacy single path when one source'
         in: query
+        items:
+          type: string
         name: scope
-        type: string
+        type: array
       - description: Unix seconds; only results modified strictly before this time
         in: query
         name: olderThan
@@ -4110,9 +4625,23 @@ paths:
         in: query
         name: newerThan
         type: integer
-      - description: User session ID, add unique value to prevent collisions
-        in: header
-        name: SessionId
+      - description: When true, match indexed file names with SQLite GLOB (wildcard
+          patterns)
+        in: query
+        name: useWildcard
+        type: boolean
+      - description: 'Deprecated: alias for useWildcard'
+        in: query
+        name: glob
+        type: boolean
+      - description: 'Deprecated: alias for useWildcard'
+        in: query
+        name: useGlob
+        type: boolean
+      - description: 'Optional: ''and'' to require all repeated ''terms'' match; default
+          is OR'
+        in: query
+        name: termJoin
         type: string
       produces:
       - application/json
@@ -4330,6 +4859,41 @@ paths:
           schema:
             $ref: '#/definitions/http.HttpResponse'
       summary: Health Check
+  /public/api/media/lyrics:
+    get:
+      parameters:
+      - description: Share hash
+        in: query
+        name: hash
+        required: true
+        type: string
+      - description: Path within the share
+        in: query
+        name: path
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Lyrics array
+          schema:
+            additionalProperties: true
+            type: object
+        "403":
+          description: Forbidden
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+        "404":
+          description: Not found
+          schema:
+            additionalProperties:
+              type: string
+            type: object
+      summary: Get lyrics for an audio file (public share)
+      tags:
+      - Shares
   /public/api/media/metadata:
     get:
       parameters:

frontend/package-lock.json

@@ -101,9 +101,9 @@
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.2.tgz",
-      "integrity": "sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==",
+      "version": "7.29.3",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
+      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.29.0"
@@ -1126,13 +1126,13 @@
       }
     },
     "node_modules/@playwright/test": {
-      "version": "1.59.1",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.59.1.tgz",
-      "integrity": "sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg==",
+      "version": "1.60.0",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.60.0.tgz",
+      "integrity": "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.59.1"
+        "playwright": "1.60.0"
       },
       "bin": {
         "playwright": "cli.js"
@@ -1165,9 +1165,9 @@
       }
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.60.2.tgz",
-      "integrity": "sha512-dnlp69efPPg6Uaw2dVqzWRfAWRnYVb1XJ8CyyhIbZeaq4CA5/mLeZ1IEt9QqQxmbdvagjLIm2ZL8BxXv5lH4Yw==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.60.3.tgz",
+      "integrity": "sha512-x35CNW/ANXG3hE/EZpRU8MXX1JDN86hBb2wMGAtltkz7pc6cxgjpy1OMMfDosOQ+2hWqIkag/fGok1Yady9nGw==",
       "cpu": [
         "arm"
       ],
@@ -1179,9 +1179,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.60.2.tgz",
-      "integrity": "sha512-OqZTwDRDchGRHHm/hwLOL7uVPB9aUvI0am/eQuWMNyFHf5PSEQmyEeYYheA0EPPKUO/l0uigCp+iaTjoLjVoHg==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.60.3.tgz",
+      "integrity": "sha512-xw3xtkDApIOGayehp2+Rz4zimfkaX65r4t47iy+ymQB2G4iJCBBfj0ogVg5jpvjpn8UWn/+q9tprxleYeNp3Hw==",
       "cpu": [
         "arm64"
       ],
@@ -1193,9 +1193,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.60.2.tgz",
-      "integrity": "sha512-UwRE7CGpvSVEQS8gUMBe1uADWjNnVgP3Iusyda1nSRwNDCsRjnGc7w6El6WLQsXmZTbLZx9cecegumcitNfpmA==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.60.3.tgz",
+      "integrity": "sha512-vo6Y5Qfpx7/5EaamIwi0WqW2+zfiusVihKatLvtN1VFVy3D13uERk/6gZLU1UiHRL6fDXqj/ELIeVRGnvcTE1g==",
       "cpu": [
         "arm64"
       ],
@@ -1207,9 +1207,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.60.2.tgz",
-      "integrity": "sha512-gjEtURKLCC5VXm1I+2i1u9OhxFsKAQJKTVB8WvDAHF+oZlq0GTVFOlTlO1q3AlCTE/DF32c16ESvfgqR7343/g==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.60.3.tgz",
+      "integrity": "sha512-D+0QGcZhBzTN82weOnsSlY7V7+RMmPuF1CkbxyMAGE8+ZHeUjyb76ZiWmBlCu//AQQONvxcqRbwZTajZKqjuOw==",
       "cpu": [
         "x64"
       ],
@@ -1221,9 +1221,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.60.2.tgz",
-      "integrity": "sha512-Bcl6CYDeAgE70cqZaMojOi/eK63h5Me97ZqAQoh77VPjMysA/4ORQBRGo3rRy45x4MzVlU9uZxs8Uwy7ZaKnBw==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.60.3.tgz",
+      "integrity": "sha512-6HnvHCT7fDyj6R0Ph7A6x8dQS/S38MClRWeDLqc0MdfWkxjiu1HSDYrdPhqSILzjTIC/pnXbbJbo+ft+gy/9hQ==",
       "cpu": [
         "arm64"
       ],
@@ -1235,9 +1235,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.60.2.tgz",
-      "integrity": "sha512-LU+TPda3mAE2QB0/Hp5VyeKJivpC6+tlOXd1VMoXV/YFMvk/MNk5iXeBfB4MQGRWyOYVJ01625vjkr0Az98OJQ==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.60.3.tgz",
+      "integrity": "sha512-KHLgC3WKlUYW3ShFKnnosZDOJ0xjg9zp7au3sIm2bs/tGBeC2ipmvRh/N7JKi0t9Ue20C0dpEshi8WUubg+cnA==",
       "cpu": [
         "x64"
       ],
@@ -1249,9 +1249,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.60.2.tgz",
-      "integrity": "sha512-2QxQrM+KQ7DAW4o22j+XZ6RKdxjLD7BOWTP0Bv0tmjdyhXSsr2Ul1oJDQqh9Zf5qOwTuTc7Ek83mOFaKnodPjg==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.60.3.tgz",
+      "integrity": "sha512-DV6fJoxEYWJOvaZIsok7KrYl0tPvga5OZ2yvKHNNYyk/2roMLqQAbGhr78EQ5YhHpnhLKJD3S1WFusAkmUuV5g==",
       "cpu": [
         "arm"
       ],
@@ -1263,9 +1263,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.60.2.tgz",
