updated url redirecting (#442)

.devcontainer/devcontainer.json

@@ -1,39 +0,0 @@
-{
-  "name": "filebrowser",
-  "image": "mcr.microsoft.com/devcontainers/go:1.25-bookworm",
-  
-
-  "features": {
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "20"
-    },
-    "ghcr.io/devcontainers/features/docker-in-docker:2": {}
-  },
-
-  "containerEnv": {
-    "CGO_ENABLED": "1",
-    "FILEBROWSER_DEVMODE": "true"
-  },
-
-  "forwardPorts": [80],
-  "portsAttributes": {
-    "80": {
-      "label": "filebrowser app",
-      "onAutoForward": "notify"
-    }
-  },
-
-  "postCreateCommand": "make setup",
-
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "golang.go",
-        "Vue.volar",
-        "dbaeumer.vscode-eslint",
-        "esbenp.prettier-vscode",
-        "ms-azuretools.vscode-docker"
-      ]
-    }
-  }
-}

.dockerignore

@@ -1,12 +1,4 @@
 backend/**.db
-**.crt
-**.key
-backend/tmp
-backend/dist
-backend/backend*
-backend/http/dist/**
 backend/vendor/**
-
 frontend/dist/**
-frontend/node_modules/**
-frontend/pkg/**
+frontend/node_modules/**

.github/workflows/main.yaml

@@ -30,3 +30,42 @@ jobs:
           context: .
           file: ./_docker/Dockerfile.playwright-general
           push: false
+  push_latest_to_registry:
+    needs: [ test_playwright ]
+    name: Push latest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Find latest beta tag
+        run: |
+          echo "LATEST_TAG=$(git describe --tags $(git rev-list --tags="*-beta*" --max-count=1))" >> $GITHUB_ENV
+          echo "latest tag is $LATEST_TAG"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: gtstef/filebrowser
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ env.LATEST_TAG }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          file: ./_docker/Dockerfile
+          push: true
+          tags: 'gtstef/filebrowser:latest'
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/pr.yaml

@@ -3,127 +3,37 @@ name: PR Request
 on:
   pull_request:
     branches:
-      - "main"
-      - "dev/v*.*.*"
-      - "beta/v*.*.*"
-      - "stable/v*.*.*"
-      - "staging/v*.*.*"
+      - "dev/v[0-9]+.[0-9]+.[0-9]+"
+      - "beta/v[0-9]+.[0-9]+.[0-9]+"
+      - "stable/v[0-9]+.[0-9]+.[0-9]+"
+
 jobs:
-  prime_docker_cache:
-    name: Prime docker cache
+  test_playwright:
+    name: Test Playwright - general
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Prime Cache
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: _docker/Dockerfile.primecache
-          push: false
-          load: false
-          cache-to: |
-            type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
-  build_frontend:
-    name: Build frontend
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+        uses: docker/setup-buildx-action@v3.0.0
       - uses: actions/setup-node@v4
-      - name: Build frontend
-        working-directory: frontend
+      - working-directory: frontend
         run: npm i && npm run build
-      - name: Upload frontend build artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist
-          path: backend/http/dist
-  build_backend:
-    name: Build backend
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version: 'stable'
-      - name: Build backend
-        working-directory: backend
+      - working-directory: backend
         run: go build -o filebrowser .
-      - name: Upload backend build artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: filebrowser
-          path: backend/filebrowser
-  test_playwright:
-    needs: [build_backend, build_frontend, prime_docker_cache]
-    name: Test Playwright - ${{ matrix.name }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: general
-            dockerfile: ./_docker/Dockerfile.playwright-general
-          - name: proxy
-            dockerfile: ./_docker/Dockerfile.playwright-proxy
-          - name: noauth
-            dockerfile: ./_docker/Dockerfile.playwright-noauth
-          - name: oidc
-            dockerfile: ./_docker/Dockerfile.playwright-oidc
-          - name: sharing
-            dockerfile: ./_docker/Dockerfile.playwright-sharing
-          - name: no-config
-            dockerfile: ./_docker/Dockerfile.playwright-no-config
-          - name: settings
-            dockerfile: ./_docker/Dockerfile.playwright-settings
-          - name: screenshots
-            dockerfile: ./_docker/Dockerfile.playwright-screenshots
-          - name: previews
-            dockerfile: ./_docker/Dockerfile.playwright-previews
-          - name: jwt
-            dockerfile: ./_docker/Dockerfile.playwright-jwt
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Download frontend build
-        uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: frontend/dist
-      - name: Download backend build
-        uses: actions/download-artifact@v4
-        with:
-          name: filebrowser
-          path: backend/
-      - name: Make backend executable
-        run: chmod +x backend/filebrowser
-      - name: Copy frontend build to backend
-        run: |
-          mkdir -p backend/http/embed
-          cp -r frontend/dist/* backend/http/embed
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Build and Test
-        id: build
+      - name: Build
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ${{ matrix.dockerfile }}
+          file: ./_docker/Dockerfile.playwright-general
           push: false
-          load: true
-          cache-from: |
-            type=gha,scope=${{ github.ref_name }}-playwright-base
-            type=gha,scope=main-playwright-base
-          cache-to: |
-            type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
-  push_pr_to_registry:
-    name: Build docker image
+  test_playwright_proxy:
+    name: Test Playwright - proxy
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -132,19 +42,72 @@ jobs:
         uses: docker/setup-qemu-action@v3.0.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-proxy
+          push: false
+  test_playwright_noauth:
+    name: Test Playwright - noauth
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-noauth
+          push: false
+  push_pr_to_registry:
+    name: Push PR
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
         uses: docker/metadata-action@v5
+        with:
+          images: gtstef/filebrowser
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./_docker/Dockerfile.slim
+          file: ./_docker/Dockerfile
           push: false # Do not push the image for now
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             VERSION=${{ steps.meta.outputs.version }}
-            REVISION=${{ steps.meta.outputs.revision }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+            REVISION=${{ steps.meta.outputs.revision }}

.github/workflows/promote-beta-to-stable.yaml

@@ -86,3 +86,25 @@ jobs:
           git push origin "$STABLE_BRANCH"
 
           echo "✅ Successfully merged '$BETA_BRANCH' into '$STABLE_BRANCH'."
+
+      - name: Delete beta branch after successful merge
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          BETA_BRANCH="beta/v$VERSION"
+
+          # Delete beta branch locally and remotely
+          git branch -d "$BETA_BRANCH"
+          git push origin --delete "$BETA_BRANCH"
+
+          echo "✅ Successfully deleted '$BETA_BRANCH'."
+
+      - name: Create Pull Request to Main
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.PAT }}
+          commit-message: "Promote stable/v${{ github.event.inputs.version }} to main"
+          title: "Promote stable/v${{ github.event.inputs.version }} to main"
+          body: "This PR promotes stable/v${{ github.event.inputs.version }} to the main branch."
+          base: main
+          branch: stable/v${{ github.event.inputs.version }}
+          delete-branch: false

.github/workflows/promote-dev-to-beta.yaml

@@ -86,3 +86,14 @@ jobs:
           git push origin "$BETA_BRANCH"
 
           echo "✅ Successfully merged '$DEV_BRANCH' into '$BETA_BRANCH'."
+
+      - name: Delete dev branch after successful merge
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          DEV_BRANCH="dev/v$VERSION"
+
+          # Delete dev branch locally and remotely
+          git branch -d "$DEV_BRANCH"
+          git push origin --delete "$DEV_BRANCH"
+
+          echo "✅ Successfully deleted '$DEV_BRANCH'."

.github/workflows/regular-tests.yaml

@@ -1,7 +1,7 @@
 name: regular tests
 
 on:
-  pull_request:
+  push:
     branches:
       - "**"
 
@@ -14,19 +14,18 @@ jobs:
         with:
           go-version: 'stable'
       - working-directory: backend
-        run: go test -race -v ./... -timeout 30s
+        run: go test -race -v ./...
   lint-backend:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: 'stable'
-      - uses: golangci/golangci-lint-action@v7
+            go-version: 'stable'
+      - uses: golangci/golangci-lint-action@v5
         with:
-          version: 'v2.1.6'
+          version: 'v1.64'
           working-directory: backend
-          install-mode: goinstall
   format-backend:
     runs-on: ubuntu-latest
     steps:
@@ -50,19 +49,3 @@ jobs:
       - uses: actions/setup-node@v4
       - working-directory: frontend
         run: npm i && npm run test
-  check-translations:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run i18n:check
-  check-docs:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: 'stable'
-      - run: make generate-docs
-      - run: git diff --exit-code

.github/workflows/release_beta.yaml

@@ -59,8 +59,8 @@ jobs:
           target_commitish: ${{ github.sha }}
           token: ${{ secrets.PAT }}
           tag_name: ${{ steps.extract_branch.outputs.tag_name }}
-          prerelease: true
-          make_latest: false
+          prerelease: false # change this to false when stable gets released
+          make_latest: true # change this to false when stable gets released
           draft: false
           generate_release_notes: true
-          name: ${{ steps.extract_branch.outputs.tag_name }}
+          name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/release_dev.yaml

@@ -0,0 +1,52 @@
+name: dev release
+
+on:
+  push:
+    branches:
+      - "dev/v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  push_release_to_registry:
+    name: Push release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: gtstef/filebrowser
+      - name: modify version names
+        id: modify-json
+        run: |
+          JSON="${{ steps.meta.outputs.tags }}"
+          # Use jq to remove 'v' from the version field
+          JSON=$(echo "$JSON" | sed 's/filebrowser:dev-v/filebrowser:/')
+          JSON=$(echo "$JSON" | sed -E 's/(filebrowser:[0-9]+\.[0-9]+\.[0-9]+)/\1-dev/g')
+          JSON="$JSON,gtstef/filebrowser:dev"
+          echo "cleaned_tag=$JSON" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64
+          file: ./_docker/Dockerfile
+          push: true
+          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release_stable.yaml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   test_playwright:
-    name: Test Playwright - regular
+    name: Test Playwright
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -60,7 +60,6 @@ jobs:
           token: ${{ secrets.PAT }}
           tag_name: ${{ steps.extract_branch.outputs.tag_name }}
           prerelease: false
-          make_latest: true
           draft: false
           generate_release_notes: true
           name: ${{ steps.extract_branch.outputs.tag_name }}

.github/workflows/tag.yaml

@@ -20,9 +20,8 @@ jobs:
       - name: Install dependencies and build frontend
         run: npm i && npm run build
         working-directory: frontend
-      - name: Install OS Requirements
-        run: sudo apt update && sudo apt install -y upx build-essential musl-tools
-      - uses: goto-bus-stop/setup-zig@v2
+      - name: Install UPX
+        run: sudo apt-get install -y upx
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
@@ -46,64 +45,26 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{ secrets.PAT }}
-      - name: Extract metadata (tags, labels) for Docker and GHCR
+      - name: Extract metadata (tags, labels) for Docker
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: |
-            gtstef/filebrowser
-            ghcr.io/gtsteffaniak/filebrowser
-      - name: Modify tags (strip 'v' and add version tags)
+          images: gtstef/filebrowser
+      - name: Modify tags (strip 'v' and add 'beta'/'stable' if needed)
         id: modify-json
         run: |
-          JSON='${{ steps.meta.outputs.json }}'
+          JSON='${{ steps.meta.outputs.json }}'  # Assuming the JSON output is stored in steps.meta.outputs.json
+          # Process the JSON array using jq
           MODIFIED_JSON=$(echo "$JSON" | jq '
-            .tags |= map(
-              sub(":v"; ":")      # Strip the 'v'
-              | select(test(":latest") | not)
-            ) |
-            # Find all version tags with suffix (X.Y.Z-suffix) and add major.minor and major tags
-            .tags += [
-              .tags[] 
-              | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
-              | split(":")
-              | .[-1] as $version
-              | ($version | split("-")) as $version_split
-              | ($version_split[0] | split(".")) as $version_parts
-              | ($version_split[1:] | join("-")) as $suffix
-              | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
-              | ($version_parts[0]) as $major
-              | "gtstef/filebrowser:\($major_minor)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
-                "gtstef/filebrowser:\($major)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
-            ] |
-            # Add suffix-only tags for beta (only if tag ends with -beta)
-            if any(.tags[]; split(":")[-1] | endswith("-beta")) then
-              .tags += [
-                "gtstef/filebrowser:beta",
-                "ghcr.io/gtsteffaniak/filebrowser:beta"
-              ]
-            else . end |
-            # Add suffix-only tags for stable (and latest) (only if tag ends with -stable)
-            if any(.tags[]; split(":")[-1] | endswith("-stable")) then
-              .tags += [
-                "gtstef/filebrowser:stable",
-                "ghcr.io/gtsteffaniak/filebrowser:stable",
-                "gtstef/filebrowser:latest",
-                "ghcr.io/gtsteffaniak/filebrowser:latest"
-              ]
-            else . end
+            .tags |= map(sub(":v"; ":")) | 
+            if any(.tags[]; test("beta")) then .tags += ["gtstef/filebrowser:beta"] else . end |
+            if any(.tags[]; test("stable")) then .tags += ["gtstef/filebrowser:stable"] else . end
           ')
+          # Convert JSON to a comma-separated string for Docker tags
           TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
-          echo "$TAGS_CSV" > modified_tags.txt  # Optional debug output
+          echo "$TAGS_CSV" > modified_tags.txt  # Save for debugging
           echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
+
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
@@ -111,91 +72,8 @@ jobs:
           build-args: |
             VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
             REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
           file: ./_docker/Dockerfile
           push: true
           tags: ${{ steps.modify-json.outputs.cleaned_tag }}
           labels: ${{ steps.meta.outputs.labels }}
-  push_slim_release_to_registry:
-    name: Push slim release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{ secrets.PAT }}
-      - name: Extract metadata (tags, labels) for Docker and GHCR
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            gtstef/filebrowser
-            ghcr.io/gtsteffaniak/filebrowser
-      - name: Modify tags (strip 'v' and add 'slim' if needed)
-        id: modify-json-slim
-        run: |
-          JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq '
-            .tags |= map(
-              sub(":v"; ":")                 # Strip the 'v'
-              | select(test(":latest") | not) # Remove the "latest" tag
-              | . + "-slim"                   # Append "-slim" to the versioned tag
-            ) |
-            # Find all version tags with suffix (X.Y.Z-suffix-slim) and add major.minor and major tags
-            .tags += [
-              .tags[] 
-              | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
-              | split(":")
-              | .[-1] as $version
-              | ($version | split("-")) as $version_split
-              | ($version_split[0] | split(".")) as $version_parts
-              | ($version_split[1:] | join("-")) as $suffix
-              | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
-              | ($version_parts[0]) as $major
-              | "gtstef/filebrowser:\($major_minor)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
-                "gtstef/filebrowser:\($major)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
-            ] |
-            # Add suffix-only tags for beta-slim (only if tag ends with -beta-slim)
-            if any(.tags[]; split(":")[-1] | endswith("-beta-slim")) then
-              .tags += [
-                "gtstef/filebrowser:beta-slim",
-                "ghcr.io/gtsteffaniak/filebrowser:beta-slim"
-              ]
-            else . end |
-            # Add suffix-only tags for stable-slim (only if tag ends with -stable-slim)
-            if any(.tags[]; split(":")[-1] | endswith("-stable-slim")) then
-              .tags += [
-                "gtstef/filebrowser:stable-slim",
-                "ghcr.io/gtsteffaniak/filebrowser:stable-slim"
-              ]
-            else . end
-          ')
-          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
-          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
-      - name: Build and push slim image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          build-args: |
-            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./_docker/Dockerfile.slim
-          push: true
-          tags: ${{ steps.modify-json-slim.outputs.cleaned_tag }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/update-build-images.yaml

@@ -1,41 +0,0 @@
-
-name: Update Build Images
-
-on:
-  workflow_dispatch:
-
-jobs:
-  publish_playwright_base:
-    name: Publish playwright-base to GHCR
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/gtsteffaniak/playwright-base
-          tags: chromium
-      - name: Build and push playwright-base
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          file: _docker/Dockerfile.playwright-base
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=playwright-base
-          cache-to: type=gha,mode=max,scope=playwright-base

.gitignore

@@ -1,6 +1,4 @@
 *.db
-*.db.old
-*.sqlite
 *.bak
 *.log
 *.mjs
@@ -10,28 +8,18 @@ rice-box.go
 /backend/backend
 /backend/filebrowser
 /backend/filebrowser.exe
-frontend/tsconfig.tsbuildinfo
 /backend/backend.exe
-/backend/playwright-files.db
-/backend/tmp
-/backend/dist
 /frontend/dist
 /frontend/pkg
 /frontend/test-results
-/frontend/playwright-files
-/frontend/screenshots
-/frontend/generated
-/frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
-/frontend/sharePrepStorage.json
+/frontend/package-lock.json
 /backend/vendor
 /backend/*.cov
-/backend/*test_config.yaml
-/backend/generated.yaml
+/backend/test_config.yaml
 /backend/srv
 /backend/http/dist
-/backend/http/embed
-/backend/debug
+/backend/http/embed/*
 
 .DS_Store
 node_modules
@@ -55,9 +43,3 @@ yarn-error.log*
 *.sw*
 bin/
 build/
-*__debug*
-backend/custom.css
-
-# Runtime cache directories created by tests/application
-backend/preview/heic/
-backend/preview/thumbnails/

CONTRIBUTING.md

@@ -1,151 +0,0 @@
-# Contributing to FileBrowser Quantum
-
-Thank you for your interest in contributing to FileBrowser Quantum! This guide will help you get started with development.
-
-## Prerequisites
-
-- **Go 1.25+** (see `backend/go.mod`)
-- **Node.js 22.0.0+** with npm 9.0.0+ (see `frontend/package.json`)
-- **Docker** (optional, for containerized development)
-- **Git** especially improtant on windows -- needed for bash support.
-
-### Optional Tools
-
-- **ffmpeg/ffprobe**: For media features (subtitles, thumbnails, heic)
-  - Ubuntu/Debian: `sudo apt-get install ffmpeg`
-  - macOS: `brew install ffmpeg`
-  - Windows: Download from [ffmpeg.org](https://ffmpeg.org/download.html)
-
-- **exiftool**: For photo metadata processing (RAW/HEIC previews, EXIF orientation)
-  - Ubuntu/Debian: `sudo apt-get install libimage-exiftool-perl`
-  - macOS: `brew install exiftool`
-  - Windows: Download from [exiftool.org](https://exiftool.org/) (install `exiftool.exe` and add it to your PATH, or set `integrations.media.exiftoolPath` in config)
-
-- **mupdf-tools**: For PDF preview generation
-  - Ubuntu/Debian: `sudo apt-get install mupdf-tools`
-  - macOS: `brew install mupdf-tools`
-  - Windows: Download from [mupdf.com](https://mupdf.com/downloads/)
-
-## Quick Start
-
-```bash
-# 1. Clone the repository
-git clone https://github.com/gtsteffaniak/filebrowser.git
-cd filebrowser
-
-# 2. Initial setup - installs dependencies and creates test config
-make setup
-
-# 3. Run in development mode with hot-reloading
-make dev
-```
-
-`make setup` installs all dependencies and creates a test configuration file.
-`make run` starts the development server. Note: changes require ctrl+c and re-run.
-
-## Project Architecture
-
-### Backend (Go)
-- **Entry Point**: `backend/main.go` → `backend/cmd/`
-- **HTTP Server**: `backend/http/` - API routes, middleware, auth
-- **Storage**: BoltDB via `backend/database/storage/`
-- **Authentication**: Multiple providers in `backend/auth/`
-- **Indexing**: Real-time search in `backend/indexing/`
-- **Previews**: Image/video/document generation in `backend/preview/`
-
-### Frontend (Vue.js + TypeScript)
-- **Framework**: Vue 3 + Vite + TypeScript
-- **State**: Custom store in `frontend/src/store/`
-- **API Client**: Axios-based in `frontend/src/api/`
-- **i18n**: 25+ languages with English as main
-- **Components**: Feature-based organization
-
-## Development Commands
-
-### Essential Commands
-```bash
-make dev          # Start development server with hot-reloading
-make test         # Run all tests
-make lint         # Check code quality
-make check-all    # Lint + tests
-
-make build-frontend  # Build frontend only
-make build-backend   # Build backend only
-make build          # Build Docker image
-```
-
-### Frontend Development
-
-Note: consider using make commands above instead.
-```bash
-cd frontend
-npm run lint:fix  # Auto-fix linting issues
-npm run i18n:sync # Sync translations changes
-```
-
-## Testing
-
-### Running Tests
-```bash
-make test              # All tests
-make test-backend      # Go tests with race detection
-make test-frontend     # Frontend unit tests
-make test-playwright   # E2E tests in Docker
-```
-
-E2E tests run with three authentication modes: standard auth, no auth, and proxy auth.
-
-## Code Standards
-
-### Backend (Go)
-- **Linting**: `backend/.golangci.yml` with 30+ checks
-- **Format**: Use `gofmt` (automated in CI)
-- **Testing**: Maintain 80%+ coverage
-- **Errors**: Handle all errors explicitly
-
-### Frontend (Vue.js)
-- **Linting**: ESLint with Vue 3 + TypeScript rules
-- **i18n**: English is master locale, all text must use `$t('key')`
-- **Types**: Use TypeScript everywhere
-- **Fix**: Run `npm run lint:fix` before committing
-
-## Build & Deployment
-
-### Single Binary Build
-The project builds into a single binary with embedded frontend:
-
-```bash
-make build-frontend  # Build Vue.js app
-make build-backend   # Build Go binary with embedded assets
-```
-
-### Docker
-```bash
-make build       # Full image with ffmpeg and muPDF
-```
-
-### Configuration
-- **Test Config**: `backend/test_config.yaml` Auto-generated after running `make setup`
-
-## Contributing
-
-### Pull Request Process
-
-1. Fork and create a feature branch
-2. Make your changes following the code standards
-3. Run `make dev` to build and run with your changes. Supports hot-reloading frontend and backend changes.
-4. When ready, run `make check-all` to verify tests and linting
-5. Submit PR with a clear description
-
-### PR Requirements
-- Clear description of changes
-- All tests must pass
-- Follow existing code patterns
-- Update documentation if needed
-
-### Commit Format
-```
-type(scope): description
-
-Types: feat, fix, docs, refactor, test, chore
-```

LICENSE

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2018 File Browser contributors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

README.md

@@ -1,136 +1,152 @@
 <div align="center">
 
   [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
-  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/0b548794f2ac4871a0cf7aa9ecab049f)](https://app.codacy.com/gh/gtsteffaniak/filebrowser/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
-  [![latest version](https://img.shields.io/github/v/release/gtsteffaniak/filebrowser)](https://github.com/gtsteffaniak/filebrowser/releases)
+  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/1c48cfb7646d4009aa8c6f71287670b8)](https://www.codacy.com/gh/gtsteffaniak/filebrowser/dashboard)
+  [![latest version](https://img.shields.io/github/release/gtsteffaniak/filebrowser/all.svg)](https://github.com/gtsteffaniak/filebrowser/releases)
   [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
   [![Apache-2.0 License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
 
-  [![Donate](https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif)](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A#is-there-a-way-to-donate-or-support-this-project)
+  [![Poll](https://img.shields.io/badge/poll-vote_most_important_features-purple)](https://github.com/gtsteffaniak/filebrowser/discussions/368)
+  [![Donate with PayPal](https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif)](https://www.paypal.com/donate/?business=W5XKNXHJM2WPE&no_recurring=0&currency_code=USD)
 
-  <img width="150" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" title="Logo">
+  <img width="150" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" title="Logo">
   <h3>FileBrowser Quantum</h3>
-  The best free self-hosted web-based file manager.
+  A modern web-based file manager
   <br/><br/>
-  <img width="800" src="https://github.com/user-attachments/assets/162d7a95-33b7-49bd-976c-dd6822c0d22b">
+  <img width="800" src="https://github.com/user-attachments/assets/c35a8455-c32d-47f5-853d-f285e160b022" title="Main Screenshot">
 </div>
 
-## Pinned
+> [!WARNING]
+> There is no stable version -- planned 2025.
 
-:pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)
+FileBrowser Quantum is a fork of the file browser open-source project with the following changes:
+
+  1. ✅ Indexes files (See [indexing Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing) for more info.)
+     - Real-time search results as you type
+     - Search supports file/folder sizes and many file type filters.
+     - Enhanced interactive results that show file/folder sizes.
+  2. ✅ Multiple sources support
+  3. ✅ Revamped UI
+     - Additional compact view mode as well as refreshed view mode styles.
+     - Many graphical and user experience improvements.
+     - right-click context menu
+  4. ✅ Revamped and simplified configuration via `config.yaml` config file.
+  5. ✅ Better listing browsing
+     - Instantly Switches view modes and sort order without reloading data.
+     - Folder sizes are displayed
+     - Navigating remembers the scroll position, navigating back keeps the last scroll position.
+  6. ✅ Developer API support
+     - Ability to create long-live API Tokens.
+     - Helpful Swagger page available at `/swagger` endpoint.
+
+Notable features that this fork *does not* have (removed):
+
+ - ❌ jobs are not supported yet (planned).
+ - ❌ rules are not supported yet (planned).
+ - ❌ shell commands are completely removed and will not be returned.
 
 ## About
 
-FileBrowser Quantum provides an easy way to access and manage your files from the web. It has a modern responsive interface that has many advanced features to manage users, access, sharing, and file preview and editing.
+FileBrowser Quantum differs significantly from the original.
+There are hundreds of thousands of lines changed and they are generally
+no longer compatible with each other. This has been intentional -- the
+focus of this fork is on a few key principles:
+  - Simplicity and improved user experience
+  - Improving performance and faster feedback when making changes.
+  - Minimize external dependencies and standard library usage.
+  - Of course -- adding much-needed features.
 
-This version is called "Quantum" because it packs tons of advanced features into a tiny and easy-to-run file. Unlike the majority of alternative options, FileBrowser Quantum is simple to install and easy to configure.
+For more, see the [Q&A Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A)
 
-The goal for this repo is to become the best open-source self-hosted file browsing application that exists -- **all for free**. This repo will always be free and open-source.
+## Look
 
-Ready to try it out? See [Getting Started Docs](https://filebrowserquantum.com/en/docs/getting-started/).
+The UI has a simple three-component navigation system :
 
-## How its different
-
-FileBrowser Quantum is a massive fork of the file browser open-source project with the following changes:
-
-  1. ✅ Better source configuration - multiple sources, include/exclude rules, and [more](https://filebrowserquantum.com/en/docs/configuration/sources/)
-  2. ✅ Login support for OIDC, LDAP, JWT, password + 2FA, and proxy.
-  3. ✅ Beautiful, Responsive, and Customizable user interface.
-  4. ✅ Streamlined configuration via `config.yaml` config file.
-  5. ✅ Ultra-efficient Sqlite [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing)
-     - Real-time search results as you type.
-     - Real-time monitoring and updates in the UI.
-     - Search supports file and folder sizes, along with various filters.
-  6. ✅ Better listing browsing
-     - Better thumbnail support including **office**, **video**, and **album artwork**, and **3D models**.
-     - Faster and more responsive views with animations.
-     - Folder sizes are displayed and support thumbnails
-     - Navigating remembers the last scroll position.
-  7. ✅ Highly configurable and [customizable sharing options](https://filebrowserquantum.com/en/docs/shares/options/)
-     - share expiration time
-     - users who can access share (including anonymous)
-     - styling and themes
-     - file viewing, editing, and uploading permissions
-  8. ✅ Directory-level access control that can be scoped to user or group.
-  9. ✅ Developer API support
-     - Ability to create long-lived API Tokens.
-     - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.
-
-Notable features that this fork *does not* have (removed):
- - ❌ shell commands are completely removed and will not be returned.
-
-FileBrowser Quantum differs significantly from the original version. Many of these changes required a significant overhaul. Creating a fork was a necessary process to make the program better. There have been many growing pains, but a stable release is planned and coming soon.
-
-## The UI
-
-The UI has a simple three-component navigation system:
-
-  1. (Left) Multi-action button with slide-out panel.
+  1. (Left) The slide-out action panel button
   2. (Middle) The powerful search bar.
   3. (Right) The view change toggle.
 
-All other functions are moved either into the action menu or pop-up menus.
+All other functions are moved either into the action menu or popup menus.
 If the action does not depend on context, it will exist in the slide-out
 action panel. If the action is available based on context, it will show up as
-a pop-up menu.
+a popup menu.
 
 <p align="center">
   <img width="1000" src="https://github.com/user-attachments/assets/aa32b05c-f917-47bb-b07f-857edc5e47f7" title="Search GIF">
 </p>
 
-## Official Docs
+## Install and Configuration
 
-See the [Official Docs](https://filebrowserquantum.com/). Contributions are welcome and encouraged! See [FilebrowserDocs Github](https://github.com/quantumx-apps/filebrowserDocs).
+See the [Configuration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration)
+
+## Command Line Usage
+
+See the [CLI Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/CLI)
+
+## API Usage
+
+See the [API Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/API)
+
+## Configuration
+
+Configuration is done via the `config.yaml`, see the [Configuration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Configuration) for available configuration options and other help.
+
+## Office File Support
+
+See [Office Support Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Office-Support#adding-open-office-integration-for-docker) on how to enable office file editing and office related features.
+
+## Migration from the original filebrowser
+
+See the [Migration Wiki](https://github.com/gtsteffaniak/filebrowser/wiki/Migration)
 
 ## Comparison Chart
-Application Name | <img width="48" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
+
+ Application Name | <img width="48" src="https://github.com/user-attachments/assets/59986a2a-f960-4536-aa35-4a9a7c98ad48" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
 --- | --- | --- | --- | --- | --- | --- |
-Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
 Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Windows                       | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+Windows                       | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
+Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
 Self hostable                 | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
-Has Stable Release?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
-webdav support                | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+Has Stable Release?           | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ |
+S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
+webdav support                | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
 FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Dedicated docs site?          | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
+Dedicated docs site?          | ❌ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Docker image size             | 180 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
-Min. Memory Requirements      | 512 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
-has standalone binary         | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
+Docker image size             | 31 MB  | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
+Min. Memory Requirements      | 128 MB | 128 MB | 128 MB (main image) | 128 MB | ❌ | 4 GB   |
+has standalone binary         | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
 price                         | free | free | free | free tier | free tier | $99+ |
 rich media preview            | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Advanced Search?              | ✅ | ❌ | ✅ | configurable | ✅ | ✅ |
-Indexed Search?               | ✅ | ❌ | ✅ | configurable | ✅ | ✅ |
-Content-aware search?         | ❌ | ❌ | ✅ | configurable | ✅ | ✅ |
-Custom job support            | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
+upload files from the web?    | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Advanced Search?              | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
+Indexed Search?               | ✅ | ❌ | ❌ | configurable | ✅ | ✅ |
+Content-aware search?         | ❌ | ❌ | ❌ | configurable | ✅ | ✅ |
+Custom job support            | ❌ | ✅ | ❌ | ✅ | ❌ | ✅ |
 Multiple users                | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Single sign-on support        | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-LDAP sign-on support          | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+Single sign-on support        | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+LDAP sign-on support          | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+2FA sign-on support           | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
 Long-live API key support     | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 API documentation page        | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Mobile App                    | ❌ | ❌ | ✅ | ✅ | ✅ | ❌ |
-open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
-tags support                  | :construction: | ❌ | ✅ | ✅ | ❌ | ✅ |
-shareable web links?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Event-based notifications     | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Metrics                       | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
-file space quotas             | :construction: | ❌ | ✅ | ❌ | ✅ | ✅ |
+Mobile App                    | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ |
+open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
+tags support                  | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ |
+sharable web links?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
+Event-based notifications     | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Metrics                       | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
+file space quotas             | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
 text-based files editor       | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
-Themes                        | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-Branding support              | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-activity log                  | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
-Comments support              | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ |
-trash support                 | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
-Starred/pinned files          | ❌ | ❌ | ✅ | ❌ | ✅ | ✅ |
+office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+Office file previews          | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Themes                        | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
+Branding support              | ✅ | ✅ | ❌ | ❌ | ❌ | ✅ |
+activity log                  | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Comments support              | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+trash support                 | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ |
+Starred/pinned files          | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
 Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
-Share collections of files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can archive selected files    | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ |
-Can browse archive files      | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Can convert documents         | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Can convert videos            | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
-Can convert photos            | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
+Share collections of files    | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can archive selected files    | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |
+Can browse archive files      | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ |

_docker/Dockerfile

@@ -1,49 +1,32 @@
-FROM gtstef/ffmpeg:8.1.2-decode AS ffmpeg
-FROM golang:alpine AS base
+FROM golang:1.24-alpine AS base
 ARG VERSION
 ARG REVISION
 WORKDIR /app
 COPY ./backend ./
-RUN apk update && apk add --no-cache gcc musl-dev
-ENV CGO_ENABLED=1
-RUN go build -tags mupdf,musl -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
+#RUN swag init --output swagger/docs
+RUN ln -s swagger /usr/local/go/src/
+RUN go build -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/version.CommitSHA=${REVISION}'" \
   -o filebrowser .
 