-      "integrity": "sha512-TbziEu2DVsTEOPif2mKWkMeDMLoYjx95oESa9fkQQK7r/Orta0gnkcDpzwufEcAO2BLBsD7mZkXGFqEdMRRwfw==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.60.3.tgz",
+      "integrity": "sha512-mQKoJAzvuOs6F+TZybQO4GOTSMUu7v0WdxEk24krQ/uUxXoPTtHjuaUuPmFhtBcM4K0ons8nrE3JyhTuCFtT/w==",
       "cpu": [
         "arm"
       ],
@@ -1277,9 +1277,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.60.2.tgz",
-      "integrity": "sha512-bO/rVDiDUuM2YfuCUwZ1t1cP+/yqjqz+Xf2VtkdppefuOFS2OSeAfgafaHNkFn0t02hEyXngZkxtGqXcXwO8Rg==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.60.3.tgz",
+      "integrity": "sha512-Whjj2qoiJ6+OOJMGptTYazaJvjOJm+iKHpXQM1P3LzGjt7Ff++Tp7nH4N8J/BUA7R9IHfDyx4DJIflifwnbmIA==",
       "cpu": [
         "arm64"
       ],
@@ -1291,9 +1291,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.60.2.tgz",
-      "integrity": "sha512-hr26p7e93Rl0Za+JwW7EAnwAvKkehh12BU1Llm9Ykiibg4uIr2rbpxG9WCf56GuvidlTG9KiiQT/TXT1yAWxTA==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.60.3.tgz",
+      "integrity": "sha512-4YTNHKqGng5+yiZt3mg77nmyuCfmNfX4fPmyUapBcIk+BdwSwmCWGXOUxhXbBEkFHtoN5boLj/5NON+u5QC9tg==",
       "cpu": [
         "arm64"
       ],
@@ -1305,9 +1305,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.60.2.tgz",
-      "integrity": "sha512-pOjB/uSIyDt+ow3k/RcLvUAOGpysT2phDn7TTUB3n75SlIgZzM6NKAqlErPhoFU+npgY3/n+2HYIQVbF70P9/A==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.60.3.tgz",
+      "integrity": "sha512-SU3kNlhkpI4UqlUc2VXPGK9o886ZsSeGfMAX2ba2b8DKmMXq4AL7KUrkSWVbb7koVqx41Yczx6dx5PNargIrEA==",
       "cpu": [
         "loong64"
       ],
@@ -1319,9 +1319,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.60.2.tgz",
-      "integrity": "sha512-2/w+q8jszv9Ww1c+6uJT3OwqhdmGP2/4T17cu8WuwyUuuaCDDJ2ojdyYwZzCxx0GcsZBhzi3HmH+J5pZNXnd+Q==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.60.3.tgz",
+      "integrity": "sha512-6lDLl5h4TXpB1mTf2rQWnAk/LcXrx9vBfu/DT5TIPhvMhRWaZ5MxkIc8u4lJAmBo6klTe1ywXIUHFjylW505sg==",
       "cpu": [
         "loong64"
       ],
@@ -1333,9 +1333,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.60.2.tgz",
-      "integrity": "sha512-11+aL5vKheYgczxtPVVRhdptAM2H7fcDR5Gw4/bTcteuZBlH4oP9f5s9zYO9aGZvoGeBpqXI/9TZZihZ609wKw==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.60.3.tgz",
+      "integrity": "sha512-BMo8bOw8evlup/8G+cj5xWtPyp93xPdyoSN16Zy90Q2QZ0ZYRhCt6ZJSwbrRzG9HApFabjwj2p25TUPDWrhzqQ==",
       "cpu": [
         "ppc64"
       ],
@@ -1347,9 +1347,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.60.2.tgz",
-      "integrity": "sha512-i16fokAGK46IVZuV8LIIwMdtqhin9hfYkCh8pf8iC3QU3LpwL+1FSFGej+O7l3E/AoknL6Dclh2oTdnRMpTzFQ==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.60.3.tgz",
+      "integrity": "sha512-E0L8X1dZN1/Rph+5VPF6Xj2G7JJvMACVXtamTJIDrVI44Y3K+G8gQaMEAavbqCGTa16InptiVrX6eM6pmJ+7qA==",
       "cpu": [
         "ppc64"
       ],
@@ -1361,9 +1361,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.60.2.tgz",
-      "integrity": "sha512-49FkKS6RGQoriDSK/6E2GkAsAuU5kETFCh7pG4yD/ylj9rKhTmO3elsnmBvRD4PgJPds5W2PkhC82aVwmUcJ7A==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.60.3.tgz",
+      "integrity": "sha512-oZJ/WHaVfHUiRAtmTAeo3DcevNsVvH8mbvodjZy7D5QKvCefO371SiKRpxoDcCxB3PTRTLayWBkvmDQKTcX/sw==",
       "cpu": [
         "riscv64"
       ],
@@ -1375,9 +1375,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.60.2.tgz",
-      "integrity": "sha512-mjYNkHPfGpUR00DuM1ZZIgs64Hpf4bWcz9Z41+4Q+pgDx73UwWdAYyf6EG/lRFldmdHHzgrYyge5akFUW0D3mQ==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.60.3.tgz",
+      "integrity": "sha512-Dhbyh7j9FybM3YaTgaHmVALwA8AkUwTPccyCQ79TG9AJUsMQqgN1DDEZNr4+QUfwiWvLDumW5vdwzoeUF+TNxQ==",
       "cpu": [
         "riscv64"
       ],
@@ -1389,9 +1389,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.60.2.tgz",
-      "integrity": "sha512-ALyvJz965BQk8E9Al/JDKKDLH2kfKFLTGMlgkAbbYtZuJt9LU8DW3ZoDMCtQpXAltZxwBHevXz5u+gf0yA0YoA==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.60.3.tgz",
+      "integrity": "sha512-cJd1X5XhHHlltkaypz1UcWLA8AcoIi1aWhsvaWDskD1oz2eKCypnqvTQ8ykMNI0RSmm7NkTdSqSSD7zM0xa6Ig==",
       "cpu": [
         "s390x"
       ],
@@ -1403,9 +1403,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.2.tgz",
-      "integrity": "sha512-UQjrkIdWrKI626Du8lCQ6MJp/6V1LAo2bOK9OTu4mSn8GGXIkPXk/Vsp4bLHCd9Z9Iz2OTEaokUE90VweJgIYQ==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.3.tgz",
+      "integrity": "sha512-DAZDBHQfG2oQuhY7mc6I3/qB4LU2fQCjRvxbDwd/Jdvb9fypP4IJ4qmtu6lNjes6B531AI8cg1aKC2di97bUxA==",
       "cpu": [
         "x64"
       ],
@@ -1417,9 +1417,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.60.2.tgz",
-      "integrity": "sha512-bTsRGj6VlSdn/XD4CGyzMnzaBs9bsRxy79eTqTCBsA8TMIEky7qg48aPkvJvFe1HyzQ5oMZdg7AnVlWQSKLTnw==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.60.3.tgz",
+      "integrity": "sha512-cRxsE8c13mZOh3vP+wLDxpQBRrOHDIGOWyDL93Sy0Ga8y515fBcC2pjUfFwUe5T7tqvTvWbCpg1URM/AXdWIXA==",
       "cpu": [
         "x64"
       ],
@@ -1431,9 +1431,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.60.2.tgz",
-      "integrity": "sha512-6d4Z3534xitaA1FcMWP7mQPq5zGwBmGbhphh2DwaA1aNIXUu3KTOfwrWpbwI4/Gr0uANo7NTtaykFyO2hPuFLg==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.60.3.tgz",
+      "integrity": "sha512-QaWcIgRxqEdQdhJqW4DJctsH6HCmo5vHxY0krHSX4jMtOqfzC+dqDGuHM87bu4H8JBeibWx7jFz+h6/4C8wA5Q==",
       "cpu": [
         "x64"
       ],
@@ -1445,9 +1445,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.60.2.tgz",
-      "integrity": "sha512-NetAg5iO2uN7eB8zE5qrZ3CSil+7IJt4WDFLcC75Ymywq1VZVD6qJ6EvNLjZ3rEm6gB7XW5JdT60c6MN35Z85Q==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.60.3.tgz",
+      "integrity": "sha512-AaXwSvUi3QIPtroAUw1t5yHGIyqKEXwH54WUocFolZhpGDruJcs8c+xPNDRn4XiQsS7MEwnYsHW2l0MBLDMkWg==",
       "cpu": [
         "arm64"
       ],
@@ -1459,9 +1459,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.60.2.tgz",
-      "integrity": "sha512-NCYhOotpgWZ5kdxCZsv6Iudx0wX8980Q/oW4pNFNihpBKsDbEA1zpkfxJGC0yugsUuyDZ7gL37dbzwhR0VI7pQ==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.60.3.tgz",
+      "integrity": "sha512-65LAKM/bAWDqKNEelHlcHvm2V+Vfb8C6INFxQXRHCvaVN1rJfwr4NvdP4FyzUaLqWfaCGaadf6UbTm8xJeYfEg==",
       "cpu": [
         "arm64"
       ],
@@ -1473,9 +1473,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.60.2.tgz",
-      "integrity": "sha512-RXsaOqXxfoUBQoOgvmmijVxJnW2IGB0eoMO7F8FAjaj0UTywUO/luSqimWBJn04WNgUkeNhh7fs7pESXajWmkg==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.60.3.tgz",
+      "integrity": "sha512-EEM2gyhBF5MFnI6vMKdX1LAosE627RGBzIoGMdLloPZkXrUN0Ckqgr2Qi8+J3zip/8NVVro3/FjB+tjhZUgUHA==",
       "cpu": [
         "ia32"
       ],
@@ -1487,9 +1487,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.60.2.tgz",
-      "integrity": "sha512-qdAzEULD+/hzObedtmV6iBpdL5TIbKVztGiK7O3/KYSf+HIzU257+MX1EXJcyIiDbMAqmbwaufcYPvyRryeZtA==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.60.3.tgz",
+      "integrity": "sha512-E5Eb5H/DpxaoXH++Qkv28RcUJboMopmdDUALBczvHMf7hNIxaDZqwY5lK12UK1BHacSmvupoEWGu+n993Z0y1A==",
       "cpu": [
         "x64"
       ],
@@ -1501,9 +1501,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.60.2.tgz",
-      "integrity": "sha512-Nd/SgG27WoA9e+/TdK74KnHz852TLa94ovOYySo/yMPuTmpckK/jIF2jSwS3g7ELSKXK13/cVdmg1Z/DaCWKxA==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.60.3.tgz",
+      "integrity": "sha512-hPt/bgL5cE+Qp+/TPHBqptcAgPzgj46mPcg/16zNUmbQk0j+mOEQV/+Lqu8QRtDV3Ek95Q6FeFITpuhl6OTsAA==",
       "cpu": [
         "x64"
       ],
@@ -1533,9 +1533,9 @@
       "license": "MIT"
     },
     "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
       "dev": true,
       "license": "MIT"
     },
@@ -1550,9 +1550,9 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "24.12.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.2.tgz",
-      "integrity": "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g==",
+      "version": "24.12.4",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.4.tgz",
+      "integrity": "sha512-GUUEShf+PBCGW2KaXwcIt3Yk+e3pkKwWKb9GSyM9WQVE+ep2jzmHdGsHzu4wgcZy5fN9FBdVzjpBQsYlpfpgLA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1770,9 +1770,9 @@
       }
     },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz",
-      "integrity": "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
+      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
       "dev": true,
       "license": "ISC"
     },
@@ -1959,53 +1959,53 @@
       }
     },
     "node_modules/@vue/compiler-core": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.33.tgz",
-      "integrity": "sha512-3PZLQwFw4Za3TC8t0FvTy3wI16Kt+pmwcgNZca4Pj9iWL2E72a/gZlpBtAJvEdDMdCxdG/qq0C7PN0bsJuv0Rw==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.34.tgz",
+      "integrity": "sha512-s9cLyK5mLcvZ4Agva5QgRsQyLKvts9WbU9DB6NqiZkkGEdwmcEiylj5Jbwkp680drF/NNCV8OlAJSe+yMLxaJw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.2",
-        "@vue/shared": "3.5.33",
+        "@babel/parser": "^7.29.3",
+        "@vue/shared": "3.5.34",
         "entities": "^7.0.1",
         "estree-walker": "^2.0.2",
         "source-map-js": "^1.2.1"
       }
     },
     "node_modules/@vue/compiler-dom": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.33.tgz",
-      "integrity": "sha512-PXq0yrfCLzzL07rbXO4awtXY1Z06LG2eu6Adg3RJFa/j3Cii217XxxLXG22N330gw7GmALCY0Z8RgXEviwgpjA==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.34.tgz",
+      "integrity": "sha512-EbF/T++k0e2MMZlJsBhzK8Sgwt0HcIPOhzn1CTB/lv6sQcyk+OWf8YeiLxZp3ro7MbbLcAfAJ6sEvjFWuNgUCw==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-core": "3.5.33",
-        "@vue/shared": "3.5.33"
+        "@vue/compiler-core": "3.5.34",
+        "@vue/shared": "3.5.34"
       }
     },
     "node_modules/@vue/compiler-sfc": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.33.tgz",
-      "integrity": "sha512-UTUvRO9cY+rROrx/pvN9P5Z7FgA6QGfokUCfhQE4EnmUj3rVnK+CHI0LsEO1pg+I7//iRYMUfcNcCPe7tg0CoA==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.34.tgz",
+      "integrity": "sha512-D/ihr6uZeIt6r+pVZf46RWT1fAsLFMbUP7k8G1VkiiWexriED9GrX3echHd4Abbt17zjlfiFJ8z7a3BxZOPNjg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.2",
-        "@vue/compiler-core": "3.5.33",
-        "@vue/compiler-dom": "3.5.33",
-        "@vue/compiler-ssr": "3.5.33",
-        "@vue/shared": "3.5.33",
+        "@babel/parser": "^7.29.3",
+        "@vue/compiler-core": "3.5.34",
+        "@vue/compiler-dom": "3.5.34",
+        "@vue/compiler-ssr": "3.5.34",
+        "@vue/shared": "3.5.34",
         "estree-walker": "^2.0.2",
         "magic-string": "^0.30.21",
-        "postcss": "^8.5.10",
+        "postcss": "^8.5.14",
         "source-map-js": "^1.2.1"
       }
     },
     "node_modules/@vue/compiler-ssr": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.33.tgz",
-      "integrity": "sha512-IErjYdnj1qIupG5xxiVIYiiRvDhGWV4zuh/RCrwfYpuL+HWQzeU6lCk/nF9r7olWMnjKxCAkOctT2qFWFkzb1A==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.34.tgz",
+      "integrity": "sha512-cDtTHKibkThKGHH1SP+WdccquNRYQDFH6rRjQCqT9G2ltFAfoR5pUftpab/z+aM5mW9HLLVQW7hfKKQe/1GBeQ==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-dom": "3.5.33",
-        "@vue/shared": "3.5.33"
+        "@vue/compiler-dom": "3.5.34",
+        "@vue/shared": "3.5.34"
       }
     },
     "node_modules/@vue/compiler-vue2": {
@@ -2076,53 +2076,53 @@
       }
     },
     "node_modules/@vue/reactivity": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.33.tgz",
-      "integrity": "sha512-p8UfIqyIhb0rYGlSgSBV+lPhF2iUSBcRy7enhTmPqKWadHy9kcOFYF1AejYBP9P+avnd3OBbD49DU4pLWX/94A==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.34.tgz",
+      "integrity": "sha512-y9XDjCEuBp+98k+UL5dbYkh57AHU4o6cxZedOPXw3bmrZZYLQsVHguGurq7hVrPCSrQtrnz1f9dssyFr+dMXfQ==",
       "license": "MIT",
       "dependencies": {
-        "@vue/shared": "3.5.33"
+        "@vue/shared": "3.5.34"
       }
     },
     "node_modules/@vue/runtime-core": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.33.tgz",