-FROM node:jod-slim AS nbuild
+FROM node:slim AS nbuild
 WORKDIR /app
 COPY ./frontend/package.json ./
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
-    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
-    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
 RUN npm i --maxsockets 1
 COPY  ./frontend/ ./
-RUN npm run build:docker
+RUN npm run build-docker
 
 FROM alpine:latest
-COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
-ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
-ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
-ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
-ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata curl exiftool
+ENV FILEBROWSER_NO_EMBEDED="true"
+RUN apk --no-cache add ca-certificates mailcap
+WORKDIR /home/filebrowser
 RUN adduser -D -s /bin/true -u 1000 filebrowser
 USER filebrowser
-WORKDIR /home/filebrowser
-# copy config to two locations for compatibility
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
-## sanity checks
-RUN [ "filebrowser", "version" ]
-RUN [ "ffmpeg", "-version" ]
-RUN [ "ffprobe", "-version" ]
-RUN [ "exiftool", "-ver" ]
+COPY --from=base --chown=filebrowser:1000 /app/filebrowser* ./
+COPY --from=base --chown=filebrowser:1000 /app/config.yaml ./
+COPY --from=nbuild --chown=filebrowser:1000 /app/dist/ ./http/dist/
+USER root
 # exposing default port for auto discovery.
 EXPOSE 80
-HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-  CMD curl -f http://localhost:80/health || exit 1
 ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-base

@@ -1,5 +1,4 @@
 FROM node:22-slim
 WORKDIR /app/frontend
-
-RUN npm i @playwright/test oauth2-mock-server @types/node
-RUN npx playwright install --with-deps chromium
+RUN npm i @playwright/test
+RUN npx playwright install --with-deps firefox

_docker/Dockerfile.playwright-general

@@ -1,23 +1,8 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
+FROM gtstef/playwright-base
 WORKDIR /app
-
-# Copy setup scripts first to leverage caching
 COPY [ "./_docker/src/general/", "./" ]
-
 WORKDIR /app/frontend
-COPY [ "./_docker/src/general/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
+COPY [ "./frontend/", "./" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# generate duplicate 1.1MB files
-RUN dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1MB.bin bs=1024 count=1126 && dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1mb.bin bs=1024 count=1126
-
-# Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser set -u testuser1,testuser1
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-jwt

@@ -1,14 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-COPY [ "./_docker/src/jwt/", "./" ]
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-RUN apt update && apt install nginx -y
-RUN mv default.conf /etc/nginx/conf.d/default.conf
-RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-local

@@ -1,14 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-WORKDIR /app/frontend
-COPY [ "./frontend/", "./" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./_docker/src/screenshots/backend/*", "./"]
-
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-no-config

@@ -1,18 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/no-config/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/no-config/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-noauth

@@ -1,18 +1,8 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
+FROM gtstef/playwright-base
 WORKDIR /app
-
-# Copy setup scripts first to leverage caching
 COPY [ "./_docker/src/noauth/", "./" ]
-
 WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-COPY [ "./frontend/tests/playwright-files", "./tests/playwright-files2" ]
-
+COPY [ "./frontend/", "./" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-oidc

@@ -1,15 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-
-COPY [ "./_docker/src/oidc/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-RUN mkdir -p ./http/dist
-COPY [ "./_docker/src/oidc/backend/", "./"]
-COPY ["./backend/filebrowser", "./"]
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-WORKDIR /app/frontend
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN node mock-oidc-server.js & sleep 2 && cd ../backend/ && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-previews

@@ -1,17 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/previews/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-proxy

@@ -1,15 +1,10 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
+FROM gtstef/playwright-base
 WORKDIR /app
 COPY [ "./_docker/src/proxy/", "./" ]
 WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
+COPY [ "./frontend/", "./" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
-RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
-RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN nginx & ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-screenshots

@@ -1,15 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:chromium
-WORKDIR /app
-
-WORKDIR /app/frontend
-COPY [ "./frontend/", "./" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./_docker/src/screenshots/backend/*", "./"]
-
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots

_docker/Dockerfile.playwright-settings

@@ -1,25 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/settings/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/settings/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-COPY [ "./frontend/tests/playwright-files", "/tests/playwright-files" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser set -u testuser1,testuser1
-RUN ./filebrowser set rule -s access -p / -r user -v admin -allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded/showme.txt -r user -v admin -allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /denied -r user -v admin -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded -r user -v admin -c config.yaml
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-sharing

@@ -1,18 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest
-WORKDIR /app
-
-# Copy setup scripts first to leverage caching
-COPY [ "./_docker/src/sharing/", "./" ]
-
-WORKDIR /app/frontend
-COPY [ "./_docker/src/sharing/frontend/", "./" ]
-COPY [ "./frontend/tests/", "./tests" ]
-
-WORKDIR /app/backend/
-COPY [ "./backend/filebrowser*", "./"]
-RUN mkdir -p ./http/dist
-COPY [ "./backend/http/embed/", "./http/dist/"]
-
-# Run tests
-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.primecache

@@ -1 +0,0 @@
-FROM ghcr.io/gtsteffaniak/playwright-base:latest

_docker/Dockerfile.slim

@@ -1,41 +0,0 @@
-FROM golang:alpine AS base
-ARG VERSION
-ARG REVISION
-WORKDIR /app
-COPY ./backend ./
-RUN apk update && apk add
-RUN go build -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
-  -o filebrowser .
-
-FROM node:jod-slim AS nbuild
-WORKDIR /app
-COPY ./frontend/package.json ./
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
-    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
-    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN npm i
-COPY  ./frontend/ ./
-RUN npm run build:docker
-
-FROM alpine:latest
-ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
-ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
-ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata curl
-RUN adduser -D -s /bin/true -u 1000 filebrowser
-USER filebrowser
-WORKDIR /home/filebrowser
-COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
-COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
-## sanity checks
-RUN [ "filebrowser", "version" ]
-# exposing default port for auto discovery.
-EXPOSE 80
-HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-  CMD curl -f http://localhost:80/health || exit 1
-ENTRYPOINT [ "./filebrowser" ]

_docker/docker-compose.yaml

@@ -1,19 +1,4 @@
 services:
-  local-playwright:
-    container_name: local-playwright
-    ports:
-      - "8080:8080"
-    build:
-      dockerfile: ./_docker/Dockerfile.playwright-local
-      context: ../
-  local-playwright-screenshots:
-    container_name: local-playwright
-    volumes:
-      - ../frontend/generated:/app/frontend/generated
-    entrypoint: ["/bin/sh", "-c", "./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots && npx playwright test --project light-screenshots"]
-    build:
-      dockerfile: ./_docker/Dockerfile.playwright-local
-      context: ../
   nginx-proxy-auth:
     image: nginx
     container_name: nginx-proxy-auth
@@ -21,31 +6,11 @@ services:
       - "80:80"
     volumes:
       - ./src/proxy/backend/default.conf:/etc/nginx/conf.d/default.conf
-      - ./src/proxy/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
-  nginx-proxy-jwt:
-    image: nginx
-    container_name: nginx-proxy-jwt
-    ports:
-      - "8081:8081"  # Admin user
-      - "8082:8082"  # Regular user
-      - "8083:8083"  # Wrong key
-      - "8084:8084"  # No user
-    volumes:
-      - ./src/jwt/backend/default.conf:/etc/nginx/conf.d/default.conf
-      - ./src/jwt/backend/.htpasswd:/etc/nginx/conf.d/.htpasswd
-  filebrowser-jwt:
-    hostname: filebrowser
-    volumes:
-      - '../frontend:/home/frontend'
-      - "./src/jwt/backend/config.yaml:/home/filebrowser/data/config.yaml"
-    build:
-      context: ../
-      dockerfile: ./_docker/Dockerfile.slim
   filebrowser:
     hostname: filebrowser
     volumes:
       - '../frontend:/home/frontend'
-      - "./src/proxy/backend/config.yaml:/home/filebrowser/data/config.yaml"
+      - "./src/proxy/backend/config.yaml:/home/filebrowser/config.yaml"
     build:
       context: ../
-      dockerfile: ./_docker/Dockerfile.slim
+      dockerfile: ./_docker/Dockerfile

_docker/src/general/backend/config.yaml

@@ -1,18 +1,16 @@
 server:
-  <<: *server-main
+  port: 80
+  baseURL:  "/"
+  logging:
+    - levels: "info|error|debug"
+  sources:
+    - path: "../frontend/tests/playwright-files"
+    - path: "."
+      name: "docker"
 frontend:
-  <<: *frontend-main
-
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    audio: true
-    models: true
-    office: true
-    highQuality: true
-  permissions:
-    download: true
-    create: true
-    share: true
+  name: "Graham's Filebrowser"
+  disableDefaultLinks: true
+  externalLinks:
+    - text: "A playwright test"
+      url: "https://playwright.dev/"
+      title: "Playwright"

_docker/src/general/backend/frontend-config.yaml

@@ -1,13 +0,0 @@
-frontend-main: &frontend-main
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  styling:
-    disableEventThemes: true
-    customThemes:
-      no-rounded:
-        description: "No rounded corners" # The description of the theme to display in the UI.
-        css: "no-rounded.css" # The css file path and filename to use for the theme.
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"

_docker/src/general/backend/server-config.yaml

@@ -1,18 +0,0 @@
-server-main: &server-main
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        defaultEnabled: true
-        rules:
-          - folderPath: "/"
-            viewable: true

_docker/src/general/frontend/playwright.config.ts

@@ -10,9 +10,9 @@ import { defineConfig, devices } from "@playwright/test";
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-  globalSetup: "./tests/playwright/global-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/general",
+  globalSetup: "./global-setup",
+  timeout: 5000,
+  testDir: "./tests",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -20,7 +20,7 @@ export default defineConfig({
   /* Retry on CI only */
   retries: 2,
   /* Opt out of parallel tests on CI. */
-  workers: 1,
+  workers: 1, // required for now! todo parallel some tests
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */
   reporter: "line",
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */

_docker/src/jwt/backend/config.yaml

@@ -1,49 +0,0 @@
-server:
-  port: 8080
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        createUserDir: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true
-auth:
-  methods:
-    password:
-      enabled: false
-    jwt:
-      enabled: true
-      secret: "test-jwt-secret-key-for-development-only-do-not-use-in-production"
-      algorithm: "HS256"
-      header: "X-JWT-Assertion"
-      userIdentifier: "sub"
-      groupsClaim: "mygroup"
-      adminGroup: "admin"
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
-  darkMode: true
-  disableSettings: false
-  singleClick: false
-  permissions:
-    admin: false
-    modify: true
-    share: true
-    api: false
-    download: true
-    create: true

_docker/src/jwt/backend/default.conf

@@ -1,66 +0,0 @@
-# Admin user (port 8081)
-server {
-    listen 8081;
-    server_name localhost 127.0.0.1;
-    
-    set $admin_token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RhZG1pbkBleGFtcGxlLmNvbSIsImV4cCI6MjA4NzU2NTc2NiwiZ3JvdXBzIjpbImFkbWluIl0sImlhdCI6MTc3MjIwNTc2NiwibmFtZSI6IlRlc3QgQWRtaW4iLCJuYmYiOjE3NzIyMDU3NjYsInN1YiI6InRlc3RhZG1pbiJ9.pxuKGyMmEe94m0xQ7y1QzcUZgU-lZSvqjoKUVoVd3F4";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $admin_token;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# Regular user (port 8082)
-server {
-    listen 8082;
-    server_name localhost 127.0.0.1;
-    
-    set $regular_token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20iLCJleHAiOjIwODc1NjU2OTIsImdyb3VwcyI6WyJteWdyb3VwIl0sImlhdCI6MTc3MjIwNTY5MiwibmFtZSI6IlRlc3QgVXNlciIsIm5iZiI6MTc3MjIwNTY5Miwic3ViIjoidGVzdHVzZXIifQ.X8fUYbhnZpgvP5CnGdms9eGo8yRLyNhRbj7xUSxEgl8";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $regular_token;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# Valid token but signed with different secret (port 8083)
-server {
-    listen 8083;
-    server_name localhost 127.0.0.1;
-    
-    # Valid JWT token structure, but signed with wrong secret - should fail signature verification
-    set $wrong_key "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InRlc3RhZG1pbkBleGFtcGxlLmNvbSIsImV4cCI6MjA4NzU2NjAyMywiZ3JvdXBzIjpbImFkbWluIl0sImlhdCI6MTc3MjIwNjAyMywibmFtZSI6IlRlc3QgQWRtaW4iLCJuYmYiOjE3NzIyMDYwMjMsInN1YiI6InRlc3RhZG1pbiJ9.afBobbJ3VQ-fKnUebGr-gxFIqegyICi6E3EgkUSeFNw";
-    
-    location / {
-        proxy_set_header X-JWT-Assertion $wrong_key;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}
-
-# No authentication (port 8084)
-server {
-    listen 8084;
-    server_name localhost 127.0.0.1;
-    
-    location / {
-        proxy_set_header X-JWT-Assertion "";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_pass http://filebrowser:8080;
-    }
-}

_docker/src/jwt/backend/generate-jwt.go

@@ -1,101 +0,0 @@
-package main
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-)
-
-// Simple JWT generator without external dependencies
-func main() {
-	// Secret key - must match the one in your config file
-	secret := "wrong-key"
-
-	// Check if custom secret provided via command line
-	if len(os.Args) > 1 {
-		secret = os.Args[1]
-	}
-
-	// Create token claims with 10 year expiration
-	now := time.Now()
-	expiresAt := now.Add(10 * 365 * 24 * time.Hour) // 10 years
-
-	header := map[string]interface{}{
-		"alg": "HS256",
-		"typ": "JWT",
-	}
-
-	claims := map[string]interface{}{
-		"sub":    "testadmin",             // username (subject)
-		"email":  "testadmin@example.com", // email claim
-		"name":   "Test Admin",            // full name
-		"groups": []string{"admin"},       // groups - includes admin for testing
-		"iat":    now.Unix(),              // issued at
-		"exp":    expiresAt.Unix(),        // expires at
-		"nbf":    now.Unix(),              // not before
-	}
-
-	// Encode header
-	headerJSON, err := json.Marshal(header)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error encoding header: %v\n", err)
-		os.Exit(1)
-	}
-	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)
-
-	// Encode claims
-	claimsJSON, err := json.Marshal(claims)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error encoding claims: %v\n", err)
-		os.Exit(1)
-	}
-	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)
-
-	// Create signature
-	message := headerB64 + "." + claimsB64
-	h := hmac.New(sha256.New, []byte(secret))
-	h.Write([]byte(message))
-	signature := base64.RawURLEncoding.EncodeToString(h.Sum(nil))
-
-	// Combine to form complete JWT
-	tokenString := message + "." + signature
-
-	// Output the token
-	fmt.Println("=== JWT Token Generated ===")
-	fmt.Println()
-	fmt.Println("Token:")
-	fmt.Println(tokenString)
-	fmt.Println()
-	// Verify token can be decoded
-	parts := strings.Split(tokenString, ".")
-	if len(parts) == 3 {
-		fmt.Println("✓ Token structure is valid (3 parts)")
-	} else {
-		fmt.Fprintf(os.Stderr, "✗ Invalid token structure\n")
-		os.Exit(1)
-	}
-
-	// Save to file for easy access
-	filename := "test-jwt-token.txt"
-	if err := os.WriteFile(filename, []byte(tokenString), 0644); err != nil {
-		fmt.Fprintf(os.Stderr, "Warning: Could not write token to file: %v\n", err)
-	} else {
-		fmt.Printf("✓ Token saved to: %s\n", filename)
-		fmt.Println()
-	}
-
-	// Also save to shell script for easy sourcing
-	scriptContent := fmt.Sprintf("#!/bin/bash\n# Source this file to set JWT token as environment variable\n# Usage: source jwt-env.sh\nexport TEST_JWT_TOKEN=\"%s\"\necho \"JWT token loaded into TEST_JWT_TOKEN\"\n", tokenString)
-	if err := os.WriteFile("jwt-env.sh", []byte(scriptContent), 0755); err != nil {
-		fmt.Fprintf(os.Stderr, "Warning: Could not write shell script: %v\n", err)
-	} else {
-		fmt.Println("✓ Shell script saved to: jwt-env.sh")
-		fmt.Println("  Usage: source jwt-env.sh")
-		fmt.Println()
-	}
-}

_docker/src/jwt/backend/go.mod

@@ -1,3 +0,0 @@
-module test
-
-go 1.25.6

_docker/src/jwt/frontend/playwright.config.ts

@@ -1,66 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/jwt-setup.ts",
-  timeout: 5000,
-  testDir: "./tests/playwright/jwt",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for different JWT test scenarios */
-  projects: [
-    {
-      name: "admin-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8081", // Admin user JWT
-      },
-    },
-    {
-      name: "regular-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8082", // Regular user JWT
-      },
-    },
-    {
-      name: "wrong-key",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8083", // Wrong secret key
-      },
-    },
-    {
-      name: "no-user",
-      use: { 
-        ...devices["Desktop Firefox"],
-        baseURL: "http://127.0.0.1:8084", // No JWT token
-      },
-    },
-  ],
-});

_docker/src/no-config/frontend/playwright.config.ts

@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/no-config-setup",
-  timeout: 5000,
-  testDir: "./tests/playwright/no-config",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

_docker/src/noauth/backend/config.yaml

@@ -2,47 +2,13 @@ server:
   port: 80
   baseURL:  "/files/"
   logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
+    - levels: "info|error|debug"
   sources:
     - path: "../frontend/tests/playwright-files"
-      name: "exclude"
-      config:
-        defaultEnabled: true
-        rules:
-          - folderPath: "excluded"
-          - folderPath: "excludedButVisible"
-            viewable: true
-          - fileStartsWith: "startsWith"
-          - fileName: "dontshow.txt"
-    - path: "../frontend/tests/playwright-files2"
-      name: "include"
-      config:
-        defaultEnabled: true
-        useLogicalSize: true
-        rules:
-          - includeRootItem: "myfolder"
-          - includeRootItem: "subfolderExclusions"
-          - includeRootItem: "folder#hash"
-          - includeRootItem: "files"
-          - filePath: "/subfolderExclusions/exclusionlist.sh"
-          - folderPath: "/subfolderExclusions/folderItem"
-            viewable: true
-        conditionals:
-          rules:
-            - fileStartsWith: "startsWith"
-            - folderEndsWith: "Folder"
-            - folderNames: 'folderNames'
-            - fileNames: 'fileNames'
-            - folderName: 'folderName'
-            - fileName: 'fileName'
-            - folderName: '.hiddenDir'
-            - fileName: '.hidden'
-
 auth:
+  signup: false
   methods:
     noauth: true
-
 frontend:
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
@@ -50,17 +16,3 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
-  styling:
-    disableEventThemes: true
-
-userDefaults:
-  showHidden: true
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
-  permissions:
-    download: true
-    create: true

_docker/src/noauth/frontend/playwright.config.ts

@@ -10,9 +10,9 @@ import { defineConfig, devices } from "@playwright/test";
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-  globalSetup: "./tests/playwright/noauth-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/noauth",
+  //globalSetup: "./global-setup",
+  timeout: 5000,
+  testDir: "./tests-noauth",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
@@ -25,7 +25,6 @@ export default defineConfig({
   reporter: "line",
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
-    storageState: "noauth.json",
     actionTimeout: 5000,
     //storageState: "loginAuth.json",
     /* Base URL to use in actions like `await page.goto('/')`. */

_docker/src/oidc/backend/config.yaml

@@ -1,48 +0,0 @@
-server:
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultEnabled: true
-        createUserDir: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true
-auth:
-  methods:
-    password:
-      enabled: false
-    oidc:
-      enabled: true
-      createUser: true
-      clientId: "vyBrzOmcrU3OokiWEZoObdGBscw0eYPNJauBtOJr"
-      clientSecret: "gIMKbkEcckUhlGrnE2Vxi8eZhEcfxQqfwFgM0ATzk4DciHGrW2YRtQfqcpRTsmzrxEETkKvZ8yeK3sfoXnUV1IQTzqK7wxw3lEMtmeXi5clj0h7nH1rVGFq2Q3HL8zUe"
-      issuerUrl: "http://localhost:8080"
-      adminGroup: "Admins"
-
-userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
-  darkMode: true
-  disableSettings: false
-  singleClick: false
-  permissions:
-    admin: false
-    modify: true
-    share: false
-    api: false
-    download: true
-    create: true

_docker/src/oidc/frontend/mock-oidc-server.js

@@ -1,60 +0,0 @@
-
-import { OAuth2Server } from 'oauth2-mock-server';
-
-// This is a list of pre-defined users. You can add more users here.
-// The filebrowser application will use this data when a user logs in.
-const users = {
-  // Default user
-  johndoe: {
-    sub: 'johndoe',
-    preferred_username: 'johndoe',
-    email: 'johndoe@example.com',
-    groups: ['Admins', 'Users'],
-  },
-  // Another example user
-  testuser: {
-    sub: 'testuser',
-    preferred_username: 'testuser',
-    email: 'testuser@example.com',
-    groups: ['Users'],
-  },
-};
-
-const server = new OAuth2Server();
-
-// Generate a new RSA key for the server.
-await server.issuer.keys.generate('RS256');
-
-/**
- * This hook is called before the ID token is signed.
- * We're using it to add claims to the ID token.
- * This is the primary way the application will get user information.
- */
-server.service.on('beforeIdTokenSigning', (token, req) => {
-  // By default, the mock server uses 'johndoe' as the subject.
-  const user = users[token.payload.sub] || users.johndoe;
-  console.log(`[ID Token] Customizing token for user: ${user.sub}`);
-  Object.assign(token.payload, user);
-});
-
-
-/**
- * This hook is called before the userinfo response is sent.
- * We're using it to provide user claims when the application calls the /userinfo endpoint.
- */
-server.service.on('beforeUserinfo', (userInfoResponse, req) => {
-    const user = users.johndoe;
-    console.log(`[UserInfo] Customizing userinfo for user: ${user.sub}`);
-    userInfoResponse.body = user;
-});
-
-
-const port = 8080;
-const host = '0.0.0.0'; // Bind to 0.0.0.0 to be accessible within Docker
-await server.start(port, host);
-console.log(`OAuth 2 Mock Server listening on http://${host}:${port}`);
-console.log(`Issuer URL: ${server.issuer.url}`);
-console.log('---');
-console.log('Pre-defined users:');
-console.log(JSON.stringify(users, null, 2));
-console.log('---');

_docker/src/oidc/frontend/playwright.config.ts

@@ -1,48 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/oidc-setup",
-  timeout: 5000,
-  testDir: "./tests/playwright/oidc",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1, // required for now! todo parallel some tests
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    storageState: "loginAuth.json",
-    actionTimeout: 5000,
-    //storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

_docker/src/previews/backend/config.yaml

@@ -1,36 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-
-auth:
-  methods:
-    noauth: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true
-
-userDefaults:
-  showHidden: true
-  preview:
-    image: true
-    popup: true
-    video: true
-    audio: true
-    office: true
-    models: true
-    highQuality: true
-  permissions:
-    download: true
-    create: true

_docker/src/previews/frontend/playwright.config.ts

@@ -1,54 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/previews-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/previews",
-  /* Run tests in files in parallel */
-  fullyParallel: true,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  workers: 10,
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    launchOptions: {
-      args: [
-        '--disable-gpu',
-        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
-        '--enable-webgl',
-        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
-        '--no-sandbox',  // Required for Docker
-      ],
-    },
-    storageState: "previews.json",
-    actionTimeout: 5000,
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "chromium",
-      use: { ...devices["Desktop Chrome"] },
-    },
-  ],
-});

_docker/src/proxy/backend/.htpasswd

@@ -1 +0,0 @@
-demo-127.0.0.1:$apr1$j5FRA4Bc$RYdNFuM7YAAo9Qtie8w4b/

_docker/src/proxy/backend/config.yaml

@@ -1,15 +1,13 @@
 server:
   port: 8080
-  baseURL:  "/subpath"
+  baseURL:  "/"
   logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
+    - levels: "info|error|debug"
   sources:
     - path: "../frontend/tests/playwright-files"
       config:
         defaultEnabled: true
         createUserDir: true
-
 frontend:
   name: "Graham's Filebrowser"
   disableDefaultLinks: true
@@ -17,32 +15,20 @@ frontend:
     - text: "A playwright test"
       url: "https://playwright.dev/"
       title: "Playwright"
-  styling:
-    disableEventThemes: true
 auth:
+  signup: false
   methods:
-    password:
-      enabled: false
     proxy:
       enabled: true
       header: "X-Username"
       createUser: true
-      logoutRedirectUrl: "https://localhost/api/auth/logout2"
 
 userDefaults:
-  preview:
-    image: true
-    popup: true
-    video: true
-    office: true
-    highQuality: true
   darkMode: true
   disableSettings: false
   singleClick: false
   permissions:
     admin: false
     modify: true
-    share: true
-    api: false
-    download: true
-    create: true
+    share: false
+    api: false

_docker/src/proxy/backend/default.conf

@@ -7,26 +7,13 @@ server {
     listen 80;
     server_name localhost 127.0.0.1;
 
-    location /subpath/public/ {
-        proxy_pass http://filebrowser:8080/subpath/public/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Username $uuid;
-    }
-
-    # requires basic auth demo-127.0.0.1:SecurePass123!
-    location /subpath {
-        auth_basic "Restricted Access";
-        auth_basic_user_file /etc/nginx/conf.d/.htpasswd;
+    location / {
         proxy_set_header X-Username $uuid;
         add_header X-Username $uuid;
-        proxy_pass http://filebrowser:8080/subpath;
+        proxy_pass http://localhost:8080;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
-
 }

_docker/src/proxy/frontend/playwright.config.ts

@@ -10,23 +10,23 @@ import { defineConfig, devices } from "@playwright/test";
  * See https://playwright.dev/docs/test-configuration.
  */
 export default defineConfig({
-  globalSetup: "./tests/playwright/proxy-setup.ts",
-  timeout: 10000,
-  testDir: "./tests/playwright/proxy",
+  //globalSetup: "./global-setup",
+  timeout: 3000,
+  testDir: "./tests-proxy",
   /* Run tests in files in parallel */
   fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: false,
   /* Retry on CI only */
-  retries: 3,
+  retries: 2,
   /* Opt out of parallel tests on CI. */
   workers: 1, // required for now! todo parallel some tests
   /* Reporter to use. See https://playwright.dev/docs/test-reporters */
   reporter: "line",
   /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
+    actionTimeout: 3000,
+    //storageState: "loginAuth.json",
     /* Base URL to use in actions like `await page.goto('/')`. */
     baseURL: "http://127.0.0.1",
 

_docker/src/screenshots/backend/config.yaml

@@ -1,11 +0,0 @@
-server:
-  port: 8080
-  baseURL:  "/files/"
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright"
-      config:
-        defaultEnabled: true

_docker/src/screenshots/frontend/playwright.config.ts

@@ -1,65 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/screenshots-setup.ts",
-  timeout: 5000,
-  testDir: "./tests/playwright/screenshots",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 1,
-  /* Opt out of parallel tests on CI. */
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    launchOptions: {
-      args: [
-        '--disable-gpu',
-        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
-        '--enable-webgl',
-        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
-        '--no-sandbox',  // Required for Docker
-      ],
-    },
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://localhost:8080",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "dark-screenshots",
-      use: {
-        ...devices["Desktop Chrome"],
-        theme: 'dark',
-      },
-    },
-    {
-      name: "light-screenshots",
-      use: {
-        ...devices["Desktop Chrome"],
-        theme: 'light',
-      },
-    },
-  ],
-});

_docker/src/settings/backend/config.yaml

@@ -1,41 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        defaultEnabled: true
-        rules:
-          - folderPath: "/"
-            viewable: true
-    - path: "/tests/playwright-files"
-      name: "access"
-      config:
-        defaultEnabled: true
-        denyByDefault: true
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  styling:
-    disableEventThemes: true
-    customThemes:
-      no-rounded:
-        description: "No rounded corners" # The description of the theme to display in the UI.
-        css: "no-rounded.css" # The css file path and filename to use for the theme.
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-
-auth:
-  methods:
-    password:
-      signup: true

_docker/src/settings/frontend/playwright.config.ts

@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/global-setup",
-  timeout: 5000,
-  testDir: "./tests/playwright/settings",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 1,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

_docker/src/sharing/backend/config.yaml

@@ -1,26 +0,0 @@
-server:
-  port: 80
-  baseURL:  "/"
-  logging:
-    - levels: "info|error|warning|debug"
-      apiFilter: 'disabled'
-  sources:
-    - path: "../frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "."
-      name: "docker"
-      config:
-        private: true
-        defaultEnabled: true
-
-frontend:
-  name: "Graham's Filebrowser"
-  disableDefaultLinks: true
-  externalLinks:
-    - text: "A playwright test"
-      url: "https://playwright.dev/"
-      title: "Playwright"
-  styling:
-    disableEventThemes: true

_docker/src/sharing/frontend/playwright.config.ts

@@ -1,47 +0,0 @@
-import { defineConfig, devices } from "@playwright/test";
-
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
-/**
- * See https://playwright.dev/docs/test-configuration.
- */
-export default defineConfig({
-  globalSetup: "./tests/playwright/global-setup",
-  timeout: 10000,
-  testDir: "./tests/playwright/sharing",
-  /* Run tests in files in parallel */
-  fullyParallel: false,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
-  forbidOnly: false,
-  /* Retry on CI only */
-  retries: 2,
-  /* Opt out of parallel tests on CI. */
-  workers: 1,
-  /* Reporter to use. See https://playwright.dev/docs/test-reporters */
-  reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
-  use: {
-    actionTimeout: 5000,
-    storageState: "loginAuth.json",
-    /* Base URL to use in actions like `await page.goto('/')`. */
-    baseURL: "http://127.0.0.1/",
-
-    /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
-    trace: "on-first-retry",
-
-    /* Set default locale to English (US) */
-    locale: "en-US",
-  },
-
-  /* Configure projects for major browsers */
-  projects: [
-    {
-      name: "firefox",
-      use: { ...devices["Desktop Firefox"] },
-    },
-  ],
-});

backend/.air.toml

@@ -1,17 +0,0 @@
-root = "."
-tmp_dir = "tmp"
-
-[build]
-  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=version'\" ."
-  bin = "tmp/filebrowser"
-  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser -c test_config.yaml"
-  include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "http/dist", "http/embed", "swagger/docs", "preview/thumbnails", "preview/heic"]
-  log = "air.log"
-  delay = 1000 # ms
-
-[log]
-  time = true
-
-[misc]
-  clean_on_exit = false

backend/.air.windows.toml

@@ -1,21 +0,0 @@
-root = "."
-tmp_dir = "tmp"
-
-[build]
-  cmd = "go build -o ./tmp/filebrowser.exe --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=version'\" ."
-  bin = "tmp/filebrowser.exe"
-  args_bin = ["-c", "test_config.yaml"]
-  include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "http\\dist", "http\\embed", "swagger\\docs"]
-  exclude_unchanged = true
-  follow_symlink = false
-  poll = true
-  poll_interval = 1000
-  log = "air.log"
-  delay = 1000 # ms
-
-[log]
-  time = true
-
-[misc]
-  clean_on_exit = false

backend/.gitignore

@@ -1,6 +0,0 @@
-tmp/
-air.log
-filebrowser
-generated.yaml
-test_config.yaml
-/data

backend/.golangci.yml

@@ -1,146 +1,232 @@
-version: "2"
-linters:
-  settings:
-    staticcheck:
-      checks:
-        - all
-        - '-QF1001'
-        - '-ST1003'
-        - '-ST1016'
-        - '-QF1004'
-        - '-QF1003'
-    cyclop:
-      max-complexity: 30
-      package-average: 10
-    errcheck:
-      check-type-assertions: true
-    exhaustive:
-      check:
-        - switch
-        - map
-    exhaustruct:
-      exclude:
-        - ^net/http.Client$
-        - ^net/http.Cookie$
-        - ^net/http.Request$
-        - ^net/http.Response$
-        - ^net/http.Server$
-        - ^net/http.Transport$
-        - ^net/url.URL$
-        - ^os/exec.Cmd$
-        - ^reflect.StructField$
-        - ^github.com/Shopify/sarama.Config$
-        - ^github.com/Shopify/sarama.ProducerMessage$
-        - ^github.com/mitchellh/mapstructure.DecoderConfig$
-        - ^github.com/prometheus/client_golang/.+Opts$
-        - ^github.com/spf13/cobra.Command$
-        - ^github.com/spf13/cobra.CompletionOptions$
-        - ^github.com/stretchr/testify/mock.Mock$
-        - ^github.com/testcontainers/testcontainers-go.+Request$
-        - ^github.com/testcontainers/testcontainers-go.FromDockerfile$
-        - ^golang.org/x/tools/go/analysis.Analyzer$
-        - ^google.golang.org/protobuf/.+Options$
-        - ^gopkg.in/yaml.v3.Node$
-    funlen:
-      lines: 100
-      statements: 50
-      ignore-comments: true
-    gocognit:
-      min-complexity: 20
-    gocritic:
-      settings:
-        captLocal:
-          paramsOnly: false
-        underef:
-          skipRecvDeref: false
-    gomodguard:
-      blocked:
-        modules:
-          - github.com/golang/protobuf:
-              recommendations:
-                - google.golang.org/protobuf
-              reason: see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules
-          - github.com/satori/go.uuid:
-              recommendations:
-                - github.com/google/uuid
-              reason: satori's package is not maintained
-          - github.com/gofrs/uuid:
-              recommendations:
-                - github.com/gofrs/uuid/v5
-              reason: gofrs' package was not go module before v5
-    govet:
-      disable:
-        - fieldalignment
-      enable-all: true
-      settings:
-        shadow:
-          strict: false
-    inamedparam:
-      skip-single-param: true
-    mnd:
-      ignored-functions:
-        - args.Error
-        - flag.Arg
-        - flag.Duration.*
-        - flag.Float.*
-        - flag.Int.*
-        - flag.Uint.*
-        - os.Chmod
-        - os.Mkdir.*
-        - os.OpenFile
-        - os.WriteFile
-        - prometheus.ExponentialBuckets.*
-        - prometheus.LinearBuckets
-    nakedret:
-      max-func-lines: 0
-    nolintlint:
-      require-explanation: true
-      require-specific: true
-      allow-no-explanation:
-        - funlen
-        - gocognit
-        - lll
-    perfsprint:
-      strconcat: false
-    rowserrcheck:
-      packages:
-        - github.com/jmoiron/sqlx
-    sloglint:
-      no-global: all
-      context: scope
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    rules:
-      - linters:
-          - godot
-        source: (noinspection|TODO)
-      - linters:
-          - gocritic
-        source: //noinspection
-      - linters:
-          - bodyclose
-          - dupl
-          - funlen
-          - goconst
-          - gosec
-          - noctx
-          - wrapcheck
-        path: _test\.go
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+# This code is licensed under the terms of the MIT license https://opensource.org/license/mit
+# Copyright (c) 2021 Marat Reymers
+
+## Golden config for golangci-lint v1.59.1
+#
+# This is the best config for golangci-lint based on my experience and opinion.
+# It is very strict, but not extremely strict.
+# Feel free to adapt and change it for your needs.
+
+run:
+  # Timeout for analysis, e.g. 30s, 5m.
+  # Default: 1m
+  timeout: 3m
+
+
+# This file contains only configs which differ from defaults.
+# All possible options can be found here https://github.com/golangci/golangci-lint/blob/master/.golangci.reference.yml
+linters-settings:
+  cyclop:
+    # The maximal code complexity to report.
+    # Default: 10
+    max-complexity: 30
+    # The maximal average package complexity.
+    # If it's higher than 0.0 (float) the check is enabled
+    # Default: 0.0
+    package-average: 10.0
+
+  errcheck:
+    # Report about not checking of errors in type assertions: `a := b.(MyStruct)`.
+    # Such cases aren't reported by default.
+    # Default: false
+    check-type-assertions: true
+
+  exhaustive:
+    # Program elements to check for exhaustiveness.
+    # Default: [ switch ]
+    check:
+      - switch
+      - map
+
+  exhaustruct:
+    # List of regular expressions to exclude struct packages and their names from checks.
+    # Regular expressions must match complete canonical struct package/name/structname.
+    # Default: []
+    exclude:
+      # std libs
+      - "^net/http.Client$"
+      - "^net/http.Cookie$"
+      - "^net/http.Request$"
+      - "^net/http.Response$"
+      - "^net/http.Server$"
+      - "^net/http.Transport$"
+      - "^net/url.URL$"
+      - "^os/exec.Cmd$"
+      - "^reflect.StructField$"
+      # public libs
+      - "^github.com/Shopify/sarama.Config$"
+      - "^github.com/Shopify/sarama.ProducerMessage$"
+      - "^github.com/mitchellh/mapstructure.DecoderConfig$"
+      - "^github.com/prometheus/client_golang/.+Opts$"
+      - "^github.com/spf13/cobra.Command$"
+      - "^github.com/spf13/cobra.CompletionOptions$"
+      - "^github.com/stretchr/testify/mock.Mock$"
+      - "^github.com/testcontainers/testcontainers-go.+Request$"
+      - "^github.com/testcontainers/testcontainers-go.FromDockerfile$"
+      - "^golang.org/x/tools/go/analysis.Analyzer$"
+      - "^google.golang.org/protobuf/.+Options$"
+      - "^gopkg.in/yaml.v3.Node$"
+
+  funlen:
+    # Checks the number of lines in a function.
+    # If lower than 0, disable the check.
+    # Default: 60
+    lines: 100
+    # Checks the number of statements in a function.
+    # If lower than 0, disable the check.
+    # Default: 40
+    statements: 50
+    # Ignore comments when counting lines.
+    # Default false
+    ignore-comments: true
+
+  gocognit:
+    # Minimal code complexity to report.
+    # Default: 30 (but we recommend 10-20)
+    min-complexity: 20
+
+  gocritic:
+    # Settings passed to gocritic.
+    # The settings key is the name of a supported gocritic checker.
+    # The list of supported checkers can be find in https://go-critic.github.io/overview.
+    settings:
+      captLocal:
+        # Whether to restrict checker to params only.
+        # Default: true
+        paramsOnly: false
+      underef:
+        # Whether to skip (*x).method() calls where x is a pointer receiver.
+        # Default: true
+        skipRecvDeref: false
+
+  gomodguard:
+    blocked:
+      # List of blocked modules.
+      # Default: []
+      modules:
+        - github.com/golang/protobuf:
+            recommendations:
+              - google.golang.org/protobuf
+            reason: "see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules"
+        - github.com/satori/go.uuid:
+            recommendations:
+              - github.com/google/uuid
+            reason: "satori's package is not maintained"
+        - github.com/gofrs/uuid:
+            recommendations:
+              - github.com/gofrs/uuid/v5
+            reason: "gofrs' package was not go module before v5"
+
+  govet:
+    # Enable all analyzers.
+    # Default: false
+    enable-all: true
+    # Disable analyzers by name.
+    # Run `go tool vet help` to see all analyzers.
+    # Default: []
+    disable:
+      - fieldalignment # too strict
+    # Settings per analyzer.
+    settings:
+      shadow:
+        # Whether to be strict about shadowing; can be noisy.
+        # Default: false
+        strict: false
+
+  inamedparam:
+    # Skips check for interface methods with only a single parameter.
+    # Default: false
+    skip-single-param: true
+
+  mnd:
+    # List of function patterns to exclude from analysis.
+    # Values always ignored: `time.Date`,
+    # `strconv.FormatInt`, `strconv.FormatUint`, `strconv.FormatFloat`,
+    # `strconv.ParseInt`, `strconv.ParseUint`, `strconv.ParseFloat`.
+    # Default: []
+    ignored-functions:
+      - args.Error
+      - flag.Arg
+      - flag.Duration.*
+      - flag.Float.*
+      - flag.Int.*
+      - flag.Uint.*
+      - os.Chmod
+      - os.Mkdir.*
+      - os.OpenFile
+      - os.WriteFile
+      - prometheus.ExponentialBuckets.*
+      - prometheus.LinearBuckets
+
+  nakedret:
+    # Make an issue if func has more lines of code than this setting, and it has naked returns.
+    # Default: 30
+    max-func-lines: 0
+
+  nolintlint:
+    # Exclude following linters from requiring an explanation.
+    # Default: []
+    allow-no-explanation: [ funlen, gocognit, lll ]
+    # Enable to require an explanation of nonzero length after each nolint directive.
+    # Default: false
+    require-explanation: true
+    # Enable to require nolint directives to mention the specific linter being suppressed.
+    # Default: false
+    require-specific: true
+
+  perfsprint:
+    # Optimizes into strings concatenation.
+    # Default: true
+    strconcat: false
+
+  rowserrcheck:
+    # database/sql is always checked
+    # Default: []
+    packages:
+      - github.com/jmoiron/sqlx
+
+  sloglint:
+    # Enforce not using global loggers.
+    # Values:
+    # - "": disabled
+    # - "all": report all global loggers
+    # - "default": report only the default slog logger
+    # https://github.com/go-simpler/sloglint?tab=readme-ov-file#no-global
+    # Default: ""
+    no-global: "all"
+    # Enforce using methods that accept a context.
+    # Values:
+    # - "": disabled
+    # - "all": report all contextless calls
+    # - "scope": report only if a context exists in the scope of the outermost function
+    # https://github.com/go-simpler/sloglint?tab=readme-ov-file#context-only
+    # Default: ""
+    context: "scope"
+
+  tenv:
+    # The option `all` will run against whole test files (`_test.go`) regardless of method/function signatures.
+    # Otherwise, only methods that take `*testing.T`, `*testing.B`, and `testing.TB` as arguments are checked.
+    # Default: false
+    all: true
+
+
 issues:
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
   max-same-issues: 50
-formatters:
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+
+  exclude-rules:
+    - source: "(noinspection|TODO)"
+      linters: [ godot ]
+    - source: "//noinspection"
+      linters: [ gocritic ]
+    - path: "_test\\.go"
+      linters:
+        - bodyclose
+        - dupl
+        - funlen
+        - goconst
+        - gosec
+        - noctx
+        - wrapcheck

backend/.goreleaser.yaml

@@ -3,54 +3,18 @@ project_name: filebrowser
 version: 2
 
 builds:
-  # Build configuration for linux amd64
-  - id: linux-amd64
-    env:
-      - CGO_ENABLED=1
-      - CC=zig cc -target x86_64-linux-musl
-    tags:
-      - mupdf
-      - musl
+  # Build configuration for darwin and linux
+  - id: default
     ldflags: &ldflags
-      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/common/version.Version=v{{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA={{ .ShortCommit }}
+      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/version.Version={{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/version.CommitSHA={{ .ShortCommit }}
     main: main.go
     binary: filebrowser
     goos:
       - linux
     goarch:
       - amd64
-    hooks:
-      post:
-        - upx {{ .Path }}
-
-  # Build configuration for linux arm64
-  - id: linux-arm64
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    env:
-      - CGO_ENABLED=1
-      - CC=zig cc -target aarch64-linux-musl
-    tags:
-      - mupdf
-      - musl
-    goos:
-      - linux
-    goarch:
-      - arm64
-    hooks:
-      post:
-        - upx {{ .Path }}
-
-  # Build configuration for linux
-  - id: linux-arm32
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    goos:
-      - linux
-    goarch:
       - arm
+      - arm64
     goarm:
       - "6"
       - "7"
@@ -60,11 +24,6 @@ builds:
 
   # Build configuration for windows without arm
   - id: windows
-    env:
-      - CGO_ENABLED=1
-      - CC=zig cc -target x86_64-windows
-    tags:
-      - mupdf
     ldflags: *ldflags
     main: main.go
     binary: filebrowser
@@ -76,17 +35,7 @@ builds:
       post:
         - upx {{ .Path }}  # Compress the binary with UPX
 
-  # Build configuration for freebsd without arm & upx
-  - id: freeBSD and freebsd-arm
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    goos:
-      - freebsd
-    goarch:
-      - amd64
-
-  # Build configuration for macos without upx
+  # Build configuration for windows without arm & upx
   - id: macos
     ldflags: *ldflags
     main: main.go
@@ -94,8 +43,8 @@ builds:
     goos:
       - darwin
     goarch:
-      - arm64
       - amd64
+      - arm64
 
 archives:
   - name_template: >
@@ -104,7 +53,8 @@ archives:
       {{- else -}}
       {{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{.ProjectName}}
       {{- end -}}
-    formats: [ 'binary' ]
+    format: binary
 
 checksum:
   disable: true
+

backend/adapters/fs/files/content_test.go

@@ -1,138 +0,0 @@
-package files
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"unicode/utf8"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestGetContent_UTF8Truncation(t *testing.T) {
-	// Get the path to the test file
-	// The test file is in frontend/tests/playwright-files/utf8-truncated.txt
-	// We need to find it relative to the test execution directory
-	cwd, err := os.Getwd()
-	require.NoError(t, err)
-
-	// Navigate from backend/adapters/fs/files to the project root
-	// backend/adapters/fs/files -> backend/adapters/fs -> backend/adapters -> backend -> root
-	testFilePath := filepath.Join(cwd, "..", "..", "..", "..", "frontend", "tests", "playwright-files", "utf8-truncated.txt")
-
-	// Check if file exists, if not try alternative path
-	if _, err = os.Stat(testFilePath); os.IsNotExist(err) {
-		// Try from project root
-		testFilePath = filepath.Join("frontend", "tests", "playwright-files", "utf8-truncated.txt")
-		if _, err = os.Stat(testFilePath); os.IsNotExist(err) {
-			t.Skipf("Test file not found at %s, skipping test", testFilePath)
-			return
-		}
-	}
-
-	// Get absolute path
-	var absPath string
-	absPath, err = filepath.Abs(testFilePath)
-	require.NoError(t, err)
-
-	t.Run("file with UTF-8 truncation at 4096 byte boundary", func(t *testing.T) {
-		// The test file is longer than 4096 bytes, with valid UTF-8 throughout.
-		// However, when reading exactly 4096 bytes as a header, it cuts off in the
-		// middle of a multi-byte UTF-8 sequence (e6 9c, missing the last byte 88 of '月').
-		// This should trigger the truncation handling in getContent's header validation.
-		// The fix should trim the incomplete sequence from the header, allowing the
-		// header check to pass, and then the full file (which is valid UTF-8) should
-		// pass the full file validation.
-		content, err := getContent(absPath)
-
-		// Should not return an error - the header truncation is handled, and the full file is valid
-		require.NoError(t, err)
-
-		// The content should be the full valid UTF-8 file
-		require.NotEmpty(t, content, "Content should not be empty - full file is valid UTF-8")
-
-		// Verify it contains the expected text
-		require.Contains(t, content, "文件已备份", "Content should contain Chinese characters")
-		require.Contains(t, content, "2024年", "Content should contain date information")
-	})
-
-	t.Run("regular UTF-8 text file", func(t *testing.T) {
-		// Test with a simple text file to ensure normal files still work
-		tmpFile, err := os.CreateTemp("", "test-utf8-*.txt")
-		require.NoError(t, err)
-		defer os.Remove(tmpFile.Name())
-		defer tmpFile.Close()
-
-		testText := "Hello, 世界! This is a test file with UTF-8 characters.\n"
-		_, err = tmpFile.WriteString(testText)
-		require.NoError(t, err)
-		tmpFile.Close()
-
-		content, err := getContent(tmpFile.Name())
-		require.NoError(t, err)
-		require.Equal(t, testText, content)
-	})
-
-	t.Run("file smaller than header size", func(t *testing.T) {
-		// Test with a file smaller than 4096 bytes
-		tmpFile, err := os.CreateTemp("", "test-small-*.txt")
-		require.NoError(t, err)
-		defer os.Remove(tmpFile.Name())
-		defer tmpFile.Close()
-
-		testText := "Small file content"
-		_, err = tmpFile.WriteString(testText)
-		require.NoError(t, err)
-		tmpFile.Close()
-
-		content, err := getContent(tmpFile.Name())
-		require.NoError(t, err)
-		require.Equal(t, testText, content)
-	})
-
-	t.Run("file with Chinese characters at boundary", func(t *testing.T) {
-		// Create a file that's exactly 4094 bytes, ending with a complete Chinese character
-		tmpFile, err := os.CreateTemp("", "test-chinese-*.txt")
-		require.NoError(t, err)
-		defer os.Remove(tmpFile.Name())
-		defer tmpFile.Close()
-
-		// Create content that's exactly 4094 bytes, ending with complete UTF-8
-		baseText := "2024年 06月 17日 星期一 04:05:58 CST 文件已备份\n"
-		content := ""
-		for len([]byte(content)) < 4094 {
-			content += baseText
-		}
-		// Trim to exactly 4094 bytes
-		encoded := []byte(content)
-		if len(encoded) > 4094 {
-			encoded = encoded[:4094]
-		}
-		// Ensure it ends with a complete character by finding the last complete rune
-		for len(encoded) > 0 {
-			lastRune, _ := decodeLastRune(encoded)
-			if lastRune != 0xFFFD { // RuneError
-				break
-			}
-			encoded = encoded[:len(encoded)-1]
-		}
-
-		_, err = tmpFile.Write(encoded)
-		require.NoError(t, err)
-		tmpFile.Close()
-
-		result, err := getContent(tmpFile.Name())
-		require.NoError(t, err)
-		require.NotEmpty(t, result)
-		require.Equal(t, string(encoded), result)
-	})
-}
-
-// Helper function to check if last rune is valid
-func decodeLastRune(p []byte) (rune, int) {
-	if len(p) == 0 {
-		return 0, 0
-	}
-	r, size := utf8.DecodeLastRune(p)
-	return r, size
-}

backend/adapters/fs/files/file_test.go

@@ -1,735 +0,0 @@
-package files
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	liberrors "github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	dbsql "github.com/gtsteffaniak/filebrowser/backend/database/sql"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
-)
-
-func Test_GetRealPath(t *testing.T) {
-	cwd, err := os.Getwd()
-	if err != nil {
-		return
-	}
-	trimPrefix := filepath.Dir(filepath.Dir(cwd))
-	tests := []struct {
-		name  string
-		paths []string
-		want  struct {
-			path  string
-			isDir bool
-		}
-	}{
-		{
-			name: "current directory",
-			paths: []string{
-				"./",
-			},
-			want: struct {
-				path  string
-				isDir bool
-			}{
-				path:  "",
-				isDir: true,
-			},
-		},
-		{
-			name: "current directory",
-			paths: []string{
-				"./files/file.go",
-			},
-			want: struct {
-				path  string
-				isDir bool
-			}{
-				path:  "/files/file.go",
-				isDir: false,
-			},
-		},
-		{
-			name: "other test case",
-			paths: []string{
-				"/mnt/doesnt/exist",
-			},
-			want: struct {
-				path  string
-				isDir bool
-			}{
-				path:  "/mnt/doesnt/exist",
-				isDir: false,
-			},
-		},
-	}
-	idx := indexing.Index{
-		Source: settings.Source{
-			Path: trimPrefix,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			realPath, isDir, _ := idx.GetRealPath(tt.paths...)
-			adjustedRealPath := strings.TrimPrefix(realPath, trimPrefix)
-			if tt.want.path != adjustedRealPath || tt.want.isDir != isDir {
-				t.Errorf("expected %v:%v but got: %v:%v", tt.want.path, tt.want.isDir, adjustedRealPath, isDir)
-			}
-		})
-	}
-}
-
-// Regression: PUT / save must not os.Chmod to PermFile for existing files, or +x (and other mode bits) are lost (#2309).
-func TestWriteFilePreservesExecutableBit(t *testing.T) {
-	cacheDir := t.TempDir()
-	originalCache := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = cacheDir
-	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
-
-	fileutils.SetFsPermissions(0o644, 0o755)
-
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_writefile_exec", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	root := t.TempDir()
-	scriptName := "backupscript.sh"
-	scriptAbs := filepath.Join(root, scriptName)
-	if err := os.WriteFile(scriptAbs, []byte("#!/bin/sh\necho hi\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	sourceName := "test_writefile_exec"
-	indexing.Initialize(&settings.Source{
-		Name: sourceName,
-		Path: root,
-	}, false, false)
-
-	idx := indexing.GetIndex(sourceName)
-	if idx == nil {
-		t.Fatal("Failed to get test index")
-	}
-	stopPoll := startScannerStatusPoll(t, idx, 1)
-	defer stopPoll()
-	waitForScannerReady(t, idx)
-
-	indexPath := "/" + scriptName
-	if err := WriteFile(sourceName, indexPath, strings.NewReader("#!/bin/sh\necho bye\n")); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-
-	st, err := os.Stat(scriptAbs)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if st.Mode()&0o111 == 0 {
-		t.Fatalf("executable bits cleared after save: mode=%v", st.Mode())
-	}
-
-	indexing.StopAllScanners()
-	time.Sleep(50 * time.Millisecond)
-	indexing.ClearTestIndices()
-}
-
-func TestWriteFileRejectsExistingDirectory(t *testing.T) {
-	cacheDir := t.TempDir()
-	originalCache := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = cacheDir
-	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
-
-	fileutils.SetFsPermissions(0o644, 0o755)
-
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_writefile_isdir", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	root := t.TempDir()
-	dirName := "folder"
-	if err := os.Mkdir(filepath.Join(root, dirName), 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	sourceName := "test_writefile_isdir"
-	indexing.Initialize(&settings.Source{
-		Name: sourceName,
-		Path: root,
-	}, false, false)
-
-	idx := indexing.GetIndex(sourceName)
-	if idx == nil {
-		t.Fatal("Failed to get test index")
-	}
-	stopPoll := startScannerStatusPoll(t, idx, 1)
-	defer stopPoll()
-	waitForScannerReady(t, idx)
-
-	err := WriteFile(sourceName, "/"+dirName, strings.NewReader("file content"))
-	if err == nil {
-		t.Fatal("expected error when path is an existing directory")
-	}
-	if !errors.Is(err, liberrors.ErrIsDirectory) {
-		t.Fatalf("expected ErrIsDirectory, got: %v", err)
-	}
-
-	indexing.StopAllScanners()
-	time.Sleep(50 * time.Millisecond)
-	indexing.ClearTestIndices()
-}
-
-func TestSortItems(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    iteminfo.FileInfo
-		expected iteminfo.FileInfo
-	}{
-		{
-			name: "Numeric and Lexicographical Sorting",
-			input: iteminfo.FileInfo{
-				Folders: []iteminfo.ItemInfo{
-					{Name: "10.txt"},
-					{Name: "2.txt"},
-					{Name: "apple"},
-					{Name: "Banana"},
-				},
-				Files: []iteminfo.ExtendedItemInfo{
-					{ItemInfo: iteminfo.ItemInfo{Name: "File2.txt"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "File10.txt"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "File1"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "banana"}},
-				},
-			},
-			expected: iteminfo.FileInfo{
-				Folders: []iteminfo.ItemInfo{
-					{Name: "2.txt"},
-					{Name: "10.txt"},
-					{Name: "apple"},
-					{Name: "Banana"},
-				},
-				Files: []iteminfo.ExtendedItemInfo{
-					{ItemInfo: iteminfo.ItemInfo{Name: "banana"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "File1"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "File10.txt"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "File2.txt"}},
-				},
-			},
-		},
-		{
-			name: "Only Lexicographical Sorting",
-			input: iteminfo.FileInfo{
-				Folders: []iteminfo.ItemInfo{
-					{Name: "dog.txt"},
-					{Name: "Cat.txt"},
-					{Name: "apple"},
-				},
-				Files: []iteminfo.ExtendedItemInfo{
-					{ItemInfo: iteminfo.ItemInfo{Name: "Zebra"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "apple"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "cat"}},
-				},
-			},
-			expected: iteminfo.FileInfo{
-				Folders: []iteminfo.ItemInfo{
-					{Name: "apple"},
-					{Name: "Cat.txt"},
-					{Name: "dog.txt"},
-				},
-				Files: []iteminfo.ExtendedItemInfo{
-					{ItemInfo: iteminfo.ItemInfo{Name: "apple"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "cat"}},
-					{ItemInfo: iteminfo.ItemInfo{Name: "Zebra"}},
-				},
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			test.input.SortItems()
-
-			getFolderNames := func(items []iteminfo.ItemInfo) []string {
-				names := []string{}
-				for _, folder := range items {
-					names = append(names, folder.Name)
-				}
-				return names
-			}
-
-			getFileNames := func(items []iteminfo.ExtendedItemInfo) []string {
-				names := []string{}
-				for _, file := range items {
-					names = append(names, file.Name)
-				}
-				return names
-			}
-
-			actualFolderNames := getFolderNames(test.input.Folders)
-			expectedFolderNames := getFolderNames(test.expected.Folders)
-
-			if !reflect.DeepEqual(actualFolderNames, expectedFolderNames) {
-				t.Errorf("Folders not sorted correctly.\nGot: %v\nExpected: %v", actualFolderNames, expectedFolderNames)
-			}
-
-			actualFileNames := getFileNames(test.input.Files)
-			expectedFileNames := getFileNames(test.expected.Files)
-
-			if !reflect.DeepEqual(actualFileNames, expectedFileNames) {
-				t.Errorf("Files not sorted correctly.\nGot: %v\nExpected: %v", actualFileNames, expectedFileNames)
-			}
-		})
-	}
-}
-
-// TestDeleteFilesCacheClearing was removed because cache clearing is not performed
-// per design decision - RealPathCache is auxiliary and doesn't need clearing
-
-func TestOverrideDirectoryToFile(t *testing.T) {
-	// Use a temporary directory for cache to avoid creating directories in the source tree
-	tmpDir := t.TempDir()
-	originalCacheDir := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = tmpDir
-	defer func() {
-		settings.Config.Server.CacheDir = originalCacheDir
-	}()
-
-	// Ensure fileutils permissions are set (needed by NewTempDB)
-	if fileutils.PermDir == 0 {
-		fileutils.SetFsPermissions(0644, 0755)
-	}
-
-	// Initialize the database first (use test helper to avoid permission issues)
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_file", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	// Initialize the index with scanning disabled to prevent background scanner interference
-	indexing.Initialize(&settings.Source{
-		Name: "test",
-		Path: "/mock/path",
-	}, true, false) // true for mock mode, false for isNewDb
-
-	// Get the index and set up mock data
-	idx := indexing.GetIndex("test")
-	if idx == nil { //nolint:staticcheck // t.Fatal terminates execution
-		t.Fatal("Failed to get test index")
-	}
-
-	// Wait for initial scanner to complete (it will fail on /mock/path but needs to finish cleanup)
-	// This ensures batchItems is nil before we start testing
-	for i := 0; i < 50; i++ { // Wait up to 500ms
-		time.Sleep(10 * time.Millisecond)
-		status := idx.GetScannerStatus()
-		if status["status"] == "ready" || status["status"] == "unavailable" {
-			break
-		}
-	}
-
-	// Create mock directory structure using UpdateMetadata
-	rootInfo := &iteminfo.FileInfo{
-		Path: "/",
-		ItemInfo: iteminfo.ItemInfo{
-			Name: "/",
-			Type: "directory",
-		},
-		Folders: []iteminfo.ItemInfo{
-			{Name: "Test Object", Type: "directory"},
-		},
-	}
-	idx.UpdateMetadata(rootInfo, nil, true) // nil scanner for test
-
-	// Delete the old directory item from the database before replacing it with a file
-	idx.DeleteMetadata("/Test Object", true, false)
-
-	// Simulate the directory-to-file override by updating the mock data
-	// Remove the directory from the parent's Folders slice
-	rootInfo.Folders = []iteminfo.ItemInfo{} // Clear folders
-
-	// Add the file to the parent's Files slice
-	rootInfo.Files = []iteminfo.ExtendedItemInfo{
-		{
-			ItemInfo: iteminfo.ItemInfo{
-				Name: "Test Object",
-				Size: 25, // Length of "This is test file content"
-			},
-		},
-	}
-	idx.UpdateMetadata(rootInfo, nil, true) // nil scanner for test
-
-	// Verify the directory was replaced with a file in the mock data
-	rootInfo, exists := idx.GetMetadataInfo("/", true, false)
-	if !exists {
-		t.Fatal("Root metadata not found")
-	}
-
-	// Check that the directory was removed from Folders
-	foundDir := false
-	for _, folder := range rootInfo.Folders {
-		if folder.Name == "Test Object" {
-			foundDir = true
-			break
-		}
-	}
-	if foundDir {
-		t.Error("Directory 'Test Object' should have been removed from Folders")
-	}
-
-	// Check that the file was added to Files
-	foundFile := false
-	for _, file := range rootInfo.Files {
-		if file.Name == "Test Object" {
-			foundFile = true
-			if file.Size != 25 {
-				t.Errorf("Expected file size 25, got %d", file.Size)
-			}
-			break
-		}
-	}
-	if !foundFile {
-		t.Error("File 'Test Object' should have been added to Files")
-	}
-}
-
-func TestOverrideFileToDirectory(t *testing.T) {
-	// Use a temporary directory for cache to avoid creating directories in the source tree
-	tmpDir := t.TempDir()
-	originalCacheDir := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = tmpDir
-	defer func() {
-		settings.Config.Server.CacheDir = originalCacheDir
-	}()
-
-	// Ensure fileutils permissions are set (needed by NewTempDB)
-	if fileutils.PermDir == 0 {
-		fileutils.SetFsPermissions(0644, 0755)
-	}
-
-	// Initialize the database first (use test helper to avoid permission issues)
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_file", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	// Initialize the index in mock mode (no filesystem operations)
-	indexing.Initialize(&settings.Source{
-		Name: "test",
-		Path: "/mock/path",
-	}, true, false) // true for mock mode, false for isNewDb
-
-	// Get the index and set up mock data
-	idx := indexing.GetIndex("test")
-	if idx == nil { //nolint:staticcheck // t.Fatal terminates execution
-		t.Fatal("Failed to get test index")
-	}
-
-	// Wait for initial scanner to complete (it will fail on /mock/path but needs to finish cleanup)
-	// This ensures batchItems is nil before we start testing
-	for i := 0; i < 50; i++ { // Wait up to 500ms
-		time.Sleep(10 * time.Millisecond)
-		status := idx.GetScannerStatus()
-		if status["status"] == "ready" || status["status"] == "unavailable" {
-			break
-		}
-	}
-
-	// Create mock directory structure with a file using UpdateMetadata
-	rootInfo := &iteminfo.FileInfo{
-		Path: "/",
-		ItemInfo: iteminfo.ItemInfo{
-			Name: "/",
-			Type: "directory",
-		},
-		Files: []iteminfo.ExtendedItemInfo{
-			{ItemInfo: iteminfo.ItemInfo{Name: "Test Object", Size: 12}}, // Length of "test content"
-		},
-	}
-	idx.UpdateMetadata(rootInfo, nil, true) // nil scanner for test
-
-	// Delete the old file item from the database before replacing it with a directory
-	idx.DeleteMetadata("/Test Object", false, false)
-
-	// Simulate the file-to-directory override by updating the mock data
-	// Remove the file from the parent's Files slice
-	rootInfo.Files = []iteminfo.ExtendedItemInfo{} // Clear files
-
-	// Add the directory to the parent's Folders slice
-	rootInfo.Folders = []iteminfo.ItemInfo{
-		{
-			Name: "Test Object",
-			Type: "directory",
-		},
-	}
-	idx.UpdateMetadata(rootInfo, nil, true) // nil scanner for test
-
-	// Verify the file was replaced with a directory in the mock data
-	rootInfo, exists := idx.GetMetadataInfo("/", true, false)
-	if !exists {
-		t.Fatal("Root metadata not found")
-	}
-
-	// Check that the file was removed from Files
-	foundFile := false
-	for _, file := range rootInfo.Files {
-		if file.Name == "Test Object" {
-			foundFile = true
-			break
-		}
-	}
-	if foundFile {
-		t.Error("File 'Test Object' should have been removed from Files")
-	}
-
-	// Check that the directory was added to Folders
-	foundDir := false
-	for _, folder := range rootInfo.Folders {
-		if folder.Name == "Test Object" {
-			foundDir = true
-			if folder.Type != "directory" {
-				t.Errorf("Expected directory type, got %s", folder.Type)
-			}
-			break
-		}
-	}
-	if !foundDir {
-		t.Error("Directory 'Test Object' should have been added to Folders")
-	}
-}
-
-// TestDeleteFilesRootProtection tests that DeleteFiles refuses to delete
-// the source root directory itself, preventing catastrophic data loss.
-// This is a regression test for the safety guard added to prevent accidental
-// deletion of the entire source directory.
-func TestDeleteFilesRootProtection(t *testing.T) {
-	// Use a temporary directory for cache
-	tmpDir := t.TempDir()
-	originalCacheDir := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = tmpDir
-	defer func() {
-		settings.Config.Server.CacheDir = originalCacheDir
-	}()
-
-	// Ensure fileutils permissions are set
-	if fileutils.PermDir == 0 {
-		fileutils.SetFsPermissions(0644, 0755)
-	}
-
-	// Initialize the database
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_root_protection", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	// Create a real temporary directory to use as source root
-	realTmpDir := t.TempDir()
-
-	// Initialize the index with a real path
-	indexing.Initialize(&settings.Source{
-		Name: "test_root_protection",
-		Path: realTmpDir,
-	}, false, false) // false for mock mode (real path), false for isNewDb
-
-	// Wait for scanner to be ready
-	idx := indexing.GetIndex("test_root_protection")
-	if idx == nil {
-		t.Fatal("Failed to get test index")
-	}
-
-	// Wait for scanner to finish
-	for i := 0; i < 50; i++ {
-		time.Sleep(10 * time.Millisecond)
-		status := idx.GetScannerStatus()
-		if status["status"] == "ready" || status["status"] == "unavailable" {
-			break
-		}
-	}
-
-	// Test: Attempting to delete the root directory should return an error
-	err := DeleteFiles("test_root_protection", realTmpDir, true)
-	if err == nil {
-		t.Error("DeleteFiles should return an error when trying to delete root directory")
-	}
-
-	// Verify the error message contains expected text
-	expectedErrMsg := "refusing to delete source root directory"
-	if err != nil && !strings.Contains(err.Error(), expectedErrMsg) {
-		t.Errorf("Expected error message to contain '%s', got: %v", expectedErrMsg, err.Error())
-	}
-
-	// Test with trailing slash - should still be blocked
-	err = DeleteFiles("test_root_protection", realTmpDir+"/", true)
-	if err == nil {
-		t.Error("DeleteFiles should return an error for root directory with trailing slash")
-	}
-
-	// Test with cleaned path variations
-	err = DeleteFiles("test_root_protection", realTmpDir+"/.", true)
-	if err == nil {
-		t.Error("DeleteFiles should return an error for root directory with /. suffix")
-	}
-}
-
-// TestDeleteFilesSubfolderWithRootName tests that deleting a subfolder
-// with the same name as the root directory works correctly and doesn't
-// accidentally delete the root.
-// Regression test for path handling bug where /srv/srv could be mistaken for /srv.
-func TestDeleteFilesSubfolderWithRootName(t *testing.T) {
-	for iter := 1; iter <= raceStressIterations; iter++ {
-		iter := iter
-		t.Run(fmt.Sprintf("stress-iter-%d", iter), func(t *testing.T) {
-			runDeleteFilesSubfolderWithRaceStress(t, iter)
-		})
-	}
-}
-
-const (
-	raceStressIterations   = 3
-	raceStatusPollInterval = 5 * time.Millisecond
-	waitStatusMaxTries     = 100
-	waitStatusSleep        = 50 * time.Millisecond
-)
-
-func runDeleteFilesSubfolderWithRaceStress(t *testing.T, iter int) {
-	t.Helper()
-	start := time.Now()
-	t.Logf("iteration %d: start", iter)
-
-	cacheDir := t.TempDir()
-	originalCache := settings.Config.Server.CacheDir
-	settings.Config.Server.CacheDir = cacheDir
-	t.Cleanup(func() { settings.Config.Server.CacheDir = originalCache })
-
-	if fileutils.PermDir == 0 {
-		fileutils.SetFsPermissions(0644, 0755)
-	}
-
-	if indexing.GetIndexDB() == nil {
-		db, _, err := dbsql.NewIndexDB("test_subfolder_rootname", "OFF", 1000, 32, false)
-		if err != nil {
-			t.Fatalf("Failed to create test database: %v", err)
-		}
-		indexing.SetIndexDBForTesting(db)
-	}
-
-	realTmpDir := t.TempDir()
-	subfolderName := filepath.Base(realTmpDir)
-	subfolderPath := filepath.Join(realTmpDir, subfolderName)
-
-	if err := os.Mkdir(subfolderPath, 0755); err != nil {
-		t.Fatalf("Failed to create subfolder: %v", err)
-	}
-
-	testFile := filepath.Join(subfolderPath, "test.txt")
-	if err := os.WriteFile(testFile, []byte("test content"), 0644); err != nil {
-		t.Fatalf("Failed to create test file: %v", err)
-	}
-
-	sourceName := fmt.Sprintf("test_subfolder_rootname-%d", iter)
-	indexing.Initialize(&settings.Source{
-		Name: sourceName,
-		Path: realTmpDir,
-	}, false, false)
-
-	idx := indexing.GetIndex(sourceName)
-	if idx == nil {
-		t.Fatalf("Failed to get test index for %s", sourceName)
-	}
-
-	stopPolling := startScannerStatusPoll(t, idx, iter)
-	defer stopPolling()
-
-	waitForScannerReady(t, idx)
-
-	err := DeleteFiles(sourceName, subfolderPath, true)
-	stopPolling()
-
-	t.Logf("iteration %d: DeleteFiles finished in %s (err=%v)", iter, time.Since(start), err)
-
-	if err != nil {
-		t.Fatalf("DeleteFiles should succeed for subfolder with root-like name, got error: %v", err)
-	}
-
-	if _, err := os.Stat(subfolderPath); !os.IsNotExist(err) {
-		t.Fatal("Subfolder should have been deleted")
-	}
-
-	if _, err := os.Stat(realTmpDir); os.IsNotExist(err) {
-		t.Fatal("Root directory should NOT have been deleted")
-	}
-
-	indexing.StopAllScanners()
-	// Give scanners time to finish their cleanup (defer blocks in executeScan)
-	time.Sleep(100 * time.Millisecond)
-	indexing.ClearTestIndices()
-	t.Logf("iteration %d: cleaned scanners and indices", iter)
-}
-
-func waitForScannerReady(t *testing.T, idx *indexing.Index) {
-	t.Helper()
-	// Give the scanners a moment to initialize, but don't wait for full "ready" status
-	// The initial scan can take longer than the test timeout, but DeleteFiles will work
-	// as long as the scanners are initialized and running
-	time.Sleep(500 * time.Millisecond)
-	
-	// Verify scanners exist
-	status := idx.GetScannerStatus()
-	if totalScanners, ok := status["totalScanners"].(int); !ok || totalScanners == 0 {
-		t.Fatal("No scanners were created")
-	}
-	t.Log("Scanners initialized, proceeding with delete operation")
-}
-
-func startScannerStatusPoll(t *testing.T, idx *indexing.Index, iter int) func() {
-	t.Helper()
-	stop := make(chan struct{})
-	done := make(chan struct{})
-	var once sync.Once
-
-	go func() {
-		ticker := time.NewTicker(raceStatusPollInterval)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-stop:
-				close(done)
-				return
-			case <-ticker.C:
-				idx.GetScannerStatus()
-			}
-		}
-	}()
-
-	return func() {
-		once.Do(func() {
-			close(stop)
-			<-done
-			t.Logf("iteration %d: poll watcher stopped", iter)
-		})
-	}
-}