-      "integrity": "sha512-UpFF45RI9//a7rvq7RdOQblb4tup7hHG9QsmIrxkFQLzQ7R8/iNQ5LE15NhLZ1/WcHMU2b47u6P33CPUelHyIQ==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.34.tgz",
+      "integrity": "sha512-mKeBYvu8tcMSLhypAHBmriUFfWXKTCF/23Z4jiCoYK3UtWepkliViNLuR90V9XOyD62mUxs9p1jsrpK3CCGIzw==",
       "license": "MIT",
       "dependencies": {
-        "@vue/reactivity": "3.5.33",
-        "@vue/shared": "3.5.33"
+        "@vue/reactivity": "3.5.34",
+        "@vue/shared": "3.5.34"
       }
     },
     "node_modules/@vue/runtime-dom": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.33.tgz",
-      "integrity": "sha512-IOxMsAOwquhfITgmOgaPYl7/j8gKUxUFoflRc+u4LxyD3+783xne8vNta1PONVCvCV9A0w7hkyEepINDqfO0tw==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.34.tgz",
+      "integrity": "sha512-e8kZzERmCwUnBRVsgSQlAfrfU2rGoy0FFKPBXSlfEjc/O3KfA7QP0t1/2ZylrbchjmIKB4dPTd07A6WPr0eOrg==",
       "license": "MIT",
       "dependencies": {
-        "@vue/reactivity": "3.5.33",
-        "@vue/runtime-core": "3.5.33",
-        "@vue/shared": "3.5.33",
+        "@vue/reactivity": "3.5.34",
+        "@vue/runtime-core": "3.5.34",
+        "@vue/shared": "3.5.34",
         "csstype": "^3.2.3"
       }
     },
     "node_modules/@vue/server-renderer": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.33.tgz",
-      "integrity": "sha512-0xylq/8/h44lVG0pZFknv1XIdEgymq2E9n59uTWJBG+dIgiT0TMCSsxrN7nO16Z0MU0MPjFcguBbZV8Itk52Hw==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.34.tgz",
+      "integrity": "sha512-nHxmJoTrKsmrkbILRhkC9gY1G3moZbJTqCzDd7DOOzG5KH9oeJ0Unqrff5f9v0pW//jES05ZkJcNtfE8JjOIew==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-ssr": "3.5.33",
-        "@vue/shared": "3.5.33"
+        "@vue/compiler-ssr": "3.5.34",
+        "@vue/shared": "3.5.34"
       },
       "peerDependencies": {
-        "vue": "3.5.33"
+        "vue": "3.5.34"
       }
     },
     "node_modules/@vue/shared": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.33.tgz",
-      "integrity": "sha512-5vR2QIlmaLG77Ygd4pMP6+SGQ5yox9VhtnbDWTy9DzMzdmeLxZ1QqxrywEZ9sa1AVubfIJyaCG3ytyWU81ufcQ==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.34.tgz",
+      "integrity": "sha512-24uqU4OIiX29ryC3MeWid/Xf2fa2EFRUVLb77nRhk+UrTVrh/XiGtFAFmJBAtBRbjwNdsPRP+jj/OL27Eg1NDA==",
       "license": "MIT"
     },
     "node_modules/@xmldom/xmldom": {
@@ -2135,9 +2135,9 @@
       }
     },
     "node_modules/ace-builds": {
-      "version": "1.43.6",
-      "resolved": "https://registry.npmjs.org/ace-builds/-/ace-builds-1.43.6.tgz",
-      "integrity": "sha512-L1ddibQ7F3vyXR2k2fg+I8TQTPWVA6CKeDQr/h2+8CeyTp3W6EQL8xNFZRTztuP8xNOAqL3IYPqdzs31GCjDvg==",
+      "version": "1.44.0",
+      "resolved": "https://registry.npmjs.org/ace-builds/-/ace-builds-1.44.0.tgz",
+      "integrity": "sha512-PFNMSYqFdEUkul2Ntud0HvA09AgY+F1ag0UYdpMH60wNI/qOA8cB8tlTgoALMEwIdUPJK2CjrIQ7OnbiSS/ugQ==",
       "license": "BSD-3-Clause"
     },
     "node_modules/acorn": {
@@ -2163,6 +2163,16 @@
         "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
+    "node_modules/adm-zip": {
+      "version": "0.5.17",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.17.tgz",
+      "integrity": "sha512-+Ut8d9LLqwEvHHJl1+PIHqoyDxFgVN847JTVM3Izi3xHDWPE4UtzzXysMZQs64DMcrJfBeS/uoEP4AD3HQHnQQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0"
+      }
+    },
     "node_modules/agent-base": {
       "version": "7.1.4",
       "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
@@ -2257,12 +2267,12 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.2.tgz",
-      "integrity": "sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==",
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.16.0.tgz",
+      "integrity": "sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.11",
+        "follow-redirects": "^1.16.0",
         "form-data": "^4.0.5",
         "proxy-from-env": "^2.1.0"
       }
@@ -2307,9 +2317,9 @@
       "license": "ISC"
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -2637,19 +2647,20 @@
       "license": "MIT"
     },
     "node_modules/deepl-node": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/deepl-node/-/deepl-node-1.16.0.tgz",
-      "integrity": "sha512-sYrh8UngVHKBrgffLPl+ng065mlC+Ep3LBdSN3xqDBd4KdBZzgvdxHiHd9Pm9xQCI5pwyuCHyq0cDUW1T3vQUg==",
+      "version": "1.27.0",
+      "resolved": "https://registry.npmjs.org/deepl-node/-/deepl-node-1.27.0.tgz",
+      "integrity": "sha512-OEiprFdxqr7aS0+gmv8vsZLBLoDarBppG1zkTWUlrAvPoYdwSWKFWjcZgr9XSV3FWlPy8g10WdJjWkxDn9P56w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": ">=12.0",
+        "adm-zip": "^0.5.16",
         "axios": "^1.7.4",
-        "form-data": "^3.0.0",
+        "form-data": "^3.0.4",
         "loglevel": ">=1.6.2"
       },
       "engines": {
-        "node": ">=12.0"
+        "node": ">=14.17"
       }
     },
     "node_modules/deepl-node/node_modules/form-data": {
@@ -2711,9 +2722,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.1.tgz",
-      "integrity": "sha512-JahakDAIg1gyOm7dlgWSDjV4n7Ip2PKR55NIT6jrMfIgLFgWo81vdr1/QGqWtFNRqXP9UV71oVePtjqS2ebnPw==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.2.tgz",
+      "integrity": "sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -3516,9 +3527,9 @@
       }
     },
     "node_modules/fs-extra": {
-      "version": "11.3.4",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.4.tgz",
-      "integrity": "sha512-CTXd6rk/M3/ULNQj8FBqBWHYBVYybQ3VPBw0xGKFe3tuH7ytT6ACnvzpIQ3UZtB8yvUKC2cXn1a+x+5EVQLovA==",
+      "version": "11.3.5",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.5.tgz",
+      "integrity": "sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4464,9 +4475,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.12",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
+      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
       "funding": [
         {
           "type": "github",
@@ -4801,13 +4812,13 @@
       "license": "MIT"
     },
     "node_modules/playwright": {
-      "version": "1.59.1",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.59.1.tgz",