backend/adapters/fs/files/user.go

@@ -1,62 +0,0 @@
-package files
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// MakeUserDir makes the user directory according to settings.
-func MakeUserDir(fullPath string) error {
-	if err := os.MkdirAll(fullPath, os.ModePerm); err != nil {
-		return err
-	}
-	return nil
-}
-
-func MakeUserDirs(u *users.User, createDir bool) error {
-	cleanedUserName := users.CleanUsername(u.Username)
-	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
-		return fmt.Errorf("MakeUserDirs: invalid user for home dir creation: [%s]", u.Username)
-	}
-	for i, scope := range u.Scopes {
-		info, ok := users.ResolveSourceKey(scope.Name)
-		if !ok {
-			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
-		}
-		source, ok := settings.Config.Server.SourceMap[info.Path]
-		if !ok {
-			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
-		}
-		fullPath := filepath.Join(source.Path, scope.Scope)
-		parentDir := filepath.Dir(fullPath)
-		if createDir {
-			if source.Config.CreateUserDir && filepath.Base(scope.Scope) != cleanedUserName {
-				scope.Scope = utils.JoinPathAsUnix(scope.Scope, cleanedUserName)
-				fullPath = filepath.Join(fullPath, cleanedUserName)
-			}
-			if !Exists(parentDir) {
-				if err := MakeUserDir(parentDir); err != nil {
-					logger.Errorf("MakeUserDirs: failed to create parent scope directory: %s - %v", scope.Scope, err)
-					continue
-				}
-			}
-			err := MakeUserDir(fullPath)
-			if err != nil {
-				return fmt.Errorf("MakeUserDirs: failed to create user home dir: %s", err)
-			}
-		} else {
-			if !Exists(fullPath) {
-				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", fullPath)
-			}
-		}
-
-		u.Scopes[i] = scope
-	}
-	return nil
-}

backend/adapters/fs/fileutils/assets.go

@@ -1,36 +0,0 @@
-package fileutils
-
-import (
-	"io/fs"
-	"net/http"
-)
-
-var (
-	assetFs fs.FS
-)
-
-// Custom dirFS to handle both embedded and non-embedded file systems
-type dirFS struct {
-	http.Dir
-}
-
-// Implement the Open method for dirFS, which wraps http.Dir
-func (d dirFS) Open(name string) (fs.File, error) {
-	return d.Dir.Open(name)
-}
-
-// InitAssetFS initializes the asset filesystem for the application
-// This should be called once during startup before http or preview services start
-func InitAssetFS(embeddedAssets fs.FS, useEmbedded bool) {
-	if useEmbedded {
-		assetFs = embeddedAssets
-	} else {
-		// Dev mode: Serve files from http/dist directory
-		assetFs = dirFS{Dir: http.Dir("http/dist")}
-	}
-}
-
-// GetAssetFS returns the initialized asset filesystem
-func GetAssetFS() fs.FS {
-	return assetFs
-}

backend/adapters/fs/fileutils/partition_unix.go

@@ -1,44 +0,0 @@
-//go:build !windows
-
-package fileutils
-
-import (
-	"syscall"
-)
-
-// GetPartitionSize returns the filesystem size for Unix systems
-func GetPartitionSize(path string) (uint64, error) {
-	var stat syscall.Statfs_t
-	err := syscall.Statfs(path, &stat)
-	if err != nil {
-		return 0, err
-	}
-	// Total size in bytes: Blocks * Block size
-	total := uint64(stat.Blocks) * uint64(stat.Bsize)
-	return total, nil
-}
-
-// GetFreeSpace returns the available free space for Unix systems
-func GetFreeSpace(path string) (uint64, error) {
-	var stat syscall.Statfs_t
-	err := syscall.Statfs(path, &stat)
-	if err != nil {
-		return 0, err
-	}
-	// Available free space in bytes: Available blocks * Block size
-	free := uint64(stat.Bavail) * uint64(stat.Bsize)
-	return free, nil
-}
-
-// GetPartitionUsed returns the used space for Unix systems (total - free)
-func GetPartitionUsed(path string) (uint64, error) {
-	var stat syscall.Statfs_t
-	err := syscall.Statfs(path, &stat)
-	if err != nil {
-		return 0, err
-	}
-	total := uint64(stat.Blocks) * uint64(stat.Bsize)
-	free := uint64(stat.Bavail) * uint64(stat.Bsize)
-	used := total - free
-	return used, nil
-}

backend/adapters/fs/fileutils/partition_windows.go

@@ -1,50 +0,0 @@
-//go:build windows
-
-package fileutils
-
-import (
-	"golang.org/x/sys/windows"
-)
-
-// GetPartitionSize returns the filesystem size for Windows systems
-func GetPartitionSize(path string) (uint64, error) {
-	pathPtr, err := windows.UTF16PtrFromString(path)
-	if err != nil {
-		return 0, err
-	}
-	var freeBytes, totalBytes, totalFreeBytes uint64
-	err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytes, &totalBytes, &totalFreeBytes)
-	if err != nil {
-		return 0, err
-	}
-	return totalBytes, nil
-}
-
-// GetFreeSpace returns the available free space for Windows systems
-func GetFreeSpace(path string) (uint64, error) {
-	pathPtr, err := windows.UTF16PtrFromString(path)
-	if err != nil {
-		return 0, err
-	}
-	var freeBytes, totalBytes, totalFreeBytes uint64
-	err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytes, &totalBytes, &totalFreeBytes)
-	if err != nil {
-		return 0, err
-	}
-	return freeBytes, nil
-}
-
-// GetPartitionUsed returns the used space for Windows systems (total - free)
-func GetPartitionUsed(path string) (uint64, error) {
-	pathPtr, err := windows.UTF16PtrFromString(path)
-	if err != nil {
-		return 0, err
-	}
-	var freeBytes, totalBytes, totalFreeBytes uint64
-	err = windows.GetDiskFreeSpaceEx(pathPtr, &freeBytes, &totalBytes, &totalFreeBytes)
-	if err != nil {
-		return 0, err
-	}
-	used := totalBytes - freeBytes
-	return used, nil
-}

backend/auth/auth.go

@@ -1,65 +1,15 @@
 package auth
 
 import (
-	"fmt"
 	"net/http"
-	"time"
 
-	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/access"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/users"
 )
 
 // Auther is the authentication interface.
 type Auther interface {
 	// Auth is called to authenticate a request.
 	Auth(r *http.Request, userStore *users.Storage) (*users.User, error)
-}
-
-const FB_ISSUER = "FileBrowser Quantum" // don't change
-
-// IsRevokedApiToken checks if a token is in the revoked list.
-func IsRevokedApiToken(accessStore *access.Storage, token string) bool {
-	if accessStore == nil {
-		return false
-	}
-	return accessStore.IsTokenRevoked(token)
-}
-
-// RevokeApiToken adds a token to the revoked list.
-func RevokeApiToken(accessStore *access.Storage, token string) error {
-	if accessStore == nil {
-		return fmt.Errorf("access storage not available")
-	}
-	return accessStore.RevokeToken(token)
-}
-
-func MakeSignedTokenAPI(user *users.User, name string, duration time.Duration, perms users.Permissions, minimal bool) (string, users.AuthToken, error) {
-	if _, ok := user.Tokens[name]; ok {
-		return "", users.AuthToken{}, fmt.Errorf("key already exists with same name %v ", name)
-	}
-	now := time.Now()
-	expires := now.Add(duration)
-	// Create minimal token with only JWT standard claims
-	claim := users.AuthToken{
-		MinimalAuthToken: users.MinimalAuthToken{
-			RegisteredClaims: jwt.RegisteredClaims{
-				IssuedAt:  jwt.NewNumericDate(now),
-				ExpiresAt: jwt.NewNumericDate(expires),
-				Issuer:    FB_ISSUER,
-			},
-		},
-	}
-	if !minimal {
-		claim.Permissions = perms
-		claim.BelongsTo = user.ID
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claim)
-	tokenString, err := token.SignedString([]byte(settings.Config.Auth.Key))
-	if err != nil {
-		return "", users.AuthToken{}, err
-	}
-	return tokenString, claim, nil
-
+	// LoginPage indicates if this auther needs a login page.
+	LoginPage() bool
 }

backend/auth/hook.go

@@ -0,0 +1,277 @@
+package auth
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/users"
+)
+
+type hookCred struct {
+	Password string `json:"password"`
+	Username string `json:"username"`
+}
+
+// HookAuth is a hook implementation of an Auther.
+type HookAuth struct {
+	Users    users.Store        `json:"-"`
+	Settings *settings.Settings `json:"-"`
+	Server   *settings.Server   `json:"-"`
+	Cred     hookCred           `json:"-"`
+	Fields   hookFields         `json:"-"`
+	Command  string             `json:"command"`
+}
+
+// Auth authenticates the user via a json in content body.
+func (a *HookAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
+	var cred hookCred
+
+	if r.Body == nil {
+		return nil, os.ErrPermission
+	}
+
+	err := json.NewDecoder(r.Body).Decode(&cred)
+	if err != nil {
+		logger.Error("decode body error")
+		return nil, os.ErrPermission
+	}
+
+	a.Users = usr
+	a.Settings = &settings.Config
+	a.Server = &settings.Config.Server
+	a.Cred = cred
+
+	action, err := a.RunCommand()
+	if err != nil {
+		return nil, err
+	}
+	switch action {
+	case "auth":
+		u, err := a.SaveUser()
+		if err != nil {
+			return nil, err
+		}
+		return u, nil
+	case "block":
+		logger.Error("block error")
+
+		return nil, os.ErrPermission
+	case "pass":
+		logger.Error("pass error")
+
+		u, err := a.Users.Get(a.Cred.Username)
+		if err != nil {
+			return nil, fmt.Errorf("unable to get user from store: %v", err)
+		}
+		err = users.CheckPwd(cred.Password, u.Password)
+		if err != nil {
+			return nil, err
+		}
+		return u, nil
+	default:
+		return nil, fmt.Errorf("invalid hook action: %s", action)
+	}
+}
+
+// LoginPage tells that hook auth requires a login page.
+func (a *HookAuth) LoginPage() bool {
+	return true
+}
+
+// RunCommand starts the hook command and returns the action
+func (a *HookAuth) RunCommand() (string, error) {
+	command := strings.Split(a.Command, " ")
+	envMapping := func(key string) string {
+		switch key {
+		case "USERNAME":
+			return a.Cred.Username
+		case "PASSWORD":
+			return a.Cred.Password
+		default:
+			return os.Getenv(key)
+		}
+	}
+	for i, arg := range command {
+		if i == 0 {
+			continue
+		}
+		command[i] = os.Expand(arg, envMapping)
+	}
+
+	cmd := exec.Command(command[0], command[1:]...) //nolint:gosec
+	cmd.Env = append(os.Environ(), fmt.Sprintf("USERNAME=%s", a.Cred.Username))
+	cmd.Env = append(cmd.Env, fmt.Sprintf("PASSWORD=%s", a.Cred.Password))
+	out, err := cmd.Output()
+	if err != nil {
+		return "", err
+	}
+
+	a.GetValues(string(out))
+
+	return a.Fields.Values["hook.action"], nil
+}
+
+// GetValues creates a map with values from the key-value format string
+func (a *HookAuth) GetValues(s string) {
+	m := map[string]string{}
+
+	// make line breaks consistent on Windows platform
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+
+	// iterate input lines
+	for _, val := range strings.Split(s, "\n") {
+		v := strings.SplitN(val, "=", 2) //nolint: gomnd
+
+		// skips non key and value format
+		if len(v) != 2 { //nolint: gomnd
+			continue
+		}
+
+		fieldKey := strings.TrimSpace(v[0])
+		fieldValue := strings.TrimSpace(v[1])
+
+		if a.Fields.IsValid(fieldKey) {
+			m[fieldKey] = fieldValue
+		}
+	}
+
+	a.Fields.Values = m
+}
+
+// SaveUser updates the existing user or creates a new one when not found
+func (a *HookAuth) SaveUser() (*users.User, error) {
+	u, err := a.Users.Get(a.Cred.Username)
+	if err != nil && err != errors.ErrNotExist {
+		return nil, err
+	}
+
+	if u == nil {
+		// create user with the provided credentials
+		d := &users.User{
+			NonAdminEditable: users.NonAdminEditable{
+				Password:    a.Cred.Password,
+				Locale:      a.Settings.UserDefaults.Locale,
+				ViewMode:    a.Settings.UserDefaults.ViewMode,
+				SingleClick: a.Settings.UserDefaults.SingleClick,
+				ShowHidden:  a.Settings.UserDefaults.ShowHidden,
+			},
+			Username: a.Cred.Username,
+			Perm:     a.Settings.UserDefaults.Perm,
+		}
+		u = a.GetUser(d)
+
+		err = a.Users.Save(u, false)
+		if err != nil {
+			return nil, err
+		}
+		return u, nil
+	}
+	err = users.CheckPwd(a.Cred.Password, u.Password)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(a.Fields.Values) > 1 {
+		u = a.GetUser(u)
+		// update user with provided fields
+		err := a.Users.Update(u, true)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return u, nil
+}
+
+// GetUser returns a User filled with hook values or provided defaults
+func (a *HookAuth) GetUser(d *users.User) *users.User {
+	// adds all permissions when user is admin
+	isAdmin := d.Perm.Admin
+	perms := users.Permissions{
+		Admin:  isAdmin,
+		Modify: isAdmin || d.Perm.Modify,
+		Share:  isAdmin || d.Perm.Share,
+	}
+	user := users.User{
+		NonAdminEditable: users.NonAdminEditable{
+			Password:    d.Password,
+			Locale:      a.Fields.GetString("user.locale", d.Locale),
+			ViewMode:    a.Fields.GetString("user.viewMode", d.ViewMode),
+			SingleClick: a.Fields.GetBoolean("user.singleClick", d.SingleClick),
+			ShowHidden:  a.Fields.GetBoolean("user.showHidden", d.ShowHidden),
+		},
+		ID:           d.ID,
+		Username:     d.Username,
+		Scopes:       d.Scopes,
+		Perm:         perms,
+		LockPassword: true,
+	}
+
+	return &user
+}
+
+// hookFields is used to access fields from the hook
+type hookFields struct {
+	Values map[string]string
+}
+
+// validHookFields contains names of the fields that can be used
+var validHookFields = []string{
+	"hook.action",
+	"user.scope",
+	"user.locale",
+	"user.viewMode",
+	"user.singleClick",
+	"user.sorting.by",
+	"user.sorting.asc",
+	"user.showHidden",
+	"user.perm.admin",
+	"user.perm.modify",
+	"user.perm.share",
+	"user.perm.api",
+}
+
+// IsValid checks if the provided field is on the valid fields list
+func (hf *hookFields) IsValid(field string) bool {
+	for _, val := range validHookFields {
+		if field == val {
+			return true
+		}
+	}
+
+	return false
+}
+
+// GetString returns the string value or provided default
+func (hf *hookFields) GetString(k, dv string) string {
+	val, ok := hf.Values[k]
+	if ok {
+		return val
+	}
+	return dv
+}
+
+// GetBoolean returns the bool value or provided default
+func (hf *hookFields) GetBoolean(k string, dv bool) bool {
+	val, ok := hf.Values[k]
+	if ok {
+		return val == "true"
+	}
+	return dv
+}
+
+// GetArray returns the array value or provided default
+func (hf *hookFields) GetArray(k string, dv []string) []string {
+	val, ok := hf.Values[k]
+	if ok && strings.TrimSpace(val) != "" {
+		return strings.Split(val, " ")
+	}
+	return dv
+}

backend/auth/json.go

@@ -8,32 +8,38 @@ import (
 	"os"
 	"strings"
 
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/users"
 )
 
+type jsonCred struct {
+	Password  string `json:"password"`
+	Username  string `json:"username"`
+	ReCaptcha string `json:"recaptcha"`
+}
+
 // JSONAuth is a json implementation of an Auther.
 type JSONAuth struct {
-	ReCaptcha  *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
-	DisableOtp bool       `json:"disableOtp" yaml:"disableOtp"`
+	ReCaptcha *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
 }
 
 // Auth authenticates the user via a json in content body.
-func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.User, error) {
-	username := r.URL.Query().Get("username")
-	recaptcha := r.URL.Query().Get("recaptcha")
-	password := r.Header.Get("X-Password")
-	totpCode := r.Header.Get("X-Secret")
-	// URL-decode password to support special characters in headers
-	password, err := url.QueryUnescape(password)
+func (a JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.User, error) {
+	var cred jsonCred
+
+	if r.Body == nil {
+		logger.Error("nil body error")
+		return nil, os.ErrPermission
+	}
+	err := json.NewDecoder(r.Body).Decode(&cred)
 	if err != nil {
-		return nil, fmt.Errorf("invalid password encoding: %v", err)
+		logger.Error("decode body error")
+		return nil, os.ErrPermission
 	}
 
 	// If ReCaptcha is enabled, check the code.
-	if auther.ReCaptcha != nil && len(auther.ReCaptcha.Secret) > 0 {
-		ok, err := auther.ReCaptcha.Ok(recaptcha) //nolint:govet
+	if a.ReCaptcha != nil && len(a.ReCaptcha.Secret) > 0 {
+		ok, err := a.ReCaptcha.Ok(cred.ReCaptcha) //nolint:govet
 
 		if err != nil {
 			return nil, err
@@ -43,38 +49,21 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 			return nil, os.ErrPermission
 		}
 	}
-
-	user, getErr := userStore.Get(username)
-	var passwordHash string
-	if getErr != nil {
-		passwordHash = utils.InvalidPasswordHash
-	} else {
-		passwordHash = user.Password
+	u, err := userStore.Get(cred.Username)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get user from store: %v", err)
 	}
-	// always run checkPwd to prevent timing attacks
-	err = utils.CheckPwd(password, passwordHash)
+	err = users.CheckPwd(cred.Password, u.Password)
 	if err != nil {
 		return nil, err
 	}
-	if getErr != nil {
-		return nil, fmt.Errorf("unable to get user from store: %v", err)
-	}
-	if user.TOTPSecret != "" && !auther.DisableOtp {
-		if totpCode == "" {
-			return nil, errors.ErrNoTotpProvided
-		}
-		err = VerifyTotpCode(user, totpCode, userStore)
-		if err != nil {
-			return nil, err
-		}
-	}
 
-	if user.LoginMethod != users.LoginMethodPassword {
-		return nil, errors.ErrWrongLoginMethod
-	}
-
-	return user, nil
+	return u, nil
+}
 
+// LoginPage tells that json auth doesn't require a login page.
+func (a JSONAuth) LoginPage() bool {
+	return true
 }
 
 const reCaptchaAPI = "/recaptcha/api/siteverify"

backend/auth/json_timing_test.go

@@ -1,375 +0,0 @@
-// Package auth_test contains timing attack tests for authentication.
-//
-// These tests verify that the JSON authentication implementation is protected
-// against timing attacks that could leak information about valid usernames.
-//
-// Timing Attack Background:
-// A timing attack is a side-channel attack where an attacker measures how long
-// authentication operations take to determine if a username exists in the system.
-// If authentication fails faster for non-existent users than for valid users
-// with wrong passwords, an attacker can enumerate valid usernames.
-//
-// Protection Mechanism:
-// The json.go Auth() implementation protects against timing attacks by:
-// 1. Always running the bcrypt password comparison, even for non-existent users
-// 2. Using utils.InvalidPasswordHash (a pre-computed bcrypt hash) when the user doesn't exist
-// 3. Ensuring both valid and invalid user authentication paths take similar time
-//
-// Test Coverage:
-// - TestJSONAuth_NoTimingAttack: Statistical analysis of timing differences
-// - TestJSONAuth_InvalidPasswordHashInitialized: Verifies protection is in place
-// - TestJSONAuth_ValidUserVsInvalidUserDirectComparison: Direct comparison test
-package auth_test
-
-import (
-	"fmt"
-	"math"
-	"net/http"
-	"net/url"
-	"testing"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-// mockUserBackend is a simple in-memory user storage for testing.
-type mockUserBackend struct {
-	usersByUsername map[string]*users.User
-	usersByID       map[uint]*users.User
-}
-
-func newMockUserBackend() *mockUserBackend {
-	return &mockUserBackend{
-		usersByUsername: make(map[string]*users.User),
-		usersByID:       make(map[uint]*users.User),
-	}
-}
-
-func (m *mockUserBackend) GetBy(id interface{}) (*users.User, error) {
-	switch v := id.(type) {
-	case string:
-		if user, ok := m.usersByUsername[v]; ok {
-			return user, nil
-		}
-		return nil, fmt.Errorf("user not found: %s", v)
-	case uint:
-		if user, ok := m.usersByID[v]; ok {
-			return user, nil
-		}
-		return nil, fmt.Errorf("user not found: %d", v)
-	default:
-		return nil, fmt.Errorf("invalid id type")
-	}
-}
-
-func (m *mockUserBackend) Gets() ([]*users.User, error) {
-	result := make([]*users.User, 0, len(m.usersByID))
-	for _, user := range m.usersByID {
-		result = append(result, user)
-	}
-	return result, nil
-}
-
-func (m *mockUserBackend) Save(u *users.User, changePass bool, disableScopeChange bool) error {
-	m.usersByUsername[u.Username] = u
-	m.usersByID[u.ID] = u
-	return nil
-}
-
-func (m *mockUserBackend) Update(u *users.User, adminActor bool, fields ...string) error {
-	m.usersByUsername[u.Username] = u
-	m.usersByID[u.ID] = u
-	return nil
-}
-
-func (m *mockUserBackend) DeleteByID(id uint) error {
-	if user, ok := m.usersByID[id]; ok {
-		delete(m.usersByUsername, user.Username)
-		delete(m.usersByID, id)
-		return nil
-	}
-	return fmt.Errorf("user not found: %d", id)
-}
-
-func (m *mockUserBackend) DeleteByUsername(username string) error {
-	if user, ok := m.usersByUsername[username]; ok {
-		delete(m.usersByID, user.ID)
-		delete(m.usersByUsername, username)
-		return nil
-	}
-	return fmt.Errorf("user not found: %s", username)
-}
-
-// setupTestUsers creates a user storage with 2 valid test users
-func setupTestUsers(t *testing.T) *users.Storage {
-	t.Helper()
-
-	// Reduce bcrypt cost for faster tests (default is 10, min is 4)
-	// This significantly speeds up password hashing during tests
-	originalCost := utils.BcryptCost
-	utils.BcryptCost = 4 // Minimum bcrypt cost for testing
-	t.Cleanup(func() {
-		utils.BcryptCost = originalCost // Restore original cost after test
-	})
-
-	// Initialize InvalidPasswordHash to prevent timing attacks
-	// This simulates the application startup initialization
-	err := utils.SetInvalidPasswordHash()
-	if err != nil {
-		t.Fatalf("Failed to set invalid password hash: %v", err)
-	}
-
-	backend := newMockUserBackend()
-	storage := users.NewStorage(backend)
-
-	// Create two valid users with hashed passwords
-	password1Hash, err := utils.HashPwd("password123")
-	if err != nil {
-		t.Fatalf("Failed to hash password: %v", err)
-	}
-
-	password2Hash, err := utils.HashPwd("securepass456")
-	if err != nil {
-		t.Fatalf("Failed to hash password: %v", err)
-	}
-
-	user1 := &users.User{
-		ID:       1,
-		Username: "admin",
-		NonAdminEditable: users.NonAdminEditable{
-			Password: password1Hash,
-		},
-		LoginMethod: users.LoginMethodPassword,
-	}
-
-	user2 := &users.User{
-		ID:       2,
-		Username: "testuser",
-		NonAdminEditable: users.NonAdminEditable{
-			Password: password2Hash,
-		},
-		LoginMethod: users.LoginMethodPassword,
-	}
-
-	err = storage.Save(user1, false, false)
-	if err != nil {
-		t.Fatalf("Failed to save user1: %v", err)
-	}
-
-	err = storage.Save(user2, false, false)
-	if err != nil {
-		t.Fatalf("Failed to save user2: %v", err)
-	}
-
-	return storage
-}
-
-// measureAuthTime measures the time taken to authenticate with given credentials
-func measureAuthTime(t *testing.T, auther auth.JSONAuth, userStore *users.Storage, username, password string) time.Duration {
-	t.Helper()
-
-	// Create a mock HTTP request
-	req, err := http.NewRequest("POST", "/api/auth/login?username="+url.QueryEscape(username), nil)
-	if err != nil {
-		t.Fatalf("Failed to create request: %v", err)
-	}
-	req.Header.Set("X-Password", url.QueryEscape(password))
-
-	start := time.Now()
-	_, _ = auther.Auth(req, userStore)
-	elapsed := time.Since(start)
-
-	return elapsed
-}
-
-// TestJSONAuth_NoTimingAttack tests that authentication timing does not leak user existence
-func TestJSONAuth_NoTimingAttack(t *testing.T) {
-	storage := setupTestUsers(t)
-	auther := auth.JSONAuth{}
-
-	// Test cases: mix of valid and invalid usernames
-	testCases := []struct {
-		username string
-		isValid  bool
-	}{
-		{"admin", true},
-		{"testuser", true},
-		{"nonexistent1", false},
-		{"invaliduser", false},
-		{"notauser", false},
-		{"fakeadmin", false},
-	}
-
-	// Number of samples per test case for statistical analysis
-	samplesPerCase := 5
-
-	// Collect timing measurements
-	measurements := make(map[string][]time.Duration)
-	for _, tc := range testCases {
-		measurements[tc.username] = make([]time.Duration, 0, samplesPerCase)
-	}
-
-	// Run multiple iterations to gather statistical data
-	for i := 0; i < samplesPerCase; i++ {
-		// Randomize order to avoid cache effects
-		for _, tc := range testCases {
-			elapsed := measureAuthTime(t, auther, storage, tc.username, "wrongpassword123")
-			measurements[tc.username] = append(measurements[tc.username], elapsed)
-		}
-	}
-
-	// Calculate statistics for each test case
-	type stats struct {
-		mean   time.Duration
-		stddev time.Duration
-		min    time.Duration
-		max    time.Duration
-	}
-
-	calculateStats := func(durations []time.Duration) stats {
-		if len(durations) == 0 {
-			return stats{}
-		}
-
-		// Calculate mean
-		var sum time.Duration
-		for _, d := range durations {
-			sum += d
-		}
-		mean := sum / time.Duration(len(durations))
-
-		// Calculate standard deviation
-		var variance float64
-		for _, d := range durations {
-			diff := float64(d - mean)
-			variance += diff * diff
-		}
-		variance /= float64(len(durations))
-		stddev := time.Duration(math.Sqrt(variance))
-
-		// Find min and max
-		min := durations[0]
-		max := durations[0]
-		for _, d := range durations {
-			if d < min {
-				min = d
-			}
-			if d > max {
-				max = d
-			}
-		}
-
-		return stats{mean: mean, stddev: stddev, min: min, max: max}
-	}
-
-	// Analyze results
-	validUserStats := make([]stats, 0)
-	invalidUserStats := make([]stats, 0)
-
-	t.Log("\n=== Timing Analysis Results ===")
-	for _, tc := range testCases {
-		s := calculateStats(measurements[tc.username])
-		t.Logf("%s (valid=%v): mean=%.4fms, stddev=%.4fms, min=%.4fms, max=%.4fms",
-			tc.username, tc.isValid,
-			float64(s.mean.Microseconds())/1000.0,
-			float64(s.stddev.Microseconds())/1000.0,
-			float64(s.min.Microseconds())/1000.0,
-			float64(s.max.Microseconds())/1000.0)
-
-		if tc.isValid {
-			validUserStats = append(validUserStats, s)
-		} else {
-			invalidUserStats = append(invalidUserStats, s)
-		}
-	}
-
-	// Calculate overall statistics for valid vs invalid users
-	var validMeanSum, invalidMeanSum time.Duration
-	for _, s := range validUserStats {
-		validMeanSum += s.mean
-	}
-	for _, s := range invalidUserStats {
-		invalidMeanSum += s.mean
-	}
-
-	validAvgMean := validMeanSum / time.Duration(len(validUserStats))
-	invalidAvgMean := invalidMeanSum / time.Duration(len(invalidUserStats))
-
-	t.Logf("\n=== Summary ===")
-	t.Logf("Valid users average: %.4fms", float64(validAvgMean.Microseconds())/1000.0)
-	t.Logf("Invalid users average: %.4fms", float64(invalidAvgMean.Microseconds())/1000.0)
-
-	// Calculate the percentage difference
-	diff := float64(validAvgMean - invalidAvgMean)
-	percentDiff := math.Abs(diff) / float64(validAvgMean) * 100.0
-	t.Logf("Difference: %.4fms (%.2f%%)", diff/1e6, percentDiff)
-
-	// Assert: The timing difference should be less than 20%
-	// Bcrypt's constant-time comparison should make both cases take similar time
-	// We allow 20% threshold to account for system noise and variability
-	threshold := 20.0 // percent
-	if percentDiff > threshold {
-		t.Errorf("TIMING ATTACK VULNERABILITY DETECTED: Valid vs invalid user timing differs by %.2f%% (threshold: %.2f%%)",
-			percentDiff, threshold)
-		t.Errorf("This difference could allow an attacker to enumerate valid usernames!")
-	} else {
-		t.Logf("✓ No timing attack vulnerability detected (difference: %.2f%% < threshold: %.2f%%)",
-			percentDiff, threshold)
-	}
-
-	// Additional check: Ensure no individual case is an obvious outlier
-	// Check if any single user's timing is significantly faster than bcrypt operations
-	allStats := append(validUserStats, invalidUserStats...)
-	var allMeansSum time.Duration
-	for _, s := range allStats {
-		allMeansSum += s.mean
-	}
-	overallMean := allMeansSum / time.Duration(len(allStats))
-
-	for _, tc := range testCases {
-		s := calculateStats(measurements[tc.username])
-		deviation := math.Abs(float64(s.mean-overallMean)) / float64(overallMean) * 100.0
-
-		// If any user is more than 30% faster/slower than average, it's suspicious
-		if deviation > 30.0 {
-			t.Errorf("OUTLIER DETECTED: %s deviates by %.2f%% from overall mean (%.4fms vs %.4fms)",
-				tc.username, deviation,
-				float64(s.mean.Microseconds())/1000.0,
-				float64(overallMean.Microseconds())/1000.0)
-		}
-	}
-}
-
-// TestJSONAuth_InvalidPasswordHashInitialized verifies that InvalidPasswordHash is properly set
-func TestJSONAuth_InvalidPasswordHashInitialized(t *testing.T) {
-	// This test ensures that the InvalidPasswordHash is initialized
-	// If it's empty, timing attacks would be possible because invalid users
-	// would skip bcrypt comparison entirely
-
-	// Use lower bcrypt cost for faster testing
-	originalCost := utils.BcryptCost
-	utils.BcryptCost = 4
-	t.Cleanup(func() {
-		utils.BcryptCost = originalCost
-	})
-
-	err := utils.SetInvalidPasswordHash()
-	if err != nil {
-		t.Fatalf("Failed to set invalid password hash: %v", err)
-	}
-
-	if utils.InvalidPasswordHash == "" {
-		t.Fatal("InvalidPasswordHash is not initialized - timing attack vulnerability exists!")
-	}
-
-	// Verify that the invalid hash can be used for password comparison
-	// This should fail (wrong password) but take the same time as a real bcrypt comparison
-	err = utils.CheckPwd("anypassword", utils.InvalidPasswordHash)
-	if err == nil {
-		t.Fatal("CheckPwd should fail with InvalidPasswordHash")
-	}
-
-	t.Log("✓ InvalidPasswordHash is properly initialized")
-}

backend/auth/jwt.go

@@ -1,229 +0,0 @@
-package auth
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"net/http"
-
-	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// MethodJwtAuth is used to identify JWT external authentication.
-const MethodJwtAuth = "jwt"
-
-// JwtAuth is an external JWT implementation of an auther.
-// It verifies JWT tokens signed with a shared secret and extracts user identity.
-type JwtAuth struct {
-	Secret    string `json:"secret"`    // shared secret for verifying JWT signatures
-	Algorithm string `json:"algorithm"` // JWT signing algorithm (HS256, HS384, HS512, RS256, ES256, etc.)
-}
-
-// ExternalJwtClaims represents the expected claims in an external JWT token
-type ExternalJwtClaims struct {
-	jwt.RegisteredClaims
-	Username string                 `json:"sub"`                    // subject claim (username)
-	Email    string                 `json:"email,omitempty"`        // email claim
-	Name     string                 `json:"name,omitempty"`         // full name claim
-	Groups   []string               `json:"groups,omitempty"`       // groups claim
-	Custom   map[string]interface{} `json:"-"`                      // catch-all for custom claims
-}
-
-// Auth authenticates the user via an external JWT token.
-// The token is verified using the configured secret and algorithm.
-func (a JwtAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
-	// This should not be called directly - JWT auth is handled in middleware
-	// because we need access to the full config (header name, user identifier field, etc.)
-	return nil, fmt.Errorf("JWT auth must be handled in middleware")
-}
-
-// VerifyExternalJWT verifies an external JWT token and extracts the username claim
-func VerifyExternalJWT(tokenString string, secret string, algorithm string, userIdentifierField string) (string, map[string]interface{}, error) {
-	// Parse the token with the secret
-	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
-		// Verify the signing method matches what we expect
-		expectedMethod := jwt.GetSigningMethod(algorithm)
-		if expectedMethod == nil {
-			return nil, fmt.Errorf("unsupported signing algorithm: %s", algorithm)
-		}
-
-		if token.Method.Alg() != expectedMethod.Alg() {
-			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
-		}
-
-		return jwtVerificationKey(secret, token.Method, algorithm)
-	})
-
-	if err != nil {
-		logger.Debugf("JWT token verification failed: %v", err)
-		return "", nil, fmt.Errorf("invalid JWT token: %w", err)
-	}
-
-	if !token.Valid {
-		return "", nil, fmt.Errorf("JWT token is invalid")
-	}
-
-	// Extract claims
-	claims, ok := token.Claims.(jwt.MapClaims)
-	if !ok {
-		return "", nil, fmt.Errorf("failed to parse JWT claims")
-	}
-
-	// Check if token is expired
-	if err := claims.Valid(); err != nil {
-		logger.Debugf("JWT claims validation failed: %v", err)
-		return "", nil, fmt.Errorf("JWT token is expired or invalid: %w", err)
-	}
-
-	// Extract username from the configured field (default: "sub")
-	var username string
-	if userVal, ok := claims[userIdentifierField]; ok {
-		if userStr, ok := userVal.(string); ok {
-			username = userStr
-		}
-	}
-
-	if username == "" {
-		return "", nil, fmt.Errorf("JWT token missing required claim: %s", userIdentifierField)
-	}
-
-	// Convert claims to map for additional processing
-	claimsMap := make(map[string]interface{})
-	for k, v := range claims {
-		claimsMap[k] = v
-	}
-
-	logger.Debugf("Successfully verified JWT token for user: %s", username)
-	return username, claimsMap, nil
-}
-
-func jwtVerificationKey(secret string, method jwt.SigningMethod, algorithm string) (interface{}, error) {
-	switch method.(type) {
-	case *jwt.SigningMethodHMAC:
-		return []byte(secret), nil
-	case *jwt.SigningMethodRSA:
-		key, err := parsePublicKeyFromPEM(secret)
-		if err != nil {
-			return nil, err
-		}
-		rsaKey, ok := key.(*rsa.PublicKey)
-		if !ok {
-			return nil, fmt.Errorf("JWT secret must contain an RSA public key in PEM format for algorithm %s", algorithm)
-		}
-		return rsaKey, nil
-	case *jwt.SigningMethodECDSA:
-		key, err := parsePublicKeyFromPEM(secret)
-		if err != nil {
-			return nil, err
-		}
-		ecKey, ok := key.(*ecdsa.PublicKey)
-		if !ok {
-			return nil, fmt.Errorf("JWT secret must contain an ECDSA public key in PEM format for algorithm %s", algorithm)
-		}
-		if err := ecdsaCurveMatchesAlgorithm(algorithm, ecKey); err != nil {
-			return nil, err
-		}
-		return ecKey, nil
-	default:
-		return nil, fmt.Errorf("unsupported JWT signing method: %s", method.Alg())
-	}
-}
-
-func ecdsaCurveMatchesAlgorithm(algorithm string, pub *ecdsa.PublicKey) error {
-	var want elliptic.Curve
-	switch algorithm {
-	case "ES256":
-		want = elliptic.P256()
-	case "ES384":
-		want = elliptic.P384()
-	case "ES512":
-		want = elliptic.P521()
-	default:
-		return nil
-	}
-	if pub.Curve != want {
-		return fmt.Errorf("ECDSA public key curve does not match algorithm %s", algorithm)
-	}
-	return nil
-}
-
-func parsePublicKeyFromPEM(pemData string) (interface{}, error) {
-	rest := []byte(pemData)
-	var lastErr error
-	for len(rest) > 0 {
-		block, rem := pem.Decode(rest)
-		if block == nil {
-			break
-		}
-		rest = rem
-
-		var key interface{}
-		var err error
-		switch block.Type {
-		case "CERTIFICATE":
-			var cert *x509.Certificate
-			cert, err = x509.ParseCertificate(block.Bytes)
-			if err == nil {
-				key = cert.PublicKey
-			}
-		case "PUBLIC KEY":
-			key, err = x509.ParsePKIXPublicKey(block.Bytes)
-		case "RSA PUBLIC KEY":
-			key, err = x509.ParsePKCS1PublicKey(block.Bytes)
-		case "EC PUBLIC KEY":
-			key, err = x509.ParsePKIXPublicKey(block.Bytes)
-		default:
-			continue
-		}
-		if err != nil {
-			lastErr = err
-			continue
-		}
-		if key != nil {
-			return key, nil
-		}
-	}
-	if lastErr != nil {
-		return nil, fmt.Errorf("failed to parse JWT public key from PEM: %w", lastErr)
-	}
-	return nil, fmt.Errorf("no public key found in JWT secret (expected PEM: CERTIFICATE, PUBLIC KEY, RSA PUBLIC KEY, or EC PUBLIC KEY)")
-}
-
-// ExtractGroupsFromClaims extracts groups from JWT claims based on the configured groups claim field
-func ExtractGroupsFromClaims(claims map[string]interface{}, groupsClaimField string) []string {
-	var groups []string
-
-	if groupsVal, ok := claims[groupsClaimField]; ok {
-		switch v := groupsVal.(type) {
-		case []interface{}:
-			// Groups as array of interfaces
-			for _, g := range v {
-				if groupStr, ok := g.(string); ok {
-					groups = append(groups, groupStr)
-				}
-			}
-		case []string:
-			// Groups as array of strings
-			groups = v
-		case string:
-			// Single group as string
-			groups = []string{v}
-		default:
-			// Try to unmarshal as JSON array
-			if jsonBytes, err := json.Marshal(v); err == nil {
-				var groupsArray []string
-				if err := json.Unmarshal(jsonBytes, &groupsArray); err == nil {
-					groups = groupsArray
-				}
-			}
-		}
-	}
-
-	return groups
-}

backend/auth/jwt_test.go

@@ -1,363 +0,0 @@
-package auth_test
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"math/big"
-	"testing"
-	"time"
-
-	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
-)
-
-func TestVerifyExternalJWT_ValidToken(t *testing.T) {
-	secret := "test-secret-key"
-	algorithm := "HS256"
-	username := "testuser"
-
-	// Create a valid JWT token
-	claims := jwt.MapClaims{
-		"sub":   username,
-		"email": "test@example.com",
-		"exp":   time.Now().Add(time.Hour).Unix(),
-		"iat":   time.Now().Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Verify the token
-	extractedUsername, extractedClaims, err := auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT() failed: %v", err)
-	}
-
-	if extractedUsername != username {
-		t.Errorf("Expected username %s, got %s", username, extractedUsername)
-	}
-
-	if extractedClaims["email"] != "test@example.com" {
-		t.Errorf("Expected email test@example.com, got %v", extractedClaims["email"])
-	}
-}
-
-func TestVerifyExternalJWT_ExpiredToken(t *testing.T) {
-	secret := "test-secret-key"
-	algorithm := "HS256"
-
-	// Create an expired JWT token
-	claims := jwt.MapClaims{
-		"sub": "testuser",
-		"exp": time.Now().Add(-time.Hour).Unix(), // Expired 1 hour ago
-		"iat": time.Now().Add(-2 * time.Hour).Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Verify the token - should fail
-	_, _, err = auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
-	if err == nil {
-		t.Fatal("VerifyExternalJWT() should fail for expired token")
-	}
-}
-
-func TestVerifyExternalJWT_InvalidSignature(t *testing.T) {
-	secret := "test-secret-key"
-	wrongSecret := "wrong-secret-key"
-	algorithm := "HS256"
-
-	// Create a token with one secret
-	claims := jwt.MapClaims{
-		"sub": "testuser",
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Try to verify with a different secret - should fail
-	_, _, err = auth.VerifyExternalJWT(tokenString, wrongSecret, algorithm, "sub")
-	if err == nil {
-		t.Fatal("VerifyExternalJWT() should fail for invalid signature")
-	}
-}
-
-func TestVerifyExternalJWT_MissingUsernameClaim(t *testing.T) {
-	secret := "test-secret-key"
-	algorithm := "HS256"
-
-	// Create a token without the 'sub' claim
-	claims := jwt.MapClaims{
-		"email": "test@example.com",
-		"exp":   time.Now().Add(time.Hour).Unix(),
-		"iat":   time.Now().Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Verify the token - should fail due to missing 'sub' claim
-	_, _, err = auth.VerifyExternalJWT(tokenString, secret, algorithm, "sub")
-	if err == nil {
-		t.Fatal("VerifyExternalJWT() should fail for missing username claim")
-	}
-}
-
-func TestVerifyExternalJWT_CustomUserIdentifier(t *testing.T) {
-	secret := "test-secret-key"
-	algorithm := "HS256"
-	username := "testuser"
-
-	// Create a token with custom username field
-	claims := jwt.MapClaims{
-		"username": username,
-		"exp":      time.Now().Add(time.Hour).Unix(),
-		"iat":      time.Now().Unix(),
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString([]byte(secret))
-	if err != nil {
-		t.Fatalf("Failed to create test token: %v", err)
-	}
-
-	// Verify the token with custom user identifier field
-	extractedUsername, _, err := auth.VerifyExternalJWT(tokenString, secret, algorithm, "username")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT() failed: %v", err)
-	}
-
-	if extractedUsername != username {
-		t.Errorf("Expected username %s, got %s", username, extractedUsername)
-	}
-}
-
-func TestVerifyExternalJWT_ES256_PublicKeyPEM(t *testing.T) {
-	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	pubDER, err := x509.MarshalPKIXPublicKey(&priv.PublicKey)
-	if err != nil {
-		t.Fatalf("MarshalPKIXPublicKey: %v", err)
-	}
-	pubPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubDER}))
-
-	username := "ec-user"
-	claims := jwt.MapClaims{
-		"sub": username,
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
-	tokenString, err := token.SignedString(priv)
-	if err != nil {
-		t.Fatalf("SignedString: %v", err)
-	}
-
-	got, _, err := auth.VerifyExternalJWT(tokenString, pubPEM, "ES256", "sub")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT: %v", err)
-	}
-	if got != username {
-		t.Errorf("username: got %q want %q", got, username)
-	}
-}
-
-func TestVerifyExternalJWT_RS256_PublicKeyPEM(t *testing.T) {
-	priv, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	pubDER, err := x509.MarshalPKIXPublicKey(&priv.PublicKey)
-	if err != nil {
-		t.Fatalf("MarshalPKIXPublicKey: %v", err)
-	}
-	pubPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubDER}))
-
-	username := "rsa-user"
-	claims := jwt.MapClaims{
-		"sub": username,
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
-	tokenString, err := token.SignedString(priv)
-	if err != nil {
-		t.Fatalf("SignedString: %v", err)
-	}
-
-	got, _, err := auth.VerifyExternalJWT(tokenString, pubPEM, "RS256", "sub")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT: %v", err)
-	}
-	if got != username {
-		t.Errorf("username: got %q want %q", got, username)
-	}
-}
-
-func TestVerifyExternalJWT_ES256_WrongCurveRejected(t *testing.T) {
-	p256Priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	p384Priv, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	verifyDER, err := x509.MarshalPKIXPublicKey(&p384Priv.PublicKey)
-	if err != nil {
-		t.Fatalf("MarshalPKIXPublicKey: %v", err)
-	}
-	verifyPEM := string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: verifyDER}))
-
-	claims := jwt.MapClaims{
-		"sub": "u",
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
-	tokenString, err := token.SignedString(p256Priv)
-	if err != nil {
-		t.Fatalf("SignedString: %v", err)
-	}
-
-	_, _, err = auth.VerifyExternalJWT(tokenString, verifyPEM, "ES256", "sub")
-	if err == nil {
-		t.Fatal("expected error when PEM public key curve does not match algorithm")
-	}
-}
-
-func TestVerifyExternalJWT_CertificatePEM(t *testing.T) {
-	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Fatalf("GenerateKey: %v", err)
-	}
-	tpl := &x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject:      pkix.Name{CommonName: "jwt-test"},
-		NotBefore:    time.Now().Add(-time.Hour),
-		NotAfter:     time.Now().Add(24 * time.Hour),
-	}
-	certDER, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &priv.PublicKey, priv)
-	if err != nil {
-		t.Fatalf("CreateCertificate: %v", err)
-	}
-	certPEM := string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER}))
-
-	username := "cert-user"
-	claims := jwt.MapClaims{
-		"sub": username,
-		"exp": time.Now().Add(time.Hour).Unix(),
-		"iat": time.Now().Unix(),
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
-	tokenString, err := token.SignedString(priv)
-	if err != nil {
-		t.Fatalf("SignedString: %v", err)
-	}
-
-	got, _, err := auth.VerifyExternalJWT(tokenString, certPEM, "ES256", "sub")
-	if err != nil {
-		t.Fatalf("VerifyExternalJWT: %v", err)
-	}
-	if got != username {
-		t.Errorf("username: got %q want %q", got, username)
-	}
-}
-
-func TestExtractGroupsFromClaims_ArrayOfStrings(t *testing.T) {
-	claims := map[string]interface{}{
-		"groups": []string{"admin", "users"},
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "groups")
-
-	if len(groups) != 2 {
-		t.Fatalf("Expected 2 groups, got %d", len(groups))
-	}
-
-	if groups[0] != "admin" || groups[1] != "users" {
-		t.Errorf("Expected groups [admin, users], got %v", groups)
-	}
-}
-
-func TestExtractGroupsFromClaims_ArrayOfInterfaces(t *testing.T) {
-	claims := map[string]interface{}{
-		"groups": []interface{}{"admin", "users"},
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "groups")
-
-	if len(groups) != 2 {
-		t.Fatalf("Expected 2 groups, got %d", len(groups))
-	}
-
-	if groups[0] != "admin" || groups[1] != "users" {
-		t.Errorf("Expected groups [admin, users], got %v", groups)
-	}
-}
-
-func TestExtractGroupsFromClaims_SingleString(t *testing.T) {
-	claims := map[string]interface{}{
-		"groups": "admin",
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "groups")
-
-	if len(groups) != 1 {
-		t.Fatalf("Expected 1 group, got %d", len(groups))
-	}
-
-	if groups[0] != "admin" {
-		t.Errorf("Expected group admin, got %s", groups[0])
-	}
-}
-
-func TestExtractGroupsFromClaims_MissingClaim(t *testing.T) {
-	claims := map[string]interface{}{
-		"email": "test@example.com",
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "groups")
-
-	if len(groups) != 0 {
-		t.Fatalf("Expected 0 groups, got %d", len(groups))
-	}
-}
-
-func TestExtractGroupsFromClaims_CustomClaimName(t *testing.T) {
-	claims := map[string]interface{}{
-		"roles": []string{"admin", "editor"},
-	}
-
-	groups := auth.ExtractGroupsFromClaims(claims, "roles")
-
-	if len(groups) != 2 {
-		t.Fatalf("Expected 2 groups, got %d", len(groups))
-	}
-
-	if groups[0] != "admin" || groups[1] != "editor" {
-		t.Errorf("Expected groups [admin, editor], got %v", groups)
-	}
-}

backend/auth/none.go

@@ -3,7 +3,7 @@ package auth
 import (
 	"net/http"
 
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/users"
 )
 
 // MethodNoAuth is used to identify no auth.
@@ -16,3 +16,8 @@ type NoAuth struct{}
 func (a NoAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
 	return usr.Get(uint(1))
 }
+
+// LoginPage tells that no auth doesn't require a login page.
+func (a NoAuth) LoginPage() bool {
+	return false
+}

backend/auth/proxy.go

@@ -4,8 +4,8 @@ import (
 	"net/http"
 	"os"
 
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/users"
 )
 
 // MethodProxyAuth is used to identify no auth.
@@ -26,3 +26,8 @@ func (a ProxyAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error
 
 	return user, err
 }
+
+// LoginPage tells that proxy auth doesn't require a login page.
+func (a ProxyAuth) LoginPage() bool {
+	return false
+}

backend/auth/storage.go

@@ -1,14 +1,7 @@
 package auth
 
 import (
-	"encoding/base64"
-
-	"crypto/sha256"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-	"golang.org/x/crypto/pbkdf2"
+	"github.com/gtsteffaniak/filebrowser/backend/users"
 )
 
 // StorageBackend is a storage backend for auth storage.
@@ -34,23 +27,13 @@ func NewStorage(back StorageBackend, userStore *users.Storage) (*Storage, error)
 	if err != nil {
 		return nil, err
 	}
-	err = store.Save(&NoAuth{})
+	err = store.Save(&HookAuth{})
 	if err != nil {
 		return nil, err
 	}
-	if settings.Config.Auth.TotpSecret != "" {
-		key, err := base64.StdEncoding.DecodeString(settings.Config.Auth.TotpSecret)
-		keyLen := len(key)
-
-		if err == nil && (keyLen == 16 || keyLen == 24 || keyLen == 32) {
-			// Use the user-provided key if it's valid
-			encryptionKey = key
-		} else {
-			// Otherwise, derive the key from the provided secret string
-			logger.Warningf("totpSecret is not a valid Base64 encoded key. Deriving a key from it. For better security, generate a secret with 'openssl rand -base64 32'.")
-			salt := []byte{0xda, 0x90, 0x45, 0xc3, 0x06, 0xb5, 0x99, 0x9f, 0xb6, 0xae, 0xfc, 0x14, 0xef, 0x27, 0x6e, 0x6a}
-			encryptionKey = pbkdf2.Key([]byte(settings.Config.Auth.TotpSecret), salt, 4096, 32, sha256.New)
-		}
+	err = store.Save(&NoAuth{})
+	if err != nil {
+		return nil, err
 	}
 	return store, nil
 }

backend/auth/totp.go

@@ -1,205 +0,0 @@
-package auth
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
-	"encoding/base64"
-	"fmt"
-	"io"
-	"strings"
-	"time"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-cache/cache"
-	"github.com/gtsteffaniak/go-logger/logger"
-	"github.com/pquerna/otp"
-	"github.com/pquerna/otp/totp"
-)
-
-// Constants for TOTP (Time-based One-Time Password) configuration.
-const (
-	// IssuerName is the name of the application or service.
-	IssuerName = "FileBrowser Quantum"
-
-	// TokenValidTime defines the total duration a token is considered valid.
-	// Note: The actual validation window might be slightly longer depending on the period.
-	TokenValidTime = time.Minute * 2
-
-	// TOTPPeriod is the standard duration in seconds that a TOTP code is valid.
-	TOTPPeriod uint = 30
-
-	// TOTPSecretSize is the byte length of the shared secret.
-	TOTPSecretSize uint = 20
-
-	// TOTPDigits specifies the number of digits in the OTP code.
-	TOTPDigits = otp.DigitsSix
-
-	// TOTPAlgorithm is the hashing algorithm to use.
-	TOTPAlgorithm = otp.AlgorithmSHA1
-)
-
-var (
-	// TOTPSkew allows for a certain number of periods of clock drift.
-	// We calculate it to best match the TokenValidTime.
-	// (2 * Skew + 1) * Period >= TokenValidTime
-	// For a 2-minute (120s) window with a 30s period, we need a Skew of 2.
-	// (2*2 + 1) * 30s = 150s (2.5 minutes). This is the closest we can get.
-	TOTPSkew      uint = uint(TokenValidTime.Seconds()) / (2 * uint(TOTPPeriod))
-	encryptionKey []byte
-	TotpCache     = cache.NewCache[string](5 * time.Minute)
-)
-
-func GenerateOtpForUser(user *users.User, userStore *users.Storage) (string, error) {
-	// Generate a new TOTP key using the defined constants.
-	key, err := totp.Generate(totp.GenerateOpts{
-		Issuer:      IssuerName,
-		AccountName: user.Username,
-		Period:      TOTPPeriod,
-		SecretSize:  TOTPSecretSize,
-		Digits:      TOTPDigits,
-		Algorithm:   TOTPAlgorithm,
-	})
-	if err != nil {
-		return "", fmt.Errorf("error generating TOTP key: %w", err)
-	}
-
-	secretText := key.Secret()
-	nonce := ""
-	secretToStore := secretText
-	if settings.Config.Auth.TotpSecret != "" {
-		// If an encryption key is provided, encrypt the secret.
-		secretToStore, nonce, err = encryptSecret(secretText, encryptionKey)
-		if err != nil {
-			return "", fmt.Errorf("failed to encrypt TOTP secret: %w", err)
-		}
-	}
-	// set cache so verify can attempt to use it but not require it for user yet.
-	TotpCache.Set(user.Username, secretToStore+"||"+nonce)
-	// Use the original base32 secret in the OTP URL, not the encrypted version
-	url := fmt.Sprintf("otpauth://totp/%v?secret=%v", "FileBrowser Quantum: "+user.Username, secretText)
-	return url, nil
-}
-
-// encryptSecret uses AES-GCM to encrypt a plaintext secret.
-// It returns the base64-encoded ciphertext and nonce, or an error.
-func encryptSecret(secret string, key []byte) (string, string, error) {
-	if len(key) != 32 {
-		return "", "", fmt.Errorf("invalid encryption key length: must be 32 bytes")
-	}
-
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return "", "", err
-	}
-
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return "", "", err
-	}
-
-	nonce := make([]byte, gcm.NonceSize())
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-		return "", "", err
-	}
-
-	ciphertext := gcm.Seal(nil, nonce, []byte(secret), nil)
-
-	return base64.StdEncoding.EncodeToString(ciphertext), base64.StdEncoding.EncodeToString(nonce), nil
-}
-
-// decryptSecret uses AES-GCM to decrypt a ciphertext using its key and nonce.
-// It returns the plaintext secret or an error.
-func decryptSecret(b64Ciphertext, b64Nonce string) (string, error) {
-	if len(encryptionKey) != 32 {
-		return "", fmt.Errorf("invalid encryption key length: must be 32 bytes")
-	}
-
-	ciphertext, err := base64.StdEncoding.DecodeString(b64Ciphertext)
-	if err != nil {
-		return "", fmt.Errorf("failed to decode ciphertext: %w", err)
-	}
-
-	nonce, err := base64.StdEncoding.DecodeString(b64Nonce)
-	if err != nil {
-		return "", fmt.Errorf("failed to decode nonce: %w", err)
-	}
-
-	block, err := aes.NewCipher(encryptionKey)
-	if err != nil {
-		return "", err
-	}
-
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return "", err
-	}
-
-	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
-	if err != nil {
-		// This error often means the key is wrong or the data is corrupt
-		return "", fmt.Errorf("failed to decrypt secret: %w", err)
-	}
-
-	return string(plaintext), nil
-}
-
-func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) error {
-	cachedSecret, found := TotpCache.Get(user.Username)
-	if !found && user.TOTPSecret == "" {
-		return fmt.Errorf("OTP token not found in cache, please generate a new one")
-	}
-	useCache := found
-	totpSecret := user.TOTPSecret // The encrypted or plaintext secret
-	totpNonce := user.TOTPNonce   // The nonce if encrypted, or empty if plaintext
-	if useCache {
-		splitSecret := strings.Split(cachedSecret, "||")
-		if len(splitSecret) < 2 {
-			return fmt.Errorf("invalid cached OTP token format")
-		}
-		totpSecret = splitSecret[0]
-		totpNonce = splitSecret[1]
-	}
-	secretToValidate := totpSecret
-	if settings.Config.Auth.TotpSecret != "" {
-		// If an encryption key is configured, we must decrypt the secret first.
-		if totpNonce == "" {
-			return fmt.Errorf("secret is encrypted but nonce is missing")
-		}
-		decryptedSecret, err := decryptSecret(totpSecret, totpNonce)
-		if err != nil {
-			return fmt.Errorf("failed to decrypt TOTP secret: %w", err)
-		}
-		secretToValidate = decryptedSecret
-	}
-
-	valid, err := totp.ValidateCustom(code, secretToValidate, time.Now().UTC(), totp.ValidateOpts{
-		Period:    TOTPPeriod,
-		Skew:      TOTPSkew,
-		Digits:    TOTPDigits,
-		Algorithm: TOTPAlgorithm,
-	})
-	if err != nil {
-		logger.Errorf("error during TOTP validation for user %s: %v", user.Username, err)
-	}
-	if !valid {
-		logger.Warningf("Invalid TOTP code for user %s", user.Username)
-		return fmt.Errorf("invalid OTP token")
-	}
-	if totpSecret != "" || !user.OtpEnabled {
-		user.TOTPSecret = totpSecret // The encrypted or plaintext secret
-		user.TOTPNonce = totpNonce   // The nonce if encrypted, or empty if plaintext
-		user.OtpEnabled = true       // Enable OTP for the user
-		// save user
-		if err := userStore.Update(user, true, "TOTPSecret", "TOTPNonce", "OtpEnabled"); err != nil {
-			logger.Error("error updating user with OTP token:", err)
-			return fmt.Errorf("error updating user with OTP token: %w", err)
-		}
-		TotpCache.Delete(user.Username)
-	} else {
-		return fmt.Errorf("opt secret is empty, cannot enable TOTP")
-	}
-
-	return nil
-}