-      "integrity": "sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw==",
+      "version": "1.60.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz",
+      "integrity": "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.59.1"
+        "playwright-core": "1.60.0"
       },
       "bin": {
         "playwright": "cli.js"
@@ -4820,9 +4831,9 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.59.1",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.59.1.tgz",
-      "integrity": "sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg==",
+      "version": "1.60.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz",
+      "integrity": "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -4846,9 +4857,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.10",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz",
-      "integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
+      "version": "8.5.14",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
+      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
       "funding": [
         {
           "type": "opencollective",
@@ -4923,9 +4934,9 @@
       }
     },
     "node_modules/qrcode.vue": {
-      "version": "3.8.1",
-      "resolved": "https://registry.npmjs.org/qrcode.vue/-/qrcode.vue-3.8.1.tgz",
-      "integrity": "sha512-kJORXcI5Uml5GtzcfFkchpljFgaXKQB/3ZUt+Hwnw7Y1F7FiA01U2yyO5Vscwv3bVxPkm/KLKXUOXsHbTsYrTw==",
+      "version": "3.9.1",
+      "resolved": "https://registry.npmjs.org/qrcode.vue/-/qrcode.vue-3.9.1.tgz",
+      "integrity": "sha512-CpHVRz5iveqwRFh+nzzSYV9hPWU6q+YSOKyq5ZievjQIBv4bIIDzajGgtNz/yYSlczjAkYM3GNAQJHwwCukMEQ==",
       "license": "MIT",
       "peerDependencies": {
         "vue": "^3.0.0"
@@ -5048,9 +5059,9 @@
       }
     },
     "node_modules/rollup": {
-      "version": "4.60.2",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.60.2.tgz",
-      "integrity": "sha512-J9qZyW++QK/09NyN/zeO0dG/1GdGfyp9lV8ajHnRVLfo/uFsbji5mHnDgn/qYdUHyCkM2N+8VyspgZclfAh0eQ==",
+      "version": "4.60.3",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.60.3.tgz",
+      "integrity": "sha512-pAQK9HalE84QSm4Po3EmWIZPd3FnjkShVkiMlz1iligWYkWQ7wHYd1PF/T7QZ5TVSD6uSTon5gBVMSM4JfBV+A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5064,34 +5075,41 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.60.2",
-        "@rollup/rollup-android-arm64": "4.60.2",
-        "@rollup/rollup-darwin-arm64": "4.60.2",
-        "@rollup/rollup-darwin-x64": "4.60.2",
-        "@rollup/rollup-freebsd-arm64": "4.60.2",
-        "@rollup/rollup-freebsd-x64": "4.60.2",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.60.2",
-        "@rollup/rollup-linux-arm-musleabihf": "4.60.2",
-        "@rollup/rollup-linux-arm64-gnu": "4.60.2",
-        "@rollup/rollup-linux-arm64-musl": "4.60.2",
-        "@rollup/rollup-linux-loong64-gnu": "4.60.2",
-        "@rollup/rollup-linux-loong64-musl": "4.60.2",
-        "@rollup/rollup-linux-ppc64-gnu": "4.60.2",
-        "@rollup/rollup-linux-ppc64-musl": "4.60.2",
-        "@rollup/rollup-linux-riscv64-gnu": "4.60.2",
-        "@rollup/rollup-linux-riscv64-musl": "4.60.2",
-        "@rollup/rollup-linux-s390x-gnu": "4.60.2",
-        "@rollup/rollup-linux-x64-gnu": "4.60.2",
-        "@rollup/rollup-linux-x64-musl": "4.60.2",
-        "@rollup/rollup-openbsd-x64": "4.60.2",
-        "@rollup/rollup-openharmony-arm64": "4.60.2",
-        "@rollup/rollup-win32-arm64-msvc": "4.60.2",
-        "@rollup/rollup-win32-ia32-msvc": "4.60.2",
-        "@rollup/rollup-win32-x64-gnu": "4.60.2",
-        "@rollup/rollup-win32-x64-msvc": "4.60.2",
+        "@rollup/rollup-android-arm-eabi": "4.60.3",
+        "@rollup/rollup-android-arm64": "4.60.3",
+        "@rollup/rollup-darwin-arm64": "4.60.3",
+        "@rollup/rollup-darwin-x64": "4.60.3",
+        "@rollup/rollup-freebsd-arm64": "4.60.3",
+        "@rollup/rollup-freebsd-x64": "4.60.3",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.60.3",
+        "@rollup/rollup-linux-arm-musleabihf": "4.60.3",
+        "@rollup/rollup-linux-arm64-gnu": "4.60.3",
+        "@rollup/rollup-linux-arm64-musl": "4.60.3",
+        "@rollup/rollup-linux-loong64-gnu": "4.60.3",
+        "@rollup/rollup-linux-loong64-musl": "4.60.3",
+        "@rollup/rollup-linux-ppc64-gnu": "4.60.3",
+        "@rollup/rollup-linux-ppc64-musl": "4.60.3",
+        "@rollup/rollup-linux-riscv64-gnu": "4.60.3",
+        "@rollup/rollup-linux-riscv64-musl": "4.60.3",
+        "@rollup/rollup-linux-s390x-gnu": "4.60.3",
+        "@rollup/rollup-linux-x64-gnu": "4.60.3",
+        "@rollup/rollup-linux-x64-musl": "4.60.3",
+        "@rollup/rollup-openbsd-x64": "4.60.3",
+        "@rollup/rollup-openharmony-arm64": "4.60.3",
+        "@rollup/rollup-win32-arm64-msvc": "4.60.3",
+        "@rollup/rollup-win32-ia32-msvc": "4.60.3",
+        "@rollup/rollup-win32-x64-gnu": "4.60.3",
+        "@rollup/rollup-win32-x64-msvc": "4.60.3",
         "fsevents": "~2.3.2"
       }
     },
+    "node_modules/rollup/node_modules/@types/estree": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/rrweb-cssom": {
       "version": "0.7.1",
       "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.7.1.tgz",
@@ -5150,9 +5168,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -5656,9 +5674,9 @@
       }
     },
     "node_modules/ufo": {
-      "version": "1.6.3",
-      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.3.tgz",
-      "integrity": "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q==",
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.4.tgz",
+      "integrity": "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==",
       "dev": true,
       "license": "MIT"
     },
@@ -6047,16 +6065,16 @@
       "license": "MIT"
     },
     "node_modules/vue": {
-      "version": "3.5.33",
-      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.33.tgz",
-      "integrity": "sha512-1AgChhx5w3ALgT4oK3acm2Es/7jyZhWSVUfs3rOBlGQC0rjEDkS7G4lWlJJGGNQD+BV3reCwbQrOe1mPNwKHBQ==",
+      "version": "3.5.34",