backend/auth/webauthn.go

@@ -1,296 +0,0 @@
-package auth
-
-import (
-	"crypto/rand"
-	"encoding/base64"
-	"encoding/hex"
-	"fmt"
-	"net/http"
-	"net/url"
-	"sync"
-	"time"
-
-	"github.com/go-webauthn/webauthn/protocol"
-	"github.com/go-webauthn/webauthn/webauthn"
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-type webAuthnSession struct {
-	SessionData *webauthn.SessionData
-	UserID      uint
-	ExpiresAt   time.Time
-}
-
-type WebAuthnService struct {
-	wa       *webauthn.WebAuthn
-	sessions sync.Map
-	stopCh   chan struct{}
-}
-
-var webAuthnInstance *WebAuthnService
-
-func InitWebAuthn() error {
-	cfg := &settings.Config.Auth.Methods.PasskeyAuth
-	if !cfg.Enabled {
-		webAuthnInstance = nil
-		return nil
-	}
-
-	waCfg, err := deriveWebAuthnConfig(cfg)
-	if err != nil {
-		return fmt.Errorf("webauthn config derivation failed: %w", err)
-	}
-
-	wa, err := webauthn.New(waCfg)
-	if err != nil {
-		return fmt.Errorf("failed to initialize WebAuthn: %w", err)
-	}
-
-	webAuthnInstance = &WebAuthnService{
-		wa:     wa,
-		stopCh: make(chan struct{}),
-	}
-	go webAuthnInstance.cleanupExpiredSessions()
-	return nil
-}
-
-func GetWebAuthn() *WebAuthnService {
-	return webAuthnInstance
-}
-
-func IsWebAuthnEnabled() bool {
-	return webAuthnInstance != nil
-}
-
-// ValidateOrigin checks if the given origin is in the configured whitelist.
-// Returns true if the origin is allowed, false otherwise.
-func (s *WebAuthnService) ValidateOrigin(origin string) bool {
-	for _, allowedOrigin := range s.wa.Config.RPOrigins {
-		if allowedOrigin == origin {
-			return true
-		}
-	}
-	return false
-}
-
-func generateSessionID() string {
-	b := make([]byte, 16)
-	if _, err := rand.Read(b); err != nil {
-		return hex.EncodeToString([]byte(fmt.Sprintf("%d", time.Now().UnixNano())))
-	}
-	return hex.EncodeToString(b)
-}
-
-func (s *WebAuthnService) BeginMFALogin(username, password string, rpID string, userStore *users.Storage) (sessionID string, assertion *protocol.CredentialAssertion, err error) {
-	user, getErr := userStore.Get(username)
-	passwordHash := utils.InvalidPasswordHash
-	if getErr == nil {
-		passwordHash = user.Password
-	}
-	// Always run password check to prevent timing-based username enumeration
-	if err = utils.CheckPwd(password, passwordHash); err != nil {
-		return "", nil, errors.ErrUnauthorized
-	}
-	if getErr != nil {
-		return "", nil, errors.ErrUnauthorized
-	}
-
-	if !user.HasPasskeyMFA() {
-		return "", nil, errors.ErrPasskeyNoCredential
-	}
-
-	var opts []webauthn.LoginOption
-	if rpID != "" {
-		opts = append(opts, webauthn.WithLoginRelyingPartyID(rpID))
-	}
-	assertion, sessionData, err := s.wa.BeginLogin(user, opts...)
-	if err != nil {
-		return "", nil, fmt.Errorf("failed to begin WebAuthn login: %w", err)
-	}
-
-	sessionID = generateSessionID()
-	s.sessions.Store(sessionID, &webAuthnSession{
-		SessionData: sessionData,
-		UserID:      user.ID,
-		ExpiresAt:   time.Now().Add(5 * time.Minute),
-	})
-
-	return sessionID, assertion, nil
-}
-
-func (s *WebAuthnService) FinishMFALogin(sessionID string, r *http.Request, userStore *users.Storage) (*users.User, error) {
-	sessionVal, ok := s.sessions.Load(sessionID)
-	if !ok {
-		return nil, errors.ErrPasskeyInvalidSession
-	}
-	sess, ok := sessionVal.(*webAuthnSession)
-	if !ok {
-		return nil, errors.ErrPasskeyInvalidSession
-	}
-	defer s.sessions.Delete(sessionID)
-
-	if time.Now().After(sess.ExpiresAt) {
-		return nil, errors.ErrPasskeyInvalidSession
-	}
-
-	user, err := userStore.Get(sess.UserID)
-	if err != nil {
-		return nil, fmt.Errorf("user not found: %w", err)
-	}
-
-	credential, err := s.wa.FinishLogin(user, *sess.SessionData, r)
-	if err != nil {
-		return nil, fmt.Errorf("%w: %v", errors.ErrPasskeyVerification, err)
-	}
-
-	credB64 := base64.RawURLEncoding.EncodeToString(credential.ID)
-	for i := range user.PasskeyCredentials {
-		if user.PasskeyCredentials[i].ID == credB64 {
-			users.UpdateCredentialFromLibrary(&user.PasskeyCredentials[i], credential)
-			if err := userStore.Update(user, false, "PasskeyCredentials"); err != nil {
-				return nil, fmt.Errorf("failed to update credential: %w", err)
-			}
-			return user, nil
-		}
-	}
-
-	return user, nil
-}
-
-func (s *WebAuthnService) BeginRegistration(user *users.User, rpID string) (sessionID string, creation *protocol.CredentialCreation, err error) {
-	var opts []webauthn.RegistrationOption
-	if rpID != "" {
-		opts = append(opts, webauthn.WithRegistrationRelyingPartyID(rpID))
-	}
-	creation, sessionData, err := s.wa.BeginRegistration(user, opts...)
-	if err != nil {
-		return "", nil, fmt.Errorf("failed to begin WebAuthn registration: %w", err)
-	}
-
-	sessionID = generateSessionID()
-	s.sessions.Store(sessionID, &webAuthnSession{
-		SessionData: sessionData,
-		UserID:      user.ID,
-		ExpiresAt:   time.Now().Add(5 * time.Minute),
-	})
-
-	return sessionID, creation, nil
-}
-
-func (s *WebAuthnService) FinishRegistration(user *users.User, sessionID string, credentialName string, r *http.Request) error {
-	sessionVal, ok := s.sessions.Load(sessionID)
-	if !ok {
-		return errors.ErrPasskeyInvalidSession
-	}
-	sess, ok := sessionVal.(*webAuthnSession)
-	if !ok {
-		return errors.ErrPasskeyInvalidSession
-	}
-	defer s.sessions.Delete(sessionID)
-
-	if time.Now().After(sess.ExpiresAt) {
-		return errors.ErrPasskeyInvalidSession
-	}
-
-	if sess.UserID != user.ID {
-		return errors.ErrUnauthorized
-	}
-
-	credential, err := s.wa.FinishRegistration(user, *sess.SessionData, r)
-	if err != nil {
-		return fmt.Errorf("failed to finish WebAuthn registration: %w", err)
-	}
-
-	credB64 := base64.RawURLEncoding.EncodeToString(credential.ID)
-	for _, c := range user.PasskeyCredentials {
-		if c.ID == credB64 {
-			return errors.ErrPasskeyExists
-		}
-	}
-
-	newCred := users.CredentialFromLibrary(credentialName, credential)
-	user.PasskeyCredentials = append(user.PasskeyCredentials, newCred)
-	return nil
-}
-
-func (s *WebAuthnService) DeleteCredential(user *users.User, credentialID string) error {
-	for i, c := range user.PasskeyCredentials {
-		if c.ID == credentialID {
-			user.PasskeyCredentials = append(user.PasskeyCredentials[:i], user.PasskeyCredentials[i+1:]...)
-			return nil
-		}
-	}
-	return errors.ErrPasskeyNoCredential
-}
-
-func (s *WebAuthnService) cleanupExpiredSessions() {
-	ticker := time.NewTicker(2 * time.Minute)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ticker.C:
-			now := time.Now()
-			s.sessions.Range(func(key, value interface{}) bool {
-				sess, ok := value.(*webAuthnSession)
-				if !ok {
-					s.sessions.Delete(key)
-					return true
-				}
-				if now.After(sess.ExpiresAt) {
-					s.sessions.Delete(key)
-				}
-				return true
-			})
-		case <-s.stopCh:
-			return
-		}
-	}
-}
-
-func deriveWebAuthnConfig(cfg *settings.PasskeyAuthConfig) (*webauthn.Config, error) {
-	rpID := cfg.RPID
-	if rpID == "" {
-		if settings.Config.Server.ExternalUrl != "" {
-			if u, err := url.Parse(settings.Config.Server.ExternalUrl); err == nil {
-				rpID = u.Hostname()
-			}
-		}
-		if rpID == "" {
-			rpID = "localhost"
-		}
-	}
-
-	displayName := cfg.RPDisplayName
-	if displayName == "" {
-		displayName = settings.Config.Frontend.Name
-	}
-	if displayName == "" {
-		displayName = "FileBrowser Quantum"
-	}
-
-	origins := cfg.RPOrigins
-	if len(origins) == 0 {
-		if settings.Config.Server.ExternalUrl != "" {
-			origins = append(origins, settings.Config.Server.ExternalUrl)
-		}
-		if settings.Config.Server.InternalUrl != "" && settings.Config.Server.InternalUrl != settings.Config.Server.ExternalUrl {
-			origins = append(origins, settings.Config.Server.InternalUrl)
-		}
-		if len(origins) == 0 {
-			origins = append(origins, "http://localhost")
-		}
-	}
-
-	return &webauthn.Config{
-		RPID:          rpID,
-		RPDisplayName: displayName,
-		RPOrigins:     origins,
-		AttestationPreference: protocol.PreferNoAttestation,
-		AuthenticatorSelection: protocol.AuthenticatorSelection{
-			UserVerification: protocol.VerificationPreferred,
-		},
-	}, nil
-}

backend/benchmark_results.txt

@@ -0,0 +1,66 @@
+
+ == Running benchmark == 
+/usr/local/go/bin/go
+?   	github.com/gtsteffaniak/filebrowser/backend	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/auth	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/cmd	[no test files]
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/diskcache	0.005s
+?   	github.com/gtsteffaniak/filebrowser/backend/errors	[no test files]
+/home/graham/git/filebrowser /home/graham/git/filebrowser
+/home/graham/git/filebrowser/files/file.go /home/graham/git/filebrowser
+/home/graham/git/filebrowser/mnt/doesnt/exist /home/graham/git/filebrowser
+2025/01/04 14:04:55 Initializing index and assessing file system complexity
+2025/01/04 14:04:55 Starting full scan
+2025/01/04 14:04:55 Index assessment         : complexity=simple directories=0 files=0 
+2025/01/04 14:04:55 Time Spent Indexing      : 0 seconds
+2025/01/04 14:04:55 Next scan in 1m0s
+2025/01/04 14:04:56 Initializing index and assessing file system complexity
+2025/01/04 14:04:56 Starting full scan
+2025/01/04 14:04:56 Index assessment         : complexity=simple directories=0 files=0 
+2025/01/04 14:04:56 Time Spent Indexing      : 0 seconds
+2025/01/04 14:04:56 Next scan in 1m0s
+goos: linux
+goarch: amd64
+pkg: github.com/gtsteffaniak/filebrowser/backend/files
+cpu: 11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz
+BenchmarkFillIndex-8                     	2025/01/04 14:04:57 Initializing index and assessing file system complexity
+2025/01/04 14:04:57 Starting full scan
+2025/01/04 14:04:57 Index assessment         : complexity=simple directories=0 files=0 
+2025/01/04 14:04:57 Time Spent Indexing      : 0 seconds
+2025/01/04 14:04:57 Next scan in 1m0s
+      10	   3515090 ns/op	   34273 B/op	     451 allocs/op
+BenchmarkCheckIndexExclude-8             	      10	       156.2 ns/op	       0 B/op	       0 allocs/op
+BenchmarkCheckIndexConditionsInclude-8   	      10	        98.00 ns/op	       0 B/op	       0 allocs/op
+2025/01/04 14:04:58 Initializing index and assessing file system complexity
+2025/01/04 14:04:58 Starting full scan
+2025/01/04 14:04:58 Index assessment         : complexity=simple directories=0 files=0 
+2025/01/04 14:04:58 Time Spent Indexing      : 0 seconds
+2025/01/04 14:04:58 Next scan in 1m0s
+BenchmarkSearchAllIndexes-8              	2025/01/04 14:04:59 Initializing index and assessing file system complexity
+2025/01/04 14:04:59 Starting full scan
+2025/01/04 14:04:59 Index assessment         : complexity=simple directories=0 files=0 
+2025/01/04 14:04:59 Time Spent Indexing      : 0 seconds
+2025/01/04 14:04:59 Next scan in 1m0s
+      10	    766822 ns/op	   34230 B/op	     900 allocs/op
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/files	5.094s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/fileutils	0.002s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/http	0.184s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/img	0.123s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/runner	0.004s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/settings	0.005s
+?   	github.com/gtsteffaniak/filebrowser/backend/share	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/storage	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/storage/bolt	[no test files]
+?   	github.com/gtsteffaniak/filebrowser/backend/swagger/docs	[no test files]
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/users	0.003s
+PASS
+ok  	github.com/gtsteffaniak/filebrowser/backend/utils	0.002s
+?   	github.com/gtsteffaniak/filebrowser/backend/version	[no test files]

backend/cache/cache.go

@@ -0,0 +1,87 @@
+package cache
+
+import (
+	"sync"
+	"time"
+)
+
+var (
+	DiskUsage     = NewCache(30*time.Second, 24*time.Hour)
+	RealPath      = NewCache(48*time.Hour, 72*time.Hour)
+	SearchResults = NewCache(15*time.Second, time.Hour)
+	OnlyOffice    = NewCache(48*time.Hour, 1*time.Hour)
+)
+
+func NewCache(expires time.Duration, cleanup time.Duration) *KeyCache {
+	newCache := KeyCache{
+		data:         make(map[string]cachedValue),
+		expiresAfter: expires, // default
+	}
+	go newCache.cleanupExpiredJob(cleanup)
+	return &newCache
+}
+
+type KeyCache struct {
+	data         map[string]cachedValue
+	mu           sync.RWMutex
+	expiresAfter time.Duration
+}
+
+type cachedValue struct {
+	value     interface{}
+	expiresAt time.Time
+}
+
+func (c *KeyCache) Set(key string, value interface{}) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.data[key] = cachedValue{
+		value:     value,
+		expiresAt: time.Now().Add(c.expiresAfter),
+	}
+}
+
+func (c *KeyCache) Delete(key string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	delete(c.data, key)
+}
+
+func (c *KeyCache) SetWithExp(key string, value interface{}, exp time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.data[key] = cachedValue{
+		value:     value,
+		expiresAt: time.Now().Add(exp),
+	}
+}
+
+func (c *KeyCache) Get(key string) interface{} {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	cached, ok := c.data[key]
+	if !ok || time.Now().After(cached.expiresAt) {
+		return nil
+	}
+	return cached.value
+}
+
+func (c *KeyCache) cleanupExpired() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	now := time.Now()
+	for key, cached := range c.data {
+		if now.After(cached.expiresAt) {
+			delete(c.data, key)
+		}
+	}
+}
+
+// should automatically run for all cache types as part of init.
+func (c *KeyCache) cleanupExpiredJob(frequency time.Duration) {
+	ticker := time.NewTicker(frequency)
+	defer ticker.Stop()
+	for range ticker.C {
+		c.cleanupExpired()
+	}
+}

backend/cmd/access.go

@@ -1,116 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/access"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// validateAccessRules migrates old-style access rules (without trailing slashes) to new format
-func validateAccessRules() {
-	if store.Access == nil {
-		return
-	}
-	// Get all sources
-	for sourcePath := range settings.Config.Server.SourceMap {
-		// Get all rules for this source
-		rules, err := store.Access.GetAllRules(sourcePath)
-		if err != nil {
-			logger.Errorf("Failed to get access rules for source %s: %v", sourcePath, err)
-			continue
-		}
-
-		// Check if there are any rules that need migration
-		needsMigration := false
-		for oldPath := range rules {
-			if oldPath != "/" && !strings.HasSuffix(oldPath, "/") {
-				needsMigration = true
-				break
-			}
-		}
-
-		if !needsMigration {
-			continue
-		}
-
-		migratedCount := 0
-		for oldPath, rule := range rules {
-			// Check if this path needs migration (doesn't have trailing slash and isn't root)
-			if oldPath != "/" && !strings.HasSuffix(oldPath, "/") {
-				// Create the new path with trailing slash
-				newPath := oldPath + "/"
-
-				// Migrate the rule to the new path
-				if err := migrateAccessRule(sourcePath, oldPath, newPath, rule); err != nil {
-					logger.Errorf("Failed to migrate rule from %s to %s: %v", oldPath, newPath, err)
-					continue
-				}
-
-				// Remove the old rule
-				if err := removeOldAccessRule(sourcePath, oldPath); err != nil {
-					logger.Errorf("Failed to remove old rule %s: %v", oldPath, err)
-					continue
-				}
-
-				migratedCount++
-			}
-		}
-
-		// After migration, clear cache
-		if migratedCount > 0 {
-			logger.Infof("Migrated %d access rules for source %s", migratedCount, sourcePath)
-		}
-	}
-}
-
-// migrateAccessRule creates a new access rule with the new path format
-func migrateAccessRule(sourcePath, oldPath, newPath string, rule access.FrontendAccessRule) error {
-	// Add deny users
-	for _, user := range rule.Deny.Users {
-		if err := store.Access.DenyUser(sourcePath, newPath, user); err != nil && err != errors.ErrExist {
-			return fmt.Errorf("failed to add deny user %s: %w", user, err)
-		}
-	}
-
-	// Add deny groups
-	for _, group := range rule.Deny.Groups {
-		if err := store.Access.DenyGroup(sourcePath, newPath, group); err != nil && err != errors.ErrExist {
-			return fmt.Errorf("failed to add deny group %s: %w", group, err)
-		}
-	}
-
-	// Add allow users
-	for _, user := range rule.Allow.Users {
-		if err := store.Access.AllowUser(sourcePath, newPath, user); err != nil && err != errors.ErrExist {
-			return fmt.Errorf("failed to add allow user %s: %w", user, err)
-		}
-	}
-
-	// Add allow groups
-	for _, group := range rule.Allow.Groups {
-		if err := store.Access.AllowGroup(sourcePath, newPath, group); err != nil && err != errors.ErrExist {
-			return fmt.Errorf("failed to add allow group %s: %w", group, err)
-		}
-	}
-
-	// Add deny all rule if needed
-	if rule.DenyAll {
-		if err := store.Access.DenyAll(sourcePath, newPath); err != nil && err != errors.ErrExist {
-			return fmt.Errorf("failed to add deny all rule: %w", err)
-		}
-	}
-
-	return nil
-}
-
-// removeOldAccessRule removes the old access rule by directly accessing the internal storage
-func removeOldAccessRule(sourcePath, oldPath string) error {
-	// Access the internal storage directly to remove the old rule
-	// We need to use the unnormalized path since that's how it was stored originally
-	store.Access.RemoveRuleByPath(sourcePath, oldPath)
-	return nil
-}

backend/cmd/cli.go

@@ -1,21 +1,16 @@
 package cmd
 
 import (
-	"bufio"
 	"flag"
 	"fmt"
 	"os"
-	"path/filepath"
-	"strconv"
 	"strings"
 
-	"github.com/goccy/go-yaml"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/version"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
-	"github.com/gtsteffaniak/go-logger/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/users"
+	"github.com/gtsteffaniak/filebrowser/backend/version"
 )
 
 var (
@@ -23,10 +18,7 @@ var (
 )
 
 // return bool to indicate if the program should continue running
-func runCLI() (bool, bool) {
-
-	generateYaml()
-
+func runCLI() bool {
 	// Global flags
 	var help bool
 	// Override the default usage output to use generalUsage()
@@ -36,15 +28,10 @@ func runCLI() (bool, bool) {
 
 	if configPath == "" {
 		configPath = os.Getenv("FILEBROWSER_CONFIG")
-		// backwards compatibility in docker, prefer config.yaml if it exists
-		if configPath != "" {
-			_, err := os.Stat(configPath)
-			if err != nil {
-				logger.Fatalf("config file %v does not exist, please create it or set the FILEBROWSER_CONFIG environment variable to a valid config file path", configPath)
-			}
-		} else {
-			configPath = "config.yaml"
-		}
+	}
+
+	if configPath == "" {
+		configPath = "config.yaml"
 	}
 
 	// Parse global flags (before subcommands)
@@ -53,378 +40,88 @@ func runCLI() (bool, bool) {
 	// Show help if requested
 	if help {
 		generalUsage()
-		return false, false
+		return false
 	}
 
 	// Create a new FlagSet for the 'set' subcommand
 	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
-	var user, dbConfig string
+	var user, scope, dbConfig string
 	var asAdmin bool
-	var sourceName, indexPath, ruleCategory, value string
-	var allow bool
 
 	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
-	setCmd.BoolVar(&asAdmin, "a", false, "Create a user as admin user, used in combination with -u")
+	setCmd.BoolVar(&asAdmin, "a", false, "Create user as admin user, used in combination with -u")
+	setCmd.StringVar(&scope, "s", "", "Specify a user scope, otherwise default user config scope is used")
 	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
-	setCmd.StringVar(&sourceName, "s", "", "source name to apply the rule to")
-	setCmd.StringVar(&indexPath, "p", "", "Index path (e.g. /secret) for rule command")
-	setCmd.StringVar(&ruleCategory, "r", "", "Rule category: 'user', 'group', or 'all' (for deny only)")
-	setCmd.StringVar(&value, "v", "", "Value: username or groupname (not required if ruleCategory is 'all')")
-	setCmd.BoolVar(&allow, "allow", false, "Allow access (default: false, which means deny)")
-
-	storeCfg := configPath
-	cliSubcmd := ""
-	var setKind string
 
+	// Parse subcommand flags only if a subcommand is specified
 	if len(os.Args) > 1 {
 		switch os.Args[1] {
-		case "version":
-			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
-	Version 	 : %v
-	Commit 		 : %v
-	Release Info 	 : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
-`, version.Version, version.CommitSHA, version.Version)
-			return false, false
-		case "setup":
-			cliSubcmd = "setup"
 		case "set":
-			cliSubcmd = "set"
-			if len(os.Args) < 3 {
-				fmt.Printf("error: missing subcommand for 'set'. Use 'set user' or 'set rule'\n")
-				os.Exit(1)
-			}
-			setKind = os.Args[2]
-			var err error
-			// Handle old syntax: "set -u user,pass -c config.yaml"
-			if setKind == "-u" {
-				err = setCmd.Parse(os.Args[2:])
-			} else {
-				// New pattern: subcommand-based (e.g., "set user" or "set rule")
-				err = setCmd.Parse(os.Args[3:])
-			}
+			err := setCmd.Parse(os.Args[2:])
 			if err != nil {
 				setCmd.PrintDefaults()
 				os.Exit(1)
 			}
-			storeCfg = dbConfig
-		}
-	}
-
-	switch cliSubcmd {
-	case "setup":
-		createConfig(configPath)
-		return false, false
-	case "set":
-		if setKind == "-u" {
-			dbExists := getStore(storeCfg)
-			logger.Debugf("setUser called with args: %v, config: %v, admin: %v", os.Args, dbConfig, asAdmin)
-			err := setUser(dbConfig, asAdmin)
-			if err != nil {
-				fmt.Printf("error: %v\n", err)
+			userInfo := strings.Split(user, ",")
+			if len(userInfo) < 2 {
+				fmt.Printf("not enough info to create user: \"set -u username,password\", only provided %v\n", userInfo)
+				setCmd.PrintDefaults()
 				os.Exit(1)
 			}
-			return false, dbExists
-		}
-		switch setKind {
-		case "rule":
-			dbExists := getStore(storeCfg)
-			sourceInfo, ok := settings.Config.Server.NameToSource[sourceName] // backend source is path
+			username := userInfo[0]
+			password := userInfo[1]
+			ok := getStore(dbConfig)
 			if !ok {
-				fmt.Printf("error: invalid source name: %s\n", sourceName)
-				os.Exit(1)
+				logger.Fatal("could not load db info")
 			}
-			err := setRule(dbConfig, sourceInfo.Path, indexPath, ruleCategory, value, allow)
+			user, err := store.Users.Get(username)
 			if err != nil {
-				fmt.Printf("error: %v\n", err)
-				os.Exit(1)
+				newUser := users.User{
+					Username: username,
+					NonAdminEditable: users.NonAdminEditable{
+						Password: password,
+					},
+				}
+				for _, source := range settings.Config.Server.SourceMap {
+					if source.Config.DefaultEnabled {
+						newUser.Scopes = append(newUser.Scopes, users.SourceScope{
+							Name:  source.Name,
+							Scope: source.Config.DefaultUserScope,
+						})
+					}
+				}
+
+				// Create the user logic
+				if asAdmin {
+					logger.Info(fmt.Sprintf("Creating user as admin: %s\n", username))
+				} else {
+					logger.Info(fmt.Sprintf("Creating non-admin user: %s\n", username))
+				}
+				err = storage.CreateUser(newUser, asAdmin)
+				if err != nil {
+					logger.Error(fmt.Sprintf("could not create user: %v", err))
+				}
+				return false
 			}
-			return false, dbExists
-		default:
-			fmt.Printf("error: unknown subcommand '%s' for 'set'. Use 'set user' or 'set rule'\n", setKind)
-			os.Exit(1)
-		}
-		return false, false
-	default:
-		dbExists := getStore(storeCfg)
-		return true, dbExists
-	}
-}
-
-func setRule(dbConfig, fsPath, indexPath, ruleCategory, value string, allow bool) error {
-	// Validate required parameters
-	if fsPath == "" {
-		return fmt.Errorf("real filesystem path is required: use -f <fsPath>")
-	}
-	if indexPath == "" {
-		return fmt.Errorf("index path is required: use -p <indexPath>")
-	}
-	if ruleCategory == "" {
-		return fmt.Errorf("ruleCategory is required: use -r <user|group|all>")
-	}
-	if ruleCategory != "all" && value == "" {
-		return fmt.Errorf("value is required when ruleCategory is 'user' or 'group': use -v <username|groupname>")
-	}
-	// Apply the rule based on allow flag and ruleCategory
-	var err error
-	if allow {
-		switch ruleCategory {
-		case "user":
-			err = store.Access.AllowUser(fsPath, indexPath, value)
-		case "group":
-			err = store.Access.AllowGroup(fsPath, indexPath, value)
-		default:
-			return fmt.Errorf("invalid ruleCategory for allow: must be 'user' or 'group'")
-		}
-	} else {
-		switch ruleCategory {
-		case "user":
-			err = store.Access.DenyUser(fsPath, indexPath, value)
-		case "group":
-			err = store.Access.DenyGroup(fsPath, indexPath, value)
-		case "all":
-			err = store.Access.DenyAll(fsPath, indexPath)
-		default:
-			return fmt.Errorf("invalid ruleCategory: must be 'user', 'group', or 'all'")
-		}
-	}
-
-	if err != nil {
-		return fmt.Errorf("failed to add or update rule: %w", err)
-	}
-
-	action := "deny"
-	if allow {
-		action = "allow"
-	}
-	if ruleCategory == "all" {
-		fmt.Printf("successfully added %s rule for all users on index path '%s' in filesystem path '%s'\n", action, indexPath, fsPath)
-	} else {
-		fmt.Printf("successfully added %s rule for %s '%s' on index path '%s' in filesystem path '%s'\n", action, ruleCategory, value, indexPath, fsPath)
-	}
-	return nil
-}
-
-func setUser(dbConfig string, asAdmin bool) error {
-	if len(os.Args) < 4 {
-		return fmt.Errorf("missing username and password for 'set user'. Use 'set -u username,password'")
-	}
-	userInfo := strings.Split(os.Args[3], ",")
-	if len(userInfo) < 2 {
-		return fmt.Errorf("not enough info to create user: \"set -u username,password\", only provided %v", userInfo)
-	}
-	username := userInfo[0]
-	password := userInfo[1]
-	user, err := store.Users.Get(username)
-	if err != nil {
-		newUser := users.User{
-			Username:    username,
-			LoginMethod: users.LoginMethodPassword,
-			NonAdminEditable: users.NonAdminEditable{
-				Password: password,
-			},
-		}
-		for _, source := range settings.Config.Server.SourceMap {
-			if source.Config.DefaultEnabled {
-				newUser.Scopes = append(newUser.Scopes, users.SourceScope{
-					Name:  source.Path,
-					Scope: source.Config.DefaultUserScope,
-				})
+			user.Password = password
+			if asAdmin {
+				user.Perm.Admin = true
 			}
-		}
+			err = store.Users.Save(user, true)
+			if err != nil {
+				logger.Error(fmt.Sprintf("could not update user: %v", err))
+			}
+			fmt.Printf("successfully updated user: %s\n", username)
+			return false
 
-		// Create the user logic
-		if asAdmin {
-			logger.Infof("Creating user as admin: %s\n", username)
-		} else {
-			logger.Infof("Creating non-admin user: %s\n", username)
-		}
-		newUser.Permissions = settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Account.Permissions)
-		newUser.Permissions.Admin = asAdmin
-		err = storage.CreateUser(newUser, newUser.Permissions)
-		if err != nil {
-			return fmt.Errorf("could not create user: %v", err)
-		}
-		fmt.Printf("successfully created user")
-		return nil
-	}
-	if user.LoginMethod != users.LoginMethodPassword {
-		return fmt.Errorf("user %s is not allowed to login with password authentication, cannot set password", username)
-	}
-	user.Password = password
-	user.TOTPSecret = "" // reset TOTP secret if it exists
-	user.TOTPNonce = ""  // reset TOTP nonce if it exists
-	user.LoginMethod = users.LoginMethodPassword
-	if asAdmin {
-		user.Permissions.Admin = true
-	}
-	// Ensure version is set for existing users being updated
-	if user.Version == 0 {
-		user.Version = users.CurrentUserMigrationVersion
-	}
-	err = store.Users.Save(user, true, false)
-	if err != nil {
-		return fmt.Errorf("could not update user: %v", err)
-	}
-	fmt.Printf("successfully updated user: %s\n", username)
-	return nil
-}
-
-// askQuestion displays a prompt and reads a line of input from the user.
-// It returns the defaultValue if the user's input is empty.
-func askQuestion(reader *bufio.Reader, prompt string, defaultValue string) string {
-	fmt.Printf("%s (default: %s): ", prompt, defaultValue)
-	input, _ := reader.ReadString('\n')
-	input = strings.TrimSpace(input)
-	if input == "" {
-		return defaultValue
-	}
-	return input
-}
-
-// askYesNoQuestion prompts the user with a yes/no question and returns a boolean.
-// It retries until valid input ("yes", "y", "no", "n") is received.
-// The defaultValue must be "yes" or "no".
-func askYesNoQuestion(reader *bufio.Reader, prompt string, defaultValue string) bool {
-	for {
-		answer := askQuestion(reader, prompt, defaultValue)
-		answer = strings.ToLower(answer)
-		if answer == "yes" || answer == "y" {
-			return true
-		}
-		if answer == "no" || answer == "n" {
+		case "version":
+			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
+	Version        : %v
+	Commit         : %v
+	Release Info   : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
+	`, version.Version, version.CommitSHA, version.Version)
 			return false
 		}
-		fmt.Println("Error: Invalid input. Please enter 'yes' or 'no'.")
 	}
-}
-
-// createConfig orchestrates the configuration process by asking the user a series of questions.
-func createConfig(configpath string) {
-	reader := bufio.NewReader(os.Stdin)
-	config := settings.SetDefaults(false)
-	config.Server.Sources = []*settings.Source{{Path: "./"}}
-
-	fmt.Println("--- Starting Configuration Setup ---")
-	realPath := ""
-	// 1. Ask for the source filesystem path (with validation)
-	for {
-		config.Server.Sources[0].Path = askQuestion(reader, "What is the source filesystem path?", "./")
-		// Convert relative path to absolute path
-		absolutePath, err := filepath.Abs(config.Server.Sources[0].Path)
-		if err == nil {
-			var isDir bool
-			// Resolve symlinks and get the real path
-			realPath, isDir, _ = iteminfo.ResolveSymlinks(absolutePath)
-			if realPath != "" && isDir {
-				break // Valid path found, exit loop
-			}
-		}
-		fmt.Printf("Error: The path '%s' does not exist or isn't valid. Please try again.\n", config.Server.Sources[0].Path)
-	}
-	// 2. Ask for the source name
-	defaultSourceName := filepath.Base(realPath)
-	sourceName := askQuestion(reader, "What should the first source name be?", defaultSourceName)
-	if sourceName != defaultSourceName {
-		config.Server.Sources[0].Name = sourceName
-	}
-
-	// 3. Ask for server port (with validation)
-	for {
-		portStr := askQuestion(reader, "What port should the server listen on?", "80")
-		port, err := strconv.Atoi(portStr)
-		if err == nil && (port >= 1 && port <= 65535) {
-			config.Server.Port = port
-			break // Port is valid, exit loop
-		}
-		fmt.Printf("Error: '%s' is not a valid port. Please enter a number between 1 and 65535.\n", portStr)
-	}
-
-	for {
-		levels := askQuestion(reader, "What should the log levels be?", "info|warning|error")
-		checkLevels := SplitByMultiple(levels)
-		invalidOptions := []string{}
-		for _, level := range checkLevels {
-			if !(level == "info" || level == "warning" || level == "error" || level == "debug") {
-				invalidOptions = append(invalidOptions, level)
-			}
-		}
-		if len(invalidOptions) == 0 {
-			break
-		}
-		fmt.Printf("Error: invalid options given '%s'. valid options: 'info|warning|error|debug'.\n", invalidOptions)
-	}
-
-	for {
-		config.Server.Database = askQuestion(reader, "What should the file name and path be for the database?", "./database.db")
-		if strings.HasSuffix(config.Server.Database, ".db") {
-			break // Valid path found, exit loop
-		}
-		fmt.Printf("Error: '%s' is not a valid path. Please enter a path to a file ending in .db", config.Server.Database)
-	}
-	// 4. Ask for the application brand name
-	config.Frontend.Name = askQuestion(reader, "What should the application brand name be?", "FileBrowser Quantum")
-
-	// 5. Ask for admin username and password
-	config.Auth.AdminUsername = askQuestion(reader, "What should the default admin username be?", "admin")
-	config.Auth.AdminPassword = askQuestion(reader, "What should the default admin password be?", "admin")
-
-	// 6. Ask boolean (Yes/No) questions using the helper
-	config.UserDefaults.Account.Permissions.Modify = askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
-	config.UserDefaults.Account.Permissions.Share = askYesNoQuestion(reader, "Should a new user be able to create shares by default?", "no")
-
-	fmt.Println("--- 	Configuration Complete 	---")
-
-	// marshall yaml and write to file
-	// Marshal the struct to YAML bytes
-	yamlData, err := yaml.Marshal(&config)
-	if err != nil {
-		return
-	}
-
-	// Write the YAML data to the file
-	err = os.WriteFile("config.yaml", yamlData, 0644) // 0644 provides read/write for owner, read for others
-	if err != nil {
-		return
-	}
-	// cleanup database if it exists
-	if _, err := os.Stat(config.Server.Database); err == nil {
-		response := askYesNoQuestion(reader, "Database specified already exists. Move database file to backup to start fresh?", "no")
-		if !response {
-			return
-		}
-		// move database file to backup
-		backupPath := config.Server.Database + ".bak"
-		err = os.Rename(config.Server.Database, backupPath)
-		if err != nil {
-			fmt.Printf("Error moving database file to backup: %v\n", err)
-		} else {
-			fmt.Printf("Database file moved to backup: %s\n", backupPath)
-		}
-	}
-
-}
-
-func generateYaml() {
-	generateConfig := os.Getenv("FILEBROWSER_GENERATE_CONFIG") == "true"
-	if generateConfig || settings.Env.IsDevMode {
-		logger.Info("Generating config.yaml")
-		settings.GenerateYaml()
-	}
-
-	if generateConfig {
-		os.Exit(0)
-	}
-
-}
-
-func SplitByMultiple(str string) []string {
-	delimiters := []rune{'|', ',', ' '}
-	return strings.FieldsFunc(str, func(r rune) bool {
-		for _, d := range delimiters {
-			if r == d {
-				return true
-			}
-		}
-		return false
-	})
+	return true
 }

backend/cmd/office.go

@@ -1,21 +0,0 @@
-package cmd
-
-import (
-	"net/http"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// healthcheck attempt to save test file against configured url
-func validateOfficeIntegration() {
-	if settings.Config.Integrations.OnlyOffice.Url != "" {
-		// get url health
-		// get request against the url
-		_, err := http.NewRequest("GET", settings.Config.Integrations.OnlyOffice.Url, nil)
-		if err != nil {
-			logger.Warning("Could not create request to only office Url, make sure its valid and running")
-			return
-		}
-	}
-}

backend/cmd/root.go

@@ -3,39 +3,31 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"io/fs"
 	"os"
 	"os/signal"
 	"syscall"
-	"time"
 