+      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.34.tgz",
+      "integrity": "sha512-WdLBG9gm02OgJIG9axd5Hpx0TFLdzVgfG2evFFu8Rur5O/IoGc5cMjnjh3tPL6GnRGsYvUhBSKVPYVcxRKpMCA==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-dom": "3.5.33",
-        "@vue/compiler-sfc": "3.5.33",
-        "@vue/runtime-dom": "3.5.33",
-        "@vue/server-renderer": "3.5.33",
-        "@vue/shared": "3.5.33"
+        "@vue/compiler-dom": "3.5.34",
+        "@vue/compiler-sfc": "3.5.34",
+        "@vue/runtime-dom": "3.5.34",
+        "@vue/server-renderer": "3.5.34",
+        "@vue/shared": "3.5.34"
       },
       "peerDependencies": {
         "typescript": "*"
@@ -6399,9 +6417,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
-      "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
+      "version": "8.20.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
+      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6447,9 +6465,9 @@
       "license": "MIT"
     },
     "node_modules/yaml": {
-      "version": "2.8.3",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
-      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
       "dev": true,
       "license": "ISC",
       "bin": {

frontend/playwright.config.ts

@@ -44,7 +44,8 @@ export default defineConfig({
         ...devices["Desktop Chrome"],
         theme: 'dark',
       },
-      testMatch: /.*screenshots.spec.ts/,
+      /* Include every spec under testDir (prompts.spec.ts, settings-screenshots, etc.) */
+      testMatch: /\.spec\.ts$/,
       retries: 0,
     },
     {
@@ -53,7 +54,7 @@ export default defineConfig({
         ...devices["Desktop Chrome"],
         theme: 'light',
       },
-      testMatch: /.*screenshots.spec.ts/,
+      testMatch: /\.spec\.ts$/,
       retries: 0,
     },
   ],

frontend/public/config.generated.yaml

@@ -17,7 +17,8 @@ server:
       output: "stdout"                    # output location. (eg. "stdout" or "path/to/file.log")
       noColors: false                     # disable colors in the output
       json: false                         # output in json format
-      utc: false                          # use UTC time in the output instead of local time
+      utc: false                          # use UTC time in the output instead of local time.
+      apiFilter: ""                       # regex filter that excludes matching full api paths from being logged. (eg. '/user\?id\=self') Defaults to '^/health|^/favicon.ico|^/static|^/public/static'
   database: "database.db"                 # path to the database file
   sources:                                #  validate:required,dive
     - path: "/relative/or/absolute/path"  # file system path. (Can be relative)  validate:required
@@ -25,6 +26,7 @@ server:
       config:
         denyByDefault: false              # deny access unless an "allow" access rule was specifically created.
         private: false                    # designate as source as private -- currently just means no sharing permitted.
+        readOnly: false                   # read-only source, changes from the UI, webdav, and API will be disabled.
         disabled: false                   # disable the source, this is useful so you don't need to remove it from the config file
         rules:                            # list of item rules to apply to specific paths
           - neverWatchPath: ""            # index the folder in the first pass to get included in search, but never re-indexed.
@@ -43,6 +45,7 @@ server:
             ignoreSymlinks: false         # Excludes symbolic links
         defaultUserScope: "/"             # defaults to root of index "/" should match folders under path
         defaultEnabled: true              # should be added as a default source for new users?
+        createUserDir: false              # create a user directory for each user under defaultUserScope + username
         useLogicalSize: false             # calculate sizes based on logical size instead of disk utilization (du -sh), folders will be 0 bytes when empty.
   externalUrl: ""                         # used by share links if set (eg. http://mydomain.com)
   internalUrl: ""                         # used by integrations if set, this is the base domain that an integration service will use to communicate with filebrowser (eg. http://localhost:8080)
@@ -115,8 +118,14 @@ auth:
       disableVerifyTLS: false             # disable TLS verification (insecure, for testing only)
       logoutRedirectUrl: ""               # if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
       header: ""                          # HTTP header to look for JWT token (e.g. X-JWT-Assertion). Default is "X-JWT-Assertion"
-      secret: ""                          # Shared secret key/bytes for verifying JWT token signatures (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
+      secret: ""                          # secret: Shared secret key/bytes for verifying JWT token signatures (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
       algorithm: ""                       # JWT signing algorithm (HS256, HS384, HS512, RS256, ES256). Default is "HS256"
+    passkey:                              #  validate:omitempty
+      enabled: false                      # whether to enable passkey MFA
+      rpDisplayName: ""                   # the Relying Party display name (defaults to frontend name)
+      rpId: ""                            # the Relying Party ID; if empty, auto-derived from base URL host
+      rpOrigins:                          # allowed origins; if empty, auto-derived from base URL
+      loginButtonText: ""                 # custom text for the passkey login button
   key: ""                                 # secret: the key used to sign the JWT tokens. If not set, a random key will be generated.
   adminUsername: "admin"                  # secret: the username of the admin user. If not set, the default is "admin".
   adminPassword: "admin"                  # secret: the password of the admin user. If not set, the default is "admin".
@@ -151,60 +160,70 @@ frontend:
   loginButtonText: ""                     # text to display on the login button
   oidcLoginButtonText: ""                 # text to display on the OIDC login button
 userDefaults:
-  editorQuickSave: false                  # show quick save button in editor
-  hideSidebarFileActions: false           # hide the file actions in the sidebar
-  disableQuickToggles: false              # disable the quick toggles in the sidebar
-  disableSearchOptions: false             # disable the search options in the search bar
-  stickySidebar: true                     # keep sidebar open when navigating
-  hideFilesInTree: false                  # hide files in the sidebar tree navigation, when true, will show only directories.
-  darkMode: true                          # should dark mode be enabled
-  locale: "en"                            # language to use: eg. de, en, or fr
-  viewMode: "normal"                      # view mode to use: eg. normal, list, grid, or compact
-  singleClick: false                      # open directory on single click, also enables middle click to open in new tab
-  showHidden: false                       # show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
-  dateFormat: false                       # when false, the date is relative, when true, the date is an exact timestamp
-  gallerySize: 3                          # 0-9 - the size of the gallery thumbnails
-  themeColor: "var(--blue)"               # theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
-  quickDownload: false                    # show icon to download in one click
-  disablePreviewExt: ""                   # space separated list of file extensions to disable preview for
-  disableViewingExt: ""                   # space separated list of file extensions to disable viewing for
-  lockPassword: false                     # disable the user from changing their password
-  disableSettings: false                  # disable the user from viewing the settings page
+  sidebar:                                # New organized structure
+    disableQuickToggles: false            # disable the quick toggles in the sidebar
+    hideFileActions: false                # hide the file actions in the sidebar
+    disableHideOnPreview: false           # keep sidebar open when previewing files (was preview.disableHideSidebar)
+    sticky: true                          # keep sidebar open when navigating
+    hideFiles: false                      # hide files in the sidebar tree navigation, when true, will show only directories
+    showTools: true                       # show sidebar links with category "tool"; default is true
+  listing:
+    deleteWithoutConfirming: false        # delete files without confirmation
+    dateFormat: false                     # when false, the date is relative, when true, the date is an exact timestamp
+    showHidden: false                     # show hidden files in the UI. On windows this includes files starting with a dot and windows hidden files
+    quickDownload: false                  # show icon to download in one click
+    showSelectMultiple: false             # show select multiple files on desktop
+    singleClick: false                    # open directory on single click, also enables middle click to open in new tab
+    hideFileExt: ""                       # space separated list of file extensions to hide in UI
+    showCopyPath: false                   # show copy path button in the context menu
+    deleteAfterArchive: true              # delete source files after successful creation/extraction of archives
+    viewMode: "normal"                    # view mode to use: eg. normal, list, grid, or compact
+    gallerySize: 3                        # 0-9 - the size of the gallery thumbnails
   preview:
-    disableHideSidebar: false             # keep sidebar open when previewing files
     image: true                           # show thumbnails for image files
     video: true                           # show thumbnails for video files
     audio: true                           # show thumbnails for audio files
     motionVideoPreview: true              # show multiple frames for videos in thumbnail preview when hovering
     office: true                          # show thumbnails for office files
     popup: true                           # show larger popup preview when hovering over thumbnail
-    autoplayMedia: true                   # autoplay media files in preview
-    defaultMediaPlayer: false             # disable the styled feature-rich media player for browser default
+    disablePreviewExt: ""                 # comma separated list of file extensions to disable preview for
+    highQuality: true                     # high quality preview thumbnails
     folder: true                          # show thumbnails for folders that have previewable contents
     models: true                          # show live thumbnails for 3D models files
-  permissions:
-    api: false                            # allow api access
-    admin: false                          # allow admin access
-    modify: false                         # allow modifying files
-    share: false                          # allow sharing files
-    realtime: false                       # allow realtime updates
-    delete: false                         # allow deleting files
-    create: false                         # allow creating or uploading files
-    download: true                        # allow downloading files
-  loginMethod: "password"                 # login method to use: eg. password, proxy, oidc
-  disableUpdateNotifications: false       # disable update notifications banner for admin users
-  deleteWithoutConfirming: false          # delete files without confirmation
-  deleteAfterArchive: true                # delete source files after successful creation/extraction of archives
-  fileLoading:                            # upload and download settings
+  fileViewer:
+    editorQuickSave: false                # show quick save button in editor
+    autoplayMedia: true                   # autoplay media files in preview
+    disableViewingExt: ""                 # comma separated list of file extensions to disable viewing for
+    disableOnlyOfficeExt: ".md .txt .pdf .html .xml" # list of file extensions to disable onlyoffice editor for
+    preferEditorForMarkdown: false        # prefer editor first for markdown files instead of the Markdown Viewer
+    debugOffice: false                    # debug onlyoffice editor
+    defaultMediaPlayer: false             # disable the styled feature-rich media player for browser default
+  search:
+    disableOptions: false                 # disable the search options in the search bar
+  ui:
+    darkMode: true                        # should dark mode be enabled
+    themeColor: "var(--blue)"             # theme color to use: eg. #ff0000, or var(--red), var(--purple), etc
+    customTheme: ""                       # Name of theme to use chosen from custom themes config
+    locale: "en"                          # language to use: eg. de, en, or fr
+  fileLoading:
     maxConcurrentUpload: 10
     uploadChunkSizeMb: 10
     clearAll: false
     downloadChunkSizeMb: 0
-  disableOnlyOfficeExt: ".md .txt .pdf .html .xml" # list of file extensions to disable onlyoffice editor for
-  customTheme: ""                         # Name of theme to use chosen from custom themes config.
-  showSelectMultiple: false               # show select multiple files on desktop
-  debugOffice: false                      # debug onlyoffice editor
-  preferEditorForMarkdown: false          # prefer editor first for markdown files instead of the Markdown Viewer.
+  account:
+    permissions:
+      api: false                          # allow api access
+      admin: false                        # allow admin access
+      modify: false                       # allow modifying files
+      share: false                        # allow sharing files
+      realtime: false                     # allow realtime updates
+      delete: false                       # allow deleting files
+      create: false                       # allow creating or uploading files
+      download: true                      # allow downloading files
+    lockPassword: false                   # disable the user from changing their password
+    disableSettings: false                # disable the user from viewing the settings page
+    loginMethod: "password"               # login method to use: eg. password, proxy, oidc
+    disableUpdateNotifications: false     # disable update notifications banner for admin users
 integrations:
   office:                                 #  validate:omitempty
     url: ""                               # The URL to the OnlyOffice Document Server, needs to be accessible to the user.  validate:required
@@ -239,3 +258,6 @@ integrations:
     debug: false                          # output ffmpeg stdout for media integration -- careful can produces lots of output!
     extractEmbeddedSubtitles: false       # extract embedded subtitles from media files
     exiftoolPath: ""                      # path to exiftool executable
+http:
+  trustedHeaders:                         # list of headers to trust, useful when behind a reverse proxy.
+  disableRateLimit: false                 # turns off built-in auth route rate limiting and failed-login lockout (default false).

frontend/src/api/auth.js

@@ -182,3 +182,149 @@ export function deleteApiKey(params) {
     throw err
   }
 }
+
+function arrayBufferToBase64(buffer) {
+  const bytes = new Uint8Array(buffer)
+  let binary = ''
+  bytes.forEach(b => binary += String.fromCharCode(b))
+  return btoa(binary).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
+}
+
+function base64ToArrayBuffer(base64url) {
+  // Convert URL-safe base64 to standard base64
+  let base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
+  while (base64.length % 4) base64 += '='
+  const binary = atob(base64)
+  const bytes = new Uint8Array(binary.length)
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i)
+  }
+  return bytes.buffer
+}
+
+function preprocessPublicKeyOptions(options) {
+  const opts = { ...options }
+  if (typeof opts.challenge === 'string') {
+    opts.challenge = base64ToArrayBuffer(opts.challenge)
+  }
+  if (opts.user && typeof opts.user.id === 'string') {
+    opts.user = { ...opts.user, id: base64ToArrayBuffer(opts.user.id) }
+  }
+  if (opts.allowCredentials && Array.isArray(opts.allowCredentials)) {
+    opts.allowCredentials = opts.allowCredentials.map(c => ({
+      ...c,
+      id: typeof c.id === 'string' ? base64ToArrayBuffer(c.id) : c.id,
+    }))
+  }
+  if (opts.excludeCredentials && Array.isArray(opts.excludeCredentials)) {
+    opts.excludeCredentials = opts.excludeCredentials.map(c => ({
+      ...c,
+      id: typeof c.id === 'string' ? base64ToArrayBuffer(c.id) : c.id,
+    }))
+  }
+  return opts
+}
+
+function formatCredentialResponse(cred) {
+  return {
+    id: cred.id,
+    rawId: arrayBufferToBase64(cred.rawId),
+    type: cred.type,
+    response: {
+      clientDataJSON: arrayBufferToBase64(cred.response.clientDataJSON),
+      authenticatorData: arrayBufferToBase64(cred.response.authenticatorData),
+      signature: arrayBufferToBase64(cred.response.signature),
+      userHandle: cred.response.userHandle ? arrayBufferToBase64(cred.response.userHandle) : null,
+    },
+  }
+}
+
+function formatAttestationResponse(cred) {
+  return {
+    id: cred.id,
+    rawId: arrayBufferToBase64(cred.rawId),
+    type: cred.type,
+    response: {
+      clientDataJSON: arrayBufferToBase64(cred.response.clientDataJSON),
+      attestationObject: arrayBufferToBase64(cred.response.attestationObject),
+      transports: cred.response.getTransports ? cred.response.getTransports() : [],
+    },
+  }
+}
+
+export async function beginPasskeyLogin(username, password) {
+  const apiPath = getApiPath('auth/webauthn/begin-login', { username })
+  const res = await fetch(apiPath, {
+    method: 'POST',
+    credentials: 'same-origin',
+    headers: {
+      'X-Password': encodeURIComponent(password),
+    },
+  })
+
+  const body = await res.json().catch(() => ({}))
+  if (res.status !== 200) {
+    const msg = body.message || 'Passkey login failed'
+    throw new Error(msg)
+  }
+
+  const credential = await navigator.credentials.get({ publicKey: preprocessPublicKeyOptions(body.publicKey) })
+  const formatted = formatCredentialResponse(credential)
+
+  const finishPath = getApiPath('auth/webauthn/finish-login', { session_id: body.sessionID })
+  const finishRes = await fetch(finishPath, {
+    method: 'POST',
+    credentials: 'same-origin',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(formatted),
+  })
+
+  if (finishRes.status !== 200) {
+    const errBody = await finishRes.json().catch(() => ({}))
+    throw new Error(errBody.message || 'Passkey login failed')
+  }
+}
+
+export async function beginPasskeyRegistration() {
+  const apiPath = getApiPath('auth/webauthn/begin-register')
+  const res = await fetch(apiPath, {
+    method: 'POST',
+    credentials: 'same-origin',
+  })
+
+  const body = await res.json().catch(() => ({}))
+  if (res.status !== 200) {
+    const msg = body.message || 'Failed to begin passkey registration'
+    throw new Error(msg)
+  }
+
+  const credential = await navigator.credentials.create({ publicKey: preprocessPublicKeyOptions(body.publicKey) })
+  const formatted = formatAttestationResponse(credential)
+
+  const name = prompt('Name for this passkey (e.g. "iPhone", "YubiKey"):') || 'Passkey'
+  const finishPath = getApiPath('auth/webauthn/finish-register', { session_id: body.sessionID, name })
+  const finishRes = await fetch(finishPath, {
+    method: 'POST',
+    credentials: 'same-origin',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(formatted),
+  })
+
+  if (finishRes.status !== 200) {
+    const errBody = await finishRes.json().catch(() => ({}))
+    throw new Error(errBody.message || 'Failed to register passkey')
+  }
+}
+
+export async function deletePasskeyCredential(credentialId) {
+  const apiPath = getApiPath(`auth/webauthn/${encodeURIComponent(credentialId)}`)
+  const res = await fetch(apiPath, {
+    method: 'DELETE',
+    credentials: 'same-origin',
+  })
+
+  if (res.status !== 200) {
+    const errBody = await res.json().catch(() => ({}))
+    throw new Error(errBody.message || 'Failed to delete passkey')
+  }
+}

frontend/src/api/media.js

@@ -21,6 +21,42 @@ export async function getSubtitleContent(source, path, subtitleName, embedded =
   }
 }
 
+// GET /api/media/lyrics
+export async function getLyrics(source, path) {
+    const apiPath = getApiPath('media/lyrics', {
+        source: source,
+        path: path,
+    });
+    const res = await fetchURL(apiPath);
+    const data = await res.json();
+    return data.lyrics || [];
+}
+
+// GET /public/api/media/lyrics
+export async function getLyricsPublic(path, hash, password = "") {
+    const params = {
+        path,
+        hash,
+        ...(state.shareInfo.token && { token: state.shareInfo.token }),
+    };
+    const apiPath = getPublicApiPath("media/lyrics", params);
+    const response = await fetch(apiPath, {
+        headers: { "X-SHARE-PASSWORD": password || "" },
+    });
+    if (!response.ok) {
+        const error = new Error(response.statusText);
+        let data = null;
+        data = await response.json();
+        if (data?.message) {
+            error.message = data.message;
+        }
+        error.status = response.status;
+        throw error;
+    }
+    const data = await response.json();
+    return data.lyrics || [];
+}
+
 // GET /api/media/metadata — directory or file with metadata; optional albumArt for embedded cover extraction.
 /** @param {boolean} albumArt when true, request embedded album art in audio metadata */
 /** @returns {Promise<object>} resource (adjustedData) */