-	_ "net/http/pprof"
-
-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/auth"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/common/version"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
-	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
-	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
+	"github.com/gtsteffaniak/filebrowser/backend/diskcache"
+	"github.com/gtsteffaniak/filebrowser/backend/files"
 	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
-	"github.com/gtsteffaniak/filebrowser/backend/icons"
-	"github.com/gtsteffaniak/filebrowser/backend/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/preview"
+	"github.com/gtsteffaniak/filebrowser/backend/img"
+	"github.com/gtsteffaniak/filebrowser/backend/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/storage"
 	"github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
-	"github.com/gtsteffaniak/go-logger/logger"
 	"github.com/swaggo/swag"
+
+	"github.com/gtsteffaniak/filebrowser/backend/version"
 )
 
-var store *bolt.BoltStore
+var store *storage.Storage
 
 func getStore(configFile string) bool {
 	// Use the config file (global flag)
 	settings.Initialize(configFile)
 	s, hasDB, err := storage.InitializeDb(settings.Config.Server.Database)
 	if err != nil {
-		logger.Fatalf("could not load db info: %v", err)
+		logger.Fatal(fmt.Sprintf("could not load db info: %v", err))
 	}
 	store = s
 	return hasDB
@@ -55,23 +47,10 @@ commands:
 }
 
 func StartFilebrowser() {
-	keepGoing, dbExists := runCLI()
+	keepGoing := runCLI()
 	if !keepGoing {
 		return
 	}
-	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
-	if !dbExists {
-		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
-	}
-	if !settings.Config.Server.DisableUpdateCheck {
-		info, _ := utils.CheckForUpdates()
-		if info.LatestVersion != "" {
-			logger.Infof("A new version is available: %s (current: %s)", info.LatestVersion, info.CurrentVersion)
-			logger.Infof("Release notes: %s", info.ReleaseNotes)
-		}
-		go utils.StartCheckForUpdates()
-	}
-
 	// Create context and channels for graceful shutdown
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -81,38 +60,20 @@ func StartFilebrowser() {
 
 	done := make(chan struct{})             // Signals server has stopped
 	shutdownComplete := make(chan struct{}) // Signals shutdown process is complete
-
-	// Dev mode enables development features like template hot-reloading
-	_, err := os.Stat("http/dist")
-	// In dev mode, always use filesystem assets. Otherwise, check if http/dist exists
-	if !settings.Env.IsDevMode {
-		settings.Env.EmbeddedFs = os.IsNotExist(err)
+	dbExists := getStore(configPath)
+	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
+	if !dbExists {
+		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
 	}
-
-	err = utils.SetInvalidPasswordHash()
-	if err != nil {
-		logger.Fatalf("Failed to set security hash: %v", err)
-	}
-
 	sourceList := []string{}
 	for path, source := range settings.Config.Server.SourceMap {
 		sourceList = append(sourceList, fmt.Sprintf("%v: %v", source.Name, path))
 	}
-	logger.Infof("Initializing FileBrowser Quantum (%v)", version.Version)
-	logger.Infof("Using Config file        : %v", configPath)
-	logger.Infof("Auth Methods             : %v", settings.Config.Auth.AuthMethods)
+	logger.Info(fmt.Sprintf("Initializing FileBrowser Quantum (%v)", version.Version))
+	logger.Info(fmt.Sprintf("Using Config file        : %v", configPath))
+	logger.Info(fmt.Sprintf("Auth Methods             : %v", settings.Config.Auth.AuthMethods))
 	logger.Info(database)
-	logger.Infof("Sources                  : %v", sourceList)
-	logger.Debugf("Using Embedded FS        : %v", settings.Env.EmbeddedFs)
-	walModeStr := "OFF"
-	if settings.Config.Server.IndexSqlConfig.WalMode {
-		walModeStr = "WAL"
-	}
-	logger.Infof("SQL Journal Mode         : %v", walModeStr)
-	if settings.Config.Server.CacheDirCleanup {
-		logger.Debugf("clearing cache dir: %s", settings.Config.Server.CacheDir)
-		fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
-	}
+	logger.Info(fmt.Sprintf("Sources                  : %v", sourceList))
 	serverConfig := settings.Config.Server
 	swagInfo := docs.SwaggerInfo
 	swagInfo.BasePath = serverConfig.BaseURL
@@ -121,34 +82,14 @@ func StartFilebrowser() {
 	if len(settings.Config.Server.SourceMap) == 0 {
 		logger.Fatal("No sources configured, exiting...")
 	}
-
-	// Initialize shared index database before starting HTTP service
-	isNewDb, err := indexing.InitializeIndexDB()
-	if err != nil {
-		logger.Fatalf("Failed to initialize index database: %v", err)
-	}
-
-	// Set indexing storage for persistence
-	if store != nil && store.Indexing != nil {
-		indexing.SetIndexingStorage(store.Indexing)
-		if isNewDb {
-			if err := store.Indexing.ResetAllComplexities(); err != nil {
-				logger.Errorf("Failed to reset index complexities: %v", err)
-			}
-		}
-	}
-
 	for _, source := range settings.Config.Server.SourceMap {
-		go indexing.Initialize(source, false, isNewDb)
+		go files.Initialize(source)
 	}
-	validateUserInfo(!dbExists)
-	validateOfficeIntegration()
-	validateAccessRules()
-	validateShareInfo()
+	validateUserInfo()
 	// Start the rootCMD in a goroutine
 	go func() {
 		if err := rootCMD(ctx, store, &serverConfig, shutdownComplete); err != nil {
-			logger.Fatalf("Error starting filebrowser: %v", err)
+			logger.Fatal(fmt.Sprintf("Error starting filebrowser: %v", err))
 		}
 		close(done) // Signal that the server has stopped
 	}()
@@ -161,70 +102,32 @@ func StartFilebrowser() {
 		logger.Info("Server stopped unexpectedly. Shutting down...")
 	}
 
-	// Stop all indexing scanners before closing the database
-	indexing.StopAllScanners()
-
-	// Give scanners a moment to finish their current scan operations
-	time.Sleep(100 * time.Millisecond)
-
-	// cleanup temp databases
-	indexDB := indexing.GetIndexDB()
-	if indexDB != nil {
-		indexDB.Close()
-	}
-	if settings.Config.Server.CacheDirCleanup {
-		logger.Debugf("clearing cache dir: %s", settings.Config.Server.CacheDir)
-		fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
-	}
-	<-shutdownComplete
-	if err := fileutils.ClearDirectoryContents(settings.DownloadCacheDir()); err != nil {
-		logger.Warningf("failed to clear download spool on shutdown: %v", err)
-	}
+	<-shutdownComplete // Ensure we don't exit prematurely
+	// Wait for the server to stop
 	logger.Info("Shutdown complete.")
 }
 
-func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.Server, shutdownComplete chan struct{}) error {
+func rootCMD(ctx context.Context, store *storage.Storage, serverConfig *settings.Server, shutdownComplete chan struct{}) error {
 	if serverConfig.NumImageProcessors < 1 {
 		logger.Fatal("Image resize workers count could not be < 1")
 	}
+	imgSvc := img.New(serverConfig.NumImageProcessors)
+
 	cacheDir := settings.Config.Server.CacheDir
-	numWorkers := settings.Config.Server.NumImageProcessors
-	ffmpeg.SetFFmpegPaths()
+	var fileCache diskcache.Interface
 
-	// Initialize asset filesystem before starting services
-	if settings.Env.EmbeddedFs {
-		embeddedAssets := fbhttp.GetEmbeddedAssets()
-		subAssets, err := fs.Sub(embeddedAssets, "embed")
+	// Use file cache if cacheDir is specified
+	if cacheDir != "" {
+		var err error
+		fileCache, err = diskcache.NewFileCache(cacheDir)
 		if err != nil {
-			logger.Fatalf("Failed to create sub filesystem: %v", err)
+			logger.Fatal(fmt.Sprintf("failed to create file cache: %v", err))
 		}
-		fileutils.InitAssetFS(subAssets, true)
 	} else {
-		fileutils.InitAssetFS(nil, false)
+		// No-op cache if no cacheDir is specified
+		fileCache = diskcache.NewNoOp()
 	}
+	fbhttp.StartHttp(ctx, imgSvc, store, fileCache, shutdownComplete)
 
-	// Start preview service
-	err := preview.StartPreviewGenerator(numWorkers, cacheDir)
-	if err != nil {
-		logger.Fatalf("Error starting preview service: %v", err)
-	}
-	logger.Debugf("MuPDF Enabled            : %v", settings.Env.MuPdfAvailable)
-	logger.Debugf("Media Enabled            : %v", settings.MediaEnabled())
-	logger.Debugf("Exiftool Enabled         : %v", settings.Config.Integrations.Media.ExiftoolPath != "")
-
-	// Generate PWA icons after preview service is initialized
-	if err := icons.GeneratePWAIcons(); err != nil {
-		logger.Warningf("Failed to generate PWA icons: %v", err)
-	}
-
-	// Initialize PWA manifest after icons are generated
-	icons.InitializePWAManifest()
-
-	// Initialize WebAuthn/Passkey service if enabled
-	if err := auth.InitWebAuthn(); err != nil {
-		logger.Fatalf("Failed to initialize WebAuthn: %v", err)
-	}
-
-	fbhttp.StartHttp(ctx, store, shutdownComplete)
 	return nil
 }

backend/cmd/share.go

@@ -1,57 +0,0 @@
-package cmd
-
-import (
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// validateShareInfo migrates share links to add default sidebar links
-func validateShareInfo() {
-	if store.Share == nil {
-		return
-	}
-
-	// Get all shares
-	shares, err := store.Share.All()
-	if err != nil {
-		logger.Debugf("No shares found or error getting shares: %v", err)
-		return
-	}
-
-	migratedCount := 0
-	for _, link := range shares {
-		// Check if this share needs migration (version not set or 0)
-		if link.Version == 0 {
-			// Add default sidebar links
-			link.SidebarLinks = []users.SidebarLink{
-				{
-					Name:     "Share QR Code and Info",
-					Category: "shareInfo",
-					Target:   "#",
-					Icon:     "qr_code",
-				},
-				{
-					Name:     "Download",
-					Category: "download",
-					Target:   "#",
-					Icon:     "download",
-				},
-			}
-
-			// Set version to 1 to indicate migration is complete
-			link.Version = 1
-
-			// Save the updated share
-			if err := store.Share.Save(link); err != nil {
-				logger.Errorf("Failed to migrate share %s: %v", link.Hash, err)
-				continue
-			}
-
-			migratedCount++
-		}
-	}
-
-	if migratedCount > 0 {
-		logger.Infof("Migrated %d share links with default sidebar links", migratedCount)
-	}
-}

backend/cmd/user.go

@@ -2,282 +2,64 @@ package cmd
 
 import (
 	"fmt"
-	"os"
-	"reflect"
-	"strings"
 
-	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/logger"
+	"github.com/gtsteffaniak/filebrowser/backend/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/users"
 )
 
-var createBackup = false
-
-func validateUserInfo(newDB bool) {
+func validateUserInfo() {
 	// update source info for users if names/sources/paths might have changed
 	usersList, err := store.Users.Gets()
 	if err != nil {
-		logger.Fatalf("could not load users: %v", err)
+		logger.Fatal(fmt.Sprintf("could not load users: %v", err))
 	}
 	for _, user := range usersList {
-		changePass := false
-		updateUser := false
-		if updateUserScopes(user) {
-			updateUser = true
-		}
-		if updatePermissions(user) {
-			updateUser = true
-		}
-		if updatePreviewSettings(user) {
-			updateUser = true
-		}
-		if updateLoginType(user) {
-			updateUser = true
-		}
-		if updateShowFirstLogin(user) {
-			updateUser = true
-		}
-		if updateSidebarLinks(user) {
-			updateUser = true
-		}
-		if updateTokens(user) {
-			updateUser = true
-		}
-		if updateShowToolsInSidebar(user) {
-			updateUser = true
-		}
-		adminUser := settings.Config.Auth.AdminUsername
-		adminPass := settings.Config.Auth.AdminPassword
-		if user.Username == adminUser && adminPass != "" && user.LoginMethod == users.LoginMethodPassword {
-			logger.Info("Resetting admin user to default username and password.")
-			user.Permissions.Admin = true
-			user.Password = settings.Config.Auth.AdminPassword
-			updateUser = true
-			changePass = true
-		}
-		if updateUser {
-			skipCreateBackup := os.Getenv("FILEBROWSER_DISABLE_AUTOMATIC_BACKUP") == "true" || newDB
-			if createBackup && !skipCreateBackup {
-				logger.Warning("Incompatible user settings detected, creating backup of database before converting.")
-				err = fileutils.CopyFile(settings.Config.Server.Database, fmt.Sprintf("%s.bak", settings.Config.Server.Database))
-				if err != nil {
-					logger.Fatalf("Unable to create automatic backup of database due to error: %v", err)
-				}
-			}
-			fields := []string{"Scopes", "SidebarLinks", "Tokens", "Permissions", "Preview", "ShowFirstLogin", "LoginMethod", "Version", "ShowToolsInSidebar"}
-			if changePass {
-				fields = append(fields, "Password")
-			}
-			err := store.Users.Update(user, true, fields...)
-			if err != nil {
-				logger.Errorf("could not update user: %v", err)
-			}
-		}
+		updateUserScopes(user)
 	}
 }
 
-func updateUserScopes(user *users.User) bool {
+func updateUserScopes(user *users.User) {
+	updateUser := false
 	newScopes := []users.SourceScope{}
-	seen := make(map[string]struct{})
-
-	// Build map of existing scopes keyed by canonical source path (DB may use path or display name).
-	existing := make(map[string]users.SourceScope)
-	for _, s := range user.Scopes {
-		if info, ok := users.ResolveSourceKey(s.Name); ok {
-			existing[info.Path] = s
+	for _, source := range settings.Config.Server.SourceMap {
+		scopePath, err := settings.GetScopeFromSourcePath(user.Scopes, source.Path)
+		if !user.Perm.Admin {
+			scopePath = source.Config.DefaultUserScope
 		}
-	}
-
-	// Preserve order by using Config.Server.Sources
-	for _, src := range settings.Config.Server.Sources {
-		existingScope, ok := existing[src.Path]
-		if ok {
-			// If scope is empty and there's a default, apply default
-			if existingScope.Scope == "" {
-				existingScope.Scope = src.Config.DefaultUserScope
+		if scopePath == "" {
+			scopePath = "/"
+		}
+		if source.Config.CreateUserDir && !user.Perm.Admin {
+			scopePath = fmt.Sprintf("%s%s", scopePath, users.CleanUsername(user.Username))
+		}
+		// if user doesn't yet have scope for source, add it for admins and default sources
+		if err != nil {
+			if user.Perm.Admin || source.Config.DefaultEnabled {
+				newScopes = append(newScopes, users.SourceScope{Scope: scopePath, Name: source.Path}) // backend name is path
+				updateUser = true
 			}
-		} else if src.Config.DefaultEnabled {
-			existingScope.Scope = src.Config.DefaultUserScope
 		} else {
-			continue
+			newScopes = append(newScopes, users.SourceScope{Scope: scopePath, Name: source.Path}) // backend name is path
 		}
-		newScopes = append(newScopes, users.SourceScope{
-			Name:  src.Path,
-			Scope: existingScope.Scope,
-		})
-		seen[src.Path] = struct{}{}
+		user.Scopes = newScopes
 	}
 
-	// Preserve explicit or legacy scopes not already merged (e.g. non-defaultEnabled sources, removed sources).
-	for _, s := range user.Scopes {
-		if info, ok := users.ResolveSourceKey(s.Name); ok {
-			if _, already := seen[info.Path]; already {
-				continue
-			}
+	// maintain backwards compatibility, update user scope from scopes
+	if len(user.Scopes) == 0 {
+		user.Scopes = []users.SourceScope{
+			{
+				Scope: settings.Config.Server.DefaultSource.Config.DefaultUserScope,
+				Name:  settings.Config.Server.DefaultSource.Path, // backend name is path
+			},
 		}
-		newScopes = append(newScopes, s)
-	}
-	changed := !reflect.DeepEqual(user.Scopes, newScopes)
-	user.Scopes = newScopes
-	return changed
-}
-
-// updateShowToolsInSidebar one-time defaults for legacy users (Version < CurrentUserMigrationVersion) from configured userDefaults.
-func updateShowToolsInSidebar(user *users.User) bool {
-	if user.Version >= 3 {
-		return false
-	}
-	user.ShowToolsInSidebar = true
-	user.Version = users.CurrentUserMigrationVersion
-	return true
-}
-
-func updateShowFirstLogin(user *users.User) bool {
-	if user.ShowFirstLogin && !settings.Env.IsFirstLoad {
-		user.ShowFirstLogin = false
-		return true
-	}
-	return false
-}
-
-// func to convert legacy user with perm key to permissions
-func updatePermissions(user *users.User) bool {
-	if user.Version >= 1 {
-		return false
-	}
-	updateUser := true
-	// if any keys are true, set the permissions to true
-	if user.Perm.Api {
-		user.Permissions.Api = true
-		user.Perm.Api = false
 		updateUser = true
 	}
-	if user.Perm.Admin {
-		user.Permissions.Admin = true
-		user.Perm.Admin = false
-		updateUser = true
+	if !updateUser {
+		return
 	}
-	if user.Perm.Modify {
-		user.Permissions.Modify = true
-		user.Perm.Modify = false
-		updateUser = true
+	err := store.Users.Save(user, false)
+	if err != nil {
+		logger.Error(fmt.Sprintf("could not update user: %v", err))
 	}
-	if user.Perm.Share {
-		user.Permissions.Share = true
-		user.Perm.Share = false
-		updateUser = true
-	}
-	if user.Perm.Create {
-		user.Permissions.Create = true
-		user.Perm.Create = false
-		updateUser = true
-	}
-	if user.Perm.Create {
-		user.Permissions.Create = true
-		user.Perm.Create = false
-		updateUser = true
-	}
-	if user.Perm.Download {
-		user.Permissions.Download = true
-		user.Perm.Download = false
-		updateUser = true
-	}
-	if user.Permissions.Modify {
-		user.Permissions.Create = true
-		user.Permissions.Delete = true
-		updateUser = true
-	}
-	user.Version = users.CurrentUserMigrationVersion
-	if updateUser {
-		createBackup = true
-	}
-	return updateUser
-}
-
-func updateLoginType(user *users.User) bool {
-	if user.LoginMethod == "" {
-		user.LoginMethod = users.LoginMethodPassword
-		return true
-	}
-	return false
-}
-
-func updatePreviewSettings(user *users.User) bool {
-	// if user hasn't been updated yet
-	if user.LoginMethod == "" {
-		user.Preview.Image = true
-		user.Preview.PopUp = true
-		return true
-	}
-	return false
-}
-
-// updateSidebarLinks checks if user has stale source links and rebuilds them if needed
-func updateSidebarLinks(user *users.User) bool {
-	// Count source links and check if any are still valid
-	sourceLinksCount := 0
-	validSourceLinksCount := 0
-
-	for _, link := range user.SidebarLinks {
-		if strings.HasPrefix(link.Category, "source") {
-			sourceLinksCount++
-			if link.SourceName == "" {
-				continue
-			}
-			if _, ok := users.ResolveSourceKey(link.SourceName); ok {
-				validSourceLinksCount++
-			}
-		}
-	}
-
-	// If user has no source links, don't update anything
-	if sourceLinksCount == 0 {
-		return false
-	}
-
-	// If user has source links but NONE are valid, rebuild from their scopes
-	if validSourceLinksCount == 0 {
-		// Remove all existing source links
-		newLinks := []users.SidebarLink{}
-		for _, link := range user.SidebarLinks {
-			if !strings.HasPrefix(link.Category, "source") {
-				newLinks = append(newLinks, link)
-			}
-		}
-
-		for _, scope := range user.Scopes {
-			info, ok := users.ResolveSourceKey(scope.Name)
-			if !ok {
-				continue
-			}
-			newLinks = append(newLinks, users.SidebarLink{
-				Name:       info.Name,
-				Category:   "source",
-				Target:     "/",
-				Icon:       "",
-				SourceName: info.Path,
-			})
-		}
-
-		user.SidebarLinks = newLinks
-		return true
-	}
-
-	return false
-}
-
-func updateTokens(user *users.User) bool {
-	if user.Version >= 2 {
-		return false
-	}
-	if user.ApiKeys != nil {
-		user.Tokens = make(map[string]users.AuthToken)
-		for name, token := range user.ApiKeys {
-			token.Token = token.Key
-			user.Tokens[name] = token
-		}
-	}
-	user.Version = users.CurrentUserMigrationVersion
-	return true
 }

backend/cmd/user_test.go

@@ -1,182 +0,0 @@
-package cmd
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUpdateUserScopes_Phases(t *testing.T) {
-
-	sourceA := settings.Source{Path: "/pathA", Name: "sourceA", Config: settings.SourceConfig{
-		DefaultEnabled:   false,
-		DefaultUserScope: "/defaultA",
-	}}
-	sourceB := settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
-	settings.Config.Server.Sources = []*settings.Source{&sourceA, &sourceB}
-	settings.Config.Server.SourceMap = map[string]*settings.Source{
-		"/pathA": &sourceA,
-		"/pathB": &sourceB,
-	}
-	settings.Config.Server.NameToSource = map[string]*settings.Source{
-		"sourceA": &sourceA,
-		"sourceB": &sourceB,
-	}
-	settings.InitializeUserResolvers()
-
-	// ---------------------
-	// Test Cases Definition
-	// ---------------------
-	testCases := []struct {
-		name           string
-		user           *users.User
-		expectedPhase1 []users.SourceScope
-		expectedPhase2 []users.SourceScope
-	}{
-		{
-			name: "Single valid scope",
-			user: &users.User{
-				Scopes: []users.SourceScope{
-					{Scope: "/home", Name: "/pathA"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/home", Name: "/pathA"},
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/home", Name: "/pathA"},
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-		},
-		{
-			name: "Single empty scope path",
-			user: &users.User{
-				Scopes: []users.SourceScope{
-					{Scope: "", Name: "/pathB"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/defaultA", Name: "/pathA"},
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-		},
-		{
-			name: "Two scopes, one includes username in path",
-			user: &users.User{
-				Username: "user123",
-				Scopes: []users.SourceScope{
-					{Scope: "/home/user123", Name: "/pathA"},
-					{Scope: "/data", Name: "/pathB"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/home/user123", Name: "/pathA"},
-				{Scope: "/data", Name: "/pathB"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/home/user123", Name: "/pathA"},
-				{Scope: "/data", Name: "/pathB"},
-			},
-		},
-		{
-			name: "Two scopes, one with empty name",
-			user: &users.User{
-				Scopes: []users.SourceScope{
-					{Scope: "/home", Name: "/pathB"},
-					{Scope: "/data", Name: "/somethingElse"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/home", Name: "/pathB"},
-				{Scope: "/data", Name: "/somethingElse"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/defaultA", Name: "/pathA"},
-				{Scope: "/home", Name: "/pathB"},
-				{Scope: "/data", Name: "/somethingElse"},
-			},
-		},
-		{
-			name: "No scopes at all",
-			user: &users.User{
-				Scopes: []users.SourceScope{},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/defaultA", Name: "/pathA"},
-				{Scope: "/defaultB", Name: "/pathB"},
-			},
-		},
-		{
-			name: "All user Scope and source change",
-			user: &users.User{
-				Username: "user123",
-				Scopes: []users.SourceScope{
-					{Scope: "/defaultC/user123", Name: "/pathC"},
-					{Scope: "/defaultA/user123", Name: "/pathA"},
-					{Scope: "/defaultB/user123", Name: "/pathB"},
-				},
-			},
-			expectedPhase1: []users.SourceScope{
-				{Scope: "/defaultA/user123", Name: "/pathA"},
-				{Scope: "/defaultB/user123", Name: "/pathB"},
-				{Scope: "/defaultC/user123", Name: "/pathC"},
-			},
-			expectedPhase2: []users.SourceScope{
-				{Scope: "/defaultA/user123", Name: "/pathA"},
-				{Scope: "/defaultB/user123", Name: "/pathB"},
-				{Scope: "/defaultC/user123", Name: "/pathC"},
-			},
-		},
-	}
-
-	// ---------------------
-	// Phase 1 Tests
-	// ---------------------
-	for _, tc := range testCases {
-		t.Run(tc.name+"_Phase1", func(t *testing.T) {
-			originalScopes := tc.user.Scopes
-			updated := updateUserScopes(tc.user)
-			assert.Equal(t, tc.expectedPhase1, tc.user.Scopes, "Phase1 scope mismatch for test case: %s", tc.name)
-			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.Scopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.Scopes, tc.expectedPhase1)
-		})
-	}
-
-	// ---------------------
-	// Phase 2: rename sources but keep same paths
-	// ---------------------
-	sourceA = settings.Source{Path: "/pathA", Name: "sourceA", Config: settings.SourceConfig{
-		DefaultEnabled:   true,
-		DefaultUserScope: "/defaultA",
-	}}
-	sourceB = settings.Source{Path: "/pathB", Name: "sourceB", Config: settings.SourceConfig{DefaultEnabled: true, DefaultUserScope: "/defaultB"}}
-	settings.Config.Server.Sources = []*settings.Source{&sourceA, &sourceB}
-	settings.Config.Server.SourceMap = map[string]*settings.Source{
-		"/pathA": &sourceA,
-		"/pathB": &sourceB,
-	}
-	settings.Config.Server.NameToSource = map[string]*settings.Source{
-		"sourceA": &sourceA,
-		"sourceB": &sourceB,
-	}
-
-	// Run again without resetting user objects to test idempotency + renaming
-	for _, tc := range testCases {
-		t.Run(tc.name+"_Phase2", func(t *testing.T) {
-			originalScopes := tc.user.Scopes
-			updated := updateUserScopes(tc.user)
-			assert.Equal(t, tc.expectedPhase2, tc.user.Scopes, "Phase2 scope mismatch for test case: %s", tc.name)
-			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.Scopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.Scopes, tc.expectedPhase1)
-
-		})
-	}
-}

backend/common/errors/errors.go

@@ -1,35 +0,0 @@
-package errors
-
-import "errors"
-
-var (
-	ErrEmptyKey             = errors.New("empty key")
-	ErrExist                = errors.New("the resource already exists")
-	ErrNotExist             = errors.New("the resource does not exist")
-	ErrEmptyPassword        = errors.New("password is empty")
-	ErrEmptyUsername        = errors.New("username is empty")
-	ErrEmptyRequest         = errors.New("empty request")
-	ErrScopeIsRelative      = errors.New("scope is a relative path")
-	ErrInvalidDataType      = errors.New("invalid data type")
-	ErrIsDirectory          = errors.New("file is directory")
-	ErrInvalidOption        = errors.New("invalid option")
-	ErrInvalidAuthMethod    = errors.New("invalid auth method")
-	ErrPermissionDenied     = errors.New("permission denied")
-	ErrAccessDenied         = errors.New("access denied")
-	ErrInvalidRequestParams = errors.New("invalid request params")
-	ErrSourceIsParent       = errors.New("source is parent")
-	ErrNoTotpProvided       = errors.New("OTP code is required for user")
-	ErrNoTotpConfigured     = errors.New("OTP is enforced, but user is not configured")
-	ErrUnauthorized         = errors.New("user unauthorized")
-	ErrNotIndexed           = errors.New("directory or item excluded from indexing")
-	ErrNotViewable          = errors.New("directory or item is not viewable")
-	ErrWrongLoginMethod     = errors.New("user attempted to login with wrong login method")
-	ErrDownloadNotAllowed   = errors.New("downloads are not allowed for this share")
-	ErrUploadNotAllowed     = errors.New("upload permission not allowed for this share")
-	ErrPasskeyMFARequired   = errors.New("passkey MFA is required")
-	ErrPasskeyVerification  = errors.New("passkey verification failed")
-	ErrPasskeyNoCredential  = errors.New("no passkey credentials found for user")
-	ErrPasskeyExists        = errors.New("passkey credential already exists")
-	ErrPasskeyNotEnabled    = errors.New("passkey authentication is not enabled")
-	ErrPasskeyInvalidSession = errors.New("invalid or expired passkey session")
-)

backend/common/settings/apply_user_defaults_test.go

@@ -1,216 +0,0 @@
-package settings
-
-import (
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-)
-
-// TestApplyUserDefaults_copiesUserDefaultsOntoUser guards against drift between
-// [UserDefaults] and [ApplyUserDefaults] (regression for #2278-style bugs).
-func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
-	saved := Config
-	defer func() { Config = saved }()
-
-	dark := false
-	dlFalse := false
-	Config = Settings{
-		Server: Server{},
-		UserDefaults: UserDefaults{
-			Sidebar: UserDefaultsSidebar{
-				DisableQuickToggles:  true,
-				HideFileActions:      true,
-				DisableHideOnPreview: true,
-				Sticky:               false,
-				HideFiles:            true,
-				ShowTools:            boolPtr(true),
-			},
-			Listing: UserDefaultsListing{
-				DeleteWithoutConfirming: true,
-				DateFormat:              true,
-				ShowHidden:              true,
-				QuickDownload:           true,
-				ShowSelectMultiple:      true,
-				SingleClick:             true,
-				HideFileExt:             "",
-				ShowCopyPath:            false,
-				DeleteAfterArchive:      false,
-				ViewMode:                "list",
-				GallerySize:             7,
-			},
-			Preview: UserDefaultsPreview{
-				Image:              boolPtr(false),
-				Video:              boolPtr(false),
-				Audio:              boolPtr(false),
-				MotionVideoPreview: boolPtr(false),
-				Office:             boolPtr(false),
-				PopUp:              boolPtr(false),
-				DisablePreviewExt:  ".exe",
-				HighQuality:        boolPtr(true),
-				Folder:             boolPtr(false),
-				Models:             boolPtr(false),
-			},
-			FileViewer: UserDefaultsFileViewer{
-				EditorQuickSave:         true,
-				AutoplayMedia:           boolPtr(false),
-				DisableViewingExt:       ".bat",
-				DisableOnlyOfficeExt:    ".x",
-				PreferEditorForMarkdown: true,
-				DebugOffice:             true,
-				DefaultMediaPlayer:      true,
-			},
-			Search: UserDefaultsSearch{
-				DisableOptions: true,
-			},
-			UI: UserDefaultsUI{
-				DarkMode:    &dark,
-				ThemeColor:  "var(--red)",
-				CustomTheme: "Night",
-				Locale:      "de",
-			},
-			FileLoading: users.FileLoading{
-				MaxConcurrent:     3,
-				UploadChunkSize:   5,
-				DownloadChunkSize: 2,
-			},
-			Account: UserDefaultsAccount{
-				Permissions: UserDefaultsAccountPermissions{
-					Api:      true,
-					Admin:    true,
-					Modify:   true,
-					Share:    true,
-					Realtime: true,
-					Delete:   true,
-					Create:   true,
-					Download: &dlFalse,
-				},
-				LockPassword:               true,
-				DisableSettings:            true,
-				LoginMethod:                "password",
-				DisableUpdateNotifications: true,
-			},
-		},
-	}
-
-	u := &users.User{Username: "alice"}
-	ApplyUserDefaults(u)
-
-	want := users.User{
-		DisableSettings: true,
-		LockPassword:    true,
-		LoginMethod:     users.LoginMethodPassword,
-		Permissions: users.Permissions{
-			Api:      true,
-			Admin:    true,
-			Modify:   true,
-			Share:    true,
-			Realtime: true,
-			Delete:   true,
-			Create:   true,
-			Download: false,
-		},
-		NonAdminEditable: users.NonAdminEditable{
-			EditorQuickSave:            true,
-			HideSidebarFileActions:     true,
-			DisableQuickToggles:        true,
-			DisableSearchOptions:       true,
-			StickySidebar:              false,
-			HideFilesInTree:            true,
-			DarkMode:                   false,
-			Locale:                     "de",
-			ViewMode:                   "list",
-			SingleClick:                true,
-			ShowHidden:                 true,
-			DateFormat:                 true,
-			GallerySize:                7,
-			ThemeColor:                 "var(--red)",
-			QuickDownload:              true,
-			DisablePreviewExt:          ".exe",
-			DisableViewingExt:          ".bat",
-			DisableUpdateNotifications: true,
-			DisableOfficePreviewExt:    ".x", // deprecated: mapped to DisableOnlyOfficeExt
-			DisableOnlyOfficeExt:       ".x",
-			CustomTheme:                "Night",
-			ShowSelectMultiple:         true,
-			DebugOffice:                true,
-			DeleteWithoutConfirming:    true,
-			DeleteAfterArchive:         false,
-			PreferEditorForMarkdown:    true,
-			ShowToolsInSidebar:         true,
-			FileLoading: users.FileLoading{
-				MaxConcurrent:     3,
-				UploadChunkSize:   5,
-				DownloadChunkSize: 2,
-			},
-			Preview: users.Preview{
-				DisableHideSidebar: true,
-				Image:              false,
-				Video:              false,
-				Audio:              false,
-				MotionVideoPreview: false,
-				Office:             false,
-				PopUp:              false,
-				AutoplayMedia:      false,
-				DefaultMediaPlayer: true,
-				Folder:             false,
-				Models:             false,
-			},
-		},
-	}
-
-	if diff := cmp.Diff(want.Permissions, u.Permissions); diff != "" {
-		t.Fatalf("Permissions mismatch (-want +got):\n%s", diff)
-	}
-	if diff := cmp.Diff(want.NonAdminEditable, u.NonAdminEditable); diff != "" {
-		t.Fatalf("NonAdminEditable mismatch (-want +got):\n%s", diff)
-	}
-	if u.DisableSettings != want.DisableSettings {
-		t.Fatalf("DisableSettings: got %v want %v", u.DisableSettings, want.DisableSettings)
-	}
-	if u.LockPassword != want.LockPassword {
-		t.Fatalf("LockPassword: got %v want %v", u.LockPassword, want.LockPassword)
-	}
-	if u.LoginMethod != want.LoginMethod {
-		t.Fatalf("LoginMethod: got %q want %q", u.LoginMethod, want.LoginMethod)
-	}
-}
-
-func TestApplyUserDefaults_setsLoginMethodWhenEmpty(t *testing.T) {
-	saved := Config
-	defer func() { Config = saved }()
-
-	Config = Settings{
-		Server: Server{},
-		UserDefaults: UserDefaults{
-			Account: UserDefaultsAccount{
-				LoginMethod: "jwt",
-			},
-		},
-	}
-	u := &users.User{Username: "x"}
-	ApplyUserDefaults(u)
-	if u.LoginMethod != users.LoginMethodJwt {
-		t.Fatalf("LoginMethod: got %q want jwt", u.LoginMethod)
-	}
-}
-
-func TestApplyUserDefaults_preservesLoginMethodWhenAlreadySet(t *testing.T) {
-	saved := Config
-	defer func() { Config = saved }()
-
-	Config = Settings{
-		Server: Server{},
-		UserDefaults: UserDefaults{
-			Account: UserDefaultsAccount{
-				LoginMethod: "password",
-			},
-		},
-	}
-	u := &users.User{Username: "x", LoginMethod: users.LoginMethodProxy}
-	ApplyUserDefaults(u)
-	if u.LoginMethod != users.LoginMethodProxy {
-		t.Fatalf("LoginMethod: got %q want proxy", u.LoginMethod)
-	}
-}

backend/common/settings/auth.go

@@ -1,308 +0,0 @@
-package settings
-
-import (
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-	"net/http"
-	"strconv"
-	"strings"
-
-	"github.com/coreos/go-oidc/v3/oidc"
-	ldap "github.com/go-ldap/ldap/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/common/version"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// userAgentTransport wraps an http.RoundTripper to add a User-Agent header
-type userAgentTransport struct {
-	base      http.RoundTripper
-	userAgent string
-}
-
-// RoundTrip implements the http.RoundTripper interface
-func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	// Clone the request to avoid modifying the original
-	reqCopy := req.Clone(req.Context())
-	// Set User-Agent header if not already set
-	if reqCopy.Header.Get("User-Agent") == "" {
-		reqCopy.Header.Set("User-Agent", t.userAgent)
-	}
-	return t.base.RoundTrip(reqCopy)
-}
-
-// AuthCommon contains fields shared across multiple authentication methods
-type AuthCommon struct {
-	Enabled           bool     `json:"enabled"`           // whether to enable this authentication method.
-	AdminGroup        string   `json:"adminGroup"`        // if set, users in this group will be granted admin privileges
-	UserGroups        []string `json:"userGroups"`        // if set, only users in these groups are allowed to log in. Blocks all other users even with valid credentials.
-	GroupsClaim       string   `json:"groupsClaim"`       // the JSON field name to read groups from. Default is "groups"
-	UserIdentifier    string   `json:"userIdentifier"`    // the field value to use as the username. Default is "preferred_username" in oidc, "sub" in jwt. Other common values are "email" or "username", or "phone"
-	DisableVerifyTLS  bool     `json:"disableVerifyTLS"`  // disable TLS verification (insecure, for testing only)
-	LogoutRedirectUrl string   `json:"logoutRedirectUrl"` // if provider logout url is provided, filebrowser will also redirect to logout url. Custom logout query params are respected.
-	CreateUser        bool     `json:"createUser"`        // deprecated: always true for supported authentication methods
-}
-
-type Auth struct {
-	TokenExpirationHours int          `json:"tokenExpirationHours"` // time in hours each web UI session token is valid for. Default is 2 hours.
-	Methods              LoginMethods `json:"methods"`
-	Key                  string       `json:"key"`           // secret: the key used to sign the JWT tokens. If not set, a random key will be generated.
-	AdminUsername        string       `json:"adminUsername"` // secret: the username of the admin user. If not set, the default is "admin".
-	AdminPassword        string       `json:"adminPassword"` // secret: the password of the admin user. If not set, the default is "admin".
-	TotpSecret           string       `json:"totpSecret"`    // secret: secret used to encrypt TOTP secrets
-	AuthMethods          []string     `json:"-"`
-}
-
-type LoginMethods struct {
-	ProxyAuth    ProxyAuthConfig    `json:"proxy" validate:"omitempty"`
-	NoAuth       bool               `json:"noauth"` // if set to true, overrides all other auth methods and disables authentication
-	PasswordAuth PasswordAuthConfig `json:"password" validate:"omitempty"`
-	OidcAuth     OidcConfig         `json:"oidc" validate:"omitempty"`
-	LdapAuth     LdapConfig         `json:"ldap" validate:"omitempty"`
-	JwtAuth      JwtAuthConfig      `json:"jwt" validate:"omitempty"`
-	PasskeyAuth  PasskeyAuthConfig  `json:"passkey" validate:"omitempty"`
-}
-
-type PasswordAuthConfig struct {
-	Enabled     bool      `json:"enabled"`
-	MinLength   int       `json:"minLength" validate:"omitempty"` // minimum pasword length required, default is 5.
-	Signup      bool      `json:"signup" validate:"omitempty"`    // allow signups on login page if enabled -- not secure.
-	Recaptcha   Recaptcha `json:"recaptcha" validate:"omitempty"` // recaptcha config, only used if signup is enabled
-	EnforcedOtp bool      `json:"enforcedOtp"`                    // if set to true, TOTP is enforced for all password users users. Otherwise, users can choose to enable TOTP.
-}
-
-type ProxyAuthConfig struct {
-	AuthCommon `json:",inline"`
-	Header     string `json:"header"` // required header to use for authentication. Security Warning: FileBrowser blindly accepts the header value as username.
-}
-
-type Recaptcha struct {
-	Host   string `json:"host" validate:"required"`
-	Key    string `json:"key" validate:"required"`
-	Secret string `json:"secret" validate:"required"`
-}
-
-// OpenID OAuth2.0
-type OidcConfig struct {
-	AuthCommon   `json:",inline"`
-	ClientID     string                `json:"clientId"`     // secret: client id of the OIDC application
-	ClientSecret string                `json:"clientSecret"` // secret: client secret of the OIDC application
-	IssuerUrl    string                `json:"issuerUrl"`    // authorization URL of the OIDC provider
-	Scopes       string                `json:"scopes"`       // scopes to request from the OIDC provider
-	Provider     *oidc.Provider        `json:"-"`            // OIDC provider
-	Verifier     *oidc.IDTokenVerifier `json:"-"`            // OIDC verifier
-}
-
-type LdapConfig struct {
-	AuthCommon   `json:",inline"`
-	Server       string `json:"server"`       // scheme://host:port of the LDAP server (e.g. ldap://localhost:389)
-	BaseDN       string `json:"baseDN"`       // LDAP search base DN (e.g. dc=ldap,dc=goauthentik,dc=io)
-	UserDN       string `json:"userDN"`       // Bind DN for service account (e.g. cn=admin,ou=users,dc=ldap,dc=goauthentik,dc=io)
-	UserPassword string `json:"userPassword"` // Bind password for service account
-	UserFilter   string `json:"userFilter"`   // Search filter for finding user by username. Default (&(cn=%s)(objectClass=user)); override e.g. (email=%s) or (sAMAccountName=%s) for other directories.
-	Port         int    `json:"-"`            // derived from server
-	Scheme       string `json:"-"`            // derived from server
-	Host         string `json:"-"`            // derived from server
-}
-
-// JwtAuthConfig configures external JWT token authentication
-// Similar to Grafana's JWT auth: verifies HS* tokens with a shared secret, or RS*/ES* with a PEM public key (or certificate)
-// The query parameter is hardcoded to "jwt" (e.g. ?jwt=<token>)
-type JwtAuthConfig struct {
-	AuthCommon `json:",inline"`
-	Header     string `json:"header"`    // HTTP header to look for JWT token (e.g. X-JWT-Assertion). Default is "X-JWT-Assertion"
-	Secret     string `json:"secret"`    // secret: Shared secret key/bytes for verifying JWT token signatures (required, eg PUBLIC KEY, RSA PUBLIC KEY, EC PUBLIC KEY, or CERTIFICATE)
-	Algorithm  string `json:"algorithm"` // JWT signing algorithm (HS256, HS384, HS512, RS256, ES256). Default is "HS256"
-}
-
-// PasskeyAuthConfig configures WebAuthn / Passkey authentication as a second factor.
-type PasskeyAuthConfig struct {
-	Enabled         bool     `json:"enabled"`         // whether to enable passkey MFA
-	RPDisplayName   string   `json:"rpDisplayName"`   // the Relying Party display name (defaults to frontend name)
-	RPID            string   `json:"rpId"`            // the Relying Party ID; if empty, auto-derived from base URL host
-	RPOrigins       []string `json:"rpOrigins"`       // allowed origins; if empty, auto-derived from base URL
-	LoginButtonText string   `json:"loginButtonText"` // custom text for the passkey login button
-}
-
-// ValidateLdapAuth checks LDAP config and sets defaults. Call when LDAP is enabled.
-func ValidateLdapAuth() error {
-	ldapCfg := &Config.Auth.Methods.LdapAuth
-	if ldapCfg.Server == "" {
-		return fmt.Errorf("LDAP server is required when LDAP is enabled")
-	}
-	scheme, host, port, err := parseLdapServer(ldapCfg.Server)
-	if err != nil {
-		return fmt.Errorf("LDAP server is invalid: %w", err)
-	}
-	ldapCfg.Server = fmt.Sprintf("%s://%s:%d", scheme, host, port)
-	ldapCfg.Scheme = scheme
-	ldapCfg.Host = host
-	ldapCfg.Port = port
-
-	if ldapCfg.BaseDN == "" {
-		return fmt.Errorf("LDAP baseDN is required when LDAP is enabled")
-	}
-	if ldapCfg.UserDN == "" {
-		return fmt.Errorf("LDAP userDN (bind DN) is required when LDAP is enabled")
-	}
-	if ldapCfg.UserFilter == "" {
-		ldapCfg.UserFilter = "(&(cn=%s)(objectClass=user))"
-	}
-	if err := verifyLdapConnection(); err != nil {
-		logger.Fatalf("LDAP connection check failed: %v", err)
-	}
-	return nil
-}
-
-// ValidateOidcAuth processes the OIDC callback and retrieves user identity
-func validateOidcAuth() error {
-	oidcCfg := &Config.Auth.Methods.OidcAuth // Use a pointer to modify the original config
-	if oidcCfg.GroupsClaim == "" {
-		oidcCfg.GroupsClaim = "groups"
-	}
-	if oidcCfg.UserIdentifier == "" {
-		oidcCfg.UserIdentifier = "preferred_username"
-	}
-	if oidcCfg.Scopes == "" {
-		oidcCfg.Scopes = "openid email profile"
-	}
-
-	if !oidcCfg.Enabled {
-		return errors.New("OIDC is not enabled")
-	}
-	ctx := context.Background()
-
-	// Create a custom HTTP client with proper User-Agent to avoid being blocked by bot protection
-	transport := &http.Transport{
-		Proxy: http.ProxyFromEnvironment, // Respect HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables
-	}
-
-	// If disableVerifyTLS is true, disable TLS verification
-	if oidcCfg.DisableVerifyTLS {
-		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
-		logger.Warning("OIDC TLS verification is disabled.")
-	}
-
-	// Create custom client with User-Agent header to bypass bot protection (like Cloudflare Bot Fight Mode)
-	customClient := &http.Client{
-		Transport: &userAgentTransport{
-			base:      transport,
-			userAgent: fmt.Sprintf("FileBrowser Quantum - %s (OIDC Client)", version.Version),
-		},
-	}
-
-	// Use oidc.ClientContext to pass the custom client to the OIDC library
-	ctx = oidc.ClientContext(ctx, customClient)
-
-	provider, err := oidc.NewProvider(ctx, oidcCfg.IssuerUrl)
-	if err != nil {
-		return fmt.Errorf("url '%v' failed to create OIDC provider: %w", oidcCfg.IssuerUrl, err)
-	}
-	oidcCfg.Provider = provider
-	oidcCfg.Verifier = provider.Verifier(&oidc.Config{ClientID: oidcCfg.ClientID})
-
-	return nil
-}
-
-func parseLdapServer(server string) (scheme, host string, port int, err error) {
-	parts := strings.Split(server, "://")
-	if len(parts) != 2 {
-		return "", "", 0, fmt.Errorf("invalid LDAP server: %s", server)
-	}
-	scheme = strings.ToLower(parts[0])
-	if scheme != "ldap" && scheme != "ldaps" {
-		return "", "", 0, fmt.Errorf("invalid LDAP scheme: %s", scheme)
-	}
-	hostParts := strings.Split(parts[1], ":")
-	host = strings.TrimSuffix(hostParts[0], "/")
-	if len(hostParts) > 1 && hostParts[1] != "" {
-		port, err = strconv.Atoi(strings.TrimSuffix(hostParts[1], "/"))
-		if err != nil || port == 0 {
-			return "", "", 0, fmt.Errorf("invalid LDAP port: %s", hostParts[1])
-		}
-	} else {
-		if scheme == "ldaps" {
-			port = 636
-		} else {
-			port = 389
-		}
-	}
-	return scheme, host, port, nil
-}
-
-// VerifyLdapConnection tests that the LDAP server is reachable, can bind (if credentials set), and responds to a search.
-func verifyLdapConnection() error {
-	if Config.Auth.Methods.LdapAuth.Server == "" {
-		return fmt.Errorf("LDAP server is required when LDAP is enabled")
-	}
-	if Config.Auth.Methods.LdapAuth.BaseDN == "" {
-		return fmt.Errorf("LDAP baseDN is required for connection verification")
-	}
-	var opts []ldap.DialOpt
-	scheme := Config.Auth.Methods.LdapAuth.Scheme
-	host := Config.Auth.Methods.LdapAuth.Host
-	port := Config.Auth.Methods.LdapAuth.Port
-	if Config.Auth.Methods.LdapAuth.DisableVerifyTLS && scheme == "ldaps" {
-		opts = append(opts, ldap.DialWithTLSConfig(&tls.Config{InsecureSkipVerify: true}))
-	}
-	fullURL := fmt.Sprintf("%s://%s:%d", scheme, host, port)
-	conn, err := ldap.DialURL(fullURL, opts...)
-	if err != nil {
-		return fmt.Errorf("LDAP connection failed (is the LDAP outpost running at %s? use port 389 for LDAP, 636 for LDAPS; this is not the HTTP port): %w", fullURL, err)
-	}
-	defer conn.Close()
-	if Config.Auth.Methods.LdapAuth.UserDN != "" && Config.Auth.Methods.LdapAuth.UserPassword != "" {
-		if err = conn.Bind(Config.Auth.Methods.LdapAuth.UserDN, Config.Auth.Methods.LdapAuth.UserPassword); err != nil {
-			return fmt.Errorf("LDAP bind failed (check userDN and userPassword): %w", err)
-		}
-		defer func() { _ = conn.Unbind() }()
-	}
-	// Dummy search to verify the server responds to LDAP search (same path that fails at login if misconfigured).
-	searchRequest := ldap.NewSearchRequest(
-		Config.Auth.Methods.LdapAuth.BaseDN,
-		ldap.ScopeBaseObject,
-		ldap.NeverDerefAliases,
-		0,
-		0,
-		false,
-		"(objectClass=*)",
-		[]string{"1.1"}, // no attributes
-		nil,
-	)
-	_, err = conn.Search(searchRequest)
-	if err != nil {
-		return fmt.Errorf("LDAP search test failed (server may require StartTLS or bind before search): %w", err)
-	}
-	return nil
-}
-
-// ValidateJwtAuth checks JWT config and sets defaults. Call when JWT auth is enabled.
-func ValidateJwtAuth() error {
-	jwtCfg := &Config.Auth.Methods.JwtAuth
-	if jwtCfg.Secret == "" {
-		return fmt.Errorf("JWT secret is required when JWT auth is enabled")
-	}
-	if jwtCfg.Header == "" {
-		jwtCfg.Header = "X-JWT-Assertion"
-	}
-	if jwtCfg.Algorithm == "" {
-		jwtCfg.Algorithm = "HS256"
-	}
-	if jwtCfg.GroupsClaim == "" {
-		jwtCfg.GroupsClaim = "groups"
-	}
-	if jwtCfg.UserIdentifier == "" {
-		jwtCfg.UserIdentifier = "sub"
-	}
-	// Validate algorithm
-	validAlgos := map[string]bool{
-		"HS256": true, "HS384": true, "HS512": true,
-		"RS256": true, "RS384": true, "RS512": true,
-		"ES256": true, "ES384": true, "ES512": true,
-	}
-	if !validAlgos[jwtCfg.Algorithm] {
-		return fmt.Errorf("unsupported JWT algorithm: %s. Supported: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512", jwtCfg.Algorithm)
-	}
-	return nil
-}

backend/common/settings/auth_ldap_test.go

@@ -1,221 +0,0 @@
-package settings
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestParseLdapServer(t *testing.T) {
-	tests := []struct {
-		name       string
-		server     string
-		wantScheme string
-		wantHost   string
-		wantPort   int
-		wantErr    bool
-	}{
-		{
-			name:       "ldap with host and port",
-			server:     "ldap://localhost:389",
-			wantScheme: "ldap",
-			wantHost:   "localhost",
-			wantPort:   389,
-			wantErr:    false,
-		},
-		{
-			name:       "ldaps with host and port",
-			server:     "ldaps://ldap.example.com:636",
-			wantScheme: "ldaps",
-			wantHost:   "ldap.example.com",
-			wantPort:   636,
-			wantErr:    false,
-		},
-		{
-			name:       "ldap with trailing slash",
-			server:     "ldap://host:389/",
-			wantScheme: "ldap",
-			wantHost:   "host",
-			wantPort:   389,
-			wantErr:    false,
-		},
-		{
-			name:       "ldap port not provided defaults to 389",
-			server:     "ldap://localhost",
-			wantScheme: "ldap",
-			wantHost:   "localhost",
-			wantPort:   389,
-			wantErr:    false,
-		},
-		{
-			name:       "ldaps port not provided defaults to 636",
-			server:     "ldaps://ldap.example.com",
-			wantScheme: "ldaps",
-			wantHost:   "ldap.example.com",
-			wantPort:   636,
-			wantErr:    false,
-		},
-		{
-			name:    "port provided but invalid returns error",
-			server:  "ldap://host:bad",
-			wantErr: true,
-		},
-		{
-			name:    "port provided but invalid (ldaps) returns error",
-			server:  "ldaps://host:xyz",
-			wantErr: true,
-		},
-		{
-			name:    "port zero returns error",
-			server:  "ldap://host:0",
-			wantErr: true,
-		},
-		{
-			name:    "empty server",
-			server:  "",
-			wantErr: true,
-		},
-		{
-			name:    "no scheme",
-			server:  "localhost:389",
-			wantErr: true,
-		},
-		{
-			name:    "invalid scheme",
-			server:  "http://localhost:389",
-			wantErr: true,
-		},
-		{
-			name:    "invalid scheme ftp",
-			server:  "ftp://localhost:389",
-			wantErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			gotScheme, gotHost, gotPort, err := parseLdapServer(tt.server)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("parseLdapServer() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if !tt.wantErr {
-				if gotScheme != tt.wantScheme {
-					t.Errorf("parseLdapServer() scheme = %v, want %v", gotScheme, tt.wantScheme)
-				}
-				if gotHost != tt.wantHost {
-					t.Errorf("parseLdapServer() host = %v, want %v", gotHost, tt.wantHost)
-				}
-				if gotPort != tt.wantPort {
-					t.Errorf("parseLdapServer() port = %v, want %v", gotPort, tt.wantPort)
-				}
-			}
-		})
-	}
-}
-
-func TestVerifyLdapConnection_ValidationOnly(t *testing.T) {
-	// Save and restore global config so we don't affect other tests
-	saved := Config.Auth.Methods.LdapAuth
-	defer func() { Config.Auth.Methods.LdapAuth = saved }()
-
-	t.Run("empty server returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "",
-			BaseDN:     "dc=test,dc=local",
-		}
-		err := verifyLdapConnection()
-		if err == nil {
-			t.Fatal("verifyLdapConnection() expected error for empty server")
-		}
-		if !strings.Contains(err.Error(), "LDAP server is required") {
-			t.Errorf("verifyLdapConnection() error = %v, want message containing 'LDAP server is required'", err)
-		}
-	})
-
-	t.Run("empty baseDN returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "ldap://localhost:389",
-			Scheme:     "ldap",
-			Host:       "localhost",
-			Port:       389,
-			BaseDN:     "",
-		}
-		err := verifyLdapConnection()
-		if err == nil {
-			t.Fatal("verifyLdapConnection() expected error for empty baseDN")
-		}
-		if !strings.Contains(err.Error(), "baseDN is required") {
-			t.Errorf("verifyLdapConnection() error = %v, want message containing 'baseDN is required'", err)
-		}
-	})
-}
-
-func TestValidateLdapAuth_ConfigValidation(t *testing.T) {
-	saved := Config.Auth.Methods.LdapAuth
-	defer func() { Config.Auth.Methods.LdapAuth = saved }()
-
-	t.Run("empty server returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "",
-			BaseDN:     "dc=test,dc=local",
-			UserDN:     "cn=admin,dc=test,dc=local",
-		}
-		err := ValidateLdapAuth()
-		if err == nil {
-			t.Fatal("ValidateLdapAuth() expected error for empty server")
-		}
-		if !strings.Contains(err.Error(), "server is required") {
-			t.Errorf("ValidateLdapAuth() error = %v", err)
-		}
-	})
-
-	t.Run("invalid server URL returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "not-a-valid-ldap-url",
-			BaseDN:     "dc=test,dc=local",
-			UserDN:     "cn=admin,dc=test,dc=local",
-		}
-		err := ValidateLdapAuth()
-		if err == nil {
-			t.Fatal("ValidateLdapAuth() expected error for invalid server URL")
-		}
-		if !strings.Contains(err.Error(), "invalid") {
-			t.Errorf("ValidateLdapAuth() error = %v", err)
-		}
-	})
-
-	t.Run("empty baseDN returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "ldap://localhost:389",
-			BaseDN:     "",
-			UserDN:     "cn=admin,dc=test,dc=local",
-		}
-		err := ValidateLdapAuth()
-		if err == nil {
-			t.Fatal("ValidateLdapAuth() expected error for empty baseDN")
-		}
-		if !strings.Contains(err.Error(), "baseDN is required") {
-			t.Errorf("ValidateLdapAuth() error = %v", err)
-		}
-	})
-
-	t.Run("empty userDN returns error", func(t *testing.T) {
-		Config.Auth.Methods.LdapAuth = LdapConfig{
-			AuthCommon: AuthCommon{Enabled: true},
-			Server:     "ldap://localhost:389",
-			BaseDN:     "dc=test,dc=local",
-			UserDN:     "",
-		}
-		err := ValidateLdapAuth()
-		if err == nil {
-			t.Fatal("ValidateLdapAuth() expected error for empty userDN")
-		}
-		if !strings.Contains(err.Error(), "userDN") {
-			t.Errorf("ValidateLdapAuth() error = %v", err)
-		}
-	})
-}

backend/common/settings/configFunctions.go

@@ -1,27 +0,0 @@
-package settings
-
-func CanConvertImage(ext string) bool {
-	if !MediaEnabled() {
-		return false
-	}
-	val := Config.Integrations.Media.Convert.ImagePreview[ImagePreviewType(ext)]
-	if val == nil {
-		return false // Extension not in the configured list
-	}
-	return *val
-}
-
-func CanConvertVideo(ext string) bool {
-	if !MediaEnabled() {
-		return false
-	}
-	val := Config.Integrations.Media.Convert.VideoPreview[VideoPreviewType(ext)]
-	if val == nil {
-		return false // Extension not in the configured list
-	}
-	return *val
-}
-
-func MediaEnabled() bool {
-	return Env.FFmpegPath != "" && Env.FFprobePath != ""
-}

backend/common/settings/config_test.go

@@ -1,177 +0,0 @@
-package settings
-
-import (
-	"os"
-	"path/filepath"
-	"reflect"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-)
-
-func TestInitialize(t *testing.T) {
-	type args struct {
-		configFile string
-	}
-	tests := []struct {
-		name string
-		args args
-	}{
-		// TODO: Add test cases.
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			Initialize(tt.args.configFile)
-		})
-	}
-}
-
-func Test_setDefaults(t *testing.T) {
-	tests := []struct {
-		name string
-		want Settings
-	}{
-		// TODO: Add test cases.
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := SetDefaults(true); !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("setDefaults() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestConfigLoadChanged(t *testing.T) {
-	// Create isolated test directory
-	testDir := t.TempDir()
-	validContent, err := os.ReadFile("./validConfig.yaml")
-	if err != nil {
-		t.Fatalf("failed to read validConfig.yaml: %v", err)
-	}
-	configFile := filepath.Join(testDir, "config.yaml")
-	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
-		t.Fatalf("failed to write test config: %v", err)
-	}
-
-	defaultConfig := SetDefaults(true)
-	err = loadConfigWithDefaults(configFile, true)
-	if err != nil {
-		t.Fatalf("error loading config file: %v", err)
-	}
-	// Use go-cmp to compare the two structs
-	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
-		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
-	}
-}
-
-func TestConfigLoadEnvVars(t *testing.T) {
-	// Create isolated test directory
-	testDir := t.TempDir()
-	validContent, err := os.ReadFile("./validConfig.yaml")
-	if err != nil {
-		t.Fatalf("failed to read validConfig.yaml: %v", err)
-	}
-	configFile := filepath.Join(testDir, "config.yaml")
-	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
-		t.Fatalf("failed to write test config: %v", err)
-	}
-
-	defaultConfig := SetDefaults(true)
-	expectedKey := "MYKEY"
-	// mock environment variables
-	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
-	err = loadConfigWithDefaults(configFile, true)
-	if err != nil {
-		t.Fatalf("error loading config file: %v", err)
-	}
-	if Config.Integrations.OnlyOffice.Secret != expectedKey {
-		t.Errorf("Expected OnlyOffice.Secret to be '%v', got '%s'", expectedKey, Config.Integrations.OnlyOffice.Secret)
-	}
-	// Use go-cmp to compare the two structs
-	if diff := cmp.Diff(defaultConfig, Config); diff == "" {
-		t.Errorf("No change when there should have been (-want +got):\n%s", diff)
-	}
-}
-
-func TestConfigLoadHttpSection(t *testing.T) {
-	testDir := t.TempDir()
-	configContent := []byte(`
-server:
-  sources:
-    - path: "."
-http:
-  trustedHeaders:
-    - X-Forwarded-For
-  disableRateLimit: true
-`)
-	configFile := filepath.Join(testDir, "config.yaml")
-	if err := os.WriteFile(configFile, configContent, 0644); err != nil {
-		t.Fatalf("failed to write test config: %v", err)
-	}
-
-	if err := loadConfigWithDefaults(configFile, true); err != nil {
-		t.Fatalf("error loading config file: %v", err)
-	}
-
-	if len(Config.Http.TrustedHeadersArray) != 1 || Config.Http.TrustedHeadersArray[0] != "X-Forwarded-For" {
-		t.Fatalf("expected trusted headers to contain X-Forwarded-For, got %v", Config.Http.TrustedHeadersArray)
-	}
-	if !Config.Http.DisableRateLimit {
-		t.Fatal("expected http.disableRateLimit to be true")
-	}
-}
-
-func TestConfigLoadSpecificValues(t *testing.T) {
-	// Create isolated test directory
-	testDir := t.TempDir()
-	validContent, err := os.ReadFile("./validConfig.yaml")
-	if err != nil {
-		t.Fatalf("failed to read validConfig.yaml: %v", err)
-	}
-	configFile := filepath.Join(testDir, "config.yaml")
-	if err = os.WriteFile(configFile, validContent, 0644); err != nil {
-		t.Fatalf("failed to write test config: %v", err)
-	}
-
-	defaultConfig := SetDefaults(true)
-	err = loadConfigWithDefaults(configFile, true)
-	if err != nil {
-		t.Fatalf("error loading config file: %v", err)
-	}
-	testCases := []struct {
-		fieldName string
-		globalVal interface{}
-		newVal    interface{}
-	}{
-		{"Server.Database", Config.Server.Database, defaultConfig.Server.Database},
-	}
-
-	for _, tc := range testCases {
-		if tc.globalVal == tc.newVal {
-			t.Errorf("Differences should have been found:\nConfig.%s: %v \nSetConfig: %v \n", tc.fieldName, tc.globalVal, tc.newVal)
-		}
-	}
-}
-
-func TestInvalidConfig(t *testing.T) {
-	// Create isolated test directory
-	testDir := t.TempDir()
-	invalidContent, err := os.ReadFile("./invalidConfig.yaml")
-	if err != nil {
-		t.Fatalf("failed to read invalidConfig.yaml: %v", err)
-	}
-	configFile := filepath.Join(testDir, "config.yaml")
-	if err = os.WriteFile(configFile, invalidContent, 0644); err != nil {
-		t.Fatalf("failed to write test config: %v", err)
-	}
-
-	err = loadConfigWithDefaults(configFile, true)
-	// Config loads successfully but validation should catch missing sources
-	if err == nil {
-		err = ValidateConfig(Config)
-		if err == nil {
-			t.Fatal("expected validation error for config with missing required sources, got nil")
-		}
-	}
-}

backend/common/settings/functions.go

@@ -1,60 +0,0 @@
-package settings
-
-import (
-	"github.com/gtsteffaniak/filebrowser/backend/database/users"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-// InitializeUserResolvers sets up the global resolvers and config providers in the users package
-// This should be called once during application initialization
-func InitializeUserResolvers() {
-	// Set up the source name resolver
-	users.SetSourceNameResolver(func(sourceName string) (string, error) {
-		source, ok := Config.Server.NameToSource[sourceName]
-		if !ok {
-			logger.Debug("Could not get scope from source name: ", sourceName)
-			return "", nil
-		}
-		return source.Path, nil
-	})
-
-	// Set up the source config provider
-	users.SetSourceConfig(&users.SourceConfigProvider{
-		GetSourceByPath: func(path string) (users.SourceInfo, bool) {
-			source, ok := Config.Server.SourceMap[path]
-			if !ok {
-				return users.SourceInfo{}, false
-			}
-			return users.SourceInfo{
-				Path:             source.Path,
-				Name:             source.Name,
-				DefaultUserScope: source.Config.DefaultUserScope,
-			}, true
-		},
-		GetSourceByName: func(name string) (users.SourceInfo, bool) {
-			source, ok := Config.Server.NameToSource[name]
-			if !ok {
-				return users.SourceInfo{}, false
-			}
-			return users.SourceInfo{
-				Path:             source.Path,
-				Name:             source.Name,
-				DefaultUserScope: source.Config.DefaultUserScope,
-			}, true
-		},
-		GetAllSources: func() []users.SourceInfo {
-			sources := make([]users.SourceInfo, 0, len(Config.Server.Sources))
-			for _, source := range Config.Server.Sources {
-				sources = append(sources, users.SourceInfo{
-					Path:             source.Path,
-					Name:             source.Name,
-					DefaultUserScope: source.Config.DefaultUserScope,
-				})
-			}
-			return sources
-		},
-		GetDefaultScopes: func() []users.SourceScope {
-			return Config.UserDefaults.DefaultScopes
-		},
-	})
-